-------------------------------------------------------------------

Thu Jan  5 15:33:51 UTC 2023 - Marcus Meissner <meissner@suse.com>

- updated to 4.05c

  - afl-fuzz:

    - added afl_custom_fuzz_send custom mutator feature. Now your can

      send fuzz data to the target as you need, e.g. via IPC.

    - cmplog mode now has a -l R option for random colorization, thanks

      to guyf2010 for the PR!

    - queue statistics are written every 30 minutes to

      out/NAME/queue_data if compiled with INTROSPECTION

    - new env: AFL_FORK_SERVER_KILL_SIGNAL

  - afl-showmap/afl-cmin

    - `-t none` now translates to `-t 120000` (120 seconds)

  - unicorn_mode updated

  - updated rust custom mutator dependencies and LibAFL custom mutator

  - several minor bugfixes

-------------------------------------------------------------------

Sat Oct 22 14:15:36 UTC 2022 - Andreas Schwab <schwab@suse.de>

- Update file list for riscv64

-------------------------------------------------------------------

Fri Oct 21 14:28:09 UTC 2022 - Marcus Meissner <meissner@suse.com>

- updated to 4.04c

  - fix gramatron and grammar_mutator build scripts

  - enhancements to the afl-persistent-config and afl-system-config

  - scripts

  - afl-fuzz:

    -   force writing all stats on exit

  - afl-cc:

    -   make gcc_mode (afl-gcc-fast) work with gcc down to version 3.6

  - qemu_mode:

    -   fixed 10x speed degredation in v4.03c

    -   added qemu_mode/fastexit helper library

  - unicorn_mode:

    -   Enabled tricore arch (by @jma-qb)

    -   Updated Capstone version in Rust bindings

  - llvm-mode:

    -   AFL runtime will always pass inputs via shared memory, when possible,

        ignoring the command line.

-------------------------------------------------------------------

Tue Sep 20 15:50:19 UTC 2022 - Marcus Meissner <meissner@suse.com>

- updated to 4.03c

  - Building now gives a build summary what succeeded and what not

  - afl-fuzz:

    - added AFL_NO_STARTUP_CALIBRATION to start fuzzing at once instead

      of calibrating all initial seeds first. Good for large queues

      and long execution times, especially in CIs.

    - default calibration cycles set to 7 from 8, and only add 5 cycles

      to variables queue items instead of 12.

  - afl-cc:

    - fixed off-by-one bug in our pcguard implemenation, thanks for

      @tokatoka for reporting

    - fix for llvm 15 and reenabling LTO, thanks to nikic for the PR!

    - better handling of -fsanitize=..,...,.. lists

    - support added for LLVMFuzzerRunDriver()

    - fix gcc_mode cmplog

    - obtain the map size of a target with setting AFL_DUMP_MAP_SIZE=1

      note that this will exit the target before main()

  - qemu_mode:

    - added AFL_QEMU_TRACK_UNSTABLE to log the addresses of unstable

      edges (together with AFL_DEBUG=1 afl-fuzz). thanks to

      worksbutnottested!

  - afl-analyze broke at some point, fix by CodeLogicError, thank you!

  - afl-cmin/afl-cmin.bash now have an -A option to allow also crashing

    and timeout inputs

  - unicorn_mode:

    - updated upstream unicorn version

    - fixed builds for aarch64

    - build now uses all available cores

-------------------------------------------------------------------

Sat Aug 20 11:55:57 UTC 2022 - Marcus Meissner <meissner@suse.com>

- updated to 4.02c

  - afl-cc:

    - important fix for the default pcguard mode when LLVM IR vector

      selects are produced, thanks to @juppytt for reporting!

  - gcc_plugin:

    -   Adacore submitted CMPLOG support to the gcc_plugin! :-)

  - llvm_mode:

    -   laf cmp splitting fixed for more comparison types

  - frida_mode:

    -   now works on Android!

  - afl-fuzz:

    - change post_process hook to allow returning NULL and 0 length to

      tell afl-fuzz to skip this mutated input

-------------------------------------------------------------------

Tue Jun 28 14:32:52 UTC 2022 - Marcus Meissner <meissner@suse.com>

- updated to 4.01c

  - fixed */build_...sh scripts to work outside of git

  - new custom_mutator: libafl with token fuzzing :)

  - afl-fuzz:

    - when you just want to compile once and set CMPLOG, then just

      set -c 0 to tell afl-fuzz that the fuzzing binary is also for

      CMPLOG.

    - new commandline options -g/G to set min/max length of generated

      fuzz inputs

    - you can set the time for syncing to other fuzzer now with

      AFL_SYNC_TIME

    - reintroduced AFL_PERSISTENT and AFL_DEFER_FORKSRV to allow

      persistent mode and manual forkserver support if these are not

      in the target binary (e.g. are in a shared library)

    - add AFL_EARLY_FORKSERVER to install the forkserver as earliest as

      possible in the target (for afl-gcc-fast/afl-clang-fast/

      afl-clang-lto)

    - "saved timeouts" was wrong information, timeouts are still thrown

      away by default even if they have new coverage (hangs are always

      kept), unless AFL_KEEP_TIMEOUTS are set

    - AFL never implemented auto token inserts (but user token inserts,

      user token overwrite and auto token overwrite), added now!

    - fixed a mutation type in havoc mode

    - Mopt fix to always select the correct algorithm

    - fix effector map calculation (deterministic mode)

    - fix custom mutator post_process functionality

    - document and auto-activate pizza mode on condition

  - afl-cc:

    - due a bug in lld of llvm 15 LTO instrumentation wont work atm :-(

    - converted all passed to use the new llvm pass manager for llvm 11+

    - AFL++ PCGUARD mode is not available for 10.0.1 anymore (11+ only)

    - trying to stay on top on all these #$&ยง!! changes in llvm 15 ...

  - frida_mode:

    - update to new frida release, handles now c++ throw/catch

  - unicorn_mode:

    - update unicorn engine, fix C example

  - utils:

    - removed optimin because it looses coverage due to a bug and is

      unmaintained :-(

- removed upstream llvm14-fix-build.patch

-------------------------------------------------------------------

Sat Jun  4 13:26:34 UTC 2022 - Aaron Puchert <aaronpuchert@alice-dsl.net>

- Add llvm14-fix-build.patch: fix build with LLVM 14. 

-------------------------------------------------------------------

Wed Feb 23 22:21:07 UTC 2022 - Aaron Puchert <aaronpuchert@alice-dsl.net>

- Fix build with armv7l on Leap: we have afl-llvm-rt-lto{,-32}.o.

- Fix build with ppc64le: we don't seem to have the 32-bit object

  files available there and there is also no gcc-32bit.

-------------------------------------------------------------------

Mon Jan 31 12:45:45 UTC 2022 - Marcus Meissner <meissner@suse.com>

- updated to 4.00c

  - complete documentation restructuring, made possible by Google Season

    of Docs :) thank you Jana!

  - we renamed several UI and fuzzer_stat entries to be more precise,

    e.g. "unique crashes" -> "saved crashes", "total paths" ->

    "corpus count", "current path" -> "current item".

    This might need changing custom scripting!

  - Nyx mode (full system emulation with snapshot capability) has been

    added - thanks to @schumilo and @eqv!

  - unicorn_mode:

    -   Moved to unicorn2! by Ziqiao Kong (@lazymio)

    -   Faster, more accurate emulation (newer QEMU base), risc-v support

    -   removed indirections in rust callbacks

  - new binary-only fuzzing mode: coresight_mode for aarch64 CPUs :)

    thanks to RICSecLab submitting!

  - if instrumented libaries are dlopen()'ed after the forkserver you

    will now see a crash. Before you would have colliding coverage.

    We changed this to force fixing a broken setup rather then allowing

    ineffective fuzzing.

  - See docs/best_practices.md how to fix such setups.

  - afl-fuzz:

    -   cmplog binaries will need to be recompiled for this version

        (it is better!)

    -   fix a regression introduced in 3.10 that resulted in less

        coverage being detected. thanks to Collin May for reporting!

    -   ensure all spawned targets are killed on exit

    -   added AFL_IGNORE_PROBLEMS, plus checks to identify and abort on

        incorrect LTO usage setups and enhanced the READMEs for better

        information on how to deal with instrumenting libraries

    -   fix -n dumb mode (nobody should use this mode though)

    -   fix stability issue with LTO and cmplog

    -   better banner

    -   more effective cmplog mode

    -   more often update the UI when in input2stage mode

  - qemu_mode/unicorn_mode: fixed OOB write when using libcompcov,

    thanks to kotee4ko for reporting!

  - frida_mode:

    -   better performance, bug fixes

    -   David Carlier added Android support :)

  - afl-showmap, afl-tmin and afl-analyze:

    -   honor persistent mode for more speed. thanks to dloffre-snl

        for reporting!

    -   fix bug where targets are not killed on timeouts

    -   moved hidden afl-showmap -A option to -H to be used for

        coresight_mode

  - Prevent accidentaly killing non-afl/fuzz services when aborting

    afl-showmap and other tools.

  - afl-cc:

    -   detect overflow reads on initial input buffer for asan

    -   new cmplog mode (incompatible with older afl++ versions)

    -   support llvm IR select instrumentation for default PCGUARD and LTO

    -   fix for shared linking on MacOS

    -   better selective instrumentation AFL_LLVM_{ALLOW|DENY}LIST

        on filename matching (requires llvm 11 or newer)

    -   fixed a potential crash in targets for LAF string handling

    -   fixed a bad assert in LAF split switches

    -   added AFL_USE_TSAN thread sanitizer support

    -   llvm and LTO mode modified to work with new llvm 14-dev (again.)

    -   fix for AFL_REAL_LD

    -   more -z defs filtering

    -   make -v without options work

  - added the very good grammar mutator "GramaTron" to the

    custom_mutators

  - added optimin, a faster and better corpus minimizer by

    Adrian Herrera. Thank you!

  - added afl-persistent-config script to set perform permanent system

    configuration settings for fuzzing, for Linux and Macos.

    thanks to jhertz!

  - added xml, curl & exotic string functions to llvm dictionary feature

  - fix AFL_PRELOAD issues on MacOS

  - removed utils/afl_frida because frida_mode/ is now so much better

  - added uninstall target to makefile (todo: update new readme!)

-------------------------------------------------------------------

Sun Sep 26 11:04:42 UTC 2021 - Marcus Meissner <meissner@suse.com>

- enable gcc-plugin on factory

- build with 32bit plugins on x86_64

-------------------------------------------------------------------

Mon Jul 19 12:49:59 UTC 2021 - Marcus Meissner <meissner@suse.com>

- updated to 3.14c

  - afl-fuzz:                                                                                                                                                                                

    - fix -F when a '/' was part of the parameter                                                                                                                                            

    - fixed a crash for cmplog for very slow inputs                                                                                                                                          

    - fix for AFLfast schedule counting                                                                                                                                                      

    - removed implied -D determinstic from -M main                                                                                                                                           

    - if the target becomes unavailable check out out/default/error.txt                                                                                                                      

      for an indicator why                                                                                                                                                                   

    - AFL_CAL_FAST was a dead env, now does the same as AFL_FAST_CAL                                                                                                                         

    - reverse read the queue on resumes (more effective)                                                                                                                                     

    - fix custom mutator trimming                                                                                                                                                            

  - afl-cc:                                                                                                                                                                                  

    - Update to COMPCOV/laf-intel that speeds up the instrumentation                                                                                                                         

      process a lot - thanks to Michael Rodler/f0rki for the PR!                                                                                                                             

    - Fix for failures for some sized string instrumentations                                                                                                                                

    - Fix to instrument global namespace functions in c++                                                                                                                                    

    - Fix for llvm 13                                                                                                                                                                        

    - support partial linking                                                                                                                                                                

    - do honor AFL_LLVM_{ALLOW/DENY}LIST for LTO autodictionary and DICT2FILE                                                                                                                

    - We do support llvm versions from 3.8 to 5.0 again                                                                                                                                      

  - frida_mode:                                                                                                                                                                              

    - several fixes for cmplog                                                                                                                                                               

    - remove need for AFL_FRIDA_PERSISTENT_RETADDR_OFFSET                                                                                                                                    

    - less coverage collision                                                                                                                                                                

    - feature parity of aarch64 with intel now (persistent, cmplog,                                                                                                                          

      in-memory testcases, asan)                                                                                                                                                             

  - afl-cmin and afl-showmap -i do now descend into subdirectories                                                                                                                           

    (like afl-fuzz does) - note that afl-cmin.bash does not!                                                                                                                                 

  - afl_analyze:                                                                                                                                                                             

    - fix timeout handling                                                                                                                                                                   

    - add forkserver support for better performance                                                                                                                                          

  - ensure afl-compiler-rt is built for gcc_module                                                                                                                                           

  - always build aflpp_driver for libfuzzer harnesses                                                                                                                                        

  - added `AFL_NO_FORKSRV` env variable support to                                                                                                                                           

    afl-cmin, afl-tmin, and afl-showmap, by @jhertz                                                                                                                                          

  - removed outdated documents, improved existing documentation                                                                                                                              

-------------------------------------------------------------------

Thu Jul 15 19:29:19 UTC 2021 - Peace Peters <peacepeters.pp@gmail.com>

- s390x added to the compiler files

-------------------------------------------------------------------

Tue Jun  8 09:06:11 UTC 2021 - Andreas Schwab <schwab@suse.de>

- Fix filelist for riscv64

-------------------------------------------------------------------

Tue Jun  1 10:36:06 UTC 2021 - Marcus Meissner <meissner@suse.com>

- updated to 3.13c

  - Note: plot_data switched to relative time from unix time in 3.10

  - frida_mode - new mode that uses frida to fuzz binary-only targets,

    it currently supports persistent mode and cmplog.

    thanks to @WorksButNotTested!

  - create a fuzzing dictionary with the help of CodeQL thanks to

    @microsvuln! see utils/autodict_ql

  - afl-fuzz:

    - added patch by @realmadsci to support @@ as part of command line

      options, e.g. `afl-fuzz ... -- ./target --infile=@@`

    - add recording of previous fuzz attempts for persistent mode

      to allow replay of non-reproducable crashes, see

      AFL_PERSISTENT_RECORD in config.h and docs/envs.h

    - fixed a bug when trimming for stdin targets

    - cmplog -l: default cmplog level is now 2, better efficiency.

      level 3 now performs redqueen on everything. use with care.

    - better fuzzing strategy yield display for enabled options

    - ensure one fuzzer sync per cycle

    - fix afl_custom_queue_new_entry original file name when syncing

      from fuzzers

    - fixed a crash when more than one custom mutator was used together

      with afl_custom_post_process

    - on a crashing seed potentially the wrong input was disabled

    - added AFL_EXIT_ON_SEED_ISSUES env that will exit if a seed in

      -i dir crashes the target or results in a timeout. By default

      afl++ ignores these and uses them for splicing instead.

    - added AFL_EXIT_ON_TIME env that will make afl-fuzz exit fuzzing

      after no new paths have been found for n seconds

    - when AFL_FAST_CAL is set a variable path will now be calibrated

      8 times instead of originally 40. Long calibration is now 20.

    - added AFL_TRY_AFFINITY to try to bind to CPUs but don't error if

      it fails

  - afl-cc:

    - We do not support llvm versions prior 6.0 anymore

    - added thread safe counters to all modes (`AFL_LLVM_THREADSAFE_INST`),

      note that this disables NeverZero counters.

    - Fix for -pie compiled binaries with default afl-clang-fast PCGUARD

    - Leak Sanitizer (AFL_USE_LSAN) added by Joshua Rogers, thanks!

    - Removed InsTrim instrumentation as it is not as good as PCGUARD

    - Removed automatic linking with -lc++ for LTO mode

    - Fixed a crash in llvm dict2file when a strncmp length was -1

    - added --afl-noopt support

  - utils/aflpp_driver:

    - aflpp_qemu_driver_hook fixed to work with qemu_mode

    - aflpp_driver now compiled with -fPIC

  - unicornafl:

    - fix MIPS delay slot caching, thanks @JackGrence

    - fixed aarch64 exit address

    - execution no longer stops at address 0x0

  - updated afl-system-config to support Arch Linux weirdness and increase

    MacOS shared memory

  - updated the grammar custom mutator to the newest version

  - add -d (add dead fuzzer stats) to afl-whatsup

  - added AFL_PRINT_FILENAMES to afl-showmap/cmin to print the

    current filename

  - afl-showmap/cmin will now process queue items in alphabetical order

-------------------------------------------------------------------

Fri Apr  9 12:25:49 UTC 2021 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Fix packaging for aarch64 and %arm

-------------------------------------------------------------------

Sat Apr  3 23:31:18 UTC 2021 - Niklas Haas <obs@haasn.xyz>

- install `afl-clang-lto`, recommended by upstream as the best variant

  - add dependency on `lld`

  - bump llvm-devel up to >= 11.0.0

- fix /usr/bin/env path in afl.cmin scripts

- prevent stripping of runtime objects (fix bug 1184324)

-------------------------------------------------------------------

Mon Mar 29 12:29:54 UTC 2021 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Fix packaging on aarch64 and %{arm}

-------------------------------------------------------------------

Wed Mar 24 16:30:39 UTC 2021 - Marcus Meissner <meissner@suse.com>

- updated to 3.12c

  - afl-fuzz:

    - added AFL_TARGET_ENV variable to pass extra env vars to the target

      (for things like LD_LIBRARY_PATH)

    - fix map detection, AFL_MAP_SIZE not needed anymore for most cases

    - fix counting favorites (just a display thing)

  - afl-cc:

    - fix cmplog rtn (rare crash and not being able to gather ptr data)

    - fix our own PCGUARD implementation to compile with llvm 10.0.1

    - link runtime not to shared libs

    - ensure shared libraries are properly built and instrumented

    - AFL_LLVM_INSTRUMENT_ALLOW/DENY were not implemented for LTO, added

    - show correct LLVM PCGUARD NATIVE mode when auto switching to it

      and keep fsanitize-coverage-*list=...

      Short mnemnonic NATIVE is now also accepted.

  - qemu_mode (thanks @realmadsci):

    - move AFL_PRELOAD and AFL_USE_QASAN logic inside afl-qemu-trace

    - add AFL_QEMU_CUSTOM_BIN

  - unicorn_mode

    - accidently removed the subfolder from github, re-added

  - added DEFAULT_PERMISSION to config.h for all files created, default

    to 0600

-------------------------------------------------------------------

Tue Mar 16 07:43:01 UTC 2021 - Marcus Meissner <meissner@suse.com>

- updated to 3.11c

  - afl-fuzz:

    - better auto detection of map size

    - fix sanitizer settings (bug since 3.10c)

    - fix an off-by-one overwrite in cmplog

    - add non-unicode variants from unicode-looking dictionary entries

    - Rust custom mutator API improvements

    - Imported crash stats painted yellow on resume (only new ones are red)

  - afl-cc:

    - added AFL_NOOPT that will just pass everything to the normal

      gcc/clang compiler without any changes - to pass weird configure

      scripts

    - fixed a crash that can occur with ASAN + CMPLOG together plus

      better support for unicode (thanks to @stbergmann for reporting!)

    - fixed a crash in LAF transform for empty strings

    - handle erroneous setups in which multiple afl-compiler-rt are

      compiled into the target. This now also supports dlopen()

      instrumented libs loaded before the forkserver and even after the

      forkserver is started (then with collisions though)

    - the compiler rt was added also in object building (-c) which

      should have been fixed years ago but somewhere got lost :(

    - Renamed CTX to CALLER, added correct/real CTX implementation to

      CLASSIC

  - qemu_mode:

    - added AFL_QEMU_EXCLUDE_RANGES env by @realmadsci, thanks!

    - if no new/updated checkout is wanted, build with:

      NO_CHECKOUT=1 ./build_qemu_support.sh

    - we no longer perform a "git drop"

  - afl-cmin: support filenames with spaces

- afl-3.0c-fix-paths.patch: refreshed

-------------------------------------------------------------------

Mon Mar  1 09:43:40 UTC 2021 - Marcus Meissner <meissner@suse.com>

- update to 3.10c

  - Mac OS ARM64 support                                                                                                                                                                     

  - Android support fixed and updated by Joey Jiaojg - thanks!                                                                                                                               

  - New selective instrumentation option with __AFL_COVERAGE_* commands                                                                                                                      

    to be placed in the source code.                                                                                                                                                         

    Check out instrumentation/README.instrument_list.md                                                                                                                                      

  - afl-fuzz                                                                                                                                                                                 

    - Making AFL_MAP_SIZE (mostly) obsolete - afl-fuzz now learns on                                                                                                                         

      start the target map size                                                                                                                                                              

    - upgraded cmplog/redqueen: solving for floating point, solving                                                                                                                          

      transformations (e.g. toupper, tolower, to/from hex, xor,                                                                                                                              

      arithmetics, etc.). This is costly hence new command line option                                                                                                                       

      `-l` that sets the intensity (values 1 to 3). Recommended is 2.                                                                                                                        

    - added `AFL_CMPLOG_ONLY_NEW` to not use cmplog on initial seeds                                                                                                                         

      from `-i` or resumes (these have most likely already been done)                                                                                                                        

    - fix crash for very, very fast targets+systems (thanks to mhlakhani                                                                                                                     

      for reporting)                                                                                                                                                                         

    - on restarts (`-i`)/autoresume (AFL_AUTORESUME) the stats are now                                                                                                                       

      reloaded and used, thanks to Vimal Joseph for this patch!                                                                                                                              

    - changed the meaning of '+' of the '-t' option, it now means to                                                                                                                         

      auto-calculate the timeout with the value given being the max                                                                                                                          

      timeout. The original meaning of skipping timeouts instead of                                                                                                                          

      abort is now inherent to the -t option.                                                                                                                                                

    - if deterministic mode is active (`-D`, or `-M` without `-d`) then                                                                                                                      

      we sync after every queue entry as this can take very long time                                                                                                                        

      otherwise                                                                                                                                                                              

    - added minimum SYNC_TIME to include/config.h (30 minutes default)                                                                                                                       

    - better detection if a target needs a large shared map                                                                                                                                  

    - fix for `-Z`                                                                                                                                                                           

    - fixed a few crashes                                                                                                                                                                    

    - switched to an even faster RNG                                                                                                                                                         

    - added hghwng's patch for faster trace map analysis                                                                                                                                     

    - printing suggestions for mistyped `AFL_` env variables                                                                                                                                 

    - added Rust bindings for custom mutators (thanks @julihoh)                                                                                                                              

  - afl-cc                                                                                                                                                                                   

    - allow instrumenting LLVMFuzzerTestOneInput                                                                                                                                             

    - fixed endless loop for allow/blocklist lines starting with a                                                                                                                           

      comment (thanks to Zherya for reporting)                                                                                                                                               

    - cmplog/redqueen now also tracks floating point, _ExtInt() + 128bit                                                                                                                     

    - cmplog/redqueen can now process basic libc++ and libstdc++                                                                                                                             

      std::string comparisons (no position or length type variants)                                                                                                                          

    - added support for __afl_coverage_interesting() for LTO and our                                                                                                                         

      own PCGUARD (llvm 10.0.1+), read more about this function and                                                                                                                          

      selective coverage in instrumentation/README.instrument_list.md                                                                                                                        

    - added AFL_LLVM_INSTRUMENT option NATIVE for native clang pc-guard                                                                                                                      

      support (less performant than our own), GCC for old afl-gcc and                                                                                                                        

      CLANG for old afl-clang                                                                                                                                                                

    - fixed a potential crash in the LAF feature                                                                                                                                             

    - workaround for llvm bitcast lto bug                                                                                                                                                    

    - workaround for llvm 13                                                                                                                                                                 

  - qemuafl                                                                                                                                                                                  

    - QASan (address sanitizer for Qemu) ported to qemuafl!                                                                                                                                  

      See qemu_mode/libqasan/README.md                                                                                                                                                       

    - solved some persistent mode bugs (thanks Dil4rd)                                                                                                                                       

    - solved an issue when dumping the memory maps (thanks wizche)                                                                                                                           

    - Android support for QASan                                                                                                                                                              

  - unicornafl                                                                                                                                                                               

    - Substantial speed gains in python bindings for certain use cases                                                                                                                       

    - Improved rust bindings                                                                                                                                                                 

    - Added a new example harness to compare python, c and rust bindings                                                                                                                     

  - afl-cmin and afl-showmap now support the -f option                                                                                                                                       

  - afl_plot now also generates a graph on the discovered edges                                                                                                                              

  - changed default: no memory limit for afl-cmin and afl-cmin.bash                                                                                                                          

  - warn on any _AFL and __AFL env vars.                                                                                                                                                     

  - set AFL_IGNORE_UNKNOWN_ENVS to not warn on unknown AFL_... env vars                                                                                                                      

  - added dummy Makefile to instrumentation/                                                                                                                                                 

  - Updated utils/afl_frida to be 5% faster, 7% on x86_x64                                                                                                                                   

  - Added `AFL_KILL_SIGNAL` env variable (thanks @v-p-b)                                                                                                                                     

  - @Edznux added a nice documentation on how to use rpc.statsd with                                                                                                                         

    afl++ in docs/rpc_statsd.md, thanks!                                                                                                                                                     

-------------------------------------------------------------------

Tue Dec 15 09:18:09 UTC 2020 - Marcus Meissner <meissner@suse.com>

- updated to 3.0c

  - llvm_mode/ and gcc_plugin/ moved to instrumentation/

  - examples/ renamed to utils/

  - moved libdislocator, libtokencap and qdbi_mode to utils/

  - all compilers combined to afl-cc which emulates the previous ones

  - afl-llvm/gcc-rt.o merged into afl-compiler-rt.o

  - afl-fuzz

    - not specifying -M or -S will now auto-set "-S default"

    - deterministic fuzzing is now disabled by default and can be enabled with

      -D. It is still enabled by default for -M.

    - a new seed selection was implemented that uses weighted randoms based on

      a schedule performance score, which is much better that the previous

      walk the whole queue approach. Select the old mode with -Z (auto enabled

      with -M)

    - Marcel Boehme submitted a patch that improves all AFFast schedules :)

    - the default schedule is now FAST

    - memory limits are now disabled by default, set them with -m if required

    - rpc.statsd support, for stats and charts, by Edznux, thanks a lot!

    - reading testcases from -i now descends into subdirectories

    - allow the -x command line option up to 4 times

    - loaded extras now have a duplication protection

    - If test cases are too large we do a partial read on the maximum

      supported size

    - longer seeds with the same trace information will now be ignored

      for fuzzing but still be used for splicing

    - crashing seeds are now not prohibiting a run anymore but are

      skipped - they are used for splicing, though

    - update MOpt for expanded havoc modes

    - setting the env var AFL_NO_AUTODICT will not load an LTO autodictionary

    - added NO_SPLICING compile option and makefile define

    - added INTROSPECTION make target that writes all mutations to

      out/NAME/introspection.txt

    - print special compile time options used in help output

    - when using -c cmplog, one of the childs was not killed, fixed

    - somewhere we broke -n dumb fuzzing, fixed

    - added afl_custom_describe to the custom mutator API to allow for easy

      mutation reproduction on crashing inputs

  - instrumentation

    - We received an enhanced gcc_plugin module from AdaCore, thank you

      very much!!

    - not overriding -Ox or -fno-unroll-loops anymore

    - we now have our own trace-pc-guard implementation. It is the same as

      -fsanitize-coverage=trace-pc-guard from llvm 12, but: it is a) inline

      and b) works from llvm 10.0.1 + onwards :)

    - new llvm pass: dict2file via AFL_LLVM_DICT2FILE, create afl-fuzz

      -x dictionary of string comparisons found during compilation

    - LTO autodict now also collects interesting cmp comparisons,

      std::string compare + find + ==, bcmp

    - fix crash in dict2file for integers > 64 bit

  - custom mutators

    - added a new custom mutator: symcc -> https://github.com/eurecom-s3/symcc/

    - added a new custom mutator: libfuzzer that integrates libfuzzer mutations

    - Our afl++ Grammar-Mutator is now better integrated into custom_mutators/

    - added INTROSPECTION support for custom modules

    - python fuzz function was not optional, fixed

    - some python mutator speed improvements

  - afl-cmin/afl-cmin.bash now search first in PATH and last in AFL_PATH

  - unicornafl synced with upstream version 1.02 (fixes, better rust bindings)

  - renamed AFL_DEBUG_CHILD_OUTPUT to AFL_DEBUG_CHILD

  - added AFL_CRASH_EXITCODE env variable to treat a child exitcode as crash

- afl-2.63c-fix-paths.patch refreshed to afl-3.0c-fix-paths.patch

-------------------------------------------------------------------

Sat Sep  5 08:43:19 UTC 2020 - Marcus Meissner <meissner@suse.com>

- updated to 2.68c

  - added the GSoC excellent afl++ grammar mutator by Shengtuo to our                                                                                                                        

    custom_mutators/ (see custom_mutators/README.md) - or get it here:                                                                                                                       

    https://github.com/AFLplusplus/Grammar-Mutator                                                                                                                                           

  - a few QOL changes for Apple and its outdated gmake                                                                                                                                       

  - afl-fuzz:                                                                                                                                                                                

    - fix for auto dictionary entries found during fuzzing to not throw out                                                                                                                  

      a -x dictionary                                                                                                                                                                        

    - added total execs done to plot file                                                                                                                                                    

    - AFL_MAX_DET_EXTRAS env variable added to control the amount of                                                                                                                         

      deterministic dict entries without recompiling.                                                                                                                                        

    - AFL_FORKSRV_INIT_TMOUT env variable added to control the time to wait                                                                                                                  

      for the forkserver to come up without the need to increase the overall                                                                                                                 

      timeout.                                                                                                                                                                               

    - bugfix for cmplog that results in a heap overflow based on target data                                                                                                                 

      (thanks to the magma team for reporting!)                                                                                                                                              

    - write fuzzing setup into out/fuzzer_setup (environment variables and                                                                                                                   

      command line)                                                                                                                                                                          

  - custom mutators:                                                                                                                                                                         

    - added afl_custom_fuzz_count/fuzz_count function to allow specifying                                                                                                                    

      the number of fuzz attempts for custom_fuzz                                                                                                                                            

  - llvm_mode:                                                                                                                                                                               

    - ported SanCov to LTO, and made it the default for LTO. better                                                                                                                          

      instrumentation locations                                                                                                                                                              

    - Further llvm 12 support (fast moving target like afl++ :-) )                                                                                                                           

    - deprecated LLVM SKIPSINGLEBLOCK env environment                                                                                                                                        

-------------------------------------------------------------------

Wed Aug 19 14:35:25 UTC 2020 - Marcus Meissner <meissner@suse.com>

- updated to 2.67c

  - Support for improved afl++ snapshot module:                                                                                                                                              

    https://github.com/AFLplusplus/AFL-Snapshot-LKM                                                                                                                                          

  - Due to the instrumentation needing more memory, the initial memory sizes                                                                                                                 

    for -m have been increased                                                                                                                                                               

  - afl-fuzz:                                                                                                                                                                                

     - added -F option to allow -M main fuzzers to sync to foreign fuzzers,                                                                                                                  

       e.g. honggfuzz or libfuzzer                                                                                                                                                           

     - added -b option to bind to a specific CPU                                                                                                                                             

     - eliminated CPU affinity race condition for -S/-M runs                                                                                                                                 

     - expanded havoc mode added, on no cycle finds add extra splicing and                                                                                                                   

       MOpt into the mix                                                                                                                                                                     

     - fixed a bug in redqueen for strings and made deterministic with -s                                                                                                                    

  - llvm_mode:                                                                                                                                                                               

     - now supports llvm 12                                                                                                                                                                  

     - support for AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST (previous                                                                                                                            

       AFL_LLVM_WHITELIST and AFL_LLVM_INSTRUMENT_FILE are deprecated and                                                                                                                    

       are matched to AFL_LLVM_ALLOWLIST). The format is compatible to llvm                                                                                                                  

       sancov, and also supports function matching :)                                                                                                                                        

     - added neverzero counting to trace-pc/pcgard                                                                                                                                           

     - fixes for laf-intel float splitting (thanks to mark-griffin for                                                                                                                       

       reporting)                                                                                                                                                                            

     - fixes for llvm 4.0                                                                                                                                                                    

     - skipping ctors and ifuncs for instrumentation                                                                                                                                         

     - LTO: switch default to the dynamic memory map, set AFL_LLVM_MAP_ADDR                                                                                                                  

            for a fixed map address (eg. 0x10000)                                                                                                                                            

     - LTO: improved stability for persistent mode, no other instrumentation                                                                                                                 

            has that advantage                                                                                                                                                               

     - LTO: fixed autodict for long strings                                                                                                                                                  

     - LTO: laf-intel and redqueen/cmplog are now applied at link time                                                                                                                       

            to prevent llvm optimizing away the splits                                                                                                                                       

     - LTO: autodictionary mode is a fixed default now                                                                                                                                       

     - LTO: instrim instrumentation disabled, only classic support used                                                                                                                      

            as it is always better                                                                                                                                                           

     - LTO: env var AFL_LLVM_DOCUMENT_IDS=file will document which edge ID                                                                                                                   

            was given to which function during compilation                                                                                                                                   

     - LTO: single block functions were not implemented by default, fixed                                                                                                                    

     - LTO: AFL_LLVM_SKIP_NEVERZERO behaviour was inversed, fixed                                                                                                                            

     - setting AFL_LLVM_LAF_SPLIT_FLOATS now activates                                                                                                                                       

       AFL_LLVM_LAF_SPLIT_COMPARES                                                                                                                                                           

     - support for -E and -shared compilation runs                                                                                                                                           

  - added honggfuzz mangle as a custom mutator in custom_mutators/honggfuzz                                                                                                                  

  - added afl-frida gum solution to examples/afl_frida (mostly imported                                                                                                                      

    from https://github.com/meme/hotwax/)                                                                                                                                                    

  - small fixes to afl-plot, afl-whatsup and man page creation                                                                                                                               

  - new README, added FAQ                                                                                                                                                                    

-------------------------------------------------------------------

Thu Jul  2 09:59:38 UTC 2020 - Marcus Meissner <meissner@suse.com>

- updated to 2.66c

  - renamed blacklist/whitelist to ignorelist/instrumentlist ->

    AFL_LLVM_INSTRUMENT_FILE and AFL_GCC_INSTRUMENT_FILE

  - warn on deprecated environment variables

  - afl-fuzz:

     - -S secondary nodes now only sync from the main node to increase

       performance, the -M main node still syncs from everyone. Added checks

       that ensure exactly one main node is present and warn otherwise

     - Add -D after -S to force a secondary to perform deterministic fuzzing

     - If no main node is present at a sync one secondary node automatically

       becomes a temporary main node until a real main nodes shows up

     - Fixed a mayor performance issue we inherited from AFLfast

     - switched murmur2 hashing and random() for xxh3 and xoshiro256**,

       resulting in an up to 5.5% speed increase

     - Resizing the window does not crash afl-fuzz anymore

     - Ensure that the targets are killed on exit

     - fix/update to MOpt (thanks to arnow117)

     - added MOpt dictionary support from repo

     - added experimental SEEK power schedule. It is EXPLORE with ignoring

       the runtime and less focus on the length of the test case

  - llvm_mode:

    - the default instrumentation is now PCGUARD if the llvm version is >= 7,

      as it is faster and provides better coverage. The original afl

      instrumentation can be set via AFL_LLVM_INSTRUMENT=AFL. This is

      automatically done when the instrument_file list feature is used. 

    - PCGUARD mode is now even better because we made it collision free - plus

      it has a fixed map size, so it is also faster! :)

    - some targets want a ld variant for LD that is not gcc/clang but ld,

      added afl-ld-lto to solve this

    - lowered minimum required llvm version to 3.4 (except LLVMInsTrim, which

      needs 3.8.0)

    - instrument_file list feature now supports wildcards (thanks to sirmc)

    - small change to cmplog to make it work with current llvm 11-dev

    - added AFL_LLVM_LAF_ALL, sets all laf-intel settings

    - LTO instrument_files functionality rewritten, now main, _init etc functions

      need not to be listed anymore

    - fixed crash in compare-transform-pass when strcasecmp/strncasecmp was

      tried to be instrumented with LTO

    - fixed crash in cmplog with LTO

    - enable snapshot lkm also for persistent mode

  - Unicornafl

    - Added powerPC support from unicorn/next

    - rust bindings!

  - CMPLOG/Redqueen now also works for MMAP sharedmem

  - ensure shmem is released on errors

  - we moved radamsa to be a custom mutator in ./custom_mutators/. It is not

    compiled by default anymore.

  - allow running in /tmp (only unsafe with umask 0)

  - persistent mode shared memory testcase handover (instead of via

    files/stdin) - 10-100% performance increase

  - General support for 64 bit PowerPC, RiscV, Sparc etc.

  - fix afl-cmin.bash

  - slightly better performance compilation options for afl++ and targets

  - fixed afl-gcc/afl-as that could break on fast systems reusing pids in

    the same second

  - added lots of dictionaries from oss-fuzz, go-fuzz and Jakub Wilk

  - added former post_library examples to examples/custom_mutators/

  - Dockerfile upgraded to Ubuntu 20.04 Focal and installing llvm 11 and

    gcc 10 so afl-clang-lto can be build

-------------------------------------------------------------------

Fri May 15 09:24:47 UTC 2020 - Marcus Meissner <meissner@suse.com>

- updated to 2.65c

  - afl-fuzz:

     - AFL_MAP_SIZE was not working correctly

     - better python detection

     - an old, old bug in afl that would show negative stability in rare

       circumstances is now hopefully fixed

     - AFL_POST_LIBRARY was deprecated, use AFL_CUSTOM_MUTATOR_LIBRARY

       instead (see docs/custom_mutators.md)

  - llvm_mode:

     - afl-clang-fast/lto now do not skip single block functions. This

       behaviour can be reactivated with AFL_LLVM_SKIPSINGLEBLOCK

     - if LLVM 11 is installed the posix shm_open+mmap is used and a fixed

       address for the shared memory map is used as this increases the

       fuzzing speed

     - InsTrim now has an LTO version! :-) That is the best and fastest mode!

     - fixes to LTO mode if instrumented edges > MAP_SIZE

     - CTX and NGRAM can now be used together

     - CTX and NGRAM are now also supported in CFG/INSTRIM mode

     - AFL_LLVM_LAF_TRANSFORM_COMPARES could crash, fixed

     - added AFL_LLVM_SKIP_NEVERZERO to skip the never zero coverage counter

       implementation. For targets with few or no loops or heavily called

       functions. Gives a small performance boost.

  - qemu_mode:

    - add information on PIE/PIC load addresses for 32 bit

    - better dependency checks

  - gcc_plugin:

    - better dependency checks

  - unicorn_mode:

    - validate_crash_callback can now count non-crashing inputs as crash as well

    - better submodule handling

  - afl-showmap: fix for -Q mode

  - added examples/afl_network_proxy which allows to fuzz a target over the

    network (not fuzzing tcp/ip services but running afl-fuzz on one system

    and the target being on an embedded device)

  - added examples/afl_untracer which does a binary-only fuzzing with the

    modifications done in memory (intel32/64 and aarch64 support)

  - added examples/afl_proxy which can be easily used to fuzz and instrument

    non-standard things

  - all:

    - forkserver communication now also used for error reporting

    - fix 32 bit build options

    - make clean now leaves qemu-3.1.1.tar.xz and the unicornafl directory

      intact if in a git/svn checkout - unless "deepclean" is used

-------------------------------------------------------------------

Sat Apr 18 07:05:42 UTC 2020 - Marcus Meissner <meissner@suse.com>

- updated to 2.64c

  - llvm_mode LTO mode:

    - now requires llvm11 - but compiles all targets! :)

    - autodictionary feature added, enable with `AFL_LLVM_LTO_AUTODICTIONARY`

    - variable map size usage

  - afl-fuzz:

    - variable map size support added (only LTO mode can use this)

    - snapshot feature usage now visible in UI

    - Now setting `-L -1` will enable MOpt in parallel to normal mutation.

      Additionally, this allows to run dictionaries, radamsa and cmplog.

    - fix for cmplog/redqueen mode if stdin was used

    - fix for writing a better plot_data file

  - qemu_mode: fix for persistent mode (which would not terminate or get stuck)

  - compare-transform/AFL_LLVM_LAF_TRANSFORM_COMPARES now transforms also

    static global and local variable comparisons (cannot find all though)

  - extended forkserver: map_size and more information is communicated to

    afl-fuzz (and afl-fuzz acts accordingly)

  - new environment variable: AFL_MAP_SIZE to specify the size of the shared map

  - if AFL_CC/AFL_CXX is set but empty afl compilers did fail, fixed

    (this bug is in vanilla afl too)

  - added NO_PYTHON flag to disable python support when building afl-fuzz

  - more refactoring

-------------------------------------------------------------------

Sun Apr 12 11:04:35 UTC 2020 - Marcus Meissner <meissner@suse.com>

- updated to 2.63c

  - all:

    - big code changes to make afl-fuzz thread-safe so afl-fuzz can spawn

      multiple fuzzing threads in the future or even become a library

    - afl basic tools now report on the environment variables picked up

    - more tools get environment variable usage info in the help output

    - force all output to stdout (some OK/SAY/WARN messages were sent to

      stdout, some to stderr)

    - uninstrumented mode uses an internal forkserver ("fauxserver")

    - now builds with `-D_FORTIFY_SOURCE=2`

    - drastically reduced number of (de)allocations during fuzzing

  - afl-fuzz:

    - python mutator modules and custom mutator modules now use the same

      interface and hence the API changed

    - AFL_AUTORESUME will resume execution without the need to specify `-i -`

    - added experimental power schedules (-p):

      - mmopt: ignores runtime of queue entries, gives higher weighting to

               the last 5 queue entries

      - rare: puts focus on queue entries that hits rare branches, also ignores

              runtime

  - llvm_mode: 

    - added SNAPSHOT feature (using https://github.com/AFLplusplus/AFL-Snapshot-LKM)

    - added Control Flow Integrity sanitizer (AFL_USE_CFISAN)

    - added AFL_LLVM_INSTRUMENT option to control the instrumentation type

      easier: DEFAULT, CFG (INSTRIM), LTO, CTX, NGRAM-x (x=2-16)

    - made USE_TRACE_PC compile obsolete

  - LTO collision free instrumented added in llvm_mode with afl-clang-lto -

    note that this mode is amazing, but quite some targets won't compile

  - Added llvm_mode NGRAM prev_loc coverage by Adrean Herrera

    (https://github.com/adrianherrera/afl-ngram-pass/), activate by setting

    AFL_LLVM_INSTRUMENT=NGRAM-<value> or AFL_LLVM_NGRAM_SIZE=<value>

  - Added llvm_mode context sensitive branch coverage, activated by setting

    AFL_LLVM_INSTRUMENT=CTX or AFL_LLVM_CTX=1

  - llvm_mode InsTrim mode:

    - removed workaround for bug where paths were not instrumented and

      imported fix by author

    - made skipping 1 block functions an option and is disabled by default,

      set AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK=1 to re-enable this

  - qemu_mode:

    - qemu_mode now uses solely the internal capstone version to fix builds

      on modern Linux distributions

    - QEMU now logs routine arguments for CmpLog when the target is x86

  - afl-tmin:

    - now supports hang mode `-H` to minimize hangs

    - fixed potential afl-tmin missbehavior for targets with multiple hangs

  - Pressing Control-c in afl-cmin did not terminate it for some OS

  - the custom API was rewritten and is now the same for Python and shared

    libraries.

- afl-1.58b-fix-paths.patch moved to

- afl-2.63c-fix-paths.patch: adjust Makefile -> GNUmakefile

-------------------------------------------------------------------

Fri Feb 28 14:09:26 UTC 2020 - Marcus Meissner <meissner@suse.com>

- updated to 2.62c

  - Important fix for memory allocation functions that result in afl-fuzz not identifying crashes - UPDATE!

  - Small fix for -E/-V to release the CPU

  - CmpLog does not need sancov anymore

-------------------------------------------------------------------

Tue Feb 25 12:04:22 UTC 2020 - Marcus Meissner <meissner@suse.com>

- updated to 2.61c

  - use -march=native if available                                                                                                                                                           

  - most tools now check for mistyped environment variables                                                                                                                                  

  - gcc 10 is now supported                                                                                                                                                                  

  - the memory safety checks are now disabled for a little more speed during                                                                                                                 

    fuzzing (only affects creating queue entries), can be toggled in config.h                                                                                                                

  - afl-fuzz:                                                                                                                                                                                

     - MOpt out of bounds writing crash fixed                                                                                                                                                

     - now prints the real python version support compiled in                                                                                                                                

     - set stronger performance compile options and little tweaks                                                                                                                            

     - Android: prefer bigcores when selecting a CPU                                                                                                                                         

     - CmpLog forkserver                                                                                                                                                                     

     - Redqueen input-2-state mutator (cmp instructions only ATM)                                                                                                                            

     - all Python 2+3 versions supported now                                                                                                                                                 

     - changed execs_per_sec in fuzzer_stats from "current" execs per second                                                                                                                 

       (which is pointless) to total execs per second                                                                                                                                        

     - bugfix for dictionary insert stage count (fix via Google repo PR)                                                                                                                     

     - added warning if -M is used together with custom mutators with _ONLY option                                                                                                           

     - AFL_TMPDIR checks are now later and better explained if they fail                                                                                                                     

  - llvm_mode                                                                                                                                                                                

     - InsTrim: three bug fixes:                                                                                                                                                             

        1. (minor) no pointless instrumentation of 1 block functions                                                                                                                         

        2. (medium) path bug that leads a few blocks not instrumented that                                                                                                                   

           should be                                                                                                                                                                         

        3. (major) incorrect prev_loc was written, fixed!                                                                                                                                    

  - afl-clang-fast:                                                                                                                                                                          

     - show in the help output for which llvm version it was compiled for                                                                                                                    

     - now does not need to be recompiled between trace-pc and pass                                                                                                                          

       instrumentation. compile normally and set AFL_LLVM_USE_TRACE_PC :)                                                                                                                    

     - LLVM 11 is supported                                                                                                                                                                  

     - CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog)                                                                                                                     

  - afl-gcc, afl-clang-fast, afl-gcc-fast:                                                                                                                                                   

     - experimental support for undefined behaviour sanitizer UBSAN                                                                                                                          

       (set AFL_USE_UBSAN=1)                                                                                                                                                                 

     - the instrumentation summary output now also lists activated sanitizers                                                                                                                

     - afl-as: added isatty(2) check back in                                                                                                                                                 

     - added AFL_DEBUG (for upcoming merge)                                                                                                                                                  

  - qemu_mode:                                                                                                                                                                               

     - persistent mode is now also available for arm and aarch64                                                                                                                             

     - CmpLog instrumentation for QEMU (-c afl-fuzz command line option)                                                                                                                     

       for x86, x86_64, arm and aarch64