ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-11 01:31:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

qemu driver new api

Browse Source
This commit is contained in:
Andrea Fioraldi 2021-04-14 18:24:55 +02:00
parent 5e72568a45
commit 6069cac313
2 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
utils/aflpp_driver/aflpp_qemu_driver_hook.c
View File

@ -1,21 +1,30 @@
#include "../../qemu_mode/qemuafl/qemuafl/api.h"
#include <stdint.h>
#include <string.h>
void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
uint8_t *input_buf, uint32_t input_buf_len) {
#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
#define h2g(x) ((uint64_t)(x)-guest_base)
#define REGS_RDI 7
#define REGS_RSI 6
// In this example the register RDI is pointing to the memory location
// of the target buffer, and the length of the input is in RSI.
// This can be seen with a debugger, e.g. gdb (and "disass main")
void afl_persistent_hook(uint64_t *regs, uint64_t guest_base,
uint8_t *input_buf, uint32_t input_len) {
memcpy(g2h(regs->rdi), input_buf, input_buf_len);
regs->rsi = input_buf_len;
memcpy(g2h(regs[REGS_RDI]), input_buf, input_len);
regs[REGS_RSI] = input_len;
#undef g2h
#undef h2g
}
int afl_persistent_hook_init(void) {
// 1 for shared memory input (faster), 0 for normal input (you have to use
// read(), input_buf will be NULL)
return 1;
}

2
utils/qemu_persistent_hook/read_into_rdi.c
View File

@ -5,7 +5,7 @@
void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
uint8_t *input_buf, uint32_t input_buf_len) {
\
#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
#define h2g(x) ((uint64_t)(x)-guest_base)