AFL-GCC compiles differently than GCC

Question

I want to understand AFL's code instrumentation in detail. Compiling a sample program sample.c

int main(int argc, char **argv) {
  int ret = 0;
  if(argc > 1) {
    ret = 7;
  } else {
    ret = 12;
  }
  return ret;
}

with gcc -c -o obj/sample-gcc.o src/sample.c and afl-gcc -c -o obj/sample-afl-gcc.o src/sample.c and disassembling both with objdump -d leads to different Assembly code:

[GCC]

0000000000000000 <main>:
   0:   f3 0f 1e fa             endbr64 
   4:   55                      push   %rbp
   5:   48 89 e5                mov    %rsp,%rbp
   8:   89 7d ec                mov    %edi,-0x14(%rbp)
   b:   48 89 75 e0             mov    %rsi,-0x20(%rbp)
   f:   c7 45 fc 00 00 00 00    movl   $0x0,-0x4(%rbp)
  16:   83 7d ec 01             cmpl   $0x1,-0x14(%rbp)
  1a:   7e 09                   jle    25 <main+0x25>
  1c:   c7 45 fc 07 00 00 00    movl   $0x7,-0x4(%rbp)
  23:   eb 07                   jmp    2c <main+0x2c>
  25:   c7 45 fc 0c 00 00 00    movl   $0xc,-0x4(%rbp)
  2c:   8b 45 fc                mov    -0x4(%rbp),%eax
  2f:   5d                      pop    %rbp
  30:   c3                      retq 

[AFL-GCC]

0000000000000000 <main>:
   0:   48 8d a4 24 68 ff ff    lea    -0x98(%rsp),%rsp
   7:   ff 
   8:   48 89 14 24             mov    %rdx,(%rsp)
   c:   48 89 4c 24 08          mov    %rcx,0x8(%rsp)
  11:   48 89 44 24 10          mov    %rax,0x10(%rsp)
  16:   48 c7 c1 0e ff 00 00    mov    $0xff0e,%rcx
  1d:   e8 00 00 00 00          callq  22 <main+0x22>
  22:   48 8b 44 24 10          mov    0x10(%rsp),%rax
  27:   48 8b 4c 24 08          mov    0x8(%rsp),%rcx
  2c:   48 8b 14 24             mov    (%rsp),%rdx
  30:   48 8d a4 24 98 00 00    lea    0x98(%rsp),%rsp
  37:   00 
  38:   f3 0f 1e fa             endbr64 
  3c:   31 c0                   xor    %eax,%eax
  3e:   83 ff 01                cmp    $0x1,%edi
  41:   0f 9e c0                setle  %al
  44:   8d 44 80 07             lea    0x7(%rax,%rax,4),%eax
  48:   c3                      retq 

• AFL (usually) adds a trampoline in front of every basic block to track executed paths [https://github.com/mirrorer/afl/blob/master/afl-as.h#L130] -> Instruction 0x00 lea until 0x30 lea
• AFL (usually) adds a main payload to the program (which I excluded due to simplicity) [https://github.com/mirrorer/afl/blob/master/afl-as.h#L381]
• AFL claims to use a wrapper for GCC, so I expected everything else to be equal. Why is the if-else-condition still compiled differently?
• Bonus question: If a binary without source code available should be instrumented manually without using AFL's QEMU-mode or Unicorn-mode, can this be achieved by (naively) adding the main payload and each trampoline manually to the binary file or are there better approaches?

Answer 1

Re: Why the compilation with gcc and with afl-gcc is different, a short look at the afl-gcc source shows that by default it modifies the compiler parameters, setting -O3 -funroll-loops (as well as defining __AFL_COMPILER and FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION).

According to the documentation (docs/env_variables.txt):

By default, the wrapper appends -O3 to optimize builds. Very rarely, this will cause problems in programs built with -Werror, simply because -O3 enables more thorough code analysis and can spew out additional warnings. To disable optimizations, set AFL_DONT_OPTIMIZE.