format code for demo-so.c and template.cpp

2 files changed, 197 insertions, 184 deletions

diff --git a/qbdi_mode/demo-so.c b/qbdi_mode/demo-so.c
index 5e74f268..dbb7b714 100755
--- a/qbdi_mode/demo-so.c
+++ b/qbdi_mode/demo-so.c
@@ -1,33 +1,39 @@
 #include <stdio.h>

 

 // gcc -shared -o libdemo.so demo-so.c -w

-int target_func(char *buf, int size)

-{

-    printf("buffer:%p, size:%p\n", buf, size);

-    switch (buf[0])

-    {

+int target_func(char *buf, int size) {

+
+  printf("buffer:%p, size:%p\n", buf, size);

+  switch (buf[0]) {

+
     case 1:

-        puts("222");

-        if (buf[1] == '\x44')

-        {

-            puts("null ptr deference");

-            *(char *)(0) = 1;

-        }

-        break;

+      puts("222");

+      if (buf[1] == '\x44') {

+
+        puts("null ptr deference");

+        *(char *)(0) = 1;

+
+      }

+

+      break;

     case 0xff:

-        if (buf[2] == '\xff')

-        {

-            if (buf[1] == '\x44')

-            {

-                puts("crash....");

-                *(char *)(0xdeadbeef) = 1;

-            }

+      if (buf[2] == '\xff') {

+
+        if (buf[1] == '\x44') {

+
+          puts("crash....");

+          *(char *)(0xdeadbeef) = 1;

+
         }

-        break;

-    default:

-        puts("default action");

-        break;

-    }

+
+      }

+

+      break;

+    default: puts("default action"); break;

+
+  }

 

-    return 1;

+  return 1;

+
 }

+
diff --git a/qbdi_mode/template.cpp b/qbdi_mode/template.cpp
index f0b0c601..601860d2 100755
--- a/qbdi_mode/template.cpp
+++ b/qbdi_mode/template.cpp
@@ -24,205 +24,212 @@ using namespace QBDI;
 
 typedef int (*target_func)(char *buf, int size);
 
-static const size_t STACK_SIZE = 0x100000; // 1MB
+static const size_t      STACK_SIZE = 0x100000;  // 1MB
 static const QBDI::rword FAKE_RET_ADDR = 0x40000;
-target_func p_target_func = NULL;
-rword module_base = 0;
-rword module_end = 0;
+target_func              p_target_func = NULL;
+rword                    module_base = 0;
+rword                    module_end = 0;
 static unsigned char
-    dummy[MAP_SIZE];                /* costs MAP_SIZE but saves a few instructions */
-unsigned char *afl_area_ptr = NULL; /* Exported for afl_gen_trace */
+               dummy[MAP_SIZE]; /* costs MAP_SIZE but saves a few instructions */
+unsigned char *afl_area_ptr = NULL;           /* Exported for afl_gen_trace */
 
 unsigned long afl_prev_loc = 0;
 
 /* Set up SHM region and initialize other stuff. */
 
-int afl_setup(void)
-{
-    char *id_str = getenv(SHM_ENV_VAR);
-    int shm_id;
-    if (id_str)
-    {
-        shm_id = atoi(id_str);
-        afl_area_ptr = (unsigned char *)shmat(shm_id, NULL, 0);
-        if (afl_area_ptr == (void *)-1)
-            return 0;
-        memset(afl_area_ptr, 0, MAP_SIZE);
-    }
-    return 1;
+int afl_setup(void) {
+
+  char *id_str = getenv(SHM_ENV_VAR);
+  int   shm_id;
+  if (id_str) {
+
+    shm_id = atoi(id_str);
+    afl_area_ptr = (unsigned char *)shmat(shm_id, NULL, 0);
+    if (afl_area_ptr == (void *)-1) return 0;
+    memset(afl_area_ptr, 0, MAP_SIZE);
+
+  }
+
+  return 1;
+
 }
 
 /* Fork server logic, invoked once we hit _start. */
-static void afl_forkserver()
-{
-
-    static unsigned char tmp[4];
-    pid_t child_pid;
-
-    if (write(FORKSRV_FD + 1, tmp, 4) != 4)
-        return;
-
-    while (1)
-    {
-
-        int status;
-        u32 was_killed;
-        // wait for afl-fuzz
-        if (read(FORKSRV_FD, &was_killed, 4) != 4)
-            exit(2);
-
-        child_pid = fork();
-        if (child_pid < 0)
-            exit(4);
-
-        if (!child_pid)
-        {
-            // child return to execute code
-            close(FORKSRV_FD);
-            close(FORKSRV_FD + 1);
-            return;
-        }
-
-        // write child pid to afl-fuzz
-        if (write(FORKSRV_FD + 1, &child_pid, 4) != 4)
-            exit(5);
-
-        // wait child stop
-        if (waitpid(child_pid, &status, 0) < 0)
-            exit(6);
-
-        // send child stop status to afl-fuzz
-        if (write(FORKSRV_FD + 1, &status, 4) != 4)
-            exit(7);
+static void afl_forkserver() {
+
+  static unsigned char tmp[4];
+  pid_t                child_pid;
+
+  if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
+
+  while (1) {
+
+    int status;
+    u32 was_killed;
+    // wait for afl-fuzz
+    if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(2);
+
+    child_pid = fork();
+    if (child_pid < 0) exit(4);
+
+    if (!child_pid) {
+
+      // child return to execute code
+      close(FORKSRV_FD);
+      close(FORKSRV_FD + 1);
+      return;
+
     }
+
+    // write child pid to afl-fuzz
+    if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(5);
+
+    // wait child stop
+    if (waitpid(child_pid, &status, 0) < 0) exit(6);
+
+    // send child stop status to afl-fuzz
+    if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7);
+
+  }
+
 }
 
-void afl_maybe_log(unsigned long cur_loc)
-{
-    if (afl_area_ptr == NULL)
-    {
-        return;
-    }
-    unsigned long afl_idx = cur_loc ^ afl_prev_loc;
-    afl_area_ptr[afl_idx % MAP_SIZE]++;
-    afl_prev_loc = cur_loc >> 1;
+void afl_maybe_log(unsigned long cur_loc) {
+
+  if (afl_area_ptr == NULL) { return; }
+  unsigned long afl_idx = cur_loc ^ afl_prev_loc;
+  afl_area_ptr[afl_idx % MAP_SIZE]++;
+  afl_prev_loc = cur_loc >> 1;
+
 }
-char *read_file(char *path, unsigned long *length)
-{
-    FILE *pFile = fopen(path, "rb");
-    char *pBuf;
-    fseek(pFile, 0, SEEK_END);
-    unsigned long len = ftell(pFile);
-    pBuf = (char *)malloc(len);
-    rewind(pFile);
-    fread(pBuf, 1, len, pFile);
-    fclose(pFile);
-    *length = len;
-    return pBuf;
+
+char *read_file(char *path, unsigned long *length) {
+
+  FILE *pFile = fopen(path, "rb");
+  char *pBuf;
+  fseek(pFile, 0, SEEK_END);
+  unsigned long len = ftell(pFile);
+  pBuf = (char *)malloc(len);
+  rewind(pFile);
+  fread(pBuf, 1, len, pFile);
+  fclose(pFile);
+  *length = len;
+  return pBuf;
+
 }
 
 char FPATH[200];
 
-QBDI_NOINLINE int fuzz_func()
-{
+QBDI_NOINLINE int fuzz_func() {
 
-    if (afl_setup())
-    {
-        afl_forkserver();
-    }
+  if (afl_setup()) { afl_forkserver(); }
 
-    unsigned long len = 0;
-    char *data = read_file(FPATH, &len);
+  unsigned long len = 0;
+  char *        data = read_file(FPATH, &len);
+
+  printf("In fuzz_func\n");
+  p_target_func(data, len);
+  return 1;
 
-    printf("In fuzz_func\n");
-    p_target_func(data, len);
-    return 1;
 }
 
-static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm, const QBDI::VMState *state, QBDI::GPRState *gprState, QBDI::FPRState *fprState, void *data)
-{
-    // errno = SAVED_ERRNO;
+static QBDI::VMAction bbcallback(QBDI::VMInstanceRef  vm,
+                                 const QBDI::VMState *state,
+                                 QBDI::GPRState *     gprState,
+                                 QBDI::FPRState *fprState, void *data) {
+
+  // errno = SAVED_ERRNO;
 
 #ifdef __x86_64__
-    unsigned long pc = gprState->rip;
+  unsigned long pc = gprState->rip;
 #elif defined(i386)
-    unsigned long pc = gprState->eip;
+  unsigned long pc = gprState->eip;
 #elif defined(__arm__)
-    unsigned long pc = gprState->pc;
+  unsigned long pc = gprState->pc;
 #endif
-    
-    // just log the module path
-    if (pc >= module_base && pc <= module_end)
-    {
-        unsigned long offset = pc - module_base;
-        printf("\toffset:%p\n", offset);
-        afl_maybe_log(offset);
-    }
-    return QBDI::VMAction::CONTINUE;
+
+  // just log the module path
+  if (pc >= module_base && pc <= module_end) {
+
+    unsigned long offset = pc - module_base;
+    printf("\toffset:%p\n", offset);
+    afl_maybe_log(offset);
+
+  }
+
+  return QBDI::VMAction::CONTINUE;
+
 }
 
-int main(int argc, char **argv)
-{
+int main(int argc, char **argv) {
 
-    if (argc < 3)
-    {
-        puts("usage: ./loader library_path input_file_path");
-        exit(0);
-    }
+  if (argc < 3) {
 
-    const char *lib_path;
-    lib_path = argv[1];
-    // FPATH = argv[2];
-    strcpy(FPATH, argv[2]);
-    void *handle = dlopen(lib_path, RTLD_LAZY);
+    puts("usage: ./loader library_path input_file_path");
+    exit(0);
 
-    if (handle == nullptr)
-    {
-        perror("Cannot load library");
-        exit(EXIT_FAILURE);
-    }
+  }
 
-    const char *lib_name = lib_path;
-    if (strrchr(lib_name, '/') != nullptr)
-        lib_name = strrchr(lib_name, '/') + 1;
-
-    // printf("library name:%s\n", lib_name);
-    // load library module address for log path
-    for (MemoryMap &map : getCurrentProcessMaps())
-    {
-        // printf("module:%s\n", map.name.c_str());
-        if ((map.permission & PF_EXEC) && strstr(map.name.c_str(), lib_name) != NULL)
-        {
-            module_base = map.range.start;
-            module_end = map.range.end;
-        }
-    }
+  const char *lib_path;
+  lib_path = argv[1];
+  // FPATH = argv[2];
+  strcpy(FPATH, argv[2]);
+  void *handle = dlopen(lib_path, RTLD_LAZY);
+
+  if (handle == nullptr) {
+
+    perror("Cannot load library");
+    exit(EXIT_FAILURE);
+
+  }
+
+  const char *lib_name = lib_path;
+  if (strrchr(lib_name, '/') != nullptr) lib_name = strrchr(lib_name, '/') + 1;
+
+  // printf("library name:%s\n", lib_name);
+  // load library module address for log path
+  for (MemoryMap &map : getCurrentProcessMaps()) {
+
+    // printf("module:%s\n", map.name.c_str());
+    if ((map.permission & PF_EXEC) &&
+        strstr(map.name.c_str(), lib_name) != NULL) {
+
+      module_base = map.range.start;
+      module_end = map.range.end;
 
-    if (module_base == 0)
-    {
-        std::cerr << "Fail to find base address" << std::endl;
-        return -1;
     }
-    // printf("module base:%p, module end:%p\n", module_base, module_end);
-    p_target_func = (target_func)dlsym(handle, "target_func");
-    // p_target_func = (target_func)(module_base + 0x61a);
-    printf("p_target_func:%p\n", p_target_func);
 
-    VM vm;
-    uint8_t *fakestack = nullptr;
+  }
+
+  if (module_base == 0) {
 
-    GPRState *state = vm.getGPRState();
-    allocateVirtualStack(state, STACK_SIZE, &fakestack);
-    vm.addInstrumentedModuleFromAddr(module_base);
-    vm.addInstrumentedModuleFromAddr((rword)&main);
+    std::cerr << "Fail to find base address" << std::endl;
+    return -1;
 
-    vm.addVMEventCB(BASIC_BLOCK_ENTRY, bbcallback, nullptr);
+  }
 
-    // QBDI::simulateCall(state, FAKE_RET_ADDR);
-    // vm.run((rword)&fuzz_func, (rword)FAKE_RET_ADDR);
+  // printf("module base:%p, module end:%p\n", module_base, module_end);
+  p_target_func = (target_func)dlsym(handle, "target_func");
+  // p_target_func = (target_func)(module_base + 0x61a);
+  printf("p_target_func:%p\n", p_target_func);
 
-    rword ret;
-    vm.call(&ret, (rword)&fuzz_func, {});
+  VM       vm;
+  uint8_t *fakestack = nullptr;
+
+  GPRState *state = vm.getGPRState();
+  allocateVirtualStack(state, STACK_SIZE, &fakestack);
+  vm.addInstrumentedModuleFromAddr(module_base);
+  vm.addInstrumentedModuleFromAddr((rword)&main);
+
+  vm.addVMEventCB(BASIC_BLOCK_ENTRY, bbcallback, nullptr);
+
+  // QBDI::simulateCall(state, FAKE_RET_ADDR);
+  // vm.run((rword)&fuzz_func, (rword)FAKE_RET_ADDR);
+
+  rword ret;
+  vm.call(&ret, (rword)&fuzz_func, {});
+
+  return 0;
 
-    return 0;
 }
+