mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-11 17:51:32 +00:00
van Hauser
GitHub
@ -49,7 +49,7 @@ static gboolean asan_exclude_module(const GumModuleDetails *details,
|
||||
|
||||
void asan_exclude_module_by_symbol(gchar *symbol_name) {
|
||||
|
||||
gum_process_enumerate_modules(asan_exclude_module, "__asan_loadN");
|
||||
gum_process_enumerate_modules(asan_exclude_module, symbol_name);
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
#include "frida-gumjs.h"
|
||||
|
||||
#include "ctx.h"
|
||||
#include "util.h"
|
||||
|
||||
#if defined(__arm__)
|
||||
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
#include "frida-gumjs.h"
|
||||
|
||||
#include "ctx.h"
|
||||
#include "util.h"
|
||||
|
||||
#if defined(__aarch64__)
|
||||
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
#include "frida-gumjs.h"
|
||||
|
||||
#include "ctx.h"
|
||||
#include "util.h"
|
||||
|
||||
#if defined(__i386__)
|
||||
|
||||
|
||||
@ -68,10 +68,10 @@ typedef struct {
|
||||
// sahf
|
||||
// mov rax,QWORD PTR [rsp-0x80]
|
||||
|
||||
uint8_t mov_rax_rsp_80[5];
|
||||
uint8_t lahf;
|
||||
uint8_t mov_rax_rsp_88[8];
|
||||
uint8_t mov_rbx_rsp_90[8];
|
||||
uint8_t lahf;
|
||||
uint8_t mov_rax_rsp_90[8];
|
||||
uint8_t mov_rbx_rsp_98[8];
|
||||
|
||||
uint8_t mov_eax_prev_loc[6];
|
||||
uint8_t mov_prev_loc_curr_loc_shr1[10];
|
||||
@ -83,10 +83,10 @@ typedef struct {
|
||||
uint8_t adc_bl_0[3];
|
||||
uint8_t mov_ptr_rax_rbx[2];
|
||||
|
||||
uint8_t mov_rsp_90_rbx[8];
|
||||
uint8_t mov_rsp_88_rax[8];
|
||||
uint8_t mov_rsp_98_rbx[8];
|
||||
uint8_t mov_rsp_90_rax[8];
|
||||
uint8_t sahf;
|
||||
uint8_t mov_rsp_80_rax[5];
|
||||
uint8_t mov_rsp_88_rax[8];
|
||||
|
||||
} afl_log_code_asm_t;
|
||||
|
||||
@ -102,10 +102,10 @@ typedef union {
|
||||
static const afl_log_code_asm_t template =
|
||||
{
|
||||
|
||||
.mov_rax_rsp_80 = {0x48, 0x89, 0x44, 0x24, 0x80},
|
||||
.lahf = 0x9f,
|
||||
.mov_rax_rsp_88 = {0x48, 0x89, 0x84, 0x24, 0x78, 0xFF, 0xFF, 0xFF},
|
||||
.mov_rbx_rsp_90 = {0x48, 0x89, 0x9C, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
|
||||
.lahf = 0x9f,
|
||||
.mov_rax_rsp_90 = {0x48, 0x89, 0x84, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
|
||||
.mov_rbx_rsp_98 = {0x48, 0x89, 0x9C, 0x24, 0x68, 0xFF, 0xFF, 0xFF},
|
||||
|
||||
.mov_eax_prev_loc = {0x8b, 0x05},
|
||||
.mov_prev_loc_curr_loc_shr1 = {0xc7, 0x05},
|
||||
@ -116,10 +116,10 @@ static const afl_log_code_asm_t template =
|
||||
.adc_bl_0 = {0x80, 0xd3, 0x00},
|
||||
.mov_ptr_rax_rbx = {0x88, 0x18},
|
||||
|
||||
.mov_rsp_90_rbx = {0x48, 0x8B, 0x9C, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
|
||||
.mov_rsp_88_rax = {0x48, 0x8B, 0x84, 0x24, 0x78, 0xFF, 0xFF, 0xFF},
|
||||
.mov_rsp_98_rbx = {0x48, 0x8B, 0x9C, 0x24, 0x68, 0xFF, 0xFF, 0xFF},
|
||||
.mov_rsp_90_rax = {0x48, 0x8B, 0x84, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
|
||||
.sahf = 0x9e,
|
||||
.mov_rsp_80_rax = {0x48, 0x8B, 0x44, 0x24, 0x80},
|
||||
.mov_rsp_88_rax = {0x48, 0x8B, 0x84, 0x24, 0x78, 0xFF, 0xFF, 0xFF},
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -1,67 +1,144 @@
|
||||
#include "frida-gumjs.h"
|
||||
|
||||
#include "instrument.h"
|
||||
#include "stalker.h"
|
||||
#include "util.h"
|
||||
|
||||
#if defined(__i386__)
|
||||
|
||||
static GumAddress current_log_impl = GUM_ADDRESS(0);
|
||||
static GHashTable *coverage_blocks = NULL;
|
||||
|
||||
static void instrument_coverage_function(GumX86Writer *cw) {
|
||||
#pragma pack(push, 1)
|
||||
typedef struct {
|
||||
|
||||
gum_x86_writer_put_pushfx(cw);
|
||||
gum_x86_writer_put_push_reg(cw, GUM_REG_ECX);
|
||||
gum_x86_writer_put_push_reg(cw, GUM_REG_EDX);
|
||||
// cur_location = (block_address >> 4) ^ (block_address << 8);
|
||||
// shared_mem[cur_location ^ prev_location]++;
|
||||
// prev_location = cur_location >> 1;
|
||||
|
||||
gum_x86_writer_put_mov_reg_address(cw, GUM_REG_ECX,
|
||||
GUM_ADDRESS(&instrument_previous_pc));
|
||||
gum_x86_writer_put_mov_reg_reg_ptr(cw, GUM_REG_EDX, GUM_REG_ECX);
|
||||
gum_x86_writer_put_xor_reg_reg(cw, GUM_REG_EDX, GUM_REG_EDI);
|
||||
uint8_t mov_eax_esp_4[4];
|
||||
uint8_t lahf;
|
||||
uint8_t mov_eax_esp_8[4];
|
||||
uint8_t mov_ebx_esp_c[4];
|
||||
|
||||
gum_x86_writer_put_add_reg_imm(cw, GUM_REG_EDX, GUM_ADDRESS(__afl_area_ptr));
|
||||
uint8_t mov_eax_prev_loc[5];
|
||||
uint8_t mov_prev_loc_curr_loc_shr1[10];
|
||||
|
||||
/* add byte ptr [edx], 1 */
|
||||
uint8_t add_byte_ptr_edx_1[] = {0x80, 0x02, 0x01};
|
||||
gum_x86_writer_put_bytes(cw, add_byte_ptr_edx_1, sizeof(add_byte_ptr_edx_1));
|
||||
uint8_t xor_eax_curr_loc[5];
|
||||
uint8_t add_eax_area_ptr[5];
|
||||
|
||||
/* adc byte ptr [edx], 0 */
|
||||
uint8_t adc_byte_ptr_edx_0[] = {0x80, 0x12, 0x00};
|
||||
gum_x86_writer_put_bytes(cw, adc_byte_ptr_edx_0, sizeof(adc_byte_ptr_edx_0));
|
||||
uint8_t mov_ebx_ptr_eax[2];
|
||||
uint8_t add_bl_1[3];
|
||||
uint8_t adc_bl_0[3];
|
||||
uint8_t mov_ptr_eax_ebx[2];
|
||||
|
||||
uint8_t ror_di_1[] = {0x66, 0xd1, 0xcf};
|
||||
gum_x86_writer_put_bytes(cw, ror_di_1, sizeof(ror_di_1));
|
||||
gum_x86_writer_put_mov_reg_ptr_reg(cw, GUM_REG_ECX, GUM_REG_EDI);
|
||||
uint8_t mov_esp_c_ebx[4];
|
||||
uint8_t mov_esp_8_eax[4];
|
||||
uint8_t sahf;
|
||||
uint8_t mov_esp_4_eax[4];
|
||||
|
||||
gum_x86_writer_put_pop_reg(cw, GUM_REG_EDX);
|
||||
gum_x86_writer_put_pop_reg(cw, GUM_REG_ECX);
|
||||
gum_x86_writer_put_popfx(cw);
|
||||
gum_x86_writer_put_ret(cw);
|
||||
} afl_log_code_asm_t;
|
||||
|
||||
#pragma pack(pop)
|
||||
|
||||
typedef union {
|
||||
|
||||
afl_log_code_asm_t code;
|
||||
uint8_t bytes[0];
|
||||
|
||||
} afl_log_code;
|
||||
|
||||
static const afl_log_code_asm_t template =
|
||||
{
|
||||
|
||||
.mov_eax_esp_4 = {0x89, 0x44, 0x24, 0xFC},
|
||||
.lahf = 0x9f,
|
||||
.mov_eax_esp_8 = {0x89, 0x44, 0x24, 0xF8},
|
||||
.mov_ebx_esp_c = {0x89, 0x5C, 0x24, 0xF4},
|
||||
|
||||
.mov_eax_prev_loc = {0xA1},
|
||||
.mov_prev_loc_curr_loc_shr1 = {0xc7, 0x05},
|
||||
|
||||
.xor_eax_curr_loc = {0x35},
|
||||
.add_eax_area_ptr = {0x05},
|
||||
.mov_ebx_ptr_eax = {0x8a, 0x18},
|
||||
.add_bl_1 = {0x80, 0xc3, 0x01},
|
||||
.adc_bl_0 = {0x80, 0xd3, 0x00},
|
||||
.mov_ptr_eax_ebx = {0x88, 0x18},
|
||||
|
||||
.mov_esp_c_ebx = {0x8B, 0x5C, 0x24, 0xF4},
|
||||
.mov_esp_8_eax = {0x8B, 0x44, 0x24, 0xF8},
|
||||
.sahf = 0x9e,
|
||||
.mov_esp_4_eax = {0x8B, 0x44, 0x24, 0xFC},
|
||||
|
||||
}
|
||||
|
||||
;
|
||||
|
||||
gboolean instrument_is_coverage_optimize_supported(void) {
|
||||
|
||||
return true;
|
||||
|
||||
}
|
||||
|
||||
static void instrument_coverate_write_function(GumStalkerOutput *output) {
|
||||
static void instrument_coverage_switch(GumStalkerObserver *self,
|
||||
gpointer start_address,
|
||||
const cs_insn * from_insn,
|
||||
gpointer * target) {
|
||||
|
||||
GumX86Writer *cw = output->writer.x86;
|
||||
UNUSED_PARAMETER(self);
|
||||
UNUSED_PARAMETER(start_address);
|
||||
|
||||
if (current_log_impl == 0 ||
|
||||
!gum_x86_writer_can_branch_directly_between(cw->pc, current_log_impl) ||
|
||||
!gum_x86_writer_can_branch_directly_between(cw->pc + 128,
|
||||
current_log_impl)) {
|
||||
cs_x86 * x86;
|
||||
cs_x86_op *op;
|
||||
if (from_insn == NULL) { return; }
|
||||
|
||||
gconstpointer after_log_impl = cw->code + 1;
|
||||
x86 = &from_insn->detail->x86;
|
||||
op = x86->operands;
|
||||
|
||||
gum_x86_writer_put_jmp_near_label(cw, after_log_impl);
|
||||
if (!g_hash_table_contains(coverage_blocks, GSIZE_TO_POINTER(*target))) {
|
||||
|
||||
current_log_impl = cw->pc;
|
||||
instrument_coverage_function(cw);
|
||||
return;
|
||||
|
||||
gum_x86_writer_put_label(cw, after_log_impl);
|
||||
}
|
||||
|
||||
switch (from_insn->id) {
|
||||
|
||||
case X86_INS_CALL:
|
||||
case X86_INS_JMP:
|
||||
if (x86->op_count != 1) {
|
||||
|
||||
FATAL("Unexpected operand count: %d", x86->op_count);
|
||||
|
||||
}
|
||||
|
||||
if (op[0].type != X86_OP_IMM) { return; }
|
||||
|
||||
break;
|
||||
case X86_INS_RET:
|
||||
break;
|
||||
default:
|
||||
return;
|
||||
|
||||
}
|
||||
|
||||
*target = (guint8 *)*target + sizeof(afl_log_code);
|
||||
|
||||
}
|
||||
|
||||
static void instrument_coverage_suppress_init(void) {
|
||||
|
||||
static gboolean initialized = false;
|
||||
if (initialized) { return; }
|
||||
initialized = true;
|
||||
|
||||
GumStalkerObserver * observer = stalker_get_observer();
|
||||
GumStalkerObserverInterface *iface = GUM_STALKER_OBSERVER_GET_IFACE(observer);
|
||||
iface->switch_callback = instrument_coverage_switch;
|
||||
|
||||
coverage_blocks = g_hash_table_new(g_direct_hash, g_direct_equal);
|
||||
if (coverage_blocks == NULL) {
|
||||
|
||||
FATAL("Failed to g_hash_table_new, errno: %d", errno);
|
||||
|
||||
}
|
||||
|
||||
@ -70,14 +147,61 @@ static void instrument_coverate_write_function(GumStalkerOutput *output) {
|
||||
void instrument_coverage_optimize(const cs_insn * instr,
|
||||
GumStalkerOutput *output) {
|
||||
|
||||
afl_log_code code = {0};
|
||||
GumX86Writer *cw = output->writer.x86;
|
||||
guint64 area_offset = instrument_get_offset_hash(GUM_ADDRESS(instr->address));
|
||||
instrument_coverate_write_function(output);
|
||||
gsize map_size_pow2;
|
||||
gsize area_offset_ror;
|
||||
|
||||
gum_x86_writer_put_push_reg(cw, GUM_REG_EDI);
|
||||
gum_x86_writer_put_mov_reg_address(cw, GUM_REG_EDI, area_offset);
|
||||
gum_x86_writer_put_call_address(cw, current_log_impl);
|
||||
gum_x86_writer_put_pop_reg(cw, GUM_REG_EDI);
|
||||
code.code = template;
|
||||
|
||||
instrument_coverage_suppress_init();
|
||||
|
||||
// gum_x86_writer_put_breakpoint(cw);
|
||||
|
||||
if (!g_hash_table_add(coverage_blocks, GSIZE_TO_POINTER(cw->code))) {
|
||||
|
||||
FATAL("Failed - g_hash_table_add");
|
||||
|
||||
}
|
||||
|
||||
gssize prev_loc_value_offset2 =
|
||||
offsetof(afl_log_code, code.mov_eax_prev_loc) +
|
||||
sizeof(code.code.mov_eax_prev_loc) - sizeof(gint);
|
||||
|
||||
*((gint *)&code.bytes[prev_loc_value_offset2]) =
|
||||
(gint)GPOINTER_TO_SIZE(&instrument_previous_pc);
|
||||
|
||||
gssize curr_loc_shr_1_offset =
|
||||
offsetof(afl_log_code, code.mov_prev_loc_curr_loc_shr1) +
|
||||
sizeof(code.code.mov_prev_loc_curr_loc_shr1) - sizeof(guint32);
|
||||
|
||||
map_size_pow2 = util_log2(__afl_map_size);
|
||||
area_offset_ror = util_rotate(area_offset, 1, map_size_pow2);
|
||||
|
||||
*((guint32 *)&code.bytes[curr_loc_shr_1_offset]) = (guint32)(area_offset_ror);
|
||||
|
||||
gssize prev_loc_value_offset =
|
||||
offsetof(afl_log_code, code.mov_prev_loc_curr_loc_shr1) +
|
||||
sizeof(code.code.mov_prev_loc_curr_loc_shr1) - sizeof(gint) -
|
||||
sizeof(guint32);
|
||||
|
||||
*((gint *)&code.bytes[prev_loc_value_offset]) =
|
||||
(gint)GPOINTER_TO_SIZE(&instrument_previous_pc);
|
||||
|
||||
gssize xor_curr_loc_offset = offsetof(afl_log_code, code.xor_eax_curr_loc) +
|
||||
sizeof(code.code.xor_eax_curr_loc) -
|
||||
sizeof(guint32);
|
||||
|
||||
*((guint32 *)&code.bytes[xor_curr_loc_offset]) = (guint32)area_offset;
|
||||
|
||||
gssize add_area_ptr_offset = offsetof(afl_log_code, code.add_eax_area_ptr) +
|
||||
sizeof(code.code.add_eax_area_ptr) -
|
||||
sizeof(guint32);
|
||||
|
||||
*((guint32 *)&code.bytes[add_area_ptr_offset]) = (guint32)__afl_area_ptr;
|
||||
|
||||
gum_x86_writer_put_bytes(cw, code.bytes, sizeof(afl_log_code));
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -4,6 +4,7 @@
|
||||
|
||||
#include "instrument.h"
|
||||
#include "persistent.h"
|
||||
#include "util.h"
|
||||
|
||||
#if defined(__i386__)
|
||||
|
||||
|
||||
@ -84,7 +84,7 @@ all: $(TEST_BIN)
|
||||
make -C $(ROOT)frida_mode/
|
||||
|
||||
32:
|
||||
CXXFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
|
||||
CFLAGS="-m32" CXXFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
|
||||
|
||||
$(BUILD_DIR):
|
||||
mkdir -p $@
|
||||
@ -126,7 +126,7 @@ $(HARNESS_SRC):
|
||||
wget -O $@ $(HARNESS_URL)
|
||||
|
||||
$(HARNESS_OBJ): $(HARNESS_SRC)
|
||||
$(CC) -o $@ -c $<
|
||||
$(CC) $(CFLAGS) -o $@ -c $<
|
||||
|
||||
########## TEST #######
|
||||
|
||||
|
||||
200
frida_mode/test/vorbis/GNUmakefile
Normal file
200
frida_mode/test/vorbis/GNUmakefile
Normal file
@ -0,0 +1,200 @@
|
||||
PWD:=$(shell pwd)/
|
||||
ROOT:=$(PWD)../../../
|
||||
BUILD_DIR:=$(PWD)build/
|
||||
|
||||
AFLPP_FRIDA_DRIVER_HOOK_OBJ=$(ROOT)frida_mode/build/frida_hook.so
|
||||
AFLPP_QEMU_DRIVER_HOOK_OBJ=$(ROOT)frida_mode/build/qemu_hook.so
|
||||
|
||||
OGG_GIT_REPO:=https://github.com/xiph/ogg.git
|
||||
OGG_BUILD_DIR:=$(BUILD_DIR)ogg/
|
||||
OGG_DIR:=$(OGG_BUILD_DIR)ogg/
|
||||
OGG_INSTALL:=$(OGG_BUILD_DIR)install/
|
||||
OGG_LIB:=$(OGG_INSTALL)lib/libogg.a
|
||||
|
||||
VORBIS_GIT_REPO:=https://github.com/xiph/vorbis.git
|
||||
VORBIS_BUILD_DIR:=$(BUILD_DIR)vorbis/
|
||||
VORBIS_DIR:=$(VORBIS_BUILD_DIR)vorbis/
|
||||
VORBIS_INSTALL:=$(VORBIS_BUILD_DIR)install/
|
||||
VORBIS_LIB:=$(VORBIS_INSTALL)lib/libvorbis.a
|
||||
VORBISFILE_LIB:=$(VORBIS_INSTALL)lib/libvorbisfile.a
|
||||
|
||||
DECODE_URL:=https://raw.githubusercontent.com/google/oss-fuzz/688aadaf44499ddada755562109e5ca5eb3c5662/projects/vorbis/decode_fuzzer.cc
|
||||
DECODE_SRC:=$(BUILD_DIR)decode_fuzzer.cc
|
||||
DECODE_OBJ:=$(BUILD_DIR)decode_fuzzer.o
|
||||
|
||||
HARNESS_URL:=https://raw.githubusercontent.com/llvm/llvm-project/main/compiler-rt/lib/fuzzer/standalone/StandaloneFuzzTargetMain.c
|
||||
HARNESS_SRC:=$(BUILD_DIR)StandaloneFuzzTargetMain.c
|
||||
HARNESS_OBJ:=$(BUILD_DIR)StandaloneFuzzTargetMain.o
|
||||
|
||||
LDFLAGS += -lpthread
|
||||
|
||||
TEST_BIN:=$(BUILD_DIR)decode_fuzzer
|
||||
ifeq "$(shell uname)" "Darwin"
|
||||
TEST_BIN_LDFLAGS:=-undefined dynamic_lookup -Wl,-no_pie
|
||||
endif
|
||||
|
||||
TEST_DATA_DIR:=$(BUILD_DIR)in/
|
||||
TEST_DATA_SRC:=https://github.com/google/fuzzbench/blob/master/benchmarks/vorbis-2017-12-11/seeds/sound.ogg?raw=true
|
||||
TEST_DATA_FILE:=$(TEST_DATA_DIR)sound.ogg
|
||||
DUMMY_DATA_FILE:=$(BUILD_DIR)default_seed
|
||||
|
||||
FRIDA_OUT:=$(BUILD_DIR)frida-out
|
||||
QEMU_OUT:=$(BUILD_DIR)qemu-out
|
||||
|
||||
ifndef ARCH
|
||||
|
||||
ARCH=$(shell uname -m)
|
||||
ifeq "$(ARCH)" "aarch64"
|
||||
ARCH:=arm64
|
||||
endif
|
||||
|
||||
ifeq "$(ARCH)" "i686"
|
||||
ARCH:=x86
|
||||
endif
|
||||
endif
|
||||
|
||||
GET_SYMBOL_ADDR:=$(ROOT)frida_mode/util/get_symbol_addr.sh
|
||||
|
||||
AFL_QEMU_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x4000000000)
|
||||
|
||||
ifeq "$(ARCH)" "aarch64"
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x0000aaaaaaaaa000)
|
||||
endif
|
||||
|
||||
ifeq "$(ARCH)" "x86_64"
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x0000555555554000)
|
||||
endif
|
||||
|
||||
ifeq "$(ARCH)" "x86"
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x56555000)
|
||||
endif
|
||||
|
||||
.PHONY: all clean frida hook
|
||||
|
||||
all: $(TEST_BIN)
|
||||
make -C $(ROOT)frida_mode/
|
||||
|
||||
32:
|
||||
CXXFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
|
||||
|
||||
$(BUILD_DIR):
|
||||
mkdir -p $@
|
||||
|
||||
########## OGG #######
|
||||
|
||||
$(OGG_BUILD_DIR): | $(BUILD_DIR)
|
||||
mkdir -p $@
|
||||
|
||||
$(OGG_DIR): | $(OGG_BUILD_DIR)
|
||||
git clone $(OGG_GIT_REPO) $@
|
||||
git -C $(OGG_DIR) checkout c8391c2b267a7faf9a09df66b1f7d324e9eb7766
|
||||
|
||||
$(OGG_LIB): | $(OGG_DIR)
|
||||
cd $(OGG_DIR) && ./autogen.sh
|
||||
cd $(OGG_DIR) && ./configure \
|
||||
--prefix=$(OGG_INSTALL) \
|
||||
--enable-static \
|
||||
--disable-shared \
|
||||
--disable-crc
|
||||
make -C $(OGG_DIR) install
|
||||
|
||||
ogg: $(OGG_LIB)
|
||||
|
||||
########## VORBIS #######
|
||||
|
||||
$(VORBIS_BUILD_DIR): | $(BUILD_DIR)
|
||||
mkdir -p $@
|
||||
|
||||
$(VORBIS_DIR): | $(VORBIS_BUILD_DIR)
|
||||
git clone $(VORBIS_GIT_REPO) $@
|
||||
git -C $(VORBIS_DIR) checkout c1c2831fc7306d5fbd7bc800324efd12b28d327f
|
||||
|
||||
$(VORBIS_LIB): $(OGG_LIB) | $(VORBIS_DIR)
|
||||
cd $(VORBIS_DIR) && ./autogen.sh
|
||||
cd $(VORBIS_DIR) && ./configure \
|
||||
--prefix=$(VORBIS_INSTALL) \
|
||||
--enable-static \
|
||||
--disable-shared \
|
||||
--with-ogg=$(OGG_INSTALL)
|
||||
make -C $(VORBIS_DIR) install
|
||||
|
||||
vorbis: $(VORBIS_LIB)
|
||||
|
||||
########## HARNESS #######
|
||||
|
||||
$(DECODE_SRC):
|
||||
wget -O $@ $(DECODE_URL)
|
||||
|
||||
$(DECODE_OBJ): $(DECODE_SRC)
|
||||
$(CXX) -o $@ -c $< -I$(VORBIS_DIR)include/ -I$(OGG_DIR)include/
|
||||
|
||||
decode: $(DECODE_OBJ)
|
||||
|
||||
########## HARNESS #######
|
||||
|
||||
$(HARNESS_SRC):
|
||||
wget -O $@ $(HARNESS_URL)
|
||||
|
||||
$(HARNESS_OBJ): $(HARNESS_SRC)
|
||||
$(CC) -o $@ -c $<
|
||||
|
||||
harness: $(HARNESS_OBJ)
|
||||
|
||||
########## TEST #######
|
||||
|
||||
$(TEST_BIN): $(VORBIS_LIB) $(OGG_LIB) $(HARNESS_OBJ) $(DECODE_OBJ)
|
||||
$(CXX) \
|
||||
$(CXXFLAGS) \
|
||||
-std=c++11 \
|
||||
$(DECODE_OBJ) \
|
||||
$(HARNESS_OBJ) \
|
||||
$(VORBISFILE_LIB) \
|
||||
$(VORBIS_LIB) \
|
||||
$(OGG_LIB) \
|
||||
-o $@
|
||||
|
||||
########## DUMMY #######
|
||||
|
||||
$(TEST_DATA_DIR): | $(BUILD_DIR)
|
||||
mkdir -p $@
|
||||
|
||||
$(DUMMY_DATA_FILE): | $(TEST_DATA_DIR)
|
||||
dd if=/dev/zero bs=1048576 count=1 of=$@
|
||||
|
||||
###### TEST DATA #######
|
||||
|
||||
$(TEST_DATA_FILE):
|
||||
wget -O $@ $(TEST_DATA_SRC)
|
||||
|
||||
clean:
|
||||
rm -rf $(BUILD_DIR)
|
||||
|
||||
frida: $(TEST_BIN) $(AFLPP_FRIDA_DRIVER_HOOK_OBJ) $(TEST_DATA_FILE) $(DUMMY_DATA_FILE)
|
||||
AFL_FRIDA_PERSISTENT_CNT=1000000 \
|
||||
AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
|
||||
AFL_ENTRYPOINT=$(AFL_FRIDA_PERSISTENT_ADDR) \
|
||||
$(ROOT)afl-fuzz \
|
||||
-i $(TEST_DATA_DIR) \
|
||||
-o $(FRIDA_OUT) \
|
||||
-m none \
|
||||
-d \
|
||||
-O \
|
||||
-V 30 \
|
||||
-- \
|
||||
$(TEST_BIN) $(DUMMY_DATA_FILE)
|
||||
|
||||
qemu: $(TEST_BIN) $(AFLPP_QEMU_DRIVER_HOOK_OBJ) $(TEST_DATA_FILE) $(DUMMY_DATA_FILE)
|
||||
AFL_QEMU_PERSISTENT_CNT=1000000 \
|
||||
AFL_QEMU_PERSISTENT_HOOK=$(AFLPP_QEMU_DRIVER_HOOK_OBJ) \
|
||||
AFL_QEMU_PERSISTENT_ADDR=$(AFL_QEMU_PERSISTENT_ADDR) \
|
||||
AFL_ENTRYPOINT=$(AFL_QEMU_PERSISTENT_ADDR) \
|
||||
$(ROOT)afl-fuzz \
|
||||
-i $(TEST_DATA_DIR) \
|
||||
-o $(QEMU_OUT) \
|
||||
-m none \
|
||||
-d \
|
||||
-Q \
|
||||
-V 30 \
|
||||
-- \
|
||||
$(TEST_BIN) $(DUMMY_DATA_FILE)
|
||||
13
frida_mode/test/vorbis/Makefile
Normal file
13
frida_mode/test/vorbis/Makefile
Normal file
@ -0,0 +1,13 @@
|
||||
all:
|
||||
@echo trying to use GNU make...
|
||||
@gmake all || echo please install GNUmake
|
||||
|
||||
32:
|
||||
@echo trying to use GNU make...
|
||||
@gmake 32 || echo please install GNUmake
|
||||
|
||||
clean:
|
||||
@gmake clean
|
||||
|
||||
frida:
|
||||
@gmake frida
|
||||
36
frida_mode/test/vorbis/get_symbol_addr.py
Executable file
36
frida_mode/test/vorbis/get_symbol_addr.py
Executable file
@ -0,0 +1,36 @@
|
||||
#!/usr/bin/python3
|
||||
import argparse
|
||||
from elftools.elf.elffile import ELFFile
|
||||
|
||||
def process_file(file, symbol, base):
|
||||
with open(file, 'rb') as f:
|
||||
elf = ELFFile(f)
|
||||
symtab = elf.get_section_by_name('.symtab')
|
||||
mains = symtab.get_symbol_by_name(symbol)
|
||||
if len(mains) != 1:
|
||||
print ("Failed to find main")
|
||||
return 1
|
||||
|
||||
main_addr = mains[0]['st_value']
|
||||
main = base + main_addr
|
||||
print ("0x%016x" % main)
|
||||
return 0
|
||||
|
||||
def hex_value(x):
|
||||
return int(x, 16)
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description='Process some integers.')
|
||||
parser.add_argument('-f', '--file', dest='file', type=str,
|
||||
help='elf file name', required=True)
|
||||
parser.add_argument('-s', '--symbol', dest='symbol', type=str,
|
||||
help='symbol name', required=True)
|
||||
parser.add_argument('-b', '--base', dest='base', type=hex_value,
|
||||
help='elf base address', required=True)
|
||||
|
||||
args = parser.parse_args()
|
||||
return process_file (args.file, args.symbol, args.base)
|
||||
|
||||
if __name__ == "__main__":
|
||||
ret = main()
|
||||
exit(ret)
|
||||
Reference in New Issue
Block a user