def twitter_init(): try: config_settings["twitter_creds_file"] = os.path.abspath( os.path.expanduser(config_settings["twitter_creds_file"]) ) if not os.path.exists(config_settings["twitter_creds_file"]): twitter.oauth_dance( "fuzzer_stats", config_settings["twitter_consumer_key"], config_settings["twitter_consumer_secret"], config_settings["twitter_creds_file"], ) oauth_token, oauth_secret = twitter.read_token_file(config_settings["twitter_creds_file"]) twitter_instance = twitter.Twitter( auth=twitter.OAuth( oauth_token, oauth_secret, config_settings["twitter_consumer_key"], config_settings["twitter_consumer_secret"], ) ) return twitter_instance except (twitter.TwitterHTTPError, URLError): print_err("Network error, twitter login failed! Check your connection!") sys.exit(1)
def __invoke_rsync(self, rsync_cmdline): ret = True try: subprocess.check_call(' '.join(rsync_cmdline), shell=True) except subprocess.CalledProcessError as e: print_err('rsync failed with exit code {}'.format(e.returncode)) ret = False return ret
def build_target_cmd(conf_settings): target_cmd = [conf_settings["target"], conf_settings["cmdline"]] target_cmd = " ".join(target_cmd).split() target_cmd[0] = os.path.abspath(os.path.expanduser(target_cmd[0])) if not os.path.exists(target_cmd[0]): print_err("Target binary not found!") sys.exit(1) target_cmd = " ".join(target_cmd) return target_cmd
def main(argv): show_info() parser = argparse.ArgumentParser(description='afl-sync synchronizes fuzzer state directories between different \ locations. Supported are remote transfers through rsync that may use transport compression.', usage='afl-sync [-S SESSION] <cmd> <src_sync_dir> <dst_storage_dir>') parser.add_argument('cmd', help='Command to perform: push, pull or sync. Push transmits the local state from ' '<src_sync_dir> to the destination <dst_storage_dir>. Pull fetches remote state(s) into ' 'the local synchronization dir appending the \'.sync\' extension. Sync performs a ' 'pull operation followed by a push.') parser.add_argument('src_sync_dir', help='Source afl synchronisation directory containing state directories of afl instances.') parser.add_argument('dst_storage_dir', help='Destination directory used as fuzzer state storage. This shouldn\'t be an afl sync dir!') parser.add_argument('-S', '--session', dest='session', default=None, help='Name of an afl-multicore session. If provided, only fuzzers belonging to ' 'the specified session will be synced with the destination. Otherwise state ' 'directories of all fuzzers inside the synchronisation dir will be exchanged. ' 'Directories ending on \'.sync\' will never be pushed back to the destination!') args = parser.parse_args(argv[1:]) args.cmd = args.cmd.lower() if not args.cmd in ['push', 'pull', 'sync']: print_err('Sorry, unknown command requested!') sys.exit(1) if not os.path.exists(args.src_sync_dir): if args.cmd in ['pull', 'sync']: print_warn('Local afl sync dir does not exist! Will create it for you!') os.makedirs(args.src_sync_dir) else: print_err('Local afl sync dir does not exist!') sys.exit(1) server_config = { 'remote_path': args.dst_storage_dir, } fuzzer_config = { 'sync_dir': args.src_sync_dir, 'session': args.session, 'exclude_crashes': False, 'exclude_hangs': False, } rsyncEngine = AflRsync(server_config, fuzzer_config) if args.cmd == 'push': rsyncEngine.push() elif args.cmd == 'pull': rsyncEngine.pull() elif args.cmd == 'sync': rsyncEngine.sync()
def read_config(config_file): config_file = os.path.abspath(os.path.expanduser(config_file)) if not os.path.isfile(config_file): print_err("Config file not found!") sys.exit(1) with open(config_file, 'r') as raw_config: config = json.load(raw_config) return config
def generate_sample_list(list_filename, files_collected): list_filename = os.path.abspath(os.path.expanduser(list_filename)) try: fd = open(list_filename, "w") for f in files_collected: fd.writelines("%s\n" % f) fd.close() except (FileExistsError, PermissionError): print_err("Could not create file list '%s'!" % list_filename)
def generate_gdb_exploitable_script(script_filename, sample_index, target_cmd, script_id=0, intermediate=False): target_cmd = target_cmd.split() gdb_target_binary = target_cmd[0] gdb_run_cmd = " ".join(target_cmd[1:]) if not intermediate: script_filename = os.path.abspath(os.path.expanduser(script_filename)) print_ok( "Generating final gdb+exploitable script '%s' for %d samples..." % (script_filename, len(sample_index.outputs())) ) else: script_filename = os.path.abspath(os.path.expanduser("%s.%d" % (script_filename, script_id))) print_ok( "Generating intermediate gdb+exploitable script '%s' for %d samples..." % (script_filename, len(sample_index.outputs())) ) try: fd = open(script_filename, "w") # <script header> # source exploitable.py if necessary if gdb_exploitable_path: fd.writelines("source %s\n" % gdb_exploitable_path) # load executable fd.writelines("file %s\n" % gdb_target_binary) # </script_header> # fill script with content for f in sample_index.index: fd.writelines("echo Crash\ sample:\ '%s'\\n\n" % f["output"]) if not stdin_mode(target_cmd): run_cmd = "run " + gdb_run_cmd + "\n" else: run_cmd = "run " + gdb_run_cmd + "< @@" + "\n" if intermediate: run_cmd = run_cmd.replace("@@", f["input"]) else: run_cmd = run_cmd.replace("@@", os.path.join(sample_index.output_dir, f["output"])) fd.writelines(run_cmd) fd.writelines("exploitable\n") # <script_footer> fd.writelines("quit") # </script_footer> fd.close() except (FileExistsError, PermissionError): print_err("Could not open script file '%s' for writing!" % script_filename)
def fetch_stats(config_settings, twitter_inst): doExit = False # { 'fuzzer_dir': (stat, old_stat) } stat_dict = dict() while not doExit: try: for fuzzer in config_settings["fuzz_dirs"]: stats = load_stats(fuzzer) if not stats: continue sum_stats = summarize_stats(stats) try: # stat_dict has already been initialized for fuzzer # old_stat <- last_stat old_stats = stat_dict[fuzzer][0].copy() except KeyError: # stat_dict has not yet been initialized for fuzzer # old_stat <- cur_stat old_stats = sum_stats.copy() # initialize/update stat_dict stat_dict[fuzzer] = (sum_stats, old_stats) stat_change = diff_stats(sum_stats, old_stats) if not diff_stats: continue print(prettify_stat(sum_stats, stat_change, True)) tweet = prettify_stat(sum_stats, stat_change, False) l = len(tweet) c = clr.LRD if l > 140 else clr.LGN print_ok("Tweeting status (%s%d" % (c, l) + clr.RST + " chars)...") try: twitter_inst.statuses.update(status=shorten_tweet(tweet)) except (twitter.TwitterHTTPError, URLError): print_warn("Problem connecting to Twitter! Tweet not sent!") except Exception as e: print_err("Sending tweet failed (Reason: " + clr.GRA + "%s" % e.__cause__ + clr.RST + ")") if float(config_settings["interval"]) < 0: doExit = True else: time.sleep(float(config_settings["interval"]) * 60) except KeyboardInterrupt: print("\b\b") print_ok("Aborted by user. Good bye!") doExit = True
def generate_sample_list(list_filename, files_collected): list_filename = os.path.abspath(os.path.expanduser(list_filename)) fd = open(list_filename, "w") if not fd: print_err("Could not create file list '%s'!" % list_filename) return for f in files_collected: fd.writelines("%s\n" % f) fd.close()
def kill_session(session): if os.path.isfile("/tmp/afl_multicore.PGID.%s" % session): f = open("/tmp/afl_multicore.PGID.%s" % session) pgids = f.readlines() for pgid in pgids: try: print_ok("Killing jobs with PGID %s" % pgid.strip("\r\n")) os.killpg(int(pgid), signal.SIGTERM) except ProcessLookupError: print_warn("No processes with PGID %s found!" % (pgid.strip("\r\n"))) f.close() os.remove("/tmp/afl_multicore.PGID.%s" % session) else: print_err("PGID file '/tmp/afl_multicore.PGID.%s' not found! Aborting!" % session)
def fetch_stats(config_settings, twitter_inst): stat_dict = dict() for fuzzer in config_settings['fuzz_dirs']: stats = load_stats(fuzzer) if not stats: continue sum_stats = summarize_stats(stats) try: with open('.afl_stats.{}'.format(os.path.basename(fuzzer)), 'r') as f: old_stats = json.load(f) except FileNotFoundError: old_stats = sum_stats.copy() # initialize/update stat_dict stat_dict[fuzzer] = (sum_stats, old_stats) stat_change = diff_stats(sum_stats, old_stats) with open('.afl_stats.{}'.format(os.path.basename(fuzzer)), 'w') as f: json.dump(sum_stats, f) print(prettify_stat(sum_stats, stat_change, True)) tweet = prettify_stat(sum_stats, stat_change, False) l = len(tweet) c = clr.LRD if l > 140 else clr.LGN print_ok("Tweeting status (%s%d" % (c, l) + clr.RST + " chars)...") try: twitter_inst.statuses.update(status=shorten_tweet(tweet)) except (twitter.TwitterHTTPError, URLError): print_warn("Problem connecting to Twitter! Tweet not sent!") except Exception as e: print_err("Sending tweet failed (Reason: " + clr.GRA + "%s" % e.__cause__ + clr.RST + ")")
def read_config(config_file): global config_settings try: config_file = os.path.abspath(os.path.expanduser(config_file)) if not os.path.isfile(config_file): print_err("Config file not found!") sys.exit(1) config = ConfigParser() config.read(config_file) except (MissingSectionHeaderError, UnicodeDecodeError): print_err("No valid configuration file specified!") sys.exit(1) try: config_settings["interval"] = config.get("core", "interval", raw=True) config_settings["twitter_consumer_key"] = config.get("twitter", "consumer_key", raw=True) config_settings["twitter_consumer_secret"] = config.get("twitter", "consumer_secret", raw=True) config_settings["twitter_creds_file"] = config.get("twitter", "credentials_file", raw=True) except NoSectionError as e: print_err( "No valid configuration file specified! Section '" + clr.GRA + "%s" % e.section + clr.RST + "' not found!" ) sys.exit(1) except NoOptionError as e: print_err( "No valid configuration file specified! Option '" + clr.GRA + "%s.%s" % (e.section, e.option) + clr.RST + "' not found!" ) sys.exit(1) exists = True i = 0 while exists: try: config_settings["fuzz_dirs"].append(config.get("fuzzers", str(i), raw=True)) i += 1 except NoOptionError: exists = False return config_settings
def main(argv): show_info() parser = argparse.ArgumentParser( description= 'afl-sync synchronizes fuzzer state directories between different \ locations. Supported are remote transfers through rsync that may use transport compression.', usage='afl-sync [-S SESSION] <cmd> <src_sync_dir> <dst_storage_dir>') parser.add_argument( 'cmd', help= 'Command to perform: push, pull or sync. Push transmits the local state from ' '<src_sync_dir> to the destination <dst_storage_dir>. Pull fetches remote state(s) into ' 'the local synchronization dir appending the \'.sync\' extension. Sync performs a ' 'pull operation followed by a push.') parser.add_argument( 'src_sync_dir', help= 'Source afl synchronisation directory containing state directories of afl instances.' ) parser.add_argument( 'dst_storage_dir', help= 'Destination directory used as fuzzer state storage. This shouldn\'t be an afl sync dir!' ) parser.add_argument( '-S', '--session', dest='session', default=None, help= 'Name of an afl-multicore session. If provided, only fuzzers belonging to ' 'the specified session will be synced with the destination. Otherwise state ' 'directories of all fuzzers inside the synchronisation dir will be exchanged. ' 'Directories ending on \'.sync\' will never be pushed back to the destination!' ) args = parser.parse_args(argv[1:]) args.cmd = args.cmd.lower() if not args.cmd in ['push', 'pull', 'sync']: print_err('Sorry, unknown command requested!') sys.exit(1) if not os.path.exists(args.src_sync_dir): if args.cmd in ['pull', 'sync']: print_warn( 'Local afl sync dir does not exist! Will create it for you!') os.makedirs(args.src_sync_dir) else: print_err('Local afl sync dir does not exist!') sys.exit(1) server_config = { 'remote_path': args.dst_storage_dir, } fuzzer_config = { 'sync_dir': args.src_sync_dir, 'session': args.session, 'exclude_crashes': False, 'exclude_hangs': False, } rsyncEngine = AflRsync(server_config, fuzzer_config) if args.cmd == 'push': rsyncEngine.push() elif args.cmd == 'pull': rsyncEngine.pull() elif args.cmd == 'sync': rsyncEngine.sync()
def main(argv): show_info() parser = argparse.ArgumentParser(description="afl-multicore starts several parallel fuzzing jobs, that are run \ in the background. For fuzzer stats see 'out_dir/SESSION###/fuzzer_stats'!", usage="afl-multicore [-c config] [-h] [-s secs] [-t] [-v] <cmd> <jobs>") parser.add_argument("-c", "--config", dest="config_file", help="afl-multicore config file (Default: afl-multicore.conf)!", default="afl-multicore.conf") parser.add_argument("-s", "--startup-delay", dest="startup_delay", default=None, help="Wait a configurable amount \ of time after starting/resuming each afl instance to avoid interference during fuzzer startup. Provide wait time in \ seconds.") parser.add_argument("-t", "--test", dest="test_run", action="store_const", const=True, default=False, help="Perform \ a test run by starting a single afl instance in interactive mode using a test output directory.") parser.add_argument("-v", "--verbose", dest="verbose", action="store_const", const=True, default=False, help="For debugging purposes do not redirect stderr/stdout of the created \ subprocesses to /dev/null (Default: off). Check 'nohup.out' for further outputs.") parser.add_argument("cmd", help="afl-multicore command to execute: start, resume, add.") parser.add_argument("jobs", help="Number of instances to start/resume/add.") args = parser.parse_args(argv[1:]) conf_settings = read_config(os.path.abspath(os.path.expanduser(args.config_file))) if args.test_run: signal.signal(signal.SIGINT, sigint_handler) conf_settings["output"] += "_test" conf_settings["interactive"] = False args.jobs = 1 args.cmd = "start" if args.cmd != "resume": conf_settings["input"] = os.path.abspath(os.path.expanduser(conf_settings["input"])) if not os.path.exists(conf_settings["input"]): print_err("No valid directory provided for <INPUT_DIR>!") sys.exit(1) else: conf_settings["input"] = "-" conf_settings["output"] = os.path.abspath(os.path.expanduser(conf_settings["output"])) slave_off, slave_start = get_slave_count(args.cmd, conf_settings) if "interactive" in conf_settings and conf_settings["interactive"]: if not check_screen(): print_err("When using screen mode, please run afl-multicore from inside a screen session!") sys.exit(1) if "environment" in conf_settings: setup_screen(int(args.jobs), conf_settings["environment"]) else: setup_screen(int(args.jobs), []) target_cmd = build_target_cmd(conf_settings) master_cmd = build_master_cmd(conf_settings, target_cmd) if args.test_run: with subprocess.Popen(master_cmd.split()) as test_proc: print_ok("Test instance started (PID: %d)" % test_proc.pid) if "slave_only" not in conf_settings or ("slave_only" in conf_settings and not conf_settings["slave_only"]): print_ok("Starting master instance...") if "interactive" in conf_settings and conf_settings["interactive"]: subprocess.Popen("screen -X select 1".split()) screen_cmd = ["screen", "-X", "eval", "exec %s" % master_cmd, "next"] subprocess.Popen(screen_cmd) print(" Master 000 started inside new screen window") else: if not args.verbose: master = subprocess.Popen(" ".join(['nohup', master_cmd]).split(), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) else: master = subprocess.Popen(" ".join(['nohup', master_cmd]).split()) print(" Master 000 started (PID: %d)" % master.pid) if args.startup_delay is not None: time.sleep(int(args.startup_delay)) print_ok("Starting slave instances...") num_slaves = int(args.jobs)+slave_start-slave_off for i in range(slave_start, num_slaves, 1): slave_cmd = build_slave_cmd(conf_settings, i, target_cmd) if "interactive" in conf_settings and conf_settings["interactive"]: subprocess.Popen(["screen", "-X", "select", "%d" % (i + 1)]) screen_cmd = ["screen", "-X", "eval", "exec %s" % slave_cmd, "next"] subprocess.Popen(screen_cmd) print(" Slave %03d started inside new screen window" % i) else: if not args.verbose: slave = subprocess.Popen(" ".join(['nohup', slave_cmd]).split(), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) else: slave = subprocess.Popen(" ".join(['nohup', slave_cmd]).split()) print(" Slave %03d started (PID: %d)" % (i, slave.pid)) if args.startup_delay is not None and i < (num_slaves-1): time.sleep(int(args.startup_delay)) write_pgid_file(conf_settings)
def generate_gdb_exploitable_script(script_filename, sample_index, target_cmd, script_id=0, intermediate=False, asan_mode=False): target_cmd = target_cmd.split() gdb_target_binary = target_cmd[0] gdb_run_cmd = " ".join(target_cmd[1:]) if not intermediate: script_filename = os.path.abspath(os.path.expanduser(script_filename)) print_ok( "Generating final gdb+exploitable script '%s' for %d samples..." % (script_filename, len(sample_index.outputs()))) else: script_filename = os.path.abspath( os.path.expanduser("%s.%d" % (script_filename, script_id))) print_ok( "Generating intermediate gdb+exploitable script '%s' for %d samples..." % (script_filename, len(sample_index.outputs()))) gdb_exploitable_path = None gdbinit = os.path.expanduser("~/.gdbinit") if not os.path.exists(gdbinit) or b"exploitable.py" not in open( gdbinit, "rb").read(): gdb_exploitable_path = os.path.join(exploitable.__path__[0], "exploitable.py") try: fd = open(script_filename, "w") # <script header> # source exploitable.py if necessary if gdb_exploitable_path: fd.writelines("source %s\n" % gdb_exploitable_path) if asan_mode: fd.writelines("set pagination off\n") fd.writelines("handle SIGSEGV nostop\n") asan_logname = '/tmp/{}.{}'.format( asan_log_tmpstring, ''.join( random.choice(string.ascii_lowercase + string.digits) for _ in range(10))) # load executable fd.writelines("file %s\n" % gdb_target_binary) # </script_header> # fill script with content for f in sample_index.index: fd.writelines("echo Crash\ sample:\ '%s'\\n\n" % f['output']) if not asan_mode: if not stdin_mode(target_cmd): run_cmd = "run " + gdb_run_cmd + "\n" else: run_cmd = "run " + gdb_run_cmd + "< @@" + "\n" else: if not stdin_mode(target_cmd): run_cmd = "run " + gdb_run_cmd + " 2> {}".format( asan_logname) + "\n" else: run_cmd = "run " + gdb_run_cmd + "< @@" + " 2> {}".format( asan_logname) + "\n" if intermediate: run_cmd = run_cmd.replace("@@", "'{}'".format(f['input'])) else: run_cmd = run_cmd.replace( "@@", os.path.join(sample_index.output_dir, "'{}'".format(f['output']))) fd.writelines(run_cmd) if not asan_mode: fd.writelines("exploitable\n") else: fd.writelines("exploitable -a {}\n".format(asan_logname)) # <script_footer> fd.writelines("quit") # </script_footer> fd.close() except (FileExistsError, PermissionError): print_err("Could not open script file '%s' for writing!" % script_filename)
def run(serial_number, cmds): cmd = ['adb', '-s', serial_number] + cmds.split(" ") ret = subprocess.call(' '.join(cmd), shell=True) if ret != 0: print_err("adb command failed to run: %s!" % " ".join(cmd)) sys.exit(1)
def read_config(config_file): try: config_file = os.path.abspath(os.path.expanduser(config_file)) if not os.path.isfile(config_file): print_err("Config file not found!") sys.exit(1) config = ConfigParser() # overwrite optionxform to not convert config file items to lower case config.optionxform = str config.read(config_file) except (MissingSectionHeaderError, UnicodeDecodeError): print_err("No valid configuration file specified!") sys.exit(1) try: conf_settings = dict() # Get required settings conf_settings["input"] = config.get("afl.dirs", "input", raw=True) conf_settings["output"] = config.get("afl.dirs", "output", raw=True) conf_settings["target"] = config.get("target", "target", raw=True) conf_settings["cmdline"] = config.get("target", "cmdline", raw=True) # Get optional settings if config.has_option("afl.ctrl", "file"): conf_settings["file"] = config.get("afl.ctrl", "file", raw=True) else: conf_settings["file"] = None if config.has_option("afl.ctrl", "timeout"): conf_settings["timeout"] = config.get("afl.ctrl", "timeout", raw=True) else: conf_settings["timeout"] = None if config.has_option("afl.ctrl", "afl_margs"): conf_settings["afl_margs"] = config.get("afl.ctrl", "afl_margs", raw=True) else: conf_settings["afl_margs"] = None if config.has_option("afl.ctrl", "mem_limit"): conf_settings["mem_limit"] = config.get("afl.ctrl", "mem_limit", raw=True) else: conf_settings["mem_limit"] = None if config.has_option("afl.ctrl", "qemu"): conf_settings["qemu"] = config.get("afl.ctrl", "qemu", raw=True) else: conf_settings["qemu"] = None if config.has_option("afl.behavior", "dirty"): conf_settings["dirty"] = config.get("afl.behavior", "dirty", raw=True) else: conf_settings["dirty"] = None if config.has_option("afl.behavior", "dumb"): conf_settings["dumb"] = config.get("afl.behavior", "dumb", raw=True) else: conf_settings["dumb"] = None if config.has_option("afl.behavior", "dict"): conf_settings["dict"] = config.get("afl.behavior", "dict", raw=True) else: conf_settings["dict"] = None if config.has_option("job", "session"): conf_settings["session"] = config.get("job", "session", raw=True) else: conf_settings["session"] = "SESSION" if config.has_option("job", "slave_only"): if config.get("job", "slave_only", raw=True) == "on": conf_settings["slave_only"] = True else: conf_settings["slave_only"] = False else: conf_settings["slave_only"] = False if config.has_option("job", "interactive"): if config.get("job", "interactive", raw=True) == "on": conf_settings["interactive"] = True else: conf_settings["interactive"] = False else: conf_settings["interactive"] = False if config.has_section("environment"): environment = [] env_list = config.options("environment") for env in env_list: environment.append((env, config.get("environment", env, raw=True))) else: environment = None except NoOptionError as e: print_err("No valid configuration file specified! Option '" + clr.GRA + "%s.%s" % (e.section, e.option) + clr.RST + "' not found!") sys.exit(1) except NoSectionError as e: print_err("No valid configuration file specified! Section '" + clr.GRA + "%s" % e.section + clr.RST + "' not found!") sys.exit(1) return conf_settings, environment
def main(argv): show_info() parser = argparse.ArgumentParser( description= "afl-minimize performs several optimization steps to reduce the size\n \ of an afl-fuzz corpus.", usage= "afl-minimize [-c COLLECTION_DIR [--cmin [opts]] [--tmin [opts]]] [--reseed]\n \ [-d] [-h] [-j] sync_dir -- target_cmd\n") parser.add_argument( "-c", "--collect", dest="collection_dir", help= "Collect all samples from the synchronisation dir and store them in the collection dir.", default=None) parser.add_argument( "--cmin", dest="invoke_cmin", action="store_const", const=True, default=False, help="Run afl-cmin on collection dir. Has no effect without '-c'.") parser.add_argument("--cmin-mem-limit", dest="cmin_mem_limit", default=None, help="Set memory limit for afl-cmin.") parser.add_argument("--cmin-timeout", dest="cmin_timeout", default=None, help="Set timeout for afl-cmin.") parser.add_argument("--reseed", dest="reseed", default=False, action="store_const", const=True, help="Reseed afl-fuzz with the \ collected (and optimized) corpus. This replaces all sync_dir queues with the newly generated corpus." ) parser.add_argument( "--tmin", dest="invoke_tmin", action="store_const", const=True, default=False, help= "Run afl-tmin on minimized collection dir if used together with '--cmin'\ or on unoptimized collection dir otherwise. Has no effect without '-c'.") parser.add_argument("--tmin-mem-limit", dest="tmin_mem_limit", default=None, help="Set memory limit for afl-tmin.") parser.add_argument("--tmin-timeout", dest="tmin_timeout", default=None, help="Set timeout for afl-tmin.") parser.add_argument( "-d", "--dry-run", dest="dry_run", action="store_const", const=True, default=False, help="Perform dry-run on collection dir, if '-c' is provided or on \ synchronisation dir otherwise. Dry-run will move intermittent crashes out of the corpus." ) parser.add_argument( "-j", "--threads", dest="num_threads", default=1, help= "Enable parallel dry-run and t-minimization step by specifying the number of threads \ afl-minimize will utilize.") parser.add_argument( "sync_dir", help= "afl synchronisation directory containing multiple fuzzers and their queues." ) parser.add_argument( "target_cmd", nargs="+", help="Path to the target binary and its command line arguments. \ Use '@@' to specify crash sample input file position (see afl-fuzz usage).") args = parser.parse_args(argv[1:]) if not args.collection_dir and not args.dry_run: print_err("No operation requested. You should at least provide '-c'") print_err( "for sample collection or '-d' for a dry-run. Use '--help' for") print_err("usage instructions or checkout README.md for details.") return sync_dir = os.path.abspath(os.path.expanduser(args.sync_dir)) if not os.path.exists(sync_dir): print_err("No valid directory provided for <SYNC_DIR>!") return args.target_cmd = " ".join(args.target_cmd).split() args.target_cmd[0] = os.path.abspath(os.path.expanduser( args.target_cmd[0])) if not os.path.exists(args.target_cmd[0]): print_err("Target binary not found!") return args.target_cmd = " ".join(args.target_cmd) threads = int(args.num_threads) if args.collection_dir: out_dir = os.path.abspath(os.path.expanduser(args.collection_dir)) if not os.path.exists(out_dir) or len(os.listdir(out_dir)) == 0: os.makedirs(out_dir, exist_ok=True) print_ok("Looking for fuzzing queues in '%s'." % sync_dir) fuzzers = afl_collect.get_fuzzer_instances(sync_dir, crash_dirs=False) # collect samples from fuzzer queues print_ok("Found %d fuzzers, collecting samples." % len(fuzzers)) sample_index = afl_collect.build_sample_index( sync_dir, out_dir, fuzzers, omit_fuzzer_name=True) print_ok("Successfully indexed %d samples." % len(sample_index.index)) print_ok("Copying %d samples into collection directory..." % len(sample_index.index)) afl_collect.copy_samples(sample_index) else: print_warn("Collection directory exists and is not empty!") print_warn("Skipping collection step...") if args.invoke_cmin: # invoke cmin on collection print_ok("Executing: afl-cmin -i %s -o %s.cmin -- %s" % (out_dir, out_dir, args.target_cmd)) invoke_cmin(out_dir, "%s.cmin" % out_dir, args.target_cmd, mem_limit=args.cmin_mem_limit, timeout=args.cmin_timeout) if args.invoke_tmin: # invoke tmin on minimized collection print_ok( "Executing: afl-tmin -i %s.cmin/* -o %s.cmin.tmin/* -- %s" % (out_dir, out_dir, args.target_cmd)) tmin_num_samples, tmin_samples = afl_collect.get_samples_from_dir( "%s.cmin" % out_dir, abs_path=True) invoke_tmin(tmin_samples, "%s.cmin.tmin" % out_dir, args.target_cmd, num_threads=threads, mem_limit=args.tmin_mem_limit, timeout=args.tmin_timeout) elif args.invoke_tmin: # invoke tmin on collection print_ok("Executing: afl-tmin -i %s/* -o %s.tmin/* -- %s" % (out_dir, out_dir, args.target_cmd)) tmin_num_samples, tmin_samples = afl_collect.get_samples_from_dir( out_dir, abs_path=True) invoke_tmin(tmin_samples, "%s.tmin" % out_dir, args.target_cmd, num_threads=threads, mem_limit=args.tmin_mem_limit, timeout=args.tmin_timeout) if args.dry_run: # invoke dry-run on collected/minimized corpus if args.invoke_cmin and args.invoke_tmin: print_ok("Performing dry-run in %s.cmin.tmin..." % out_dir) print_warn( "Be patient! Depending on the corpus size this step can take hours..." ) dryrun_num_samples, dryrun_samples = afl_collect.get_samples_from_dir( "%s.cmin.tmin" % out_dir, abs_path=True) invoke_dryrun(dryrun_samples, "%s.cmin.tmin.crashes" % out_dir, "%s.cmin.tmin.hangs" % out_dir, args.target_cmd, num_threads=threads) elif args.invoke_cmin: print_ok("Performing dry-run in %s.cmin..." % out_dir) print_warn( "Be patient! Depending on the corpus size this step can take hours..." ) dryrun_num_samples, dryrun_samples = afl_collect.get_samples_from_dir( "%s.cmin" % out_dir, abs_path=True) invoke_dryrun(dryrun_samples, "%s.cmin.crashes" % out_dir, "%s.cmin.hangs" % out_dir, args.target_cmd, num_threads=threads) elif args.invoke_tmin: print_ok("Performing dry-run in %s.tmin..." % out_dir) print_warn( "Be patient! Depending on the corpus size this step can take hours..." ) dryrun_num_samples, dryrun_samples = afl_collect.get_samples_from_dir( "%s.tmin" % out_dir, abs_path=True) invoke_dryrun(dryrun_samples, "%s.tmin.crashes" % out_dir, "%s.tmin.hangs" % out_dir, args.target_cmd, num_threads=threads) else: print_ok("Performing dry-run in %s..." % out_dir) print_warn( "Be patient! Depending on the corpus size this step can take hours..." ) dryrun_num_samples, dryrun_samples = afl_collect.get_samples_from_dir( out_dir, abs_path=True) invoke_dryrun(dryrun_samples, "%s.crashes" % out_dir, "%s.hangs" % out_dir, args.target_cmd, num_threads=threads) elif args.reseed: optimized_corpus = out_dir if args.invoke_cmin: optimized_corpus = optimized_corpus + ".cmin" if args.invoke_tmin: optimized_corpus = optimized_corpus + ".tmin" afl_reseed(sync_dir, optimized_corpus) else: if args.dry_run: print_ok("Looking for fuzzing queues in '%s'." % sync_dir) fuzzers = afl_collect.get_fuzzer_instances(sync_dir, crash_dirs=False) print_ok("Found %d fuzzers, performing dry run." % len(fuzzers)) print_warn( "Be patient! Depending on the corpus size this step can take hours..." ) # invoke dry-run on original corpus for f in fuzzers: for q_dir in f[1]: q_dir_complete = os.path.join(sync_dir, f[0], q_dir) print_ok("Processing %s..." % q_dir_complete) dryrun_num_samples, dryrun_samples = afl_collect.get_samples_from_dir( q_dir_complete, abs_path=True) invoke_dryrun(dryrun_samples, os.path.join(sync_dir, f[0], "crashes"), os.path.join(sync_dir, f[0], "hangs"), args.target_cmd, num_threads=threads)
def read_config(config_file): try: config_file = os.path.abspath(os.path.expanduser(config_file)) if not os.path.isfile(config_file): print_err("Config file not found!") sys.exit(1) config = ConfigParser() # overwrite optionxform to not convert config file items to lower case config.optionxform = str config.read(config_file) except (MissingSectionHeaderError, UnicodeDecodeError): print_err("No valid configuration file specified!") sys.exit(1) try: conf_settings = dict() # Get required settings conf_settings["input"] = config.get("afl.dirs", "input", raw=True) conf_settings["output"] = config.get("afl.dirs", "output", raw=True) conf_settings["target"] = config.get("target", "target", raw=True) conf_settings["cmdline"] = config.get("target", "cmdline", raw=True) # Get optional settings if config.has_option("afl.ctrl", "file"): conf_settings["file"] = config.get("afl.ctrl", "file", raw=True) else: conf_settings["file"] = None if config.has_option("afl.ctrl", "timeout"): conf_settings["timeout"] = config.get("afl.ctrl", "timeout", raw=True) else: conf_settings["timeout"] = None if config.has_option("afl.ctrl", "afl_margs"): conf_settings["afl_margs"] = config.get("afl.ctrl", "afl_margs", raw=True) else: conf_settings["afl_margs"] = None if config.has_option("afl.ctrl", "mem_limit"): conf_settings["mem_limit"] = config.get("afl.ctrl", "mem_limit", raw=True) else: conf_settings["mem_limit"] = None if config.has_option("afl.ctrl", "cpu_affinity"): conf_settings["cpu_affinity"] = config.get("afl.ctrl", "cpu_affinity", raw=True).split() else: conf_settings["cpu_affinity"] = None if config.has_option("afl.ctrl", "qemu"): conf_settings["qemu"] = config.get("afl.ctrl", "qemu", raw=True) else: conf_settings["qemu"] = None if config.has_option("afl.behavior", "dirty"): conf_settings["dirty"] = config.get("afl.behavior", "dirty", raw=True) else: conf_settings["dirty"] = None if config.has_option("afl.behavior", "dumb"): conf_settings["dumb"] = config.get("afl.behavior", "dumb", raw=True) else: conf_settings["dumb"] = None if config.has_option("afl.behavior", "dict"): conf_settings["dict"] = config.get("afl.behavior", "dict", raw=True) else: conf_settings["dict"] = None if config.has_option("job", "session"): conf_settings["session"] = config.get("job", "session", raw=True) else: conf_settings["session"] = "SESSION" if config.has_option("job", "slave_only"): if config.get("job", "slave_only", raw=True) == "on": conf_settings["slave_only"] = True else: conf_settings["slave_only"] = False else: conf_settings["slave_only"] = False if config.has_option("job", "interactive"): if config.get("job", "interactive", raw=True) == "on": conf_settings["interactive"] = True else: conf_settings["interactive"] = False else: conf_settings["interactive"] = False if config.has_section("environment"): environment = [] env_list = config.options("environment") for env in env_list: environment.append( (env, config.get("environment", env, raw=True))) else: environment = None except NoSectionError as e: print_err("No valid configuration file specified! Section '" + clr.GRA + "%s" % e.section + clr.RST + "' not found!") sys.exit(1) except NoOptionError as e: print_err("No valid configuration file specified! Option '" + clr.GRA + "%s.%s" % (e.section, e.option) + clr.RST + "' not found!") sys.exit(1) return conf_settings, environment
def main(argv): show_info() parser = argparse.ArgumentParser(description="afl-multicore starts several parallel fuzzing jobs, that are run \ in the background. For fuzzer stats see 'out_dir/SESSION###/fuzzer_stats'!", usage="afl-multicore [-c config] [-h] [-t] [-v] <cmd> <jobs>") parser.add_argument("-c", "--config", dest="config_file", help="afl-multicore config file (Default: afl-multicore.conf)!", default="afl-multicore.conf") parser.add_argument("-t", "--test", dest="test_run", action="store_const", const=True, default=False, help="Perform \ a test run by starting a single afl instance in interactive mode using a test output directory.") parser.add_argument("-v", "--verbose", dest="verbose", action="store_const", const=True, default=False, help="For debugging purposes do not redirect stderr/stdout of the created \ subprocesses to /dev/null (Default: off). Check 'nohup.out' for further outputs.") parser.add_argument("cmd", help="afl-multicore command to execute: start, resume, add.") parser.add_argument("jobs", help="Number of instances to start/resume/add.") args = parser.parse_args(argv[1:]) conf_settings, environment = read_config(os.path.abspath(os.path.expanduser(args.config_file))) if args.test_run: signal.signal(signal.SIGINT, sigint_handler) conf_settings["output"] += "_test" conf_settings["interactive"] = False args.jobs = 1 args.cmd = "start" if args.cmd != "resume": conf_settings["input"] = os.path.abspath(os.path.expanduser(conf_settings["input"])) if not os.path.exists(conf_settings["input"]): print_err("No valid directory provided for <INPUT_DIR>!") return else: conf_settings["input"] = "-" conf_settings["output"] = os.path.abspath(os.path.expanduser(conf_settings["output"])) if args.cmd == "add": slave_start = 0 slave_off = 0 dirs = os.listdir(conf_settings["output"]) for d in dirs: if os.path.isdir(os.path.abspath(os.path.join(conf_settings["output"], d))) \ and conf_settings["session"] in d: slave_start += 1 conf_settings["slave_only"] = True else: slave_start = 1 slave_off = 1 target_cmd = [conf_settings["target"], conf_settings["cmdline"]] target_cmd = " ".join(target_cmd).split() target_cmd[0] = os.path.abspath(os.path.expanduser(target_cmd[0])) if not os.path.exists(target_cmd[0]): print_err("Target binary not found!") return target_cmd = " ".join(target_cmd) if conf_settings["interactive"]: if not check_screen(): print_err("When using screen mode, please run afl-multicore from inside a screen session!") return setup_screen(int(args.jobs), environment) # compile command-line for master # $ afl-fuzz -i <input_dir> -o <output_dir> -M <session_name>.000 <afl_args> \ # </path/to/target.bin> <target_args> master_cmd = [afl_path] + afl_cmdline_from_config(conf_settings) master_cmd += ["-M", "%s000" % conf_settings["session"], "--", target_cmd] master_cmd = " ".join(master_cmd) if args.test_run: with subprocess.Popen(master_cmd.split()) as test_proc: print_ok("Test instance started (PID: %d)" % test_proc.pid) if not conf_settings["slave_only"]: print_ok("Starting master instance...") if not conf_settings["interactive"]: if not args.verbose: master = subprocess.Popen(" ".join(['nohup', master_cmd]).split(), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) else: master = subprocess.Popen(" ".join(['nohup', master_cmd]).split()) print(" Master 000 started (PID: %d)" % master.pid) else: subprocess.Popen("screen -X select 1".split()) screen_cmd = ["screen", "-X", "eval", "exec %s" % master_cmd, "next"] subprocess.Popen(screen_cmd) print(" Master 000 started inside new screen window") # compile command-line for slaves print_ok("Starting slave instances...") for i in range(slave_start, int(args.jobs)+slave_start-slave_off, 1): # $ afl-fuzz -i <input_dir> -o <output_dir> -S <session_name>.NNN <afl_args> \ # </path/to/target.bin> <target_args> slave_cmd = [afl_path] + afl_cmdline_from_config(conf_settings) slave_cmd += ["-S", "%s%03d" % (conf_settings["session"], i), "--", target_cmd] slave_cmd = " ".join(slave_cmd) if not conf_settings["interactive"]: if not args.verbose: slave = subprocess.Popen(" ".join(['nohup', slave_cmd]).split(), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) else: slave = subprocess.Popen(" ".join(['nohup', slave_cmd]).split()) print(" Slave %03d started (PID: %d)" % (i, slave.pid)) else: subprocess.Popen(["screen", "-X", "select", "%d" % (i+1)]) screen_cmd = ["screen", "-X", "eval", "exec %s" % slave_cmd, "next"] subprocess.Popen(screen_cmd) print(" Slave %03d started inside new screen window" % i) print("") if not conf_settings["interactive"]: # write/append PGID to file /tmp/afl-multicore.PGID.<SESSION> f = open("/tmp/afl_multicore.PGID.%s" % conf_settings["session"], "a") if f.writable(): f.write("%d\n" % os.getpgid(0)) f.close() print_ok("For progress info check: %s/%sxxx/fuzzer_stats!" % (conf_settings["output"], conf_settings["session"])) else: print_ok("Check the newly created screen windows!")
# afl-collect global settings global_crash_subdirs = "crashes" global_queue_subdirs = "queue" global_exclude_files = [ "README.txt", ] fuzzer_stats_filename = "fuzzer_stats" # gdb settings # Path to gdb binary gdb_binary = shutil.which("gdb") if gdb_binary is None: print_err("gdb binary not found!") sys.exit(1) # Path to 'exploitable.py' (https://github.com/rc0r/exploitable) # Set to None if you already source exploitable.py in your .gdbinit file! gdb_exploitable_path = None def show_info(): print(clr.CYA + "afl-collect " + clr.BRI + "%s" % afl_utils.__version__ + clr.RST + " by %s" % afl_utils.__author__) print("Crash sample collection and processing utility for afl-fuzz.") print("") def get_fuzzer_instances(sync_dir, crash_dirs=True): if not os.path.isabs(sync_dir):
def find_fuzzer_binary(fuzzer_bin): afl_path = shutil.which(fuzzer_bin) if afl_path is None: print_err("Fuzzer binary not found!") sys.exit(1) return afl_path
# afl-collect global settings global_crash_subdirs = "crashes" global_queue_subdirs = "queue" global_exclude_files = [ "README.txt", ] fuzzer_stats_filename = "fuzzer_stats" # gdb settings # Path to gdb binary gdb_binary = shutil.which("gdb") if gdb_binary is None: print_err("gdb binary not found!") sys.exit(1) # Path to 'exploitable.py' (https://github.com/rc0r/exploitable) # Set to None if you already source exploitable.py in your .gdbinit file! gdb_exploitable_path = None # afl-collect database table spec db_table_spec = """`Sample` TEXT PRIMARY KEY NOT NULL, `Classification` TEXT NOT NULL, `Classification_Description` TEXT NOT NULL, `Hash` TEXT, `User_Comment` TEXT""" def show_info(): print(clr.CYA + "afl-collect " + clr.BRI + "%s" % afl_utils.__version__ + clr.RST + " by %s" % afl_utils.__author__) print("Crash sample collection and processing utility for afl-fuzz.")
def main(argv): show_info() parser = argparse.ArgumentParser(description="afl-collect copies all crash sample files from an afl sync dir used \ by multiple fuzzers when fuzzing in parallel into a single location providing easy access for further crash analysis.", usage="afl-collect [-d DATABASE] [-e|-g GDB_EXPL_SCRIPT_FILE] [-f LIST_FILENAME]\n \ [-h] [-j THREADS] [-m] [-r] [-rr] sync_dir collection_dir -- target_cmd") parser.add_argument("sync_dir", help="afl synchronisation directory crash samples will be collected from.") parser.add_argument("collection_dir", help="Output directory that will hold a copy of all crash samples and other generated files. \ Existing files in the collection directory will be overwritten!") parser.add_argument("-d", "--database", dest="database_file", help="Submit sample data into an sqlite3 database (\ only when used together with '-e'). afl-collect skips processing of samples already found in existing database.", default=None) parser.add_argument("-e", "--execute-gdb-script", dest="gdb_expl_script_file", help="Generate and execute a gdb+exploitable script after crash sample collection for crash \ classification. (Like option '-g', plus script execution.)", default=None) parser.add_argument("-f", "--filelist", dest="list_filename", default=None, help="Writes all collected crash sample filenames into a file in the collection directory.") parser.add_argument("-g", "--generate-gdb-script", dest="gdb_script_file", help="Generate gdb script to run 'exploitable.py' on all collected crash samples. Generated \ script will be placed into collection directory.", default=None) parser.add_argument("-j", "--threads", dest="num_threads", default=1, help="Enable parallel analysis by specifying the number of threads afl-collect will utilize.") parser.add_argument("-m", "--minimize-filenames", dest="min_filename", action="store_const", const=True, default=False, help="Minimize crash sample file names by only keeping fuzzer name and ID.") parser.add_argument("-r", "--remove-invalid", dest="remove_invalid", action="store_const", const=True, default=False, help="Verify collected crash samples and remove samples that do not lead to \ crashes (runs 'afl-vcrash.py -r' on collection directory). This step is done prior to any script file \ or file list generation/execution.") parser.add_argument("-rr", "--remove-unexploitable", dest="remove_unexploitable", action="store_const", const=True, default=False, help="Remove crash samples that have an exploitable classification of \ 'NOT_EXPLOITABLE' or 'PROBABLY_NOT_EXPLOITABLE'. Sample file removal will take place after gdb+exploitable \ script execution. Has no effect without '-e'.") parser.add_argument("target_cmd", nargs="+", help="Path to the target binary and its command line arguments. \ Use '@@' to specify crash sample input file position (see afl-fuzz usage).") args = parser.parse_args(argv[1:]) sync_dir = os.path.abspath(os.path.expanduser(args.sync_dir)) if not os.path.exists(sync_dir): print_err("No valid directory provided for <SYNC_DIR>!") return if args.collection_dir: out_dir = os.path.abspath(os.path.expanduser(args.collection_dir)) if not os.path.exists(out_dir): os.makedirs(out_dir, exist_ok=True) else: print_err("No valid directory provided for <OUT_DIR>!") return args.target_cmd = " ".join(args.target_cmd).split() args.target_cmd[0] = os.path.abspath(os.path.expanduser(args.target_cmd[0])) if not os.path.exists(args.target_cmd[0]): print_err("Target binary not found!") return args.target_cmd = " ".join(args.target_cmd) if args.database_file: db_file = os.path.abspath(os.path.expanduser(args.database_file)) else: db_file = None print_ok("Going to collect crash samples from '%s'." % sync_dir) # initialize database if db_file: lite_db = con_sqlite.sqliteConnector(db_file) lite_db.init_database() else: lite_db = None fuzzers = get_fuzzer_instances(sync_dir) print_ok("Found %d fuzzers, collecting crash samples." % len(fuzzers)) sample_index = build_sample_index(sync_dir, out_dir, fuzzers, lite_db, args.min_filename) if len(sample_index.index) > 0: print_ok("Successfully indexed %d crash samples." % len(sample_index.index)) elif db_file: print_warn("No unseen samples found. Check your database for results!") return else: print_warn("No samples found. Check directory settings!") return if args.remove_invalid: from afl_utils import afl_vcrash invalid_samples = afl_vcrash.verify_samples(int(args.num_threads), sample_index.inputs(), args.target_cmd) # store invalid samples in db print_ok("Saving invalid sample info to database.") if args.gdb_expl_script_file and db_file: for sample in invalid_samples: sample_name = sample_index.outputs(input_file=sample) dataset = {'sample': sample_name[0]['output'], 'classification': 'INVALID', 'description': 'Sample does not cause a crash in the target.', 'hash': ''} if not lite_db.dataset_exists(dataset): lite_db.insert_dataset(dataset) # remove invalid samples from sample index sample_index.remove_inputs(invalid_samples) print_warn("Removed %d invalid crash samples from index." % len(invalid_samples)) # generate gdb+exploitable script if args.gdb_expl_script_file: divided_index = sample_index.divide(int(args.num_threads)) for i in range(0, int(args.num_threads), 1): generate_gdb_exploitable_script(os.path.join(out_dir, args.gdb_expl_script_file), divided_index[i], args.target_cmd, i, intermediate=True) # execute gdb+exploitable script classification_data = execute_gdb_script(out_dir, args.gdb_expl_script_file, len(sample_index.inputs()), int(args.num_threads)) # Submit crash classification data into database print_ok("Saving sample classification info to database.") if db_file: for dataset in classification_data: if not lite_db.dataset_exists(dataset): lite_db.insert_dataset(dataset) # de-dupe by exploitable hash seen = set() seen_add = seen.add classification_data_dedupe = [x for x in classification_data if x['hash'] not in seen and not seen_add(x['hash'])] # remove dupe samples identified by exploitable hash uninteresting_samples = [x['sample'] for x in classification_data if x not in classification_data_dedupe] sample_index.remove_outputs(uninteresting_samples) print_warn("Removed %d duplicate samples from index. Will continue with %d remaining samples." % (len(uninteresting_samples), len(sample_index.index))) # remove crash samples that are classified uninteresting if args.remove_unexploitable: classification_unexploitable = [ 'NOT_EXPLOITABLE', 'PROBABLY_NOT_EXPLOITABLE', ] uninteresting_samples = [] for c in classification_data_dedupe: if c['classification'] in classification_unexploitable: uninteresting_samples.append(c['sample']) sample_index.remove_outputs(uninteresting_samples) print_warn("Removed %d uninteresting crash samples from index." % len(uninteresting_samples)) # generate output gdb script generate_gdb_exploitable_script(os.path.join(out_dir, args.gdb_expl_script_file), sample_index, args.target_cmd, 0) elif args.gdb_script_file: generate_gdb_exploitable_script(os.path.join(out_dir, args.gdb_script_file), sample_index, args.target_cmd) print_ok("Copying %d samples into output directory..." % len(sample_index.index)) files_collected = copy_samples(sample_index) # generate filelist of collected crash samples if args.list_filename: generate_sample_list(os.path.abspath(os.path.expanduser(args.list_filename)), files_collected) print_ok("Generated crash sample list '%s'." % os.path.abspath(os.path.expanduser(args.list_filename)))
def main(argv): show_info() parser = argparse.ArgumentParser( description= "afl-multicore starts several parallel fuzzing jobs, that are run \ in the background. For fuzzer stats see 'out_dir/SESSION###/fuzzer_stats'!", usage= "afl-multicore [-c config] [-h] [-s secs] [-t] [-v] <cmd> <jobs[,offset]>" ) parser.add_argument( "-c", "--config", dest="config_file", help="afl-multicore config file (Default: afl-multicore.conf)!", default="afl-multicore.conf") parser.add_argument("-s", "--startup-delay", dest="startup_delay", default=None, help="Wait a configurable amount \ of time after starting/resuming each afl instance to avoid interference during fuzzer startup. Provide wait time in \ seconds.") parser.add_argument("-t", "--test", dest="test_run", action="store_const", const=True, default=False, help="Perform \ a test run by starting a single afl instance in interactive mode using a test output directory." ) parser.add_argument( "-v", "--verbose", dest="verbose", action="store_const", const=True, default=False, help= "For debugging purposes do not redirect stderr/stdout of the created \ subprocesses to /dev/null (Default: off). Check 'nohup.out' for further outputs." ) parser.add_argument( "-r", "--redirect", dest="redirect", type=str, default=False, help="For debugging purposes, redirect to specific file.") parser.add_argument( "cmd", help="afl-multicore command to execute: start, resume, add.") parser.add_argument( "jobs", help= "Number of instances to start/resume/add. For resumes you may specify an optional \ job offset that allows to resume specific (ranges of) afl-instances.") args = parser.parse_args(argv[1:]) conf_settings = read_config( os.path.abspath(os.path.expanduser(args.config_file))) if args.test_run: signal.signal(signal.SIGINT, sigint_handler) conf_settings["output"] += "_test" conf_settings["interactive"] = False args.jobs = 1 args.cmd = "start" jobs_count, jobs_offset = get_job_counts(args.jobs) if args.cmd != "resume": conf_settings["input"] = os.path.abspath( os.path.expanduser(conf_settings["input"])) jobs_offset = 0 if not os.path.exists(conf_settings["input"]): print_err("No valid directory provided for <INPUT_DIR>!") sys.exit(1) else: conf_settings["input"] = "-" conf_settings["output"] = os.path.abspath( os.path.expanduser(conf_settings["output"])) instances_started = get_started_instance_count(args.cmd, conf_settings) master_count = get_master_count(conf_settings) if "interactive" in conf_settings and conf_settings["interactive"]: if not check_screen(): print_err( "When using screen mode, please run afl-multicore from inside a screen session!" ) sys.exit(1) if "environment" in conf_settings: setup_screen(jobs_count, conf_settings["environment"]) else: setup_screen(jobs_count, []) target_cmd = build_target_cmd(conf_settings) if args.test_run: cmd = build_master_cmd(conf_settings, 0, target_cmd) with subprocess.Popen(cmd.split()) as test_proc: print_ok("Test instance started (PID: %d)" % test_proc.pid) print_ok("Starting fuzzer instance(s)...") jobs_offset += instances_started jobs_count += jobs_offset instances = [] for i in range(jobs_offset, jobs_count, 1): is_master = has_master(conf_settings, i) if is_master: cmd = build_master_cmd(conf_settings, i, target_cmd) else: cmd = build_slave_cmd(conf_settings, i, target_cmd) if "interactive" in conf_settings and conf_settings["interactive"]: subprocess.Popen(["screen", "-X", "select", "%d" % (i + 1)]) screen_cmd = ["screen", "-X", "eval", "exec %s" % cmd, "next"] subprocess.Popen(screen_cmd) if is_master: if master_count == 1: print(" Master %03d started inside new screen window" % i) else: print( " Master %03d/%03d started inside new screen window" % (i, master_count - 1)) else: print(" Slave %03d started inside new screen window" % i) else: if not args.verbose and not args.redirect: fuzzer_inst = subprocess.Popen(" ".join(['nohup', cmd]).split(), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) elif args.redirect: with open(args.redirect, "ab") as fp: fuzzer_inst = subprocess.Popen(" ".join(['nohup', cmd]).split(), stdout=fp, stderr=subprocess.STDOUT) instances.append(fuzzer_inst) else: fuzzer_inst = subprocess.Popen(" ".join(['nohup', cmd]).split()) if is_master: if master_count == 1: print(" Master %03d started inside new screen window" % i) else: print(" Master %03d/%03d started (PID: %d)" % (i, master_count - 1, fuzzer_inst.pid)) else: print(" Slave %03d started (PID: %d)" % (i, fuzzer_inst.pid)) if i < (jobs_count - 1): startup_delay(conf_settings, i, args.cmd, args.startup_delay) write_pgid_file(conf_settings)
def main(argv): show_info() parser = argparse.ArgumentParser(description="afl-collect copies all crash sample files from an afl sync dir used \ by multiple fuzzers when fuzzing in parallel into a single location providing easy access for further crash analysis.", usage="afl-collect [-d DATABASE] [-e|-g GDB_EXPL_SCRIPT_FILE] [-f LIST_FILENAME]\n \ [-h] [-j THREADS] [-m] [-r] [-rr] sync_dir collection_dir -- target_cmd") parser.add_argument("sync_dir", help="afl synchronisation directory crash samples will be collected from.") parser.add_argument("collection_dir", help="Output directory that will hold a copy of all crash samples and other generated files. \ Existing files in the collection directory will be overwritten!") parser.add_argument("-d", "--database", dest="database_file", help="Submit sample data into an sqlite3 database (\ only when used together with '-e'). afl-collect skips processing of samples already found in existing database.", default=None) parser.add_argument("-e", "--execute-gdb-script", dest="gdb_expl_script_file", help="Generate and execute a gdb+exploitable script after crash sample collection for crash \ classification. (Like option '-g', plus script execution.)", default=None) parser.add_argument("-f", "--filelist", dest="list_filename", default=None, help="Writes all collected crash sample filenames into a file in the collection directory.") parser.add_argument("-g", "--generate-gdb-script", dest="gdb_script_file", help="Generate gdb script to run 'exploitable.py' on all collected crash samples. Generated \ script will be placed into collection directory.", default=None) parser.add_argument("-j", "--threads", dest="num_threads", default=1, help="Enable parallel analysis by specifying the number of threads afl-collect will utilize.") parser.add_argument("-m", "--minimize-filenames", dest="min_filename", action="store_const", const=True, default=False, help="Minimize crash sample file names by only keeping fuzzer name and ID.") parser.add_argument("-r", "--remove-invalid", dest="remove_invalid", action="store_const", const=True, default=False, help="Verify collected crash samples and remove samples that do not lead to \ crashes or cause timeouts (runs 'afl-vcrash.py -r' on collection directory). This step is done prior to any script \ file execution or file list generation.") parser.add_argument("-rr", "--remove-unexploitable", dest="remove_unexploitable", action="store_const", const=True, default=False, help="Remove crash samples that have an exploitable classification of \ 'NOT_EXPLOITABLE' or 'PROBABLY_NOT_EXPLOITABLE'. Sample file removal will take place after gdb+exploitable \ script execution. Has no effect without '-e'.") parser.add_argument("target_cmd", nargs="+", help="Path to the target binary and its command line arguments. \ Use '@@' to specify crash sample input file position (see afl-fuzz usage).") args = parser.parse_args(argv[1:]) sync_dir = os.path.abspath(os.path.expanduser(args.sync_dir)) if not os.path.exists(sync_dir): print_err("No valid directory provided for <SYNC_DIR>!: %s" % sync_dir) return out_dir = os.path.abspath(os.path.expanduser(args.collection_dir)) if not os.path.exists(out_dir): os.makedirs(out_dir, exist_ok=True) args.target_cmd = " ".join(args.target_cmd).split() args.target_cmd[0] = os.path.abspath(os.path.expanduser(args.target_cmd[0])) if not os.path.exists(args.target_cmd[0]): print_err("Target binary not found!") return args.target_cmd = " ".join(args.target_cmd) if args.database_file: db_file = os.path.abspath(os.path.expanduser(args.database_file)) else: db_file = None print_ok("Going to collect crash samples from '%s'." % sync_dir) # initialize database if db_file: lite_db = con_sqlite.sqliteConnector(db_file) lite_db.init_database('Data', db_table_spec) else: lite_db = None fuzzers = get_fuzzer_instances(sync_dir) print_ok("Found %d fuzzers, collecting crash samples." % len(fuzzers)) sample_index = build_sample_index(sync_dir, out_dir, fuzzers, lite_db, args.min_filename) sample_index_original = copy.copy(sample_index) if len(sample_index.index) > 0: print_ok("Successfully indexed %d crash samples." % len(sample_index.index)) elif db_file: print_warn("No unseen samples found. Check your database for results!") return else: print_warn("No samples found. Check directory settings!") return if args.remove_invalid: from afl_utils import afl_vcrash invalid_samples, timeout_samples = afl_vcrash.verify_samples(int(args.num_threads), sample_index.inputs(), args.target_cmd, timeout_secs=2) # store invalid samples in db if args.gdb_expl_script_file and db_file: print_ok("Saving invalid sample info to database.") for sample in invalid_samples: sample_name = sample_index.outputs(input_file=sample) dataset = {'Sample': sample_name[0], 'Classification': 'INVALID', 'Classification_Description': 'Sample does not cause a crash in the target.', 'Hash': '', 'User_Comment': ''} if not lite_db.dataset_exists('Data', dataset, ['Sample']): lite_db.insert_dataset('Data', dataset) for sample in timeout_samples: sample_name = sample_index.outputs(input_file=sample) dataset = {'Sample': sample_name[0], 'Classification': 'TIMEOUT', 'Classification_Description': 'Sample caused a target execution timeout.', 'Hash': '', 'User_Comment': ''} if not lite_db.dataset_exists('Data', dataset, ['Sample']): lite_db.insert_dataset('Data', dataset) # remove invalid samples from sample index sample_index.remove_inputs(invalid_samples+timeout_samples) print_warn("Removed %d invalid crash samples from index." % len(invalid_samples)) print_warn("Removed %d timed out samples from index." % len(timeout_samples)) # generate gdb+exploitable script if args.gdb_expl_script_file: divided_index = sample_index.divide(int(args.num_threads)) for i in range(0, int(args.num_threads), 1): generate_gdb_exploitable_script(os.path.join(out_dir, args.gdb_expl_script_file), divided_index[i], args.target_cmd, i, intermediate=True) # execute gdb+exploitable script classification_data = execute_gdb_script(out_dir, args.gdb_expl_script_file, len(sample_index.inputs()), int(args.num_threads)) # Submit crash classification data into database if db_file: print_ok("Saving sample classification info to database.") for dataset in classification_data: if not lite_db.dataset_exists('Data', dataset, ['Sample']): lite_db.insert_dataset('Data', dataset) # de-dupe by exploitable hash seen = set() seen_add = seen.add classification_data_dedupe = [x for x in classification_data if x['Hash'].split(".")[0] not in seen and not seen_add(x['Hash'].split(".")[0])] # remove dupe samples identified by exploitable hash uninteresting_samples = [x['Sample'] for x in classification_data if x not in classification_data_dedupe] sample_index.remove_outputs(uninteresting_samples) print_warn("Removed %d duplicate samples from index. Will continue with %d remaining samples." % (len(uninteresting_samples), len(sample_index.index))) # remove crash samples that are classified uninteresting if args.remove_unexploitable: classification_unexploitable = [ 'NOT_EXPLOITABLE', 'PROBABLY_NOT_EXPLOITABLE', ] uninteresting_samples = [] for c in classification_data_dedupe: if c['Classification'] in classification_unexploitable: uninteresting_samples.append(c['Sample']) sample_index.remove_outputs(uninteresting_samples) print_warn("Removed %d uninteresting crash samples from index." % len(uninteresting_samples)) # generate output gdb script generate_gdb_exploitable_script(os.path.join(out_dir, args.gdb_expl_script_file), sample_index, args.target_cmd, 0) elif args.gdb_script_file: generate_gdb_exploitable_script(os.path.join(out_dir, args.gdb_script_file), sample_index, args.target_cmd) print_ok("Copying %d samples into output directory..." % len(sample_index.index)) files_collected = copy_samples(sample_index) # Move crashes to a special folder, collected_all_crashes print_ok("Moving all crashes to %s (Samples: %d)" % (os.path.join(sample_index.output_dir, "all_crashes"), len(sample_index_original.index))) if not os.path.exists(os.path.join(sample_index_original.output_dir, "all_crashes")): os.makedirs(os.path.join(sample_index_original.output_dir, "all_crashes")) for sample in sample_index_original.index: #print("Moving %s to %s" % (sample['input'], os.path.join(sample_index.output_dir, "all_crashes", sample['output']))) shutil.move(sample['input'], os.path.join(sample_index_original.output_dir, "all_crashes", sample['output'])) # generate filelist of collected crash samples if args.list_filename: generate_sample_list(os.path.abspath(os.path.expanduser(args.list_filename)), files_collected) print_ok("Generated crash sample list '%s'." % os.path.abspath(os.path.expanduser(args.list_filename))) # write db contents to file and close db connection if db_file: lite_db.commit_close()
def main(argv): show_info() parser = argparse.ArgumentParser(description="Post selected contents of fuzzer_stats to Twitter.", usage="afl-stats [-h] [-c config]\n") parser.add_argument("-c", "--config", dest="config_file", help="afl-stats config file (Default: afl-stats.conf)!", default="afl-stats.conf") args = parser.parse_args(argv[1:]) config_settings = read_config(args.config_file) twitter_inst = twitter_init() doExit = False # { 'fuzzer_dir': (stat, old_stat) } stat_dict = dict() while not doExit: try: for fuzzer in config_settings['fuzz_dirs']: stats = load_stats(fuzzer) if not stats: continue sum_stats = summarize_stats(stats) try: # stat_dict has already been initialized for fuzzer # old_stat <- last_stat old_stats = stat_dict[fuzzer][0].copy() except KeyError: # stat_dict has not yet been initialized for fuzzer # old_stat <- cur_stat old_stats = sum_stats.copy() # initialize/update stat_dict stat_dict[fuzzer] = (sum_stats, old_stats) stat_change = diff_stats(sum_stats, old_stats) if not diff_stats: continue print(prettify_stat(sum_stats, stat_change, True)) tweet = prettify_stat(sum_stats, stat_change, False) l = len(tweet) c = clr.LRD if l>140 else clr.LGN print_ok("Tweeting status (%s%d" % (c, l) + clr.RST + " chars)...") try: twitter_inst.statuses.update(status=shorten_tweet(tweet)) except (twitter.TwitterHTTPError, URLError): print_warn("Problem connecting to Twitter! Tweet not sent!") except Exception as e: print_err("Sending tweet failed (Reason: " + clr.GRA + "%s" % e.__cause__ + clr.RST + ")") if float(config_settings['interval']) < 0: doExit = True else: time.sleep(float(config_settings['interval'])*60) except KeyboardInterrupt: print("\b\b") print_ok("Aborted by user. Good bye!") doExit = True
def main(argv): show_info() parser = argparse.ArgumentParser(description="afl-minimize performs several optimization steps to reduce the size\n \ of an afl-fuzz corpus.", usage="afl-minimize [-c COLLECTION_DIR [--cmin [opts]] [--tmin [opts]]] [-d] [-h]\n \ [-j] sync_dir -- target_cmd\n") parser.add_argument("-c", "--collect", dest="collection_dir", help="Collect all samples from the synchronisation dir and store them in the collection dir. \ Existing files in the collection directory will be overwritten!", default=None) parser.add_argument("--cmin", dest="invoke_cmin", action="store_const", const=True, default=False, help="Run afl-cmin on collection dir. Has no effect without '-c'.") parser.add_argument("--cmin-mem-limit", dest="cmin_mem_limit", default=None, help="Set memory limit for afl-cmin.") parser.add_argument("--cmin-timeout", dest="cmin_timeout", default=None, help="Set timeout for afl-cmin.") parser.add_argument("--tmin", dest="invoke_tmin", action="store_const", const=True, default=False, help="Run afl-tmin on minimized collection dir if used together with '--cmin'\ or on unoptimized collection dir otherwise. Has no effect without '-c'.") parser.add_argument("--tmin-mem-limit", dest="tmin_mem_limit", default=None, help="Set memory limit for afl-tmin.") parser.add_argument("--tmin-timeout", dest="tmin_timeout", default=None, help="Set timeout for afl-tmin.") parser.add_argument("-d", "--dry-run", dest="dry_run", action="store_const", const=True, default=False, help="Perform dry-run on collection dir, if '-c' is provided or on \ synchronisation dir otherwise. Dry-run will move intermittent crashes out of the corpus.") parser.add_argument("-j", "--threads", dest="num_threads", default=1, help="Enable parallel dry-run and t-minimization step by specifying the number of threads \ afl-minimize will utilize.") parser.add_argument("sync_dir", help="afl synchronisation directory containing multiple fuzzers and their queues.") parser.add_argument("target_cmd", nargs="+", help="Path to the target binary and its command line arguments. \ Use '@@' to specify crash sample input file position (see afl-fuzz usage).") args = parser.parse_args(argv[1:]) if not args.collection_dir and not args.dry_run: print_err("No operation requested. You should at least provide '-c'") print_err("for sample collection or '-d' for a dry-run. Use '--help' for") print_err("usage instructions or checkout README.md for details.") return sync_dir = os.path.abspath(os.path.expanduser(args.sync_dir)) if not os.path.exists(sync_dir): print_err("No valid directory provided for <SYNC_DIR>!") return args.target_cmd = " ".join(args.target_cmd).split() args.target_cmd[0] = os.path.abspath(os.path.expanduser(args.target_cmd[0])) if not os.path.exists(args.target_cmd[0]): print_err("Target binary not found!") return args.target_cmd = " ".join(args.target_cmd) if not args.num_threads: threads = 1 else: threads = int(args.num_threads) if args.collection_dir: out_dir = os.path.abspath(os.path.expanduser(args.collection_dir)) if not os.path.exists(out_dir) or len(os.listdir(out_dir)) == 0: os.makedirs(out_dir, exist_ok=True) print_ok("Looking for fuzzing queues in '%s'." % sync_dir) fuzzers = afl_collect.get_fuzzer_instances(sync_dir, crash_dirs=False) # collect samples from fuzzer queues print_ok("Found %d fuzzers, collecting samples." % len(fuzzers)) sample_index = afl_collect.build_sample_index(sync_dir, out_dir, fuzzers) print_ok("Successfully indexed %d samples." % len(sample_index.index)) print_ok("Copying %d samples into collection directory..." % len(sample_index.index)) afl_collect.copy_samples(sample_index) else: print_warn("Collection directory exists and is not empty!") print_warn("Skipping collection step...") if args.invoke_cmin: # invoke cmin on collection print_ok("Executing: afl-cmin -i %s -o %s.cmin -- %s" % (out_dir, out_dir, args.target_cmd)) invoke_cmin(out_dir, "%s.cmin" % out_dir, args.target_cmd, mem_limit=args.cmin_mem_limit, timeout=args.cmin_timeout) if args.invoke_tmin: # invoke tmin on minimized collection print_ok("Executing: afl-tmin -i %s.cmin/* -o %s.cmin.tmin/* -- %s" % (out_dir, out_dir, args.target_cmd)) tmin_num_samples, tmin_samples = afl_collect.get_samples_from_dir("%s.cmin" % out_dir, abs_path=True) invoke_tmin(tmin_samples, "%s.cmin.tmin" % out_dir, args.target_cmd, num_threads=threads, mem_limit=args.tmin_mem_limit, timeout=args.tmin_timeout) elif args.invoke_tmin: # invoke tmin on collection print_ok("Executing: afl-tmin -i %s/* -o %s.tmin/* -- %s" % (out_dir, out_dir, args.target_cmd)) tmin_num_samples, tmin_samples = afl_collect.get_samples_from_dir(out_dir, abs_path=True) invoke_tmin(tmin_samples, "%s.tmin" % out_dir, args.target_cmd, num_threads=threads, mem_limit=args.tmin_mem_limit, timeout=args.tmin_timeout) if args.dry_run: # invoke dry-run on collected/minimized corpus if args.invoke_cmin and args.invoke_tmin: print_ok("Performing dry-run in %s.cmin.tmin..." % out_dir) print_warn("Be patient! Depending on the corpus size this step can take hours...") dryrun_num_samples, dryrun_samples = afl_collect.get_samples_from_dir("%s.cmin.tmin" % out_dir, abs_path=True) invoke_dryrun(dryrun_samples, "%s.cmin.tmin.crashes" % out_dir, "%s.cmin.tmin.hangs" % out_dir, args.target_cmd, num_threads=threads) elif args.invoke_cmin: print_ok("Performing dry-run in %s.cmin..." % out_dir) print_warn("Be patient! Depending on the corpus size this step can take hours...") dryrun_num_samples, dryrun_samples = afl_collect.get_samples_from_dir("%s.cmin" % out_dir, abs_path=True) invoke_dryrun(dryrun_samples, "%s.cmin.crashes" % out_dir, "%s.cmin.hangs" % out_dir, args.target_cmd, num_threads=threads) elif args.invoke_tmin: print_ok("Performing dry-run in %s.tmin..." % out_dir) print_warn("Be patient! Depending on the corpus size this step can take hours...") dryrun_num_samples, dryrun_samples = afl_collect.get_samples_from_dir("%s.tmin" % out_dir, abs_path=True) invoke_dryrun(dryrun_samples, "%s.tmin.crashes" % out_dir, "%s.tmin.hangs" % out_dir, args.target_cmd, num_threads=threads) else: print_ok("Performing dry-run in %s..." % out_dir) print_warn("Be patient! Depending on the corpus size this step can take hours...") dryrun_num_samples, dryrun_samples = afl_collect.get_samples_from_dir(out_dir, abs_path=True) invoke_dryrun(dryrun_samples, "%s.crashes" % out_dir, "%s.hangs" % out_dir, args.target_cmd, num_threads=threads) else: if args.dry_run: print_ok("Looking for fuzzing queues in '%s'." % sync_dir) fuzzers = afl_collect.get_fuzzer_instances(sync_dir, crash_dirs=False) print_ok("Found %d fuzzers, performing dry run." % len(fuzzers)) print_warn("Be patient! Depending on the corpus size this step can take hours...") # invoke dry-run on original corpus for f in fuzzers: for q_dir in f[1]: q_dir_complete = os.path.join(sync_dir, f[0], q_dir) print_ok("Processing %s..." % q_dir_complete) dryrun_num_samples, dryrun_samples = afl_collect.get_samples_from_dir(q_dir_complete, abs_path=True) invoke_dryrun(dryrun_samples, os.path.join(sync_dir, f[0], "crashes"), os.path.join(sync_dir, f[0], "hangs"), args.target_cmd, num_threads=threads)
def main(argv): show_info() parser = argparse.ArgumentParser( description= "afl-multicore starts several parallel fuzzing jobs, that are run \ in the background. For fuzzer stats see 'out_dir/SESSION###/fuzzer_stats'!", usage="afl-multicore [-c config] [-h] [-t] [-v] <cmd> <jobs>") parser.add_argument( "-c", "--config", dest="config_file", help="afl-multicore config file (Default: afl-multicore.conf)!", default="afl-multicore.conf") parser.add_argument("-t", "--test", dest="test_run", action="store_const", const=True, default=False, help="Perform \ a test run by starting a single afl instance in interactive mode using a test output directory." ) parser.add_argument( "-v", "--verbose", dest="verbose", action="store_const", const=True, default=False, help= "For debugging purposes do not redirect stderr/stdout of the created \ subprocesses to /dev/null (Default: off). Check 'nohup.out' for further outputs." ) parser.add_argument( "cmd", help="afl-multicore command to execute: start, resume, add.") parser.add_argument("jobs", help="Number of instances to start/resume/add.") args = parser.parse_args(argv[1:]) conf_settings, environment = read_config( os.path.abspath(os.path.expanduser(args.config_file))) if args.test_run: signal.signal(signal.SIGINT, sigint_handler) conf_settings["output"] += "_test" conf_settings["interactive"] = False args.jobs = 1 args.cmd = "start" if args.cmd != "resume": conf_settings["input"] = os.path.abspath( os.path.expanduser(conf_settings["input"])) if not os.path.exists(conf_settings["input"]): print_err("No valid directory provided for <INPUT_DIR>!") sys.exit(1) else: conf_settings["input"] = "-" conf_settings["output"] = os.path.abspath( os.path.expanduser(conf_settings["output"])) slave_off, slave_start = get_slave_count(args.cmd, conf_settings) if conf_settings["interactive"]: if not check_screen(): print_err( "When using screen mode, please run afl-multicore from inside a screen session!" ) sys.exit(1) setup_screen(int(args.jobs), environment) target_cmd = build_target_cmd(conf_settings) master_cmd = build_master_cmd(conf_settings, target_cmd) if args.test_run: with subprocess.Popen(master_cmd.split()) as test_proc: print_ok("Test instance started (PID: %d)" % test_proc.pid) if not conf_settings["slave_only"]: print_ok("Starting master instance...") if not conf_settings["interactive"]: if not args.verbose: master = subprocess.Popen(" ".join(['nohup', master_cmd]).split(), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) else: master = subprocess.Popen(" ".join(['nohup', master_cmd]).split()) print(" Master 000 started (PID: %d)" % master.pid) else: subprocess.Popen("screen -X select 1".split()) screen_cmd = [ "screen", "-X", "eval", "exec %s" % master_cmd, "next" ] subprocess.Popen(screen_cmd) print(" Master 000 started inside new screen window") print_ok("Starting slave instances...") for i in range(slave_start, int(args.jobs) + slave_start - slave_off, 1): slave_cmd = build_slave_cmd(conf_settings, i, target_cmd) if not conf_settings["interactive"]: if not args.verbose: slave = subprocess.Popen(" ".join(['nohup', slave_cmd]).split(), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) else: slave = subprocess.Popen(" ".join(['nohup', slave_cmd]).split()) print(" Slave %03d started (PID: %d)" % (i, slave.pid)) else: subprocess.Popen(["screen", "-X", "select", "%d" % (i + 1)]) screen_cmd = [ "screen", "-X", "eval", "exec %s" % slave_cmd, "next" ] subprocess.Popen(screen_cmd) print(" Slave %03d started inside new screen window" % i) write_pgid_file(conf_settings)