mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-08 08:11:34 +00:00
028f8ced8f
Removed use of 'realpath' in makefiles to fix OSX incompatibility Fixed handling of when prefetching should be enabled Snap the main binary during initialization to avoid stability issues with lazy loading Add support for configurable inline cache entries for FRIDA on x86/x64 Support for prefetching FRIDA backpatches on x86/x64 Improved stats support on x86/x64/aarch64
164 lines
4.6 KiB
Makefile
164 lines
4.6 KiB
Makefile
PWD:=$(shell pwd)/
|
|
ROOT:=$(PWD)../../../
|
|
BUILD_DIR:=$(PWD)build/
|
|
TESTINSTR_DATA_DIR:=$(BUILD_DIR)in/
|
|
TESTINSTR_DATA_FILE:=$(TESTINSTR_DATA_DIR)in
|
|
AFLPP_DRIVER_DUMMY_INPUT:=$(BUILD_DIR)dummy.dat
|
|
|
|
HARNESS_BIN:=$(BUILD_DIR)harness
|
|
HARNESS_SRC:=$(PWD)harness.c
|
|
|
|
HARNESS2_BIN:=$(BUILD_DIR)harness2
|
|
HARNESS2_SRC:=$(PWD)harness2.c
|
|
|
|
HARNESS3_BIN:=$(BUILD_DIR)harness3
|
|
HARNESS3_SRC:=$(PWD)harness3.c
|
|
|
|
LIB_BIN:=$(BUILD_DIR)libcrashme.dylib
|
|
LIB_SRC:=$(PWD)lib.c
|
|
|
|
LIB2_BIN:=$(BUILD_DIR)libcrashme2.dylib
|
|
LIB2_SRC:=$(PWD)lib2.c
|
|
|
|
QEMU_OUT:=$(BUILD_DIR)qemu-out
|
|
FRIDA_OUT:=$(BUILD_DIR)frida-out
|
|
|
|
HARNESS_LDFLAGS:=-Wl,-no_pie
|
|
LIB_CFLAGS:=-dynamiclib
|
|
|
|
GET_SYMBOL_ADDR:=$(ROOT)frida_mode/util/get_symbol_addr.sh
|
|
AFL_FRIDA_MAIN_ADDR=$(shell $(GET_SYMBOL_ADDR) $(HARNESS_BIN) main 0x0)
|
|
AFL_FRIDA_MAIN_ADDR2=$(shell $(GET_SYMBOL_ADDR) $(HARNESS2_BIN) main 0x0)
|
|
AFL_FRIDA_FUZZ_ADDR=$(shell $(GET_SYMBOL_ADDR) $(HARNESS_BIN) LLVMFuzzerTestOneInput 0x0)
|
|
AFL_FRIDA_FUZZ_ADDR2=$(shell $(GET_SYMBOL_ADDR) $(HARNESS2_BIN) LLVMFuzzerTestOneInput 0x0)
|
|
AFL_FRIDA_FUZZ_ADDR3=$(shell $(GET_SYMBOL_ADDR) $(HARNESS3_BIN) LLVMFuzzerTestOneInput 0x0)
|
|
|
|
AFLPP_FRIDA_DRIVER_HOOK_OBJ=$(ROOT)frida_mode/build/frida_hook.so
|
|
|
|
TEST_FILE:=$(BUILD_DIR)test.dat
|
|
|
|
.PHONY: all clean qemu frida
|
|
|
|
all: $(HARNESS_BIN) $(LIB_BIN)
|
|
make -C $(ROOT)frida_mode/
|
|
|
|
$(BUILD_DIR):
|
|
mkdir -p $@
|
|
|
|
$(TESTINSTR_DATA_DIR): | $(BUILD_DIR)
|
|
mkdir -p $@
|
|
|
|
$(TESTINSTR_DATA_FILE): | $(TESTINSTR_DATA_DIR)
|
|
echo -n "$$FA$$" > $@
|
|
|
|
$(AFLPP_DRIVER_DUMMY_INPUT): | $(BUILD_DIR)
|
|
dd if=/dev/zero bs=1048576 count=1 of=$@
|
|
|
|
$(HARNESS_BIN): $(HARNESS_SRC) | $(BUILD_DIR)
|
|
$(CC) $(CFLAGS) $(LDFLAGS) $(HARNESS_LDFLAGS) -o $@ $<
|
|
|
|
$(LIB_BIN): $(LIB_SRC) | $(BUILD_DIR)
|
|
$(CC) $(CFLAGS) $(LDFLAGS) $(LIB_CFLAGS) -o $@ $<
|
|
|
|
$(LIB2_BIN): $(LIB2_SRC) | $(BUILD_DIR)
|
|
$(CC) $(CFLAGS) $(LDFLAGS) $(LIB_CFLAGS) -o $@ $<
|
|
|
|
$(HARNESS2_BIN): $(HARNESS2_SRC) $(LIB_BIN) | $(BUILD_DIR)
|
|
$(CC) $(CFLAGS) $(LDFLAGS) $(HARNESS_LDFLAGS) -o $@ $<
|
|
|
|
$(HARNESS3_BIN): $(HARNESS3_SRC) $(LIB_BIN) | $(BUILD_DIR)
|
|
$(CC) $(CFLAGS) $(LDFLAGS) $(HARNESS_LDFLAGS) -L$(BUILD_DIR) -lcrashme -o $@ $<
|
|
|
|
clean:
|
|
rm -rf $(BUILD_DIR)
|
|
|
|
LIBASAN?=/usr/local/opt/llvm/lib/clang/10.0.1/lib/darwin/libclang_rt.asan_osx_dynamic.dylib
|
|
|
|
.ONESHELL:
|
|
frida_persistent: $(HARNESS_BIN) $(LIB_BIN) $(TESTINSTR_DATA_FILE)
|
|
cd $(BUILD_DIR) && \
|
|
AFL_INST_LIBS=1 \
|
|
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_MAIN_ADDR) \
|
|
AFL_FRIDA_PERSISTENT_CNT=1000000 \
|
|
AFL_ENTRYPOINT=$(AFL_FRIDA_MAIN_ADDR) \
|
|
$(ROOT)afl-fuzz \
|
|
-D \
|
|
-O \
|
|
-i $(TESTINSTR_DATA_DIR) \
|
|
-o $(FRIDA_OUT) \
|
|
-f $(TEST_FILE) \
|
|
-- \
|
|
$(HARNESS_BIN) $(TEST_FILE)
|
|
|
|
.ONESHELL:
|
|
frida_persistent_asan: $(HARNESS2_BIN) $(LIB2_BIN) $(TESTINSTR_DATA_FILE)
|
|
cd $(BUILD_DIR) && \
|
|
AFL_PRELOAD=$(LIBASAN) \
|
|
AFL_USE_FASAN=1 \
|
|
AFL_INST_LIBS=1 \
|
|
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_MAIN_ADDR2) \
|
|
AFL_FRIDA_PERSISTENT_CNT=1000000 \
|
|
AFL_ENTRYPOINT=$(AFL_FRIDA_MAIN_ADDR2) \
|
|
AFL_FRIDA_INST_RANGES=libcrashme2.dylib,harness2 \
|
|
$(ROOT)afl-fuzz \
|
|
-D \
|
|
-O \
|
|
-i $(TESTINSTR_DATA_DIR) \
|
|
-o $(FRIDA_OUT) \
|
|
-f $(TEST_FILE) \
|
|
-- \
|
|
$(HARNESS2_BIN) $(TEST_FILE)
|
|
|
|
.ONESHELL:
|
|
frida_persistent_hook: $(HARNESS_BIN) $(LIB_BIN) $(AFLPP_DRIVER_DUMMY_INPUT) $(TESTINSTR_DATA_FILE)
|
|
cd $(BUILD_DIR) && \
|
|
AFL_INST_LIBS=1 \
|
|
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_FUZZ_ADDR) \
|
|
AFL_FRIDA_PERSISTENT_CNT=1000000 \
|
|
AFL_ENTRYPOINT=$(AFL_FRIDA_FUZZ_ADDR) \
|
|
AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
|
|
AFL_FRIDA_INST_RANGES=libcrashme.dylib,harness \
|
|
$(ROOT)afl-fuzz \
|
|
-D \
|
|
-O \
|
|
-i $(TESTINSTR_DATA_DIR) \
|
|
-o $(FRIDA_OUT) \
|
|
-- \
|
|
$(HARNESS_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
|
|
|
|
.ONESHELL:
|
|
frida_persistent_hook_asan: $(HARNESS2_BIN) $(LIB2_BIN) $(AFLPP_DRIVER_DUMMY_INPUT) $(TESTINSTR_DATA_FILE)
|
|
cd $(BUILD_DIR) && \
|
|
AFL_PRELOAD=$(LIBASAN) \
|
|
AFL_USE_FASAN=1 \
|
|
AFL_INST_LIBS=1 \
|
|
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_FUZZ_ADDR2) \
|
|
AFL_FRIDA_PERSISTENT_CNT=1000000 \
|
|
AFL_ENTRYPOINT=$(AFL_FRIDA_FUZZ_ADDR2) \
|
|
AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
|
|
AFL_FRIDA_INST_RANGES=libcrashme2.dylib,harness2 \
|
|
$(ROOT)afl-fuzz \
|
|
-D \
|
|
-O \
|
|
-i $(TESTINSTR_DATA_DIR) \
|
|
-o $(FRIDA_OUT) \
|
|
-- \
|
|
$(HARNESS2_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
|
|
|
|
.ONESHELL:
|
|
frida_persistent_hook3: $(HARNESS3_BIN) $(LIB_BIN) $(AFLPP_DRIVER_DUMMY_INPUT) $(TESTINSTR_DATA_FILE)
|
|
cd $(BUILD_DIR) && \
|
|
AFL_INST_LIBS=1 \
|
|
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_FUZZ_ADDR3) \
|
|
AFL_FRIDA_PERSISTENT_CNT=1000000 \
|
|
AFL_ENTRYPOINT=$(AFL_FRIDA_FUZZ_ADDR3) \
|
|
AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
|
|
AFL_FRIDA_INST_RANGES=libcrashme.dylib,harness3 \
|
|
$(ROOT)afl-fuzz \
|
|
-D \
|
|
-O \
|
|
-i $(TESTINSTR_DATA_DIR) \
|
|
-o $(FRIDA_OUT) \
|
|
-- \
|
|
$(HARNESS3_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
|