more speedy settings

.gitignore

@@ -10,6 +10,7 @@ Cargo.lock
 *.dll
 *.exe
 
+callgrind.out.*
 perf.data
 perf.data.old
 

afl/Cargo.toml

@@ -23,7 +23,6 @@ harness = false
 
 [profile.release]
 lto = true
-codegen-units = 1
 opt-level = 3
 debug = true
 
@@ -38,4 +37,4 @@ num = "*"
 xxhash-rust = { version = "0.8.0", features = ["xxh3"] } # xxh3 hashing for rust
 serde = { version = "1.0", default-features = false, features = ["alloc"] } # serialization lib
 erased-serde = "0.3.12"
-postcard = { version = "0.5.1", features = ["alloc"] } # no_std compatible serde serialization fromat
+postcard = { version = "0.5.1", features = ["alloc"] } # no_std compatible serde serialization fromat

afl/src/mutators/scheduled.rs

@@ -20,20 +20,15 @@ where
     }
 
     /// Get the next mutation to apply
+    #[inline]
     fn schedule(
         &mut self,
+        mutations_count: usize,
         rand: &mut R,
         _input: &I,
-    ) -> Result<MutationFunction<Self, C, I, R>, AflError> {
+    ) -> usize {
-        let count = self.mutations_count() as u64;
+        debug_assert!(mutations_count > 0);
-        if count == 0 {
+        rand.below(mutations_count as u64) as usize
-            return Err(AflError::Empty("no mutations".into()));
-        }
-        let idx;
-        {
-            idx = rand.below(count) as usize;
-        }
-        Ok(self.mutation_by_idx(idx))
     }
 
     /// New default implementation for mutate
@@ -47,7 +42,8 @@ where
     ) -> Result<(), AflError> {
         let num = self.iterations(rand, input);
         for _ in 0..num {
-            self.schedule(rand, input)?(self, rand, corpus, input)?;
+            let idx = self.schedule(self.mutations_count(), rand, input);
+            self.mutation_by_idx(idx)(self, rand, corpus, input)?;
         }
         Ok(())
     }
@@ -86,14 +82,17 @@ where
     I: Input,
     R: Rand,
 {
+    #[inline]
     fn mutation_by_idx(&self, index: usize) -> MutationFunction<Self, C, I, R> {
         self.mutations[index]
     }
 
+    #[inline]
     fn mutations_count(&self) -> usize {
         self.mutations.len()
     }
 
+    #[inline]
     fn add_mutation(&mut self, mutation: MutationFunction<Self, C, I, R>) {
         self.mutations.push(mutation)
     }
@@ -151,7 +150,7 @@ where
 /// Schedule some selected byte level mutations given a ScheduledMutator type
 pub struct HavocBytesMutator<SM, C, I, R>
 where
-    SM: ScheduledMutator<C, I, R>,
+    SM: ScheduledMutator<C, I, R> + HasMaxSize,
     C: Corpus<I, R>,
     I: Input + HasBytesVec,
     R: Rand,
@@ -162,7 +161,7 @@ where
 
 impl<SM, C, I, R> Mutator<C, I, R> for HavocBytesMutator<SM, C, I, R>
 where
-    SM: ScheduledMutator<C, I, R>,
+    SM: ScheduledMutator<C, I, R> + HasMaxSize,
     C: Corpus<I, R>,
     I: Input + HasBytesVec,
     R: Rand,
@@ -173,15 +172,55 @@ where
         rand: &mut R,
         corpus: &C,
         input: &mut I,
-        stage_idx: i32,
+        _stage_idx: i32,
     ) -> Result<(), AflError> {
-        self.scheduled.mutate(rand, corpus, input, stage_idx)
+        //self.scheduled.mutate(rand, corpus, input, stage_idx);
+        let num = self.scheduled.iterations(rand, input);
+        for _ in 0..num {
+            let idx = self.scheduled.schedule(13, rand, input);
+            match idx {
+                0=> mutation_bitflip(self, rand, corpus, input)?,
+                1=> mutation_byteflip(self, rand, corpus, input)?,
+                2=> mutation_byteinc(self, rand, corpus, input)?,
+                3=> mutation_bytedec(self, rand, corpus, input)?,
+                4=> mutation_byteneg(self, rand, corpus, input)?,
+                5=> mutation_byterand(self, rand, corpus, input)?,
+    
+                6=> mutation_byteadd(self, rand, corpus, input)?,
+                7=> mutation_wordadd(self, rand, corpus, input)?,
+                8=> mutation_dwordadd(self, rand, corpus, input)?,
+                9=> mutation_byteinteresting(self, rand, corpus, input)?,
+                10=> mutation_wordinteresting(self, rand, corpus, input)?,
+                11=> mutation_dwordinteresting(self, rand, corpus, input)?,
+
+                _=> mutation_splice(self, rand, corpus, input)?,
+            };
+        }
+        Ok(())
+    }
+}
+
+impl<SM, C, I, R> HasMaxSize for HavocBytesMutator<SM, C, I, R>
+where
+    SM: ScheduledMutator<C, I, R> + HasMaxSize,
+    C: Corpus<I, R>,
+    I: Input + HasBytesVec,
+    R: Rand,
+{
+    #[inline]
+    fn max_size(&self) -> usize {
+        self.scheduled.max_size()
+    }
+
+    #[inline]
+    fn set_max_size(&mut self, max_size: usize) {
+        self.scheduled.set_max_size(max_size);
     }
 }
 
 impl<SM, C, I, R> HavocBytesMutator<SM, C, I, R>
 where
-    SM: ScheduledMutator<C, I, R>,
+    SM: ScheduledMutator<C, I, R> + HasMaxSize,
     C: Corpus<I, R>,
     I: Input + HasBytesVec,
     R: Rand,
@@ -239,6 +278,7 @@ where
         scheduled.add_mutation(mutation_bitflip);*/
 
         scheduled.add_mutation(mutation_splice);
+
         HavocBytesMutator {
             scheduled: scheduled,
             phantom: PhantomData,

afl/src/serde_anymap.rs

@@ -156,6 +156,7 @@ macro_rules! create_serde_registry_for_trait {
             }
 
             impl SerdeAnyMap {
+                #[inline]
                 pub fn get<T>(&self) -> Option<&T>
                 where
                     T: $trait_name,
@@ -165,6 +166,7 @@ macro_rules! create_serde_registry_for_trait {
                         .map(|x| x.as_ref().as_any().downcast_ref::<T>().unwrap())
                 }
 
+                #[inline]
                 pub fn get_mut<T>(&mut self) -> Option<&mut T>
                 where
                     T: $trait_name,
@@ -174,6 +176,7 @@ macro_rules! create_serde_registry_for_trait {
                         .map(|x| x.as_mut().as_any_mut().downcast_mut::<T>().unwrap())
                 }
 
+                #[inline]
                 pub fn insert<T>(&mut self, t: T)
                 where
                     T: $trait_name,
@@ -182,10 +185,12 @@ macro_rules! create_serde_registry_for_trait {
                         .insert(unpack_type_id(TypeId::of::<T>()), Box::new(t));
                 }
 
+                #[inline]
                 pub fn len(&self) -> usize {
                     self.map.len()
                 }
 
+                #[inline]
                 pub fn contains<T>(&self) -> bool
                 where
                     T: $trait_name,
@@ -212,6 +217,7 @@ macro_rules! create_serde_registry_for_trait {
             }
 
             impl NamedSerdeAnyMap {
+                #[inline]
                 pub fn get<T>(&self, name: &String) -> Option<&T>
                 where
                     T: Any,
@@ -224,6 +230,7 @@ macro_rules! create_serde_registry_for_trait {
                     }
                 }
 
+                #[inline]
                 pub fn by_typeid(
                     &self,
                     name: &String,
@@ -237,6 +244,7 @@ macro_rules! create_serde_registry_for_trait {
                     }
                 }
 
+                #[inline]
                 pub fn get_mut<T>(&mut self, name: &String) -> Option<&mut T>
                 where
                     T: Any,
@@ -249,6 +257,7 @@ macro_rules! create_serde_registry_for_trait {
                     }
                 }
 
+                #[inline]
                 pub fn by_typeid_mut(
                     &mut self,
                     name: &String,
@@ -262,6 +271,7 @@ macro_rules! create_serde_registry_for_trait {
                     }
                 }
 
+                #[inline]
                 pub fn get_all<T>(
                     &self,
                 ) -> Option<
@@ -281,6 +291,7 @@ macro_rules! create_serde_registry_for_trait {
                     }
                 }
 
+                #[inline]
                 pub fn all_by_typeid(
                     &self,
                     typeid: &TypeId,
@@ -296,6 +307,7 @@ macro_rules! create_serde_registry_for_trait {
                     }
                 }
 
+                #[inline]
                 pub fn get_all_mut<T>(
                     &mut self,
                 ) -> Option<
@@ -316,6 +328,7 @@ macro_rules! create_serde_registry_for_trait {
                     }
                 }
 
+                #[inline]
                 pub fn all_by_typeid_mut(
                     &mut self,
                     typeid: &TypeId,
@@ -331,6 +344,7 @@ macro_rules! create_serde_registry_for_trait {
                     }
                 }
 
+                #[inline]
                 pub fn all_typeids(
                     &self,
                 ) -> core::iter::Map<
@@ -340,6 +354,7 @@ macro_rules! create_serde_registry_for_trait {
                     self.map.keys().map(|x| pack_type_id(*x))
                 }
 
+                #[inline]
                 pub fn for_each(
                     &self,
                     func: fn(&TypeId, &Box<dyn $trait_name>) -> Result<(), AflError>,
@@ -352,6 +367,7 @@ macro_rules! create_serde_registry_for_trait {
                     Ok(())
                 }
 
+                #[inline]
                 pub fn for_each_mut(
                     &mut self,
                     func: fn(&TypeId, &mut Box<dyn $trait_name>) -> Result<(), AflError>,
@@ -364,6 +380,7 @@ macro_rules! create_serde_registry_for_trait {
                     Ok(())
                 }
 
+                #[inline]
                 pub fn insert(&mut self, val: Box<dyn $trait_name>, name: &String) {
                     let id = unpack_type_id((*val).type_id());
                     if !self.map.contains_key(&id) {
@@ -375,10 +392,12 @@ macro_rules! create_serde_registry_for_trait {
                         .insert(xxhash_rust::xxh3::xxh3_64(name.as_bytes()), val);
                 }
 
+                #[inline]
                 pub fn len(&self) -> usize {
                     self.map.len()
                 }
 
+                #[inline]
                 pub fn contains_type<T>(&self) -> bool
                 where
                     T: Any,
@@ -386,6 +405,7 @@ macro_rules! create_serde_registry_for_trait {
                     self.map.contains_key(&unpack_type_id(TypeId::of::<T>()))
                 }
 
+                #[inline]
                 pub fn contains<T>(&self, name: &String) -> bool
                 where
                     T: Any,

fuzzers/libfuzzer/src/lib.rs

@@ -18,6 +18,7 @@ use afl::executors::{Executor, ExitKind};
 use afl::feedbacks::MaxMapFeedback;
 use afl::generators::RandPrintablesGenerator;
 use afl::mutators::scheduled::HavocBytesMutator;
+use afl::mutators::HasMaxSize;
 use afl::observers::StdMapObserver;
 use afl::stages::mutational::StdMutationalStage;
 use afl::utils::StdRand;
@@ -66,7 +67,8 @@ pub extern "C" fn afl_libfuzzer_main() {
     state.add_feedback(Box::new(edges_feedback));
 
     let mut engine = Engine::new(executor);
-    let mutator = HavocBytesMutator::new_default();
+    let mut mutator = HavocBytesMutator::new_default();
+    mutator.set_max_size(4096);
 
     let stage = StdMutationalStage::new(mutator);
 

fuzzers/libfuzzer/test.sh

@@ -3,8 +3,9 @@
 cargo build --release
 make -C runtime
 
-./compiler test/test.c -o test_fuzz.elf
+./compiler -flto=thin -c test/test.c -o test_fuzz.o
+./compiler -flto=thin -fuse-ld=lld test_fuzz.o -o test_fuzz.elf
 
 RUST_BACKTRACE=1 ./test_fuzz.elf
 
-rm ./test_fuzz.elf
+#rm ./test_fuzz.elf