aboutsummaryrefslogtreecommitdiff
path: root/examples/qemu_persistent_hook
diff options
context:
space:
mode:
authorvanhauser-thc <vh@thc.org>2020-12-01 14:40:30 +0100
committervanhauser-thc <vh@thc.org>2020-12-01 14:40:30 +0100
commitc05e4efbe9b4e7d1ff078b7a392621f2ca7572e6 (patch)
treee005593b09169435cbad53c9990c6485e8fd9d06 /examples/qemu_persistent_hook
parent8584f9d2b5de9687c518c672e471f4f8cd9166fa (diff)
downloadafl++-c05e4efbe9b4e7d1ff078b7a392621f2ca7572e6.tar.gz
renamed examples/ to utils/
Diffstat (limited to 'examples/qemu_persistent_hook')
-rw-r--r--examples/qemu_persistent_hook/Makefile6
-rw-r--r--examples/qemu_persistent_hook/README.md19
-rw-r--r--examples/qemu_persistent_hook/read_into_rdi.c34
-rw-r--r--examples/qemu_persistent_hook/test.c35
4 files changed, 0 insertions, 94 deletions
diff --git a/examples/qemu_persistent_hook/Makefile b/examples/qemu_persistent_hook/Makefile
deleted file mode 100644
index 85db1b46..00000000
--- a/examples/qemu_persistent_hook/Makefile
+++ /dev/null
@@ -1,6 +0,0 @@
-all:
- $(CC) -no-pie test.c -o test
- $(CC) -fPIC -shared read_into_rdi.c -o read_into_rdi.so
-
-clean:
- rm -rf in out test read_into_rdi.so
diff --git a/examples/qemu_persistent_hook/README.md b/examples/qemu_persistent_hook/README.md
deleted file mode 100644
index 3f908c22..00000000
--- a/examples/qemu_persistent_hook/README.md
+++ /dev/null
@@ -1,19 +0,0 @@
-# QEMU persistent hook example
-
-Compile the test binary and the library:
-
-```
-make
-```
-
-Fuzz with:
-
-```
-export AFL_QEMU_PERSISTENT_ADDR=0x$(nm test | grep "T target_func" | awk '{print $1}')
-export AFL_QEMU_PERSISTENT_HOOK=./read_into_rdi.so
-
-mkdir in
-echo 0000 > in/in
-
-../../afl-fuzz -Q -i in -o out -- ./test
-```
diff --git a/examples/qemu_persistent_hook/read_into_rdi.c b/examples/qemu_persistent_hook/read_into_rdi.c
deleted file mode 100644
index f4a8ae59..00000000
--- a/examples/qemu_persistent_hook/read_into_rdi.c
+++ /dev/null
@@ -1,34 +0,0 @@
-#include "../../qemu_mode/qemuafl/qemuafl/api.h"
-
-#include <stdio.h>
-#include <string.h>
-
-void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
- uint8_t *input_buf, uint32_t input_buf_len) {
-\
-#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
-#define h2g(x) ((uint64_t)(x)-guest_base)
-
- // In this example the register RDI is pointing to the memory location
- // of the target buffer, and the length of the input is in RSI.
- // This can be seen with a debugger, e.g. gdb (and "disass main")
-
- printf("Placing input into 0x%lx\n", regs->rdi);
-
- if (input_buf_len > 1024) input_buf_len = 1024;
- memcpy(g2h(regs->rdi), input_buf, input_buf_len);
- regs->rsi = input_buf_len;
-
-#undef g2h
-#undef h2g
-
-}
-
-int afl_persistent_hook_init(void) {
-
- // 1 for shared memory input (faster), 0 for normal input (you have to use
- // read(), input_buf will be NULL)
- return 1;
-
-}
-
diff --git a/examples/qemu_persistent_hook/test.c b/examples/qemu_persistent_hook/test.c
deleted file mode 100644
index afeff202..00000000
--- a/examples/qemu_persistent_hook/test.c
+++ /dev/null
@@ -1,35 +0,0 @@
-#include <stdio.h>
-
-int target_func(unsigned char *buf, int size) {
-
- printf("buffer:%p, size:%p\n", buf, size);
- switch (buf[0]) {
-
- case 1:
- if (buf[1] == '\x44') { puts("a"); }
- break;
- case 0xff:
- if (buf[2] == '\xff') {
-
- if (buf[1] == '\x44') { puts("b"); }
-
- }
-
- break;
- default:
- break;
-
- }
-
- return 1;
-
-}
-
-char data[1024];
-
-int main() {
-
- target_func(data, 1024);
-
-}
-