diff options
author | vanhauser-thc <vh@thc.org> | 2021-07-19 10:48:41 +0200 |
---|---|---|
committer | vanhauser-thc <vh@thc.org> | 2021-07-19 10:48:41 +0200 |
commit | cc57cc5f463e9b79980c2087d19b4a1e1360ec52 (patch) | |
tree | 69a89651deefc660b481e9c964f4cb97ab9073b6 /frida_mode/test/js/replace.js | |
parent | 3d1cc8ec57f0bf07d7834b652ec2db24e7914624 (diff) | |
parent | c55f7af65700e3d11c368072d39ba6670efa477b (diff) | |
download | afl++-cc57cc5f463e9b79980c2087d19b4a1e1360ec52.tar.gz |
fix merge conflicts
Diffstat (limited to 'frida_mode/test/js/replace.js')
-rw-r--r-- | frida_mode/test/js/replace.js | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/frida_mode/test/js/replace.js b/frida_mode/test/js/replace.js new file mode 100644 index 00000000..4e1e7eb7 --- /dev/null +++ b/frida_mode/test/js/replace.js @@ -0,0 +1,43 @@ +Afl.print('******************'); +Afl.print('* AFL FRIDA MODE *'); +Afl.print('******************'); +Afl.print(''); + +Afl.print(`PID: ${Process.id}`); + +const name = Process.enumerateModules()[0].name; +Afl.print(`Name: ${name}`); + +new ModuleMap().values().forEach(m => { + Afl.print(`${m.base}-${m.base.add(m.size)} ${m.name}`); +}); + +const slow = DebugSymbol.fromName('slow').address; +Afl.print(`slow: ${slow}`); + +const LLVMFuzzerTestOneInput = DebugSymbol.fromName('LLVMFuzzerTestOneInput').address; +Afl.print(`LLVMFuzzerTestOneInput: ${LLVMFuzzerTestOneInput}`); + +const cm = new CModule(` + + extern unsigned char * __afl_fuzz_ptr; + extern unsigned int * __afl_fuzz_len; + extern void LLVMFuzzerTestOneInput(char *buf, int len); + + void slow(void) { + + LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len); + } + `, + { + LLVMFuzzerTestOneInput: LLVMFuzzerTestOneInput, + __afl_fuzz_ptr: Afl.getAflFuzzPtr(), + __afl_fuzz_len: Afl.getAflFuzzLen() + }); + +Afl.setEntryPoint(cm.slow); +Afl.setPersistentAddress(cm.slow); +Afl.setInMemoryFuzzing(); +Interceptor.replace(slow, cm.slow); +Afl.print("done"); +Afl.done(); |