about summary refs log tree commit diff
path: root/examples/qemu_persistent_hook/read_into_rdi.c
diff options
context:
space:
mode:
authorvan Hauser <vh@thc.org>2020-11-06 09:37:14 +0100
committerGitHub <noreply@github.com>2020-11-06 09:37:14 +0100
commit3b799c09cd68bb68b26784261f1fbaa3e737c747 (patch)
treee581c3689d5fe231678464bb6bd48cab75c7db41 /examples/qemu_persistent_hook/read_into_rdi.c
parent5ee63a6e6267e448342ccb28cc8d3c0d34ffc1cd (diff)
parent50c98445fe74b92d2e6ab784def3e8b26a662b36 (diff)
downloadafl++-3b799c09cd68bb68b26784261f1fbaa3e737c747.tar.gz
Merge pull request #594 from AFLplusplus/dev
push to stable
Diffstat (limited to 'examples/qemu_persistent_hook/read_into_rdi.c')
-rw-r--r--examples/qemu_persistent_hook/read_into_rdi.c51
1 files changed, 12 insertions, 39 deletions
diff --git a/examples/qemu_persistent_hook/read_into_rdi.c b/examples/qemu_persistent_hook/read_into_rdi.c
index bd6d3f45..f4a8ae59 100644
--- a/examples/qemu_persistent_hook/read_into_rdi.c
+++ b/examples/qemu_persistent_hook/read_into_rdi.c
@@ -1,53 +1,26 @@
-#include <stdint.h>
+#include "../../qemu_mode/qemuafl/qemuafl/api.h"
+
 #include <stdio.h>
-#include <unistd.h>
 #include <string.h>
 
+void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
+                         uint8_t *input_buf, uint32_t input_buf_len) {
+\
 #define g2h(x) ((void *)((unsigned long)(x) + guest_base))
 #define h2g(x) ((uint64_t)(x)-guest_base)
 
-enum {
-
-  R_EAX = 0,
-  R_ECX = 1,
-  R_EDX = 2,
-  R_EBX = 3,
-  R_ESP = 4,
-  R_EBP = 5,
-  R_ESI = 6,
-  R_EDI = 7,
-  R_R8 = 8,
-  R_R9 = 9,
-  R_R10 = 10,
-  R_R11 = 11,
-  R_R12 = 12,
-  R_R13 = 13,
-  R_R14 = 14,
-  R_R15 = 15,
-
-  R_AL = 0,
-  R_CL = 1,
-  R_DL = 2,
-  R_BL = 3,
-  R_AH = 4,
-  R_CH = 5,
-  R_DH = 6,
-  R_BH = 7,
-
-};
-
-void afl_persistent_hook(uint64_t *regs, uint64_t guest_base,
-                         uint8_t *input_buf, uint32_t input_len) {
-
   // In this example the register RDI is pointing to the memory location
   // of the target buffer, and the length of the input is in RSI.
   // This can be seen with a debugger, e.g. gdb (and "disass main")
 
-  printf("placing input into %p\n", regs[R_EDI]);
+  printf("Placing input into 0x%lx\n", regs->rdi);
+
+  if (input_buf_len > 1024) input_buf_len = 1024;
+  memcpy(g2h(regs->rdi), input_buf, input_buf_len);
+  regs->rsi = input_buf_len;
 
-  if (input_len > 1024) input_len = 1024;
-  memcpy(g2h(regs[R_EDI]), input_buf, input_len);
-  regs[R_ESI] = input_len;
+#undef g2h
+#undef h2g
 
 }