ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-11 01:31:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

format code for demo-so.c and template.cpp

Browse Source
This commit is contained in:
hac425 2019-11-14 14:38:04 +00:00
parent 5efd936e1e
commit 0071e537f3
2 changed files with 190 additions and 177 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
qbdi_mode/demo-so.c
View File

@ -1,33 +1,39 @@
#include <stdio.h> #include <stdio.h>
// gcc -shared -o libdemo.so demo-so.c -w // gcc -shared -o libdemo.so demo-so.c -w
int target_func(char *buf, int size) int target_func(char *buf, int size) {
{
printf("buffer:%p, size:%p\n", buf, size); printf("buffer:%p, size:%p\n", buf, size);
switch (buf[0]) switch (buf[0]) {
{
case 1: case 1:
puts("222"); puts("222");
if (buf[1] == '\x44') if (buf[1] == '\x44') {
{
puts("null ptr deference"); puts("null ptr deference");
*(char *)(0) = 1; *(char *)(0) = 1;
}
break; }
case 0xff:
if (buf[2] == '\xff')
{
if (buf[1] == '\x44')
{
puts("crash....");
*(char *)(0xdeadbeef) = 1;
}
}
break;
default:
puts("default action");
break;
}
return 1; break;
case 0xff:
if (buf[2] == '\xff') {
if (buf[1] == '\x44') {
puts("crash....");
*(char *)(0xdeadbeef) = 1;
}
}
break;
default: puts("default action"); break;
}
return 1;
} }

307
qbdi_mode/template.cpp
View File

@ -24,205 +24,212 @@ using namespace QBDI;
typedef int (*target_func)(char *buf, int size); typedef int (*target_func)(char *buf, int size);
static const size_t STACK_SIZE = 0x100000; // 1MB static const size_t STACK_SIZE = 0x100000; // 1MB
static const QBDI::rword FAKE_RET_ADDR = 0x40000; static const QBDI::rword FAKE_RET_ADDR = 0x40000;
target_func p_target_func = NULL; target_func p_target_func = NULL;
rword module_base = 0; rword module_base = 0;
rword module_end = 0; rword module_end = 0;
static unsigned char static unsigned char
dummy[MAP_SIZE]; /* costs MAP_SIZE but saves a few instructions */ dummy[MAP_SIZE]; /* costs MAP_SIZE but saves a few instructions */
unsigned char *afl_area_ptr = NULL; /* Exported for afl_gen_trace */ unsigned char *afl_area_ptr = NULL; /* Exported for afl_gen_trace */
unsigned long afl_prev_loc = 0; unsigned long afl_prev_loc = 0;
/* Set up SHM region and initialize other stuff. */ /* Set up SHM region and initialize other stuff. */
int afl_setup(void) int afl_setup(void) {
{
char *id_str = getenv(SHM_ENV_VAR); char *id_str = getenv(SHM_ENV_VAR);
int shm_id; int shm_id;
if (id_str) if (id_str) {
{
shm_id = atoi(id_str); shm_id = atoi(id_str);
afl_area_ptr = (unsigned char *)shmat(shm_id, NULL, 0); afl_area_ptr = (unsigned char *)shmat(shm_id, NULL, 0);
if (afl_area_ptr == (void *)-1) if (afl_area_ptr == (void *)-1) return 0;
return 0; memset(afl_area_ptr, 0, MAP_SIZE);
memset(afl_area_ptr, 0, MAP_SIZE);
} }
return 1;
return 1;
} }
/* Fork server logic, invoked once we hit _start. */ /* Fork server logic, invoked once we hit _start. */
static void afl_forkserver() static void afl_forkserver() {
{
static unsigned char tmp[4]; static unsigned char tmp[4];
pid_t child_pid; pid_t child_pid;
if (write(FORKSRV_FD + 1, tmp, 4) != 4) if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
return;
while (1) while (1) {
{
int status; int status;
u32 was_killed; u32 was_killed;
// wait for afl-fuzz // wait for afl-fuzz
if (read(FORKSRV_FD, &was_killed, 4) != 4) if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(2);
exit(2);
child_pid = fork(); child_pid = fork();
if (child_pid < 0) if (child_pid < 0) exit(4);
exit(4);
if (!child_pid) if (!child_pid) {
{
// child return to execute code
close(FORKSRV_FD);
close(FORKSRV_FD + 1);
return;
}
// write child pid to afl-fuzz // child return to execute code
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) close(FORKSRV_FD);
exit(5); close(FORKSRV_FD + 1);
return;
// wait child stop
if (waitpid(child_pid, &status, 0) < 0)
exit(6);
// send child stop status to afl-fuzz
if (write(FORKSRV_FD + 1, &status, 4) != 4)
exit(7);
} }
// write child pid to afl-fuzz
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(5);
// wait child stop
if (waitpid(child_pid, &status, 0) < 0) exit(6);
// send child stop status to afl-fuzz
if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7);
}
} }
void afl_maybe_log(unsigned long cur_loc) void afl_maybe_log(unsigned long cur_loc) {
{
if (afl_area_ptr == NULL) if (afl_area_ptr == NULL) { return; }
{ unsigned long afl_idx = cur_loc ^ afl_prev_loc;
return; afl_area_ptr[afl_idx % MAP_SIZE]++;
} afl_prev_loc = cur_loc >> 1;
unsigned long afl_idx = cur_loc ^ afl_prev_loc;
afl_area_ptr[afl_idx % MAP_SIZE]++;
afl_prev_loc = cur_loc >> 1;
} }
char *read_file(char *path, unsigned long *length)
{ char *read_file(char *path, unsigned long *length) {
FILE *pFile = fopen(path, "rb");
char *pBuf; FILE *pFile = fopen(path, "rb");
fseek(pFile, 0, SEEK_END); char *pBuf;
unsigned long len = ftell(pFile); fseek(pFile, 0, SEEK_END);
pBuf = (char *)malloc(len); unsigned long len = ftell(pFile);
rewind(pFile); pBuf = (char *)malloc(len);
fread(pBuf, 1, len, pFile); rewind(pFile);
fclose(pFile); fread(pBuf, 1, len, pFile);
*length = len; fclose(pFile);
return pBuf; *length = len;
return pBuf;
} }
char FPATH[200]; char FPATH[200];
QBDI_NOINLINE int fuzz_func() QBDI_NOINLINE int fuzz_func() {
{
if (afl_setup()) if (afl_setup()) { afl_forkserver(); }
{
afl_forkserver();
}
unsigned long len = 0; unsigned long len = 0;
char *data = read_file(FPATH, &len); char * data = read_file(FPATH, &len);
printf("In fuzz_func\n");
p_target_func(data, len);
return 1;
printf("In fuzz_func\n");
p_target_func(data, len);
return 1;
} }
static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm, const QBDI::VMState *state, QBDI::GPRState *gprState, QBDI::FPRState *fprState, void *data) static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm,
{ const QBDI::VMState *state,
// errno = SAVED_ERRNO; QBDI::GPRState * gprState,
QBDI::FPRState *fprState, void *data) {
// errno = SAVED_ERRNO;
#ifdef __x86_64__ #ifdef __x86_64__
unsigned long pc = gprState->rip; unsigned long pc = gprState->rip;
#elif defined(i386) #elif defined(i386)
unsigned long pc = gprState->eip; unsigned long pc = gprState->eip;
#elif defined(__arm__) #elif defined(__arm__)
unsigned long pc = gprState->pc; unsigned long pc = gprState->pc;
#endif #endif
// just log the module path // just log the module path
if (pc >= module_base && pc <= module_end) if (pc >= module_base && pc <= module_end) {
{
unsigned long offset = pc - module_base; unsigned long offset = pc - module_base;
printf("\toffset:%p\n", offset); printf("\toffset:%p\n", offset);
afl_maybe_log(offset); afl_maybe_log(offset);
}
return QBDI::VMAction::CONTINUE; }
return QBDI::VMAction::CONTINUE;
} }
int main(int argc, char **argv) int main(int argc, char **argv) {
{
if (argc < 3) {
puts("usage: ./loader library_path input_file_path");
exit(0);
}
const char *lib_path;
lib_path = argv[1];
// FPATH = argv[2];
strcpy(FPATH, argv[2]);
void *handle = dlopen(lib_path, RTLD_LAZY);
if (handle == nullptr) {
perror("Cannot load library");
exit(EXIT_FAILURE);
}
const char *lib_name = lib_path;
if (strrchr(lib_name, '/') != nullptr) lib_name = strrchr(lib_name, '/') + 1;
// printf("library name:%s\n", lib_name);
// load library module address for log path
for (MemoryMap &map : getCurrentProcessMaps()) {
// printf("module:%s\n", map.name.c_str());
if ((map.permission & PF_EXEC) &&
strstr(map.name.c_str(), lib_name) != NULL) {
module_base = map.range.start;
module_end = map.range.end;
if (argc < 3)
{
puts("usage: ./loader library_path input_file_path");
exit(0);
} }
const char *lib_path; }
lib_path = argv[1];
// FPATH = argv[2];
strcpy(FPATH, argv[2]);
void *handle = dlopen(lib_path, RTLD_LAZY);
if (handle == nullptr) if (module_base == 0) {
{
perror("Cannot load library");
exit(EXIT_FAILURE);
}
const char *lib_name = lib_path; std::cerr << "Fail to find base address" << std::endl;
if (strrchr(lib_name, '/') != nullptr) return -1;
lib_name = strrchr(lib_name, '/') + 1;
// printf("library name:%s\n", lib_name); }
// load library module address for log path
for (MemoryMap &map : getCurrentProcessMaps())
{
// printf("module:%s\n", map.name.c_str());
if ((map.permission & PF_EXEC) && strstr(map.name.c_str(), lib_name) != NULL)
{
module_base = map.range.start;
module_end = map.range.end;
}
}
if (module_base == 0) // printf("module base:%p, module end:%p\n", module_base, module_end);
{ p_target_func = (target_func)dlsym(handle, "target_func");
std::cerr << "Fail to find base address" << std::endl; // p_target_func = (target_func)(module_base + 0x61a);
return -1; printf("p_target_func:%p\n", p_target_func);
}
// printf("module base:%p, module end:%p\n", module_base, module_end);
p_target_func = (target_func)dlsym(handle, "target_func");
// p_target_func = (target_func)(module_base + 0x61a);
printf("p_target_func:%p\n", p_target_func);
VM vm; VM vm;
uint8_t *fakestack = nullptr; uint8_t *fakestack = nullptr;
GPRState *state = vm.getGPRState(); GPRState *state = vm.getGPRState();
allocateVirtualStack(state, STACK_SIZE, &fakestack); allocateVirtualStack(state, STACK_SIZE, &fakestack);
vm.addInstrumentedModuleFromAddr(module_base); vm.addInstrumentedModuleFromAddr(module_base);
vm.addInstrumentedModuleFromAddr((rword)&main); vm.addInstrumentedModuleFromAddr((rword)&main);
vm.addVMEventCB(BASIC_BLOCK_ENTRY, bbcallback, nullptr); vm.addVMEventCB(BASIC_BLOCK_ENTRY, bbcallback, nullptr);
// QBDI::simulateCall(state, FAKE_RET_ADDR); // QBDI::simulateCall(state, FAKE_RET_ADDR);
// vm.run((rword)&fuzz_func, (rword)FAKE_RET_ADDR); // vm.run((rword)&fuzz_func, (rword)FAKE_RET_ADDR);
rword ret; rword ret;
vm.call(&ret, (rword)&fuzz_func, {}); vm.call(&ret, (rword)&fuzz_func, {});
return 0;
return 0;
} }