1 /* 2 american fuzzy lop - injectable parts 3 ------------------------------------- 4 5 Written and maintained by Michal Zalewski <lcamtuf@google.com> 6 7 Forkserver design by Jann Horn <jannhorn@googlemail.com> 8 9 Copyright 2013, 2014, 2015 Google Inc. All rights reserved. 10 11 Licensed under the Apache License, Version 2.0 (the "License"); 12 you may not use this file except in compliance with the License. 13 You may obtain a copy of the License at: 14 15 http://www.apache.org/licenses/LICENSE-2.0 16 17 This file houses the assembly-level instrumentation injected into fuzzed 18 programs. The instrumentation stores XORed pairs of data: identifiers of the 19 currently executing branch and the one that executed immediately before. 20 21 TL;DR: the instrumentation does shm_trace_map[cur_loc ^ prev_loc]++ 22 23 The code is designed for 32-bit and 64-bit x86 systems. Both modes should 24 work everywhere except for Apple systems. Apple does relocations differently 25 from everybody else, so since their OSes have been 64-bit for a longer while, 26 I didn't go through the mental effort of porting the 32-bit code. 27 28 In principle, similar code should be easy to inject into any well-behaved 29 binary-only code (e.g., using DynamoRIO). Conditional jumps offer natural 30 targets for instrumentation, and should offer comparable probe density. 31 32 */ 33 34 #ifndef _HAVE_AFL_AS_H 35 #define _HAVE_AFL_AS_H 36 37 #include "config.h" 38 #include "types.h" 39 40 /* 41 ------------------ 42 Performances notes 43 ------------------ 44 45 Contributions to make this code faster are appreciated! Here are some 46 rough notes that may help with the task: 47 48 - Only the trampoline_fmt and the non-setup __afl_maybe_log code paths are 49 really worth optimizing; the setup / fork server stuff matters a lot less 50 and should be mostly just kept readable. 51 52 - We're aiming for modern CPUs with out-of-order execution and large 53 pipelines; the code is mostly follows intuitive, human-readable 54 instruction ordering, because "textbook" manual reorderings make no 55 substantial difference. 56 57 - Interestingly, instrumented execution isn't a lot faster if we store a 58 variable pointer to the setup, log, or return routine and then do a reg 59 call from within trampoline_fmt. It does speed up non-instrumented 60 execution quite a bit, though, since that path just becomes 61 push-call-ret-pop. 62 63 - There is also not a whole lot to be gained by doing SHM attach at a 64 fixed address instead of retrieving __afl_area_ptr. Although it allows us 65 to have a shorter log routine inserted for conditional jumps and jump 66 labels (for a ~10% perf gain), there is a risk of bumping into other 67 allocations created by the program or by tools such as ASAN. 68 69 - popf is *awfully* slow, which is why we're doing the lahf / sahf + 70 overflow test trick. Unfortunately, this forces us to taint eax / rax, but 71 this dependency on a commonly-used register still beats the alternative of 72 using pushf / popf. 73 74 One possible optimization is to avoid touching flags by using a circular 75 buffer that stores just a sequence of current locations, with the XOR stuff 76 happening offline. Alas, this doesn't seem to have a huge impact: 77 78 https://groups.google.com/d/msg/afl-users/MsajVf4fRLo/2u6t88ntUBIJ 79 80 - Preforking one child a bit sooner, and then waiting for the "go" command 81 from within the child, doesn't offer major performance gains; fork() seems 82 to be relatively inexpensive these days. Preforking multiple children does 83 help, but badly breaks the "~1 core per fuzzer" design, making it harder to 84 scale up. Maybe there is some middle ground. 85 86 Perhaps of note: in the 64-bit version for all platforms except for Apple, 87 the instrumentation is done slightly differently than on 32-bit, with 88 __afl_prev_loc and __afl_area_ptr being local to the object file (.lcomm), 89 rather than global (.comm). This is to avoid GOTRELPC lookups in the critical 90 code path, which AFAICT, are otherwise unavoidable if we want gcc -shared to 91 work; simple relocations between .bss and .text won't work on most 64-bit 92 platforms in such a case. 93 94 (Fun fact: on Apple systems, .lcomm can segfault the linker.) 95 96 The side effect is that state transitions are measured in a somewhat 97 different way, with previous tuple being recorded separately within the scope 98 of every .c file. This should have no impact in any practical sense. 99 100 Another side effect of this design is that getenv() will be called once per 101 every .o file when running in non-instrumented mode; and since getenv() tends 102 to be optimized in funny ways, we need to be very careful to save every 103 oddball register it may touch. 104 105 */ 106 107 static const u8* trampoline_fmt_32 = 108 109 "\n" 110 "/* --- AFL TRAMPOLINE (32-BIT) --- */\n" 111 "\n" 112 ".align 4\n" 113 "\n" 114 "leal -16(%%esp), %%esp\n" 115 "movl %%edi, 0(%%esp)\n" 116 "movl %%edx, 4(%%esp)\n" 117 "movl %%ecx, 8(%%esp)\n" 118 "movl %%eax, 12(%%esp)\n" 119 "movl $0x%08x, %%ecx\n" 120 "call __afl_maybe_log\n" 121 "movl 12(%%esp), %%eax\n" 122 "movl 8(%%esp), %%ecx\n" 123 "movl 4(%%esp), %%edx\n" 124 "movl 0(%%esp), %%edi\n" 125 "leal 16(%%esp), %%esp\n" 126 "\n" 127 "/* --- END --- */\n" 128 "\n"; 129 130 static const u8* trampoline_fmt_64 = 131 132 "\n" 133 "/* --- AFL TRAMPOLINE (64-BIT) --- */\n" 134 "\n" 135 ".align 4\n" 136 "\n" 137 "leaq -(128+24)(%%rsp), %%rsp\n" 138 "movq %%rdx, 0(%%rsp)\n" 139 "movq %%rcx, 8(%%rsp)\n" 140 "movq %%rax, 16(%%rsp)\n" 141 "movq $0x%08x, %%rcx\n" 142 "call __afl_maybe_log\n" 143 "movq 16(%%rsp), %%rax\n" 144 "movq 8(%%rsp), %%rcx\n" 145 "movq 0(%%rsp), %%rdx\n" 146 "leaq (128+24)(%%rsp), %%rsp\n" 147 "\n" 148 "/* --- END --- */\n" 149 "\n"; 150 151 static const u8* main_payload_32 = 152 153 "\n" 154 "/* --- AFL MAIN PAYLOAD (32-BIT) --- */\n" 155 "\n" 156 ".text\n" 157 ".att_syntax\n" 158 ".code32\n" 159 ".align 8\n" 160 "\n" 161 162 "__afl_maybe_log:\n" 163 "\n" 164 " lahf\n" 165 " seto %al\n" 166 "\n" 167 " /* Check if SHM region is already mapped. */\n" 168 "\n" 169 " movl __afl_area_ptr, %edx\n" 170 " testl %edx, %edx\n" 171 " je __afl_setup\n" 172 "\n" 173 "__afl_store:\n" 174 "\n" 175 " /* Calculate and store hit for the code location specified in ecx. There\n" 176 " is a double-XOR way of doing this without tainting another register,\n" 177 " and we use it on 64-bit systems; but it's slower for 32-bit ones. */\n" 178 "\n" 179 #ifndef COVERAGE_ONLY 180 " movl __afl_prev_loc, %edi\n" 181 " xorl %ecx, %edi\n" 182 " shrl $1, %ecx\n" 183 " movl %ecx, __afl_prev_loc\n" 184 #else 185 " movl %ecx, %edi\n" 186 #endif /* ^!COVERAGE_ONLY */ 187 "\n" 188 #ifdef SKIP_COUNTS 189 " orb $1, (%edx, %edi, 1)\n" 190 #else 191 " incb (%edx, %edi, 1)\n" 192 #endif /* ^SKIP_COUNTS */ 193 "\n" 194 "__afl_return:\n" 195 "\n" 196 " addb $127, %al\n" 197 " sahf\n" 198 " ret\n" 199 "\n" 200 ".align 8\n" 201 "\n" 202 "__afl_setup:\n" 203 "\n" 204 " /* Do not retry setup if we had previous failures. */\n" 205 "\n" 206 " cmpb $0, __afl_setup_failure\n" 207 " jne __afl_return\n" 208 "\n" 209 " /* Map SHM, jumping to __afl_setup_abort if something goes wrong.\n" 210 " We do not save FPU/MMX/SSE registers here, but hopefully, nobody\n" 211 " will notice this early in the game. */\n" 212 "\n" 213 " pushl %eax\n" 214 " pushl %ecx\n" 215 "\n" 216 " pushl $.AFL_SHM_ENV\n" 217 " call getenv\n" 218 " addl $4, %esp\n" 219 "\n" 220 " testl %eax, %eax\n" 221 " je __afl_setup_abort\n" 222 "\n" 223 " pushl %eax\n" 224 " call atoi\n" 225 " addl $4, %esp\n" 226 "\n" 227 " pushl $0 /* shmat flags */\n" 228 " pushl $0 /* requested addr */\n" 229 " pushl %eax /* SHM ID */\n" 230 " call shmat\n" 231 " addl $12, %esp\n" 232 "\n" 233 " cmpl $-1, %eax\n" 234 " je __afl_setup_abort\n" 235 "\n" 236 " /* Store the address of the SHM region. */\n" 237 "\n" 238 " movl %eax, __afl_area_ptr\n" 239 " movl %eax, %edx\n" 240 "\n" 241 " popl %ecx\n" 242 " popl %eax\n" 243 "\n" 244 "__afl_forkserver:\n" 245 "\n" 246 " /* Enter the fork server mode to avoid the overhead of execve() calls. */\n" 247 "\n" 248 " pushl %eax\n" 249 " pushl %ecx\n" 250 " pushl %edx\n" 251 "\n" 252 " /* Phone home and tell the parent that we're OK. (Note that signals with\n" 253 " no SA_RESTART will mess it up). If this fails, assume that the fd is\n" 254 " closed because we were execve()d from an instrumented binary, or because\n" 255 " the parent doesn't want to use the fork server. */\n" 256 "\n" 257 " pushl $4 /* length */\n" 258 " pushl $__afl_temp /* data */\n" 259 " pushl $" STRINGIFY((FORKSRV_FD + 1)) " /* file desc */\n" 260 " call write\n" 261 " addl $12, %esp\n" 262 "\n" 263 " cmpl $4, %eax\n" 264 " jne __afl_fork_resume\n" 265 "\n" 266 "__afl_fork_wait_loop:\n" 267 "\n" 268 " /* Wait for parent by reading from the pipe. Abort if read fails. */\n" 269 "\n" 270 " pushl $4 /* length */\n" 271 " pushl $__afl_temp /* data */\n" 272 " pushl $" STRINGIFY(FORKSRV_FD) " /* file desc */\n" 273 " call read\n" 274 " addl $12, %esp\n" 275 "\n" 276 " cmpl $4, %eax\n" 277 " jne __afl_die\n" 278 "\n" 279 " /* Once woken up, create a clone of our process. This is an excellent use\n" 280 " case for syscall(__NR_clone, 0, CLONE_PARENT), but glibc boneheadedly\n" 281 " caches getpid() results and offers no way to update the value, breaking\n" 282 " abort(), raise(), and a bunch of other things :-( */\n" 283 "\n" 284 " call fork\n" 285 "\n" 286 " cmpl $0, %eax\n" 287 " jl __afl_die\n" 288 " je __afl_fork_resume\n" 289 "\n" 290 " /* In parent process: write PID to pipe, then wait for child. */\n" 291 "\n" 292 " movl %eax, __afl_fork_pid\n" 293 "\n" 294 " pushl $4 /* length */\n" 295 " pushl $__afl_fork_pid /* data */\n" 296 " pushl $" STRINGIFY((FORKSRV_FD + 1)) " /* file desc */\n" 297 " call write\n" 298 " addl $12, %esp\n" 299 "\n" 300 " pushl $0 /* no flags */\n" 301 " pushl $__afl_temp /* status */\n" 302 " pushl __afl_fork_pid /* PID */\n" 303 " call waitpid\n" 304 " addl $12, %esp\n" 305 "\n" 306 " cmpl $0, %eax\n" 307 " jle __afl_die\n" 308 "\n" 309 " /* Relay wait status to pipe, then loop back. */\n" 310 "\n" 311 " pushl $4 /* length */\n" 312 " pushl $__afl_temp /* data */\n" 313 " pushl $" STRINGIFY((FORKSRV_FD + 1)) " /* file desc */\n" 314 " call write\n" 315 " addl $12, %esp\n" 316 "\n" 317 " jmp __afl_fork_wait_loop\n" 318 "\n" 319 "__afl_fork_resume:\n" 320 "\n" 321 " /* In child process: close fds, resume execution. */\n" 322 "\n" 323 " pushl $" STRINGIFY(FORKSRV_FD) "\n" 324 " call close\n" 325 "\n" 326 " pushl $" STRINGIFY((FORKSRV_FD + 1)) "\n" 327 " call close\n" 328 "\n" 329 " addl $8, %esp\n" 330 "\n" 331 " popl %edx\n" 332 " popl %ecx\n" 333 " popl %eax\n" 334 " jmp __afl_store\n" 335 "\n" 336 "__afl_die:\n" 337 "\n" 338 " xorl %eax, %eax\n" 339 " call _exit\n" 340 "\n" 341 "__afl_setup_abort:\n" 342 "\n" 343 " /* Record setup failure so that we don't keep calling\n" 344 " shmget() / shmat() over and over again. */\n" 345 "\n" 346 " incb __afl_setup_failure\n" 347 " popl %ecx\n" 348 " popl %eax\n" 349 " jmp __afl_return\n" 350 "\n" 351 ".AFL_VARS:\n" 352 "\n" 353 " .comm __afl_area_ptr, 4, 32\n" 354 " .comm __afl_setup_failure, 1, 32\n" 355 #ifndef COVERAGE_ONLY 356 " .comm __afl_prev_loc, 4, 32\n" 357 #endif /* !COVERAGE_ONLY */ 358 " .comm __afl_fork_pid, 4, 32\n" 359 " .comm __afl_temp, 4, 32\n" 360 "\n" 361 ".AFL_SHM_ENV:\n" 362 " .asciz \"" SHM_ENV_VAR "\"\n" 363 "\n" 364 "/* --- END --- */\n" 365 "\n"; 366 367 /* The OpenBSD hack is due to lahf and sahf not being recognized by some 368 versions of binutils: http://marc.info/?l=openbsd-cvs&m=141636589924400 369 370 The Apple code is a bit different when calling libc functions because 371 they are doing relocations differently from everybody else. We also need 372 to work around the crash issue with .lcomm and the fact that they don't 373 recognize .string. */ 374 375 #ifdef __APPLE__ 376 # define CALL_L64(str) "call _" str "\n" 377 #else 378 # define CALL_L64(str) "call " str "@PLT\n" 379 #endif /* ^__APPLE__ */ 380 381 static const u8* main_payload_64 = 382 383 "\n" 384 "/* --- AFL MAIN PAYLOAD (64-BIT) --- */\n" 385 "\n" 386 ".text\n" 387 ".att_syntax\n" 388 ".code64\n" 389 ".align 8\n" 390 "\n" 391 "__afl_maybe_log:\n" 392 "\n" 393 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && (__FreeBSD__ < 9)) 394 " .byte 0x9f /* lahf */\n" 395 #else 396 " lahf\n" 397 #endif /* ^__OpenBSD__, etc */ 398 " seto %al\n" 399 "\n" 400 " /* Check if SHM region is already mapped. */\n" 401 "\n" 402 " movq __afl_area_ptr(%rip), %rdx\n" 403 " testq %rdx, %rdx\n" 404 " je __afl_setup\n" 405 "\n" 406 "__afl_store:\n" 407 "\n" 408 " /* Calculate and store hit for the code location specified in rcx. */\n" 409 "\n" 410 #ifndef COVERAGE_ONLY 411 " xorq __afl_prev_loc(%rip), %rcx\n" 412 " xorq %rcx, __afl_prev_loc(%rip)\n" 413 " shrq $1, __afl_prev_loc(%rip)\n" 414 #endif /* ^!COVERAGE_ONLY */ 415 "\n" 416 #ifdef SKIP_COUNTS 417 " orb $1, (%rdx, %rcx, 1)\n" 418 #else 419 " incb (%rdx, %rcx, 1)\n" 420 #endif /* ^SKIP_COUNTS */ 421 "\n" 422 "__afl_return:\n" 423 "\n" 424 " addb $127, %al\n" 425 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && (__FreeBSD__ < 9)) 426 " .byte 0x9e /* sahf */\n" 427 #else 428 " sahf\n" 429 #endif /* ^__OpenBSD__, etc */ 430 " ret\n" 431 "\n" 432 ".align 8\n" 433 "\n" 434 "__afl_setup:\n" 435 "\n" 436 " /* Do not retry setup if we had previous failures. */\n" 437 "\n" 438 " cmpb $0, __afl_setup_failure(%rip)\n" 439 " jne __afl_return\n" 440 "\n" 441 " /* Check out if we have a global pointer on file. */\n" 442 "\n" 443 #ifndef __APPLE__ 444 " movq __afl_global_area_ptr@GOTPCREL(%rip), %rdx\n" 445 " movq (%rdx), %rdx\n" 446 #else 447 " movq __afl_global_area_ptr(%rip), %rdx\n" 448 #endif /* !^__APPLE__ */ 449 " testq %rdx, %rdx\n" 450 " je __afl_setup_first\n" 451 "\n" 452 " movq %rdx, __afl_area_ptr(%rip)\n" 453 " jmp __afl_store\n" 454 "\n" 455 "__afl_setup_first:\n" 456 "\n" 457 " /* Save everything that is not yet saved and that may be touched by\n" 458 " getenv() and several other libcalls we'll be relying on. */\n" 459 "\n" 460 " leaq -352(%rsp), %rsp\n" 461 "\n" 462 " movq %rax, 0(%rsp)\n" 463 " movq %rcx, 8(%rsp)\n" 464 " movq %rdi, 16(%rsp)\n" 465 " movq %rsi, 32(%rsp)\n" 466 " movq %r8, 40(%rsp)\n" 467 " movq %r9, 48(%rsp)\n" 468 " movq %r10, 56(%rsp)\n" 469 " movq %r11, 64(%rsp)\n" 470 "\n" 471 " movq %xmm0, 96(%rsp)\n" 472 " movq %xmm1, 112(%rsp)\n" 473 " movq %xmm2, 128(%rsp)\n" 474 " movq %xmm3, 144(%rsp)\n" 475 " movq %xmm4, 160(%rsp)\n" 476 " movq %xmm5, 176(%rsp)\n" 477 " movq %xmm6, 192(%rsp)\n" 478 " movq %xmm7, 208(%rsp)\n" 479 " movq %xmm8, 224(%rsp)\n" 480 " movq %xmm9, 240(%rsp)\n" 481 " movq %xmm10, 256(%rsp)\n" 482 " movq %xmm11, 272(%rsp)\n" 483 " movq %xmm12, 288(%rsp)\n" 484 " movq %xmm13, 304(%rsp)\n" 485 " movq %xmm14, 320(%rsp)\n" 486 " movq %xmm15, 336(%rsp)\n" 487 "\n" 488 " /* Map SHM, jumping to __afl_setup_abort if something goes wrong. */\n" 489 "\n" 490 " /* The 64-bit ABI requires 16-byte stack alignment. We'll keep the\n" 491 " original stack ptr in the callee-saved r12. */\n" 492 "\n" 493 " pushq %r12\n" 494 " movq %rsp, %r12\n" 495 " subq $16, %rsp\n" 496 " andq $0xfffffffffffffff0, %rsp\n" 497 "\n" 498 " leaq .AFL_SHM_ENV(%rip), %rdi\n" 499 CALL_L64("getenv") 500 "\n" 501 " testq %rax, %rax\n" 502 " je __afl_setup_abort\n" 503 "\n" 504 " movq %rax, %rdi\n" 505 CALL_L64("atoi") 506 "\n" 507 " xorq %rdx, %rdx /* shmat flags */\n" 508 " xorq %rsi, %rsi /* requested addr */\n" 509 " movq %rax, %rdi /* SHM ID */\n" 510 CALL_L64("shmat") 511 "\n" 512 " cmpq $-1, %rax\n" 513 " je __afl_setup_abort\n" 514 "\n" 515 " /* Store the address of the SHM region. */\n" 516 "\n" 517 " movq %rax, %rdx\n" 518 " movq %rax, __afl_area_ptr(%rip)\n" 519 "\n" 520 #ifdef __APPLE__ 521 " movq %rax, __afl_global_area_ptr(%rip)\n" 522 #else 523 " movq __afl_global_area_ptr@GOTPCREL(%rip), %rdx\n" 524 " movq %rax, (%rdx)\n" 525 #endif /* ^__APPLE__ */ 526 " movq %rax, %rdx\n" 527 "\n" 528 "__afl_forkserver:\n" 529 "\n" 530 " /* Enter the fork server mode to avoid the overhead of execve() calls. We\n" 531 " push rdx (area ptr) twice to keep stack alignment neat. */\n" 532 "\n" 533 " pushq %rdx\n" 534 " pushq %rdx\n" 535 "\n" 536 " /* Phone home and tell the parent that we're OK. (Note that signals with\n" 537 " no SA_RESTART will mess it up). If this fails, assume that the fd is\n" 538 " closed because we were execve()d from an instrumented binary, or because\n" 539 " the parent doesn't want to use the fork server. */\n" 540 "\n" 541 " movq $4, %rdx /* length */\n" 542 " leaq __afl_temp(%rip), %rsi /* data */\n" 543 " movq $" STRINGIFY((FORKSRV_FD + 1)) ", %rdi /* file desc */\n" 544 CALL_L64("write") 545 "\n" 546 " cmpq $4, %rax\n" 547 " jne __afl_fork_resume\n" 548 "\n" 549 "__afl_fork_wait_loop:\n" 550 "\n" 551 " /* Wait for parent by reading from the pipe. Abort if read fails. */\n" 552 "\n" 553 " movq $4, %rdx /* length */\n" 554 " leaq __afl_temp(%rip), %rsi /* data */\n" 555 " movq $" STRINGIFY(FORKSRV_FD) ", %rdi /* file desc */\n" 556 CALL_L64("read") 557 " cmpq $4, %rax\n" 558 " jne __afl_die\n" 559 "\n" 560 " /* Once woken up, create a clone of our process. This is an excellent use\n" 561 " case for syscall(__NR_clone, 0, CLONE_PARENT), but glibc boneheadedly\n" 562 " caches getpid() results and offers no way to update the value, breaking\n" 563 " abort(), raise(), and a bunch of other things :-( */\n" 564 "\n" 565 CALL_L64("fork") 566 " cmpq $0, %rax\n" 567 " jl __afl_die\n" 568 " je __afl_fork_resume\n" 569 "\n" 570 " /* In parent process: write PID to pipe, then wait for child. */\n" 571 "\n" 572 " movl %eax, __afl_fork_pid(%rip)\n" 573 "\n" 574 " movq $4, %rdx /* length */\n" 575 " leaq __afl_fork_pid(%rip), %rsi /* data */\n" 576 " movq $" STRINGIFY((FORKSRV_FD + 1)) ", %rdi /* file desc */\n" 577 CALL_L64("write") 578 "\n" 579 " movq $0, %rdx /* no flags */\n" 580 " leaq __afl_temp(%rip), %rsi /* status */\n" 581 " movq __afl_fork_pid(%rip), %rdi /* PID */\n" 582 CALL_L64("waitpid") 583 " cmpq $0, %rax\n" 584 " jle __afl_die\n" 585 "\n" 586 " /* Relay wait status to pipe, then loop back. */\n" 587 "\n" 588 " movq $4, %rdx /* length */\n" 589 " leaq __afl_temp(%rip), %rsi /* data */\n" 590 " movq $" STRINGIFY((FORKSRV_FD + 1)) ", %rdi /* file desc */\n" 591 CALL_L64("write") 592 "\n" 593 " jmp __afl_fork_wait_loop\n" 594 "\n" 595 "__afl_fork_resume:\n" 596 "\n" 597 " /* In child process: close fds, resume execution. */\n" 598 "\n" 599 " movq $" STRINGIFY(FORKSRV_FD) ", %rdi\n" 600 CALL_L64("close") 601 "\n" 602 " movq $" STRINGIFY((FORKSRV_FD + 1)) ", %rdi\n" 603 CALL_L64("close") 604 "\n" 605 " popq %rdx\n" 606 " popq %rdx\n" 607 "\n" 608 " movq %r12, %rsp\n" 609 " popq %r12\n" 610 "\n" 611 " movq 0(%rsp), %rax\n" 612 " movq 8(%rsp), %rcx\n" 613 " movq 16(%rsp), %rdi\n" 614 " movq 32(%rsp), %rsi\n" 615 " movq 40(%rsp), %r8\n" 616 " movq 48(%rsp), %r9\n" 617 " movq 56(%rsp), %r10\n" 618 " movq 64(%rsp), %r11\n" 619 "\n" 620 " movq 96(%rsp), %xmm0\n" 621 " movq 112(%rsp), %xmm1\n" 622 " movq 128(%rsp), %xmm2\n" 623 " movq 144(%rsp), %xmm3\n" 624 " movq 160(%rsp), %xmm4\n" 625 " movq 176(%rsp), %xmm5\n" 626 " movq 192(%rsp), %xmm6\n" 627 " movq 208(%rsp), %xmm7\n" 628 " movq 224(%rsp), %xmm8\n" 629 " movq 240(%rsp), %xmm9\n" 630 " movq 256(%rsp), %xmm10\n" 631 " movq 272(%rsp), %xmm11\n" 632 " movq 288(%rsp), %xmm12\n" 633 " movq 304(%rsp), %xmm13\n" 634 " movq 320(%rsp), %xmm14\n" 635 " movq 336(%rsp), %xmm15\n" 636 "\n" 637 " leaq 352(%rsp), %rsp\n" 638 "\n" 639 " jmp __afl_store\n" 640 "\n" 641 "__afl_die:\n" 642 "\n" 643 " xorq %rax, %rax\n" 644 CALL_L64("_exit") 645 "\n" 646 "__afl_setup_abort:\n" 647 "\n" 648 " /* Record setup failure so that we don't keep calling\n" 649 " shmget() / shmat() over and over again. */\n" 650 "\n" 651 " incb __afl_setup_failure(%rip)\n" 652 "\n" 653 " movq %r12, %rsp\n" 654 " popq %r12\n" 655 "\n" 656 " movq 0(%rsp), %rax\n" 657 " movq 8(%rsp), %rcx\n" 658 " movq 16(%rsp), %rdi\n" 659 " movq 32(%rsp), %rsi\n" 660 " movq 40(%rsp), %r8\n" 661 " movq 48(%rsp), %r9\n" 662 " movq 56(%rsp), %r10\n" 663 " movq 64(%rsp), %r11\n" 664 "\n" 665 " movq 96(%rsp), %xmm0\n" 666 " movq 112(%rsp), %xmm1\n" 667 " movq 128(%rsp), %xmm2\n" 668 " movq 144(%rsp), %xmm3\n" 669 " movq 160(%rsp), %xmm4\n" 670 " movq 176(%rsp), %xmm5\n" 671 " movq 192(%rsp), %xmm6\n" 672 " movq 208(%rsp), %xmm7\n" 673 " movq 224(%rsp), %xmm8\n" 674 " movq 240(%rsp), %xmm9\n" 675 " movq 256(%rsp), %xmm10\n" 676 " movq 272(%rsp), %xmm11\n" 677 " movq 288(%rsp), %xmm12\n" 678 " movq 304(%rsp), %xmm13\n" 679 " movq 320(%rsp), %xmm14\n" 680 " movq 336(%rsp), %xmm15\n" 681 "\n" 682 " leaq 352(%rsp), %rsp\n" 683 "\n" 684 " jmp __afl_return\n" 685 "\n" 686 ".AFL_VARS:\n" 687 "\n" 688 689 #ifdef __APPLE__ 690 691 " .comm __afl_area_ptr, 8\n" 692 #ifndef COVERAGE_ONLY 693 " .comm __afl_prev_loc, 8\n" 694 #endif /* !COVERAGE_ONLY */ 695 " .comm __afl_fork_pid, 4\n" 696 " .comm __afl_temp, 4\n" 697 " .comm __afl_setup_failure, 1\n" 698 699 #else 700 701 " .lcomm __afl_area_ptr, 8\n" 702 #ifndef COVERAGE_ONLY 703 " .lcomm __afl_prev_loc, 8\n" 704 #endif /* !COVERAGE_ONLY */ 705 " .lcomm __afl_fork_pid, 4\n" 706 " .lcomm __afl_temp, 4\n" 707 " .lcomm __afl_setup_failure, 1\n" 708 709 #endif /* ^__APPLE__ */ 710 711 " .comm __afl_global_area_ptr, 8, 8\n" 712 "\n" 713 ".AFL_SHM_ENV:\n" 714 " .asciz \"" SHM_ENV_VAR "\"\n" 715 "\n" 716 "/* --- END --- */\n" 717 "\n"; 718 719 #endif /* !_HAVE_AFL_AS_H */ 720