ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-08 16:21:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

nits

Browse Source
This commit is contained in:
vanhauser-thc 2021-04-28 10:59:34 +02:00
parent 39ad3b8946
commit dde0538b48
5 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/Changelog.md
View File

@ -10,6 +10,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
### Version ++3.13a (development) ### Version ++3.13a (development)
- frida_mode - new mode that uses frida to fuzz binary-only targets, - frida_mode - new mode that uses frida to fuzz binary-only targets,
it currently supports persistent mode and cmplog.
thanks to @WorksButNotTested! thanks to @WorksButNotTested!
- create a fuzzing dictionary with the help of CodeQL thanks to - create a fuzzing dictionary with the help of CodeQL thanks to
@microsvuln! see utils/autodict_ql @microsvuln! see utils/autodict_ql

2
qemu_mode/qemuafl

@ -1 +1 @@
Subproject commit d1ca56b84e78f821406eef28d836918edfc8d610 Subproject commit d73b0336b451fd034e5f469089fb7ee96c80adf2

10
utils/aflpp_driver/aflpp_qemu_driver_hook.c
View File

@ -3,12 +3,12 @@
#include <stdint.h> #include <stdint.h>
#include <string.h> #include <string.h>
void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
uint8_t *input_buf, uint32_t input_buf_len) {
#define g2h(x) ((void *)((unsigned long)(x) + guest_base)) #define g2h(x) ((void *)((unsigned long)(x) + guest_base))
#define h2g(x) ((uint64_t)(x)-guest_base) #define h2g(x) ((uint64_t)(x)-guest_base)
void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
uint8_t *input_buf, uint32_t input_buf_len) {
// In this example the register RDI is pointing to the memory location // In this example the register RDI is pointing to the memory location
// of the target buffer, and the length of the input is in RSI. // of the target buffer, and the length of the input is in RSI.
// This can be seen with a debugger, e.g. gdb (and "disass main") // This can be seen with a debugger, e.g. gdb (and "disass main")
@ -16,11 +16,11 @@ void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
memcpy(g2h(regs->rdi), input_buf, input_buf_len); memcpy(g2h(regs->rdi), input_buf, input_buf_len);
regs->rsi = input_buf_len; regs->rsi = input_buf_len;
}
#undef g2h #undef g2h
#undef h2g #undef h2g
}
int afl_persistent_hook_init(void) { int afl_persistent_hook_init(void) {
// 1 for shared memory input (faster), 0 for normal input (you have to use // 1 for shared memory input (faster), 0 for normal input (you have to use

10
utils/qemu_persistent_hook/read_into_rdi.c
View File

@ -3,12 +3,12 @@
#include <stdio.h> #include <stdio.h>
#include <string.h> #include <string.h>
void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
uint8_t *input_buf, uint32_t input_buf_len) {
#define g2h(x) ((void *)((unsigned long)(x) + guest_base)) #define g2h(x) ((void *)((unsigned long)(x) + guest_base))
#define h2g(x) ((uint64_t)(x)-guest_base) #define h2g(x) ((uint64_t)(x)-guest_base)
void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
uint8_t *input_buf, uint32_t input_buf_len) {
// In this example the register RDI is pointing to the memory location // In this example the register RDI is pointing to the memory location
// of the target buffer, and the length of the input is in RSI. // of the target buffer, and the length of the input is in RSI.
// This can be seen with a debugger, e.g. gdb (and "disass main") // This can be seen with a debugger, e.g. gdb (and "disass main")
@ -19,11 +19,11 @@ void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
memcpy(g2h(regs->rdi), input_buf, input_buf_len); memcpy(g2h(regs->rdi), input_buf, input_buf_len);
regs->rsi = input_buf_len; regs->rsi = input_buf_len;
}
#undef g2h #undef g2h
#undef h2g #undef h2g
}
int afl_persistent_hook_init(void) { int afl_persistent_hook_init(void) {
// 1 for shared memory input (faster), 0 for normal input (you have to use // 1 for shared memory input (faster), 0 for normal input (you have to use