about summary refs log tree commit diff
path: root/frida_mode/src
diff options
context:
space:
mode:
authorYour Name <you@example.com>2022-08-01 08:10:45 +0100
committerYour Name <you@example.com>2022-08-05 20:56:14 +0100
commit7b6743f14ceb426e282900a9d5ee35b1ac820013 (patch)
treeba76da004c1a52b79eeb21713c968eab87d4b46b /frida_mode/src
parent4b9c560b07e1ea42633b59e0eb94f7a3f0fe0c58 (diff)
downloadafl++-7b6743f14ceb426e282900a9d5ee35b1ac820013.tar.gz
Android fixes
Diffstat (limited to 'frida_mode/src')
-rw-r--r--frida_mode/src/main.c31
-rw-r--r--frida_mode/src/prefetch.c4
-rw-r--r--frida_mode/src/seccomp/seccomp.c6
3 files changed, 40 insertions, 1 deletions
diff --git a/frida_mode/src/main.c b/frida_mode/src/main.c
index 844c42b9..1bbcec28 100644
--- a/frida_mode/src/main.c
+++ b/frida_mode/src/main.c
@@ -36,6 +36,17 @@
 #ifdef __APPLE__
 extern mach_port_t mach_task_self();
 extern GumAddress  gum_darwin_find_entrypoint(mach_port_t task);
+#elif defined(__ANDROID__)
+typedef struct {
+	void (**preinit_array)(void);
+	void (**init_array)(void);
+	void (**fini_array)(void);
+} structors_array_t;
+
+extern void __libc_init(void* raw_args,
+                            void (*onexit)(void) __unused,
+                            int (*slingshot)(int, char **, char **),
+                            structors_array_t const * const structors);
 #else
 extern int  __libc_start_main(int (*main)(int, char **, char **), int argc,
                               char **ubp_av, void (*init)(void),
@@ -69,7 +80,11 @@ static void on_main_os(int argc, char **argv, char **envp) {
   GumInterceptor *interceptor = gum_interceptor_obtain();
 
   gum_interceptor_begin_transaction(interceptor);
+  #if defined(__ANDROID__)
+  gum_interceptor_revert(interceptor, __libc_init);
+  #else
   gum_interceptor_revert(interceptor, __libc_start_main);
+  #endif
   gum_interceptor_end_transaction(interceptor);
   gum_interceptor_flush(interceptor);
 
@@ -276,6 +291,22 @@ static void intercept_main(void) {
   intercept_hook(main, on_main, NULL);
 
 }
+#elif defined(__ANDROID__)
+static void on_libc_init(void* raw_args,
+                            void (*onexit)(void) __unused,
+                            int (*slingshot)(int, char**, char**),
+                            structors_array_t const * const structors){
+  main_fn = slingshot;
+  intercept_unhook_self();
+  intercept_hook(slingshot, on_main, NULL);
+  return __libc_init(raw_args, onexit, slingshot, structors);
+
+}
+static void intercept_main(void) {
+
+  intercept_hook(__libc_init, on_libc_init, NULL);
+
+}
 
 #else
 static int on_libc_start_main(int (*main)(int, char **, char **), int argc,
diff --git a/frida_mode/src/prefetch.c b/frida_mode/src/prefetch.c
index 5621a685..b2c516f5 100644
--- a/frida_mode/src/prefetch.c
+++ b/frida_mode/src/prefetch.c
@@ -298,12 +298,16 @@ void prefetch_init(void) {
 
   /*
    * Configure the shared memory region to be removed once the process dies.
+   * This doesn't work on Android, so we skip it. Would could end up leaking
+   * shared memory regions though.
    */
+ #ifndef __ANDROID__
   if (shmctl(prefetch_shm_id, IPC_RMID, NULL) < 0) {
 
     FFATAL("shmctl (IPC_RMID) < 0 - errno: %d\n", errno);
 
   }
+#endif
 
   /* Clear it, not sure it's necessary, just seems like good practice */
   memset(prefetch_data, '\0', sizeof(prefetch_data_t));
diff --git a/frida_mode/src/seccomp/seccomp.c b/frida_mode/src/seccomp/seccomp.c
index 984a3990..72443831 100644
--- a/frida_mode/src/seccomp/seccomp.c
+++ b/frida_mode/src/seccomp/seccomp.c
@@ -11,7 +11,9 @@ void seccomp_on_fork(void) {
 
 #ifdef __APPLE__
   FFATAL("Seccomp not supported on OSX");
-#else
+#elif defined(__ANDROID__)
+  FFATAL("Seccomp not supported on Android");
+#else 
   seccomp_callback_parent();
 #endif
 
@@ -32,6 +34,8 @@ void seccomp_init(void) {
 
 #ifdef __APPLE__
   FFATAL("Seccomp not supported on OSX");
+#elif defined(__ANDROID__)
+  FFATAL("Seccomp not supported on Android");
 #else
   seccomp_callback_initialize();
 #endif