about summary refs log tree commit diff
diff options
context:
space:
mode:
authorvanhauser-thc <vh@thc.org>2023-08-31 14:42:16 +0200
committervanhauser-thc <vh@thc.org>2023-08-31 14:42:16 +0200
commit8f5c510be18df03fe201c1bae9bde8e7e7bc0bd9 (patch)
treec15fce54f5e730a74f9c2ca9e6f15a2cc2f84471
parent88ca5c75634d8edfa268005f2e1855a35a5b9e2e (diff)
parent5020e6b275adf0d74e9174b278ff417b5c6a64d2 (diff)
downloadafl++-8f5c510be18df03fe201c1bae9bde8e7e7bc0bd9.tar.gz
Merge branch 'dev' of ssh://github.com/AFLplusplus/AFLplusplus into dev
-rw-r--r--frida_mode/src/instrument/instrument_arm64.c12
-rw-r--r--frida_mode/test/png/GNUmakefile2
-rwxr-xr-xfrida_mode/util/frida_get_symbol_addr.sh3
3 files changed, 15 insertions, 2 deletions
diff --git a/frida_mode/src/instrument/instrument_arm64.c b/frida_mode/src/instrument/instrument_arm64.c
index 2256f941..a0c66697 100644
--- a/frida_mode/src/instrument/instrument_arm64.c
+++ b/frida_mode/src/instrument/instrument_arm64.c
@@ -402,6 +402,18 @@ bool instrument_write_inline(GumArm64Writer *cw, GumAddress code_addr,
 
   }
 
+  /* 
+   * The mov instruction supports up to a 16-bit offset. If our offset is out of 
+   * range, then it can end up clobbering the op-code portion of the instruction 
+   * rather than just the operands. So return false and fall back to the 
+   * alternative instrumentation.
+   */
+  if (area_offset > UINT16_MAX) {
+
+    return false;
+    
+  }
+
   code.code.mov_x0_curr_loc |= area_offset << 5;
 
   if (!instrument_patch_ardp(
diff --git a/frida_mode/test/png/GNUmakefile b/frida_mode/test/png/GNUmakefile
index 408b7dcb..eccc66f6 100644
--- a/frida_mode/test/png/GNUmakefile
+++ b/frida_mode/test/png/GNUmakefile
@@ -8,7 +8,7 @@ HARNESS_BUILD_DIR:=$(BUILD_DIR)harness/
 PNGTEST_BUILD_DIR:=$(BUILD_DIR)pngtest/
 
 LIBZ_FILE:=$(LIBZ_BUILD_DIR)zlib-1.2.13.tar.gz
-LIBZ_URL:=http://www.zlib.net/zlib-1.2.13.tar.gz
+LIBZ_URL:=http://www.zlib.net/fossils/zlib-1.2.13.tar.gz
 LIBZ_DIR:=$(LIBZ_BUILD_DIR)zlib-1.2.13/
 LIBZ_PC:=$(LIBZ_DIR)zlib.pc
 LIBZ_LIB:=$(LIBZ_DIR)libz.a
diff --git a/frida_mode/util/frida_get_symbol_addr.sh b/frida_mode/util/frida_get_symbol_addr.sh
index fb0002b7..2e682255 100755
--- a/frida_mode/util/frida_get_symbol_addr.sh
+++ b/frida_mode/util/frida_get_symbol_addr.sh
@@ -31,12 +31,13 @@ file=$(file $target|sed 's/.*: //')
 arch=$(echo $file|awk -F, '{print$2}'|tr -d ' ')
 bits=$(echo $file|sed 's/-bit .*//'|sed 's/.* //')
 pie=$(echo $file|grep -wqi pie && echo pie)
+dso=$(echo $file|grep -wqi "shared object" && echo dso)
 
 test $(uname -s) = "Darwin" && symbol=_"$symbol"
 tmp_addr=$(nm "$target" | grep -i "T $symbol" | awk '{print$1}' | tr a-f A-F)
 
 test -z "$tmp_addr" && { echo Error: function $symbol not found 1>&2; exit 1; }
-test -z "$pie" && { echo 0x$tmp_addr; exit 0; }
+test -z "$pie" && test -z "$dso" && { echo 0x$tmp_addr; exit 0; }
 
 test -z "$base" && {
   test "$bits" = 32 -o "$bits" = 64 || { echo "Error: could not identify arch (bits=$bits)" 1>&2 ; exit 1; }