ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

doc for qemuafl

Browse Source
This commit is contained in:
Andrea Fioraldi
2020-11-02 13:56:24 +01:00
parent 52512aa0af
commit fdc364046e
3 changed files with 85 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
examples/qemu_persistent_hook/read_into_rdi.c
View File

@ -1,53 +1,28 @@
#include <stdint.h>
#include "../../qemu_mode/qemuafl/qemuafl/api.h"
#include <stdio.h>
#include <unistd.h>
#include <string.h>
void afl_persistent_hook(struct x86_64_regs *regs,
uint64_t guest_base,
uint8_t *input_buf,
uint32_t input_buf_len) {
#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
#define h2g(x) ((uint64_t)(x)-guest_base)
enum {
R_EAX = 0,
R_ECX = 1,
R_EDX = 2,
R_EBX = 3,
R_ESP = 4,
R_EBP = 5,
R_ESI = 6,
R_EDI = 7,
R_R8 = 8,
R_R9 = 9,
R_R10 = 10,
R_R11 = 11,
R_R12 = 12,
R_R13 = 13,
R_R14 = 14,
R_R15 = 15,
R_AL = 0,
R_CL = 1,
R_DL = 2,
R_BL = 3,
R_AH = 4,
R_CH = 5,
R_DH = 6,
R_BH = 7,
};
void afl_persistent_hook(uint64_t *regs, uint64_t guest_base,
uint8_t *input_buf, uint32_t input_len) {
// In this example the register RDI is pointing to the memory location
// of the target buffer, and the length of the input is in RSI.
// This can be seen with a debugger, e.g. gdb (and "disass main")
printf("placing input into %p\n", regs[R_EDI]);
printf("Placing input into %p\n", regs->rdi);
if (input_len > 1024) input_len = 1024;
memcpy(g2h(regs[R_EDI]), input_buf, input_len);
regs[R_ESI] = input_len;
memcpy(g2h(regs->rdi), input_buf, input_len);
regs->rsi = input_len;
#undef g2h
#undef h2g
}
@ -58,4 +33,3 @@ int afl_persistent_hook_init(void) {
return 1;
}