about summary refs log tree commit diff
path: root/frida_mode/test/js/replace.js
diff options
context:
space:
mode:
authorvanhauser-thc <vh@thc.org>2021-07-19 10:48:41 +0200
committervanhauser-thc <vh@thc.org>2021-07-19 10:48:41 +0200
commitcc57cc5f463e9b79980c2087d19b4a1e1360ec52 (patch)
tree69a89651deefc660b481e9c964f4cb97ab9073b6 /frida_mode/test/js/replace.js
parent3d1cc8ec57f0bf07d7834b652ec2db24e7914624 (diff)
parentc55f7af65700e3d11c368072d39ba6670efa477b (diff)
downloadafl++-cc57cc5f463e9b79980c2087d19b4a1e1360ec52.tar.gz
fix merge conflicts
Diffstat (limited to 'frida_mode/test/js/replace.js')
-rw-r--r--frida_mode/test/js/replace.js43
1 files changed, 43 insertions, 0 deletions
diff --git a/frida_mode/test/js/replace.js b/frida_mode/test/js/replace.js
new file mode 100644
index 00000000..4e1e7eb7
--- /dev/null
+++ b/frida_mode/test/js/replace.js
@@ -0,0 +1,43 @@
+Afl.print('******************');
+Afl.print('* AFL FRIDA MODE *');
+Afl.print('******************');
+Afl.print('');
+
+Afl.print(`PID: ${Process.id}`);
+
+const name = Process.enumerateModules()[0].name;
+Afl.print(`Name: ${name}`);
+
+new ModuleMap().values().forEach(m => {
+    Afl.print(`${m.base}-${m.base.add(m.size)} ${m.name}`);
+});
+
+const slow = DebugSymbol.fromName('slow').address;
+Afl.print(`slow: ${slow}`);
+
+const LLVMFuzzerTestOneInput = DebugSymbol.fromName('LLVMFuzzerTestOneInput').address;
+Afl.print(`LLVMFuzzerTestOneInput: ${LLVMFuzzerTestOneInput}`);
+
+const cm = new CModule(`
+
+    extern unsigned char * __afl_fuzz_ptr;
+    extern unsigned int * __afl_fuzz_len;
+    extern void LLVMFuzzerTestOneInput(char *buf, int len);
+
+    void slow(void) {
+
+      LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
+    }
+    `,
+    {
+        LLVMFuzzerTestOneInput: LLVMFuzzerTestOneInput,
+        __afl_fuzz_ptr: Afl.getAflFuzzPtr(),
+        __afl_fuzz_len: Afl.getAflFuzzLen()
+    });
+
+Afl.setEntryPoint(cm.slow);
+Afl.setPersistentAddress(cm.slow);
+Afl.setInMemoryFuzzing();
+Interceptor.replace(slow, cm.slow);
+Afl.print("done");
+Afl.done();