diff --git a/afl/src/events/llmp.rs b/afl/src/events/llmp.rs index fce9887cce..614cd77cb5 100644 --- a/afl/src/events/llmp.rs +++ b/afl/src/events/llmp.rs @@ -91,6 +91,9 @@ const LLMP_PAGE_HEADER_LEN: usize = size_of::(); /// Message hook type pub type LlmpMsgHookFn = unsafe fn(client_id: u32, msg: *mut LlmpMsg) -> LlmpMsgHookResult; +/// TAGs used thorughout llmp +pub type Tag = u32; + /// Sending end on a (unidirectional) sharedmap channel #[derive(Clone)] pub struct LlmpSender { @@ -139,7 +142,7 @@ pub struct LlmpSharedMap { #[repr(C, packed)] pub struct LlmpMsg { /// A tag - pub tag: u32, + pub tag: Tag, /// Sender of this messge pub sender: u32, /// The message ID, unique per page @@ -489,7 +492,7 @@ impl LlmpSender { } /// Allocates a message of the given size, tags it, and sends it off. - pub fn send_buf(&mut self, tag: u32, buf: &[u8]) -> Result<(), AflError> { + pub fn send_buf(&mut self, tag: Tag, buf: &[u8]) -> Result<(), AflError> { // Make sure we don't reuse already allocated tags if tag == LLMP_TAG_NEW_SHM_CLIENT || tag == LLMP_TAG_END_OF_PAGE @@ -867,7 +870,7 @@ impl LlmpBroker { } /// Broadcasts the given buf to all lients - fn send_buf(&mut self, tag: u32, buf: &[u8]) -> Result<(), AflError> { + pub fn send_buf(&mut self, tag: Tag, buf: &[u8]) -> Result<(), AflError> { self.llmp_out.send_buf(tag, buf) } } @@ -915,7 +918,7 @@ impl LlmpClient { } /// Allocates a message of the given size, tags it, and sends it off. - pub fn send_buf(&mut self, tag: u32, buf: &[u8]) -> Result<(), AflError> { + pub fn send_buf(&mut self, tag: Tag, buf: &[u8]) -> Result<(), AflError> { self.llmp_out.send_buf(tag, buf) } diff --git a/afl/src/events/mod.rs b/afl/src/events/mod.rs index 2bc4ecfa73..001576b5d5 100644 --- a/afl/src/events/mod.rs +++ b/afl/src/events/mod.rs @@ -376,6 +376,12 @@ where phantom: PhantomData<(C, E, I, R)>, } +/// Forward this to the client +const LLMP_TAG_EVENT_TO_CLIENT: llmp::Tag = 0x2C11E471; +/// Only handle this in the broker +const LLMP_TAG_EVENT_TO_BROKER: llmp::Tag = 0x2B80438; +const LLMP_TAG_EVENT_TO_BOTH: llmp::Tag = 0x2B0741; + /// Eventmanager for multi-processed application #[cfg(feature = "std")] pub struct LlmpClientEventManager @@ -406,8 +412,9 @@ where state: &mut State, corpus: &mut C, ) -> Result<(), AflError> { - // TODO let serialized = postcard::to_vec(&event)?; - // self.llmp_broker.send_buf(&serialized)?; + let serialized = postcard::to_allocvec(&event)?; + self.llmp_broker + .send_buf(LLMP_TAG_EVENT_TO_CLIENT, &serialized)?; Ok(()) } diff --git a/afl/src/inputs/mod.rs b/afl/src/inputs/mod.rs index 5533052a92..61d19c0a93 100644 --- a/afl/src/inputs/mod.rs +++ b/afl/src/inputs/mod.rs @@ -3,6 +3,7 @@ pub use bytes::BytesInput; use alloc::vec::Vec; use core::clone::Clone; +use serde::{Deserialize, Serialize}; #[cfg(feature = "std")] use std::fs::File; @@ -22,9 +23,8 @@ pub trait Input: Clone + serde::Serialize + serde::de::DeserializeOwned { P: AsRef, { let mut file = File::create(path)?; - let v = bincode::serialize(&self) - .map_err(|_| AflError::Unknown("cannot serialize".to_string()))?; - file.write_all(v.as_slice())?; + let serialized = postcard::to_allocvec(self)?; + file.write_all(&serialized); Ok(()) } @@ -41,11 +41,10 @@ where { where P: AsRef, { - let mut file = File::open(path).map_err(AflError::File)?; + let mut file = File::open(path)?; let mut bytes: Vec = vec![]; - file.read_to_end(&mut bytes).map_err(AflError::File)?; - bincode::deserialize::(&bytes) - .map_err(|_| AflError::Unknown("cannot deserialize".to_string())) + file.read_to_end(&mut bytes)?; + Ok(postcard::from_bytes(&bytes)?) } /// Write this input to the file diff --git a/afl/src/lib.rs b/afl/src/lib.rs index ded495487e..d8b7a62818 100644 --- a/afl/src/lib.rs +++ b/afl/src/lib.rs @@ -69,6 +69,13 @@ impl fmt::Display for AflError { } } +/// Stringify the postcard serializer error +impl From for AflError { + fn from(err: postcard::Error) -> Self { + Self::Serialize(err.to_string()) + } +} + /// Create an AFL Error from io Error #[cfg(feature = "std")] impl From for AflError { diff --git a/afl/src/stages/mutational.rs b/afl/src/stages/mutational.rs index 12be4bbe46..ee3e26e386 100644 --- a/afl/src/stages/mutational.rs +++ b/afl/src/stages/mutational.rs @@ -16,7 +16,7 @@ use crate::serde_anymap::{Ptr, PtrMut}; /// A Mutational stage is the stage in a fuzzing run that mutates inputs. /// Mutational stages will usually have a range of mutations that are -/// being applied to the input one by one. +/// being applied to the input one by one, between executions. pub trait MutationalStage: Stage where M: Mutator, @@ -56,7 +56,6 @@ where let fitness = state.evaluate_input(&input_mut, engine.executor_mut())?; - // TODO post exec on the testcase, like post_exec(testcase_maybe, i as i32) self.mutator_mut() .post_exec(fitness, &input_mut, i as i32)?; @@ -67,6 +66,7 @@ where // if needed by particular cases let testcase_maybe = state.testcase_if_interesting(input_mut, fitness)?; if let Some(mut testcase) = testcase_maybe { + // TODO decouple events manager and engine manager.fire( Event::NewTestcase { sender_id: 0,