From 9b459fc7e180582a51c5625fc1bcfcd208013669 Mon Sep 17 00:00:00 2001
From: Eric Bavier <bavier@member.fsf.org>
Date: Sun, 16 Aug 2015 06:07:28 -0500
Subject: [PATCH] gnu: Add American fuzzy lop.

* gnu/packages/debug.scm (american-fuzzy-lop): New variable.
---
 gnu/packages/debug.scm | 101 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 100 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/debug.scm b/gnu/packages/debug.scm
index ba80711f01..b098832681 100644
--- a/gnu/packages/debug.scm
+++ b/gnu/packages/debug.scm
@@ -27,7 +27,10 @@
   #:use-module (gnu packages indent)
   #:use-module (gnu packages llvm)
   #:use-module (gnu packages perl)
-  #:use-module (gnu packages pretty-print))
+  #:use-module (gnu packages pretty-print)
+  #:use-module (gnu packages qemu)
+  #:use-module (ice-9 match)
+  #:use-module (srfi srfi-1))
 
 (define-public delta
   (package
@@ -137,3 +140,99 @@ produces a much smaller C/C++ program that has the same property.  It is
 intended for use by people who discover and report bugs in compilers and other
 tools that process C/C++ code.")
     (license ncsa)))
+
+(define-public american-fuzzy-lop
+  (let ((machine (match (or (%current-target-system)
+                            (%current-system))
+                   ("x86_64-linux"   "x86_64")
+                   ("i686-linux"     "i386")
+                   ;; Prevent errors when querying this package on unsupported
+                   ;; platforms, e.g. when running "guix package --search="
+                   (_                "UNSUPPORTED"))))
+    (package
+      (name "american-fuzzy-lop")
+      (version "1.86b")             ;It seems all releases have the 'b' suffix
+      (source
+       (origin
+         (method url-fetch)
+         (uri (string-append "http://lcamtuf.coredump.cx/afl/releases/"
+                             "afl-" version ".tgz"))
+         (sha256
+          (base32
+           "1by9ncf6lgcyibzqwyla34jv64sd66mn8zhgjz2pcgsds51qwn0r"))))
+      (build-system gnu-build-system)
+      (inputs
+       `(("custom-qemu"
+          ;; The afl-qemu tool builds qemu 2.3.0 with a few patches applied.
+          ,(package (inherit qemu-headless)
+             (name "afl-qemu")
+             (inputs
+              `(("afl-src" ,source)
+                ,@(package-inputs qemu-headless)))
+             ;; afl only supports using a single afl-qemu-trace executable, so
+             ;; we only build qemu for the native target.
+             (arguments
+              `(#:configure-flags
+                (list (string-append "--target-list=" ,machine "-linux-user"))
+                #:modules ((srfi srfi-1)
+                           ,@%gnu-build-system-modules)
+                ,@(substitute-keyword-arguments (package-arguments qemu-headless)
+                    ((#:phases qemu-phases)
+                     `(modify-phases ,qemu-phases
+                        (add-after
+                         'unpack 'apply-afl-patches
+                         (lambda* (#:key inputs #:allow-other-keys)
+                           (let* ((afl-dir (string-append "afl-" ,version))
+                                  (patch-dir
+                                   (string-append afl-dir
+                                                  "/qemu_mode/patches")))
+                             (unless (zero?
+                                      (system* "tar" "xf"
+                                               (assoc-ref inputs "afl-src")))
+                               (error "tar failed to unpack afl-src"))
+                             (copy-file (string-append patch-dir
+                                                       "/afl-qemu-cpu-inl.h")
+                                        "./afl-qemu-cpu-inl.h")
+                             (copy-file (string-append afl-dir "/config.h")
+                                        "./afl-config.h")
+                             (copy-file (string-append afl-dir "/types.h")
+                                        "./types.h")
+                             (substitute* "afl-qemu-cpu-inl.h"
+                               (("\\.\\./\\.\\./config.h") "afl-config.h"))
+                             (substitute* (string-append patch-dir
+                                                         "/cpu-exec.diff")
+                               (("\\.\\./patches/") ""))
+                             (every (lambda (patch-file)
+                                      (zero? (system* "patch" "--force" "-p1"
+                                                      "--input" patch-file)))
+                                    (find-files patch-dir
+                                                "\\.diff$"))))))))))))))
+      (arguments
+       `(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
+                            "CC=gcc")
+         #:phases (modify-phases %standard-phases
+                    (delete 'configure)
+                    (add-after
+                     ;; TODO: Build and install the afl-llvm tool.
+                     'install 'install-qemu
+                     (lambda* (#:key inputs outputs #:allow-other-keys)
+                       (let ((qemu (assoc-ref inputs "custom-qemu"))
+                             (out  (assoc-ref outputs "out")))
+                         (copy-file (string-append qemu "/bin/qemu-" ,machine)
+                                    (string-append out "/bin/afl-qemu-trace"))
+                         #t)))
+                    (delete 'check))))
+      (supported-systems (fold delete
+                               %supported-systems
+                               '("armhf-linux" "mips64el-linux")))
+      (home-page "http://lcamtuf.coredump.cx/afl")
+      (synopsis "Security-oriented fuzzer")
+      (description
+       "American fuzzy lop is a security-oriented fuzzer that employs a novel
+type of compile-time instrumentation and genetic algorithms to automatically
+discover clean, interesting test cases that trigger new internal states in the
+targeted binary.  This substantially improves the functional coverage for the
+fuzzed code.  The compact synthesized corpora produced by the tool are also
+useful for seeding other, more labor- or resource-intensive testing regimes
+down the road.")
+      (license asl2.0))))