diff options
| author | Andrea Fioraldi <andreafioraldi@gmail.com> | 2020-11-02 14:15:44 +0100 |
|---|---|---|
| committer | Andrea Fioraldi <andreafioraldi@gmail.com> | 2020-11-02 14:15:44 +0100 |
| commit | a260d34b4997d86ec158843c2362dae009e3bcf7 (patch) | |
| tree | 0c4ed87b721ee10b40d4a7c85f8fffc8b06182ba /examples | |
| parent | 54ed02ef4771b227b000baa5e491e13e514d235e (diff) | |
| download | afl++-a260d34b4997d86ec158843c2362dae009e3bcf7.tar.gz | |
persistent hook example
Diffstat (limited to 'examples')
| -rw-r--r-- | examples/qemu_persistent_hook/Makefile | 6 | ||||
| -rw-r--r-- | examples/qemu_persistent_hook/README.md | 3 | ||||
| -rw-r--r-- | examples/qemu_persistent_hook/read_into_rdi.c | 8 |
3 files changed, 11 insertions, 6 deletions
diff --git a/examples/qemu_persistent_hook/Makefile b/examples/qemu_persistent_hook/Makefile new file mode 100644 index 00000000..85db1b46 --- /dev/null +++ b/examples/qemu_persistent_hook/Makefile @@ -0,0 +1,6 @@ +all: + $(CC) -no-pie test.c -o test + $(CC) -fPIC -shared read_into_rdi.c -o read_into_rdi.so + +clean: + rm -rf in out test read_into_rdi.so diff --git a/examples/qemu_persistent_hook/README.md b/examples/qemu_persistent_hook/README.md index 3278b60c..3f908c22 100644 --- a/examples/qemu_persistent_hook/README.md +++ b/examples/qemu_persistent_hook/README.md @@ -3,8 +3,7 @@ Compile the test binary and the library: ``` -gcc -no-pie test.c -o test -gcc -fPIC -shared read_into_rdi.c -o read_into_rdi.so +make ``` Fuzz with: diff --git a/examples/qemu_persistent_hook/read_into_rdi.c b/examples/qemu_persistent_hook/read_into_rdi.c index 15647cb4..1977c89f 100644 --- a/examples/qemu_persistent_hook/read_into_rdi.c +++ b/examples/qemu_persistent_hook/read_into_rdi.c @@ -15,11 +15,11 @@ void afl_persistent_hook(struct x86_64_regs *regs, // of the target buffer, and the length of the input is in RSI. // This can be seen with a debugger, e.g. gdb (and "disass main") - printf("Placing input into %p\n", regs->rdi); + printf("Placing input into 0x%lx\n", regs->rdi); - if (input_len > 1024) input_len = 1024; - memcpy(g2h(regs->rdi), input_buf, input_len); - regs->rsi = input_len; + if (input_buf_len > 1024) input_buf_len = 1024; + memcpy(g2h(regs->rdi), input_buf, input_buf_len); + regs->rsi = input_buf_len; #undef g2h #undef h2g |