aboutsummaryrefslogtreecommitdiff
path: root/frida_mode/src/persistent/persistent.c
diff options
context:
space:
mode:
authorvanhauser-thc <vh@thc.org>2021-07-19 10:58:19 +0200
committervanhauser-thc <vh@thc.org>2021-07-19 10:58:19 +0200
commit32a0d6ac31554a47dca591f8978982758fb87677 (patch)
treebe2ffd03f136dbecd408c73e4bc250ae249a4180 /frida_mode/src/persistent/persistent.c
parent815161827689c339d335233b7b232ac9b120b79b (diff)
downloadafl++-32a0d6ac31554a47dca591f8978982758fb87677.tar.gz
Revert "Merge branch 'release' into stable"
This reverts commit 815161827689c339d335233b7b232ac9b120b79b, reversing changes made to 9321a24e682b5c8bf6278961bd014cb883b87295.
Diffstat (limited to 'frida_mode/src/persistent/persistent.c')
-rw-r--r--frida_mode/src/persistent/persistent.c80
1 files changed, 44 insertions, 36 deletions
diff --git a/frida_mode/src/persistent/persistent.c b/frida_mode/src/persistent/persistent.c
index 2ec5b9cc..639a694e 100644
--- a/frida_mode/src/persistent/persistent.c
+++ b/frida_mode/src/persistent/persistent.c
@@ -1,30 +1,31 @@
#include <dlfcn.h>
-#include "frida-gum.h"
+#include "frida-gumjs.h"
#include "config.h"
#include "debug.h"
+#include "entry.h"
#include "persistent.h"
+#include "ranges.h"
+#include "stalker.h"
#include "util.h"
-int __afl_sharedmem_fuzzing = 0;
-afl_persistent_hook_fn hook = NULL;
+int __afl_sharedmem_fuzzing = 0;
+static char *hook_name = NULL;
+
+afl_persistent_hook_fn persistent_hook = NULL;
guint64 persistent_start = 0;
guint64 persistent_count = 0;
guint64 persistent_ret = 0;
-guint64 persistent_ret_offset = 0;
gboolean persistent_debug = FALSE;
-void persistent_init(void) {
-
- char *hook_name = getenv("AFL_FRIDA_PERSISTENT_HOOK");
+void persistent_config(void) {
+ hook_name = getenv("AFL_FRIDA_PERSISTENT_HOOK");
persistent_start = util_read_address("AFL_FRIDA_PERSISTENT_ADDR");
persistent_count = util_read_num("AFL_FRIDA_PERSISTENT_CNT");
persistent_ret = util_read_address("AFL_FRIDA_PERSISTENT_RET");
- persistent_ret_offset =
- util_read_address("AFL_FRIDA_PERSISTENT_RETADDR_OFFSET");
if (getenv("AFL_FRIDA_PERSISTENT_DEBUG") != NULL) { persistent_debug = TRUE; }
@@ -36,6 +37,11 @@ void persistent_init(void) {
}
+ if (persistent_start != 0 && persistent_count == 0) persistent_count = 1000;
+
+ if (persistent_start != 0 && !persistent_is_supported())
+ FATAL("Persistent mode not supported on this architecture");
+
if (persistent_ret != 0 && persistent_start == 0) {
FATAL(
@@ -44,21 +50,28 @@ void persistent_init(void) {
}
- if (persistent_ret_offset != 0 && persistent_ret == 0) {
+ if (hook_name == NULL) { return; }
- FATAL(
- "AFL_FRIDA_PERSISTENT_RET must be specified if "
- "AFL_FRIDA_PERSISTENT_RETADDR_OFFSET is");
+ void *hook_obj = dlopen(hook_name, RTLD_NOW);
+ if (hook_obj == NULL)
+ FATAL("Failed to load AFL_FRIDA_PERSISTENT_HOOK (%s)", hook_name);
- }
+ int (*afl_persistent_hook_init_ptr)(void) =
+ dlsym(hook_obj, "afl_persistent_hook_init");
+ if (afl_persistent_hook_init_ptr == NULL)
+ FATAL("Failed to find afl_persistent_hook_init in %s", hook_name);
- if (persistent_start != 0 && persistent_count == 0) persistent_count = 1000;
+ if (afl_persistent_hook_init_ptr() == 0)
+ FATAL("afl_persistent_hook_init returned a failure");
- if (persistent_count != 0 && persistent_count < 100)
- WARNF("Persistent count out of recommended range (<100)");
+ persistent_hook =
+ (afl_persistent_hook_fn)dlsym(hook_obj, "afl_persistent_hook");
+ if (persistent_hook == NULL)
+ FATAL("Failed to find afl_persistent_hook in %s", hook_name);
- if (persistent_start != 0 && !persistent_is_supported())
- FATAL("Persistent mode not supported on this architecture");
+}
+
+void persistent_init(void) {
OKF("Instrumentation - persistent mode [%c] (0x%016" G_GINT64_MODIFIER "X)",
persistent_start == 0 ? ' ' : 'X', persistent_start);
@@ -68,30 +81,25 @@ void persistent_init(void) {
OKF("Instrumentation - persistent ret [%c] (0x%016" G_GINT64_MODIFIER "X)",
persistent_ret == 0 ? ' ' : 'X', persistent_ret);
- OKF("Instrumentation - persistent ret offset [%c] (%" G_GINT64_MODIFIER "d)",
- persistent_ret_offset == 0 ? ' ' : 'X', persistent_ret_offset);
- if (hook_name != NULL) {
+ if (persistent_hook != NULL) { __afl_sharedmem_fuzzing = 1; }
- void *hook_obj = dlopen(hook_name, RTLD_NOW);
- if (hook_obj == NULL)
- FATAL("Failed to load AFL_FRIDA_PERSISTENT_HOOK (%s)", hook_name);
+}
- int (*afl_persistent_hook_init_ptr)(void) =
- dlsym(hook_obj, "afl_persistent_hook_init");
- if (afl_persistent_hook_init_ptr == NULL)
- FATAL("Failed to find afl_persistent_hook_init in %s", hook_name);
+void persistent_prologue(GumStalkerOutput *output) {
- if (afl_persistent_hook_init_ptr() == 0)
- FATAL("afl_persistent_hook_init returned a failure");
+ OKF("AFL_FRIDA_PERSISTENT_ADDR reached");
+ entry_reached = TRUE;
+ ranges_exclude();
+ stalker_trust();
+ persistent_prologue_arch(output);
- hook = (afl_persistent_hook_fn)dlsym(hook_obj, "afl_persistent_hook");
- if (hook == NULL)
- FATAL("Failed to find afl_persistent_hook in %s", hook_name);
+}
- __afl_sharedmem_fuzzing = 1;
+void persistent_epilogue(GumStalkerOutput *output) {
- }
+ OKF("AFL_FRIDA_PERSISTENT_RET reached");
+ persistent_epilogue_arch(output);
}