diff options
| author | Andrea Fioraldi <andreafioraldi@gmail.com> | 2019-09-22 19:38:53 +0200 |
|---|---|---|
| committer | Andrea Fioraldi <andreafioraldi@gmail.com> | 2019-09-22 19:38:53 +0200 |
| commit | 17bb51756faeaeda6fb17d63ede0a1a9d8ae4b5c (patch) | |
| tree | 2291cfeafa1d2d99cde69933f28e5bc9bdc4d12a | |
| parent | 63677bb1f963b2f6ee7157e94d471d3b1df8f162 (diff) | |
| download | afl++-17bb51756faeaeda6fb17d63ede0a1a9d8ae4b5c.tar.gz | |
persistent qemu retaddr offset
| -rw-r--r-- | qemu_mode/patches/afl-qemu-common.h | 1 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-cpu-inl.h | 4 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 2 |
3 files changed, 6 insertions, 1 deletions
diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h index 2b7bd51c..e435c62f 100644 --- a/qemu_mode/patches/afl-qemu-common.h +++ b/qemu_mode/patches/afl-qemu-common.h @@ -61,6 +61,7 @@ extern target_long persistent_stack_offset; extern unsigned char persistent_first_pass; extern unsigned char persistent_save_gpr; extern target_ulong persistent_saved_gpr[CPU_NB_REGS]; +extern int persisent_retaddr_offset; extern __thread abi_ulong afl_prev_loc; diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index ee7d12e0..cfea04d6 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -90,6 +90,7 @@ target_long persistent_stack_offset; unsigned char persistent_first_pass; unsigned char persistent_save_gpr; target_ulong persistent_saved_gpr[CPU_NB_REGS]; +int persisent_retaddr_offset; /* Instrumentation ratio: */ @@ -218,6 +219,9 @@ static void afl_setup(void) { if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1; + + if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET")) + persisent_retaddr_offset = strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 16); if (getenv("AFL_QEMU_PERSISTENT_CNT")) afl_persistent_cnt = strtoll(getenv("AFL_QEMU_PERSISTENT_CNT"), NULL, 16); diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index 48b11c64..126cf255 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -195,7 +195,7 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2, if (afl_persistent_ret_addr == 0) { \ \ TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr); \ - tcg_gen_st_tl(paddr, cpu_regs[R_ESP], 0); \ + tcg_gen_st_tl(paddr, cpu_regs[R_ESP], persisent_retaddr_offset); \ \ } \ tcg_gen_afl_call0(&afl_persistent_loop); \ |