afl qemu persistent hook

3 files changed, 96 insertions, 0 deletions

diff --git a/examples/qemu_persistent_hook/README.md b/examples/qemu_persistent_hook/README.md
new file mode 100644
index 00000000..3278b60c
--- /dev/null
+++ b/examples/qemu_persistent_hook/README.md
@@ -0,0 +1,20 @@
+# QEMU persistent hook example
+
+Compile the test binary and the library:
+
+```
+gcc -no-pie test.c -o test
+gcc -fPIC -shared read_into_rdi.c -o read_into_rdi.so
+```
+
+Fuzz with:
+
+```
+export AFL_QEMU_PERSISTENT_ADDR=0x$(nm test | grep "T target_func" | awk '{print $1}')
+export AFL_QEMU_PERSISTENT_HOOK=./read_into_rdi.so
+
+mkdir in
+echo 0000 > in/in
+
+../../afl-fuzz -Q -i in -o out -- ./test
+```
diff --git a/examples/qemu_persistent_hook/read_into_rdi.c b/examples/qemu_persistent_hook/read_into_rdi.c
new file mode 100644
index 00000000..4c5119e0
--- /dev/null
+++ b/examples/qemu_persistent_hook/read_into_rdi.c
@@ -0,0 +1,42 @@
+#include <stdint.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
+#define h2g(x) ((uint64_t)(x) - guest_base)
+
+enum {
+    R_EAX = 0,
+    R_ECX = 1,
+    R_EDX = 2,
+    R_EBX = 3,
+    R_ESP = 4,
+    R_EBP = 5,
+    R_ESI = 6,
+    R_EDI = 7,
+    R_R8 = 8,
+    R_R9 = 9,
+    R_R10 = 10,
+    R_R11 = 11,
+    R_R12 = 12,
+    R_R13 = 13,
+    R_R14 = 14,
+    R_R15 = 15,
+
+    R_AL = 0,
+    R_CL = 1,
+    R_DL = 2,
+    R_BL = 3,
+    R_AH = 4,
+    R_CH = 5,
+    R_DH = 6,
+    R_BH = 7,
+};
+
+void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) {
+
+  printf("reading into %p\n", regs[R_EDI]);
+  size_t r = read(0, g2h(regs[R_EDI]), 1024);
+  printf("readed %ld bytes\n", r);
+
+}
diff --git a/examples/qemu_persistent_hook/test.c b/examples/qemu_persistent_hook/test.c
new file mode 100644
index 00000000..079d2be4
--- /dev/null
+++ b/examples/qemu_persistent_hook/test.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+
+int target_func(char *buf, int size) {
+
+  printf("buffer:%p, size:%p\n", buf, size);
+  switch (buf[0]) {
+
+    case 1:
+      if (buf[1] == '\x44') {
+        puts("a");
+      }
+      break;
+    case 0xff:
+      if (buf[2] == '\xff') {
+        if (buf[1] == '\x44') {
+          puts("b");
+        }
+      }
+      break;
+    default: break;
+
+  }
+
+  return 1;
+
+}
+
+char data[1024];
+
+int main() {
+
+  target_func(data, 1024);
+
+}