(List (Com {[LIT_CHARS set]} {[LIT_CHARS -o]} {[LIT_CHARS nounset]} ) (Com {[LIT_CHARS set]} {[LIT_CHARS -o]} {[LIT_CHARS pipefail]} ) (Com {[LIT_CHARS set]} {[LIT_CHARS -o]} {[LIT_CHARS errexit]} ) (FunctionDef download [] (Com {[LIT_CHARS wget]} {[LIT_CHARS --directory]} {[TildeSub ''] [LIT_CHARS /src]} {[LIT_CHARS http] [LIT_OTHER ":"] [LIT_CHARS //lcamtuf.coredump.cx/afl/releases/afl-latest.tgz]} ) ) (FunctionDef build [] (Com {[LIT_CHARS time]} {[LIT_CHARS make]} ) ) (FunctionDef count [] (Pipeline (Com {[LIT_CHARS find]} {[LIT_CHARS .]} {[LIT_CHARS -name]} {[SQ ]} {[LIT_CHARS -o]} {[LIT_CHARS -name]} {[SQ ]} ) (Com {[LIT_CHARS xargs]} {[LIT_CHARS wc]} {[LIT_CHARS -l]} ) ) ) (= scope= flags=2 words=[] bindings=[('AFL_DIR', {[TildeSub ''] [LIT_CHARS /src/afl-2.06b/]})]) (= scope= flags=2 words=[] bindings=[('TOYBOX_DIR', {[TildeSub ''] [LIT_CHARS /git/other/toybox/]})]) (FunctionDef build-toybox [] (List (= scope= flags=0 words=[] bindings=[('clean', {[VarSub 1 test_op=VS_TEST_COLON_HYPHEN {}]})]) (Com {[LIT_CHARS pushd]} {[VarSub TOYBOX_DIR]} ) (If (Com {[LIT_CHARS test]} {[LIT_CHARS -n]} {[DQ [VarSub clean]]} ) (Com {[LIT_CHARS make]} {[LIT_CHARS clean]} ) ) (= scope= flags=0 words=[] bindings=[('cflags', {[SQ ]})]) (Com {[LIT_CHARS make]} more_env=[('CC', {[VarSub AFL_DIR] [LIT_CHARS /afl-gcc]}), ('CFLAGS', {[DQ [VarSub cflags]]})] ) (Com {[LIT_CHARS ls]} {[LIT_CHARS -l]} {[LIT_CHARS toybox]} {[LIT_CHARS toybox_unstripped]} ) (Com {[LIT_CHARS popd]} ) ) ) (FunctionDef show-debug [] (Com {[LIT_CHARS readelf]} {[LIT_CHARS -s]} {[VarSub TOYBOX_DIR] [LIT_CHARS /toybox_unstripped]} ) ) (FunctionDef save-core-config [] (List (= scope= flags=0 words=[] bindings=[('out', {[LIT_CHARS _tmp/core_pattern.txt]})]) (Pipeline (Com {[LIT_CHARS cat]} {[LIT_CHARS /proc/sys/kernel/core_pattern]} ) (Com {[LIT_CHARS tee]} {[VarSub out]} ) ) (Com {[LIT_CHARS echo]} {[DQ [LIT_CHARS "Saved as "][VarSub out]]} ) ) ) (FunctionDef setup-fuzz [] (Com {[LIT_CHARS sudo]} {[LIT_CHARS sh]} {[LIT_CHARS -c]} {[SQ /proc/sys/kernel/core_pattern">]} ) ) (FunctionDef restore-core-config [] (List (= scope= flags=0 words=[] bindings=[('input', {[LIT_CHARS _tmp/core_pattern.txt]})]) (Com {[LIT_CHARS sudo]} {[LIT_CHARS sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat >/proc/sys/kernel/core_pattern <"][VarSub input]]} ) (Com {[LIT_CHARS echo]} {[DQ [LIT_CHARS "Restored from "][VarSub input]]} ) (Com {[LIT_CHARS cat]} {[LIT_CHARS /proc/sys/kernel/core_pattern]} ) ) ) (FunctionDef afl-fuzz [] (Com {[VarSub AFL_DIR] [LIT_CHARS /afl-fuzz]} {[DQ [VarSub @]]} more_env=[('AFL_SKIP_CPUFREQ', {[LIT_CHARS 1]})] ) ) (FunctionDef toybox [] (Com {[VarSub TOYBOX_DIR] [LIT_CHARS /toybox]} {[DQ [VarSub @]]} ) ) (FunctionDef toybox-unstripped [] (Com {[VarSub TOYBOX_DIR] [LIT_CHARS /toybox_unstripped]} {[DQ [VarSub @]]} ) ) (FunctionDef write-input [] (Com {[LIT_CHARS seq]} {[LIT_CHARS 10]} < (FilenameRedirectNode filename={[LIT_CHARS _tmp/input.txt]} "> 1), > ) ) (FunctionDef sedc-cases [] (List (Com {[LIT_CHARS echo]} {[LIT_CHARS --]} {[LIT_CHARS 1]} ) (Com {[DQ [VarSub @]]} {[LIT_CHARS -e]} {[SQ ]} < (HereDocRedirectNode here_end='EOF' do_expansion=True body_word={[DQ [LIT_CHARS "a\n"][LIT_CHARS "b\n"][LIT_CHARS "c\n"]]} 0), > ) (Com {[LIT_CHARS echo]} {[LIT_CHARS --]} {[LIT_CHARS 2]} ) (Com {[DQ [VarSub @]]} {[LIT_CHARS -e]} {[SQ ]} < (HereDocRedirectNode here_end='EOF' do_expansion=True body_word={[DQ [LIT_CHARS "a\n"][LIT_CHARS "b\n"][LIT_CHARS "c\n"]]} 0), > ) (Com {[LIT_CHARS echo]} {[LIT_CHARS --]} {[LIT_CHARS 3]} ) (Com {[DQ [VarSub @]]} {[LIT_CHARS -e]} {[SQ ]} < (HereDocRedirectNode here_end='EOF' do_expansion=True body_word={[DQ [LIT_CHARS "a\n"][LIT_CHARS "b\n"][LIT_CHARS "c\n"]]} 0), > ) (Com {[LIT_CHARS echo]} {[LIT_CHARS --]} {[LIT_CHARS 4]} ) (Com {[DQ [VarSub @]]} {[LIT_CHARS -e]} {[SQ ]} < (HereDocRedirectNode here_end='EOF' do_expansion=True body_word={[DQ [LIT_CHARS "a\n"][LIT_CHARS "b\n"][LIT_CHARS "c\n"]]} 0), > ) (Com {[LIT_CHARS echo]} {[LIT_CHARS --]} {[LIT_CHARS 5]} ) (Com {[DQ [VarSub @]]} {[LIT_CHARS -e]} {[SQ ]} < (HereDocRedirectNode here_end='EOF' do_expansion=True body_word={[DQ [LIT_CHARS "a\n"][LIT_CHARS "b\n"][LIT_CHARS "c\n"]]} 0), > ) (Com {[LIT_CHARS echo]} {[LIT_CHARS --]} {[LIT_CHARS 6]} ) (Com {[DQ [VarSub @]]} {[LIT_CHARS -e]} {[SQ ]} < (HereDocRedirectNode here_end='EOF' do_expansion=True body_word={[DQ [LIT_CHARS "a\n"][LIT_CHARS "b\n"][LIT_CHARS "c\n"]]} 0), > ) ) ) (FunctionDef sedc-compare [] (List (Com {[LIT_CHARS echo]} ) (Com {[LIT_CHARS sedc-cases]} {[LIT_CHARS sed]} ) (Com {[LIT_CHARS echo]} ) (Com {[LIT_CHARS echo]} {[LIT_CHARS TOYBOX]} ) (Com {[LIT_CHARS echo]} ) (Com {[LIT_CHARS sedc-cases]} {[TildeSub ''] [LIT_CHARS /git/other/toybox/toybox_unstripped]} {[LIT_CHARS sed]} ) ) ) (FunctionDef sed-demo [] (List (Com {[LIT_CHARS mkdir]} {[LIT_CHARS -p]} {[LIT_CHARS _tmp]} ) (Com {[LIT_CHARS write-input]} ) (Com {[LIT_CHARS echo]} {[SQ ]} < (FilenameRedirectNode filename={[LIT_CHARS _tmp/prog.txt]} "> 1), > ) (Com {[LIT_CHARS toybox]} {[LIT_CHARS sed]} {[LIT_CHARS -f]} {[LIT_CHARS _tmp/prog.txt]} {[LIT_CHARS _tmp/input.txt]} ) ) ) (FunctionDef write-sed-cases [] (List (= scope= flags=0 words=[] bindings=[('dir', {[VarSub 1]})]) (Com {[LIT_CHARS echo]} {[SQ ]} < (FilenameRedirectNode filename={[VarSub dir] [LIT_CHARS /1.txt]} "> 1), > ) ) ) (FunctionDef fuzz-sed [] (List (Com {[LIT_CHARS mkdir]} {[LIT_CHARS -p]} {[LIT_CHARS _tmp/sed/] [LIT_LBRACE "{"] [LIT_CHARS cases] [LIT_COMMA ","] [LIT_CHARS findings] [LIT_RBRACE "}"]} ) (Com {[LIT_CHARS write-input]} ) (Com {[LIT_CHARS write-sed-cases]} {[LIT_CHARS _tmp/sed/cases]} ) (Com {[LIT_CHARS pushd]} {[LIT_CHARS _tmp/sed]} ) (Com {[LIT_CHARS afl-fuzz]} {[LIT_CHARS -i]} {[LIT_CHARS cases]} {[LIT_CHARS -o]} {[LIT_CHARS findings]} {[LIT_CHARS --]} {[VarSub TOYBOX_DIR] [LIT_CHARS /toybox]} {[LIT_CHARS sed]} {[LIT_CHARS -f]} {[LIT_OTHER "@"] [LIT_OTHER "@"]} {[LIT_CHARS ../input.txt]} ) (Com {[LIT_CHARS popd]} ) ) ) (FunctionDef grep-demo [] (List (Com {[LIT_CHARS mkdir]} {[LIT_CHARS -p]} {[LIT_CHARS _tmp]} ) (Com {[LIT_CHARS write-input]} ) (Com {[LIT_CHARS echo]} {[SQ ]} < (FilenameRedirectNode filename={[LIT_CHARS _tmp/pat.txt]} "> 1), > ) (Com {[LIT_CHARS toybox]} {[LIT_CHARS grep]} {[LIT_CHARS -f]} {[LIT_CHARS _tmp/pat.txt]} {[LIT_CHARS _tmp/input.txt]} ) ) ) (FunctionDef write-grep-cases [] (List (= scope= flags=0 words=[] bindings=[('dir', {[VarSub 1]})]) (Com {[LIT_CHARS echo]} {[SQ ]} < (FilenameRedirectNode filename={[VarSub dir] [LIT_CHARS /1.txt]} "> 1), > ) ) ) (FunctionDef fuzz-grep [] (List (Com {[LIT_CHARS mkdir]} {[LIT_CHARS -p]} {[LIT_CHARS _tmp/grep/] [LIT_LBRACE "{"] [LIT_CHARS cases] [LIT_COMMA ","] [LIT_CHARS findings] [LIT_RBRACE "}"]} ) (Com {[LIT_CHARS write-input]} ) (Com {[LIT_CHARS write-grep-cases]} {[LIT_CHARS _tmp/grep/cases]} ) (Com {[LIT_CHARS pushd]} {[LIT_CHARS _tmp/grep]} ) (Com {[LIT_CHARS afl-fuzz]} {[LIT_CHARS -i]} {[LIT_CHARS cases]} {[LIT_CHARS -o]} {[LIT_CHARS findings]} {[LIT_CHARS --]} {[VarSub TOYBOX_DIR] [LIT_CHARS /toybox]} {[LIT_CHARS grep]} {[LIT_CHARS -f]} {[LIT_OTHER "@"] [LIT_OTHER "@"]} {[LIT_CHARS ../input.txt]} ) (Com {[LIT_CHARS popd]} ) ) ) (FunctionDef write-chmod-cases [] (List (= scope= flags=0 words=[] bindings=[('dir', {[VarSub 1]})]) (Com {[LIT_CHARS rm]} {[LIT_CHARS --verbose]} {[VarSub dir] [LIT_CHARS /] [LIT_OTHER "*"]} ) (Com {[LIT_CHARS echo]} {[SQ ]} < (FilenameRedirectNode filename={[VarSub dir] [LIT_CHARS /1.txt]} "> 1), > ) (Com {[LIT_CHARS echo]} {[SQ ]} < (FilenameRedirectNode filename={[VarSub dir] [LIT_CHARS /2.txt]} "> 1), > ) (Com {[LIT_CHARS echo]} {[SQ ]} < (FilenameRedirectNode filename={[VarSub dir] [LIT_CHARS /3.txt]} "> 1), > ) ) ) (FunctionDef fuzz-chmod [] (List (Com {[LIT_CHARS mkdir]} {[LIT_CHARS -p]} {[LIT_CHARS _tmp/chmod/] [LIT_LBRACE "{"] [LIT_CHARS cases] [LIT_COMMA ","] [LIT_CHARS findings] [LIT_RBRACE "}"]} ) (Com {[LIT_CHARS write-chmod-cases]} {[LIT_CHARS _tmp/chmod/cases]} ) (= scope= flags=0 words=[] bindings=[('test_file', {[VarSub TMPFS_DIR] [LIT_CHARS /file]})]) (Com {[LIT_CHARS pushd]} {[LIT_CHARS _tmp/chmod]} ) (Com {[LIT_CHARS afl-fuzz]} {[LIT_CHARS -i]} {[LIT_CHARS cases]} {[LIT_CHARS -o]} {[LIT_CHARS findings]} {[LIT_CHARS --]} {[VarSub TOYBOX_DIR] [LIT_CHARS /toybox]} {[LIT_CHARS chmod]} {[SQ ]} {[VarSub test_file]} ) (Com {[LIT_CHARS popd]} ) ) ) (FunctionDef show-tests [] (List (= scope= flags=0 words=[] bindings=[('cmd', {[VarSub 1 test_op=VS_TEST_COLON_HYPHEN {[LIT_CHARS chmod]}]})]) (Com {[LIT_CHARS cat]} {[VarSub TOYBOX_DIR] [LIT_CHARS /tests/] [VarSub cmd] [LIT_CHARS .test]} ) ) ) (FunctionDef test-len [] (Pipeline (Com {[LIT_CHARS wc]} {[LIT_CHARS -l]} {[VarSub TOYBOX_DIR] [LIT_CHARS /tests/] [LIT_OTHER "*"] [LIT_CHARS .test]} ) (Com {[LIT_CHARS sort]} {[LIT_CHARS -n]} ) ) ) (FunctionDef repro-sed [] (List (Com {[LIT_CHARS build-toybox]} ) (Com {[LIT_CHARS toybox-unstripped]} {[LIT_CHARS sed]} {[LIT_CHARS -e]} {[SQ ]} {[LIT_CHARS _tmp/input.txt]} ) (Com {[LIT_CHARS echo]} {[LIT_CHARS DONE]} ) ) ) (FunctionDef repro-sed2 [] (List (= scope= flags=0 words=[] bindings=[('prog', {[SQ ]})]) (Com {[LIT_CHARS echo]} {[LIT_CHARS PROG]} ) (Com {[LIT_CHARS od]} {[LIT_CHARS -c]} {[VarSub prog]} ) (Com {[LIT_CHARS echo]} ) (Com {[LIT_CHARS toybox]} {[LIT_CHARS sed]} {[LIT_CHARS -f]} {[DQ [VarSub prog]]} {[LIT_CHARS _tmp/input.txt]} ) ) ) (FunctionDef debug-sed [] (List (= scope= flags=0 words=[] bindings=[('case', {[TildeSub ''] [LIT_CHARS /git/scratch/afl-fuzz/_tmp/findings/crashes/id] [LIT_OTHER ":"] [LIT_CHARS 000000] [LIT_COMMA ","] [LIT_CHARS sig] [LIT_OTHER ":"] [LIT_CHARS 11] [LIT_COMMA ","] [LIT_CHARS src] [LIT_OTHER ":"] [LIT_CHARS 000000] [LIT_COMMA ","] [LIT_CHARS op] [LIT_OTHER ":"] [LIT_CHARS havoc] [LIT_COMMA ","] [LIT_CHARS rep] [LIT_OTHER ":"] [LIT_CHARS 64]})]) (Com {[LIT_CHARS build-toybox]} ) (Com {[LIT_CHARS pushd]} {[VarSub TOYBOX_DIR]} ) (Com {[LIT_CHARS gdb]} {[LIT_CHARS --tui]} {[LIT_CHARS --args]} {[LIT_CHARS ./toybox_unstripped]} {[LIT_CHARS sed]} {[LIT_CHARS -e]} {[SQ ]} {[LIT_CHARS _tmp/input.txt]} ) (Com {[LIT_CHARS popd]} ) ) ) (= scope= flags=2 words=[] bindings=[('TMPFS_DIR', {[TildeSub ''] [LIT_CHARS /afl-fuzz/tmpfs]})]) (FunctionDef _make-tmpfs [] (List (= scope= flags=0 words=[] bindings=[('mount_dir', {[VarSub TMPFS_DIR]})]) (Com {[LIT_CHARS mkdir]} {[LIT_CHARS -p]} {[VarSub mount_dir]} ) (Com {[LIT_CHARS mount]} {[LIT_CHARS -t]} {[LIT_CHARS tmpfs]} {[LIT_CHARS -o]} {[LIT_VAR_LIKE "size="] [LIT_CHARS 10m] =} {[LIT_CHARS tmpfs]} {[VarSub mount_dir]} ) (Com {[LIT_CHARS ls]} {[LIT_CHARS -al]} {[VarSub mount_dir]} ) (Com {[LIT_CHARS df]} {[LIT_CHARS -h]} ) ) ) (FunctionDef make-tmpfs [] (Com {[LIT_CHARS sudo]} {[VarSub 0]} {[LIT_CHARS _make-tmpfs]} ) ) (Com {[DQ [VarSub @]]} ) )