ijon set: init

9 files changed, 35 insertions, 2 deletions

diff --git a/dynamic_list.txt b/dynamic_list.txt
index 50c0c6b8..1a5c514a 100644
--- a/dynamic_list.txt
+++ b/dynamic_list.txt
@@ -30,6 +30,7 @@
   "__afl_selective_coverage_temp";
   "__afl_sharedmem_fuzzing";
   "__afl_trace";
+  "__afl_ijon_set";
   "__cmplog_ins_hook1";
   "__cmplog_ins_hook16";
   "__cmplog_ins_hook2";
diff --git a/frida_mode/frida.map b/frida_mode/frida.map
index a98c2096..90ea1421 100644
--- a/frida_mode/frida.map
+++ b/frida_mode/frida.map
@@ -45,6 +45,7 @@
     js_api_set_stdout;
     js_api_set_traceable;
     js_api_set_verbose;
+    js_api_ijon_set;
 
   local:
     *;
diff --git a/frida_mode/include/instrument.h b/frida_mode/include/instrument.h
index 1825e331..7f4958a2 100644
--- a/frida_mode/include/instrument.h
+++ b/frida_mode/include/instrument.h
@@ -22,6 +22,7 @@ extern guint64  instrument_fixed_seed;
 
 extern uint8_t *__afl_area_ptr;
 extern uint32_t __afl_map_size;
+extern void     __afl_ijon_set(uint32_t);
 
 extern __thread guint64 *instrument_previous_pc_addr;
 
@@ -72,5 +73,7 @@ void instrument_cache(const cs_insn *instr, GumStalkerOutput *output);
 void instrument_write_regs(GumCpuContext *cpu_context, gpointer user_data);
 void instrument_regs_format(int fd, char *format, ...);
 
+void ijon_set(uint32_t edge);
+
 #endif
 
diff --git a/frida_mode/src/instrument/instrument.c b/frida_mode/src/instrument/instrument.c
index db73d845..cbb8afd9 100644
--- a/frida_mode/src/instrument/instrument.c
+++ b/frida_mode/src/instrument/instrument.c
@@ -449,3 +449,9 @@ void instrument_regs_format(int fd, char *format, ...) {
 
 }
 
+void ijon_set(uint32_t edge) {
+
+  __afl_ijon_set(edge);
+
+}
+
diff --git a/frida_mode/src/js/api.js b/frida_mode/src/js/api.js
index a65d32df..9e2b15c5 100644
--- a/frida_mode/src/js/api.js
+++ b/frida_mode/src/js/api.js
@@ -326,6 +326,12 @@ class Afl {
     static jsApiGetSymbol(name) {
         return Afl.module.getExportByName(name);
     }
+
+    static IJON = class {
+        static set(addr, val) {
+            Afl.jsApiIjonSet((addr ^ val) & 0xffffffff);
+        }
+    }
 }
 /**
  * Field containing the `Module` object for `afl-frida-trace.so` (the FRIDA mode
@@ -377,3 +383,4 @@ Afl.jsApiSetVerbose = Afl.jsApiGetFunction("js_api_set_verbose", "void", []);
 Afl.jsApiWrite = new NativeFunction(
 /* tslint:disable-next-line:no-null-keyword */
 Module.getExportByName(null, "write"), "int", ["int", "pointer", "int"]);
+Afl.jsApiIjonSet = Afl.jsApiGetFunction("js_api_ijon_set", "void", ["uint32"]);
diff --git a/frida_mode/src/js/js_api.c b/frida_mode/src/js/js_api.c
index 288aec95..274cd1bc 100644
--- a/frida_mode/src/js/js_api.c
+++ b/frida_mode/src/js/js_api.c
@@ -316,3 +316,9 @@ __attribute__((visibility("default"))) void js_api_set_verbose(void) {
 
 }
 
+__attribute__((visibility("default"))) void js_api_ijon_set(uint32_t edge) {
+
+  ijon_set(edge);
+
+}
+
diff --git a/frida_mode/test/fasan/.gdb_history b/frida_mode/test/fasan/.gdb_history
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/frida_mode/test/fasan/.gdb_history
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index c08e6380..bf498781 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -2761,5 +2761,11 @@ void __afl_injection_xss(u8 *buf) {
 
 }
 
+void __afl_ijon_set(u32 edge) {
+
+  __afl_area_ptr[edge % __afl_map_size] |= 1;
+
+}
+
 #undef write_error
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 7afab850..2a027ce4 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1528,7 +1528,8 @@ void add_defs_selective_instr(aflcc_state_t *aflcc) {
                  "extern \"C\" void __afl_coverage_discard();"
                  "extern \"C\" void __afl_coverage_skip();"
                  "extern \"C\" void __afl_coverage_on();"
-                 "extern \"C\" void __afl_coverage_off();");
+                 "extern \"C\" void __afl_coverage_off();"
+                 "extern \"C\" void __afl_ijon_set(unsigned int);");
 
   } else {
 
@@ -1537,7 +1538,8 @@ void add_defs_selective_instr(aflcc_state_t *aflcc) {
                  "void __afl_coverage_discard();"
                  "void __afl_coverage_skip();"
                  "void __afl_coverage_on();"
-                 "void __afl_coverage_off();");
+                 "void __afl_coverage_off();"
+                 "void __afl_ijon_set(unsigned int);");
 
   }
 
@@ -1549,6 +1551,7 @@ void add_defs_selective_instr(aflcc_state_t *aflcc) {
   insert_param(aflcc, "-D__AFL_COVERAGE_OFF()=__afl_coverage_off()");
   insert_param(aflcc, "-D__AFL_COVERAGE_DISCARD()=__afl_coverage_discard()");
   insert_param(aflcc, "-D__AFL_COVERAGE_SKIP()=__afl_coverage_skip()");
+  insert_param(aflcc, "-D__AFL_IJON_SET(_A)=__afl_ijon_set(_A)");
 
 }