mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-22 14:19:02 +00:00
Document QEMU persistent hook on mipsel
This adds a new persistent hook library `mipsel_read_into_a0.c`. With it, you can test the persistent hook on the *mipsel* architecture. I'm also updating the README in `utils/qemu_persistent_hook` and Makefile and explain how to test the persistent hook on *mipsel*. This all works thanks to qemuafl already having the correct CPU struct for *mipsel* in `qemuafl/api.h`. This patch also updates the root `.gitignore` file to ignore the two test binaries `test` and `mipsel_test`.
This commit is contained in:
35
utils/qemu_persistent_hook/mipsel_read_into_a0.c
Normal file
35
utils/qemu_persistent_hook/mipsel_read_into_a0.c
Normal file
@ -0,0 +1,35 @@
|
||||
#define TARGET_MIPS
|
||||
#include "../../qemu_mode/qemuafl/qemuafl/api.h"
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
|
||||
#define h2g(x) ((uint64_t)(x) - guest_base)
|
||||
|
||||
void afl_persistent_hook(struct mips_regs *regs, uint64_t guest_base,
|
||||
uint8_t *input_buf, uint32_t input_buf_len) {
|
||||
|
||||
// In this example the register $a0 is pointing to the memory location
|
||||
// of the target buffer, and the length of the input is in $a1.
|
||||
// This can be seen with a debugger, e.g. gdb (and "disass main")
|
||||
|
||||
printf("Placing input into 0x%lx\n", regs->a0);
|
||||
|
||||
if (input_buf_len > 1024) input_buf_len = 1024;
|
||||
memcpy(g2h(regs->a0), input_buf, input_buf_len);
|
||||
regs->a1 = input_buf_len;
|
||||
|
||||
}
|
||||
|
||||
#undef g2h
|
||||
#undef h2g
|
||||
|
||||
int afl_persistent_hook_init(void) {
|
||||
|
||||
// 1 for shared memory input (faster), 0 for normal input (you have to use
|
||||
// read(), input_buf will be NULL)
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
Reference in New Issue
Block a user