about summary refs log tree commit diff
path: root/qemu_mode/README.persistent.md
diff options
context:
space:
mode:
authorvan Hauser <vh@thc.org>2022-10-11 15:40:55 +0200
committerGitHub <noreply@github.com>2022-10-11 15:40:55 +0200
commitcbfa5207ba2853e249ffb256d99880368ee224e0 (patch)
tree0ca719900045ab9171b9fb2590b2323e31e9bd5f /qemu_mode/README.persistent.md
parent7e0171006a32bf6b510e08df76ca6d8555272140 (diff)
parentbac6ba89074019e0f095774ecebc435970f4940d (diff)
downloadafl++-cbfa5207ba2853e249ffb256d99880368ee224e0.tar.gz
Merge pull request #1551 from AFLplusplus/dev 4.04c
push to stable
Diffstat (limited to 'qemu_mode/README.persistent.md')
-rw-r--r--qemu_mode/README.persistent.md11
1 files changed, 6 insertions, 5 deletions
diff --git a/qemu_mode/README.persistent.md b/qemu_mode/README.persistent.md
index ab45860d..ef8fb71b 100644
--- a/qemu_mode/README.persistent.md
+++ b/qemu_mode/README.persistent.md
@@ -27,11 +27,12 @@ function and will patch the return address (on stack or in the link register) to
 return to START (like WinAFL).
 
 *Note:* If the target is compiled with position independent code (PIE/PIC) qemu
-loads these to a specific base address. For 64 bit you have to add 0x4000000000
-(9 zeroes) and for 32 bit 0x40000000 (7 zeroes) to the address. On strange
-setups the base address set by QEMU for PIE executable may change. You can check
-it printing the process map using `AFL_QEMU_DEBUG_MAPS=1 afl-qemu-trace
-TARGET-BINARY`.
+loads these to a specific base address. For amd64 bit you have to add
+0x4000000000 (9 zeroes) and for 32 bit 0x40000000 (7 zeroes) to the address.
+For aarch64 it is usually 0x5500000000.
+On strange setups the base address set by QEMU for PIE executable may change.
+You can check it printing the process map using
+`AFL_QEMU_DEBUG_MAPS=1 afl-qemu-trace TARGET-BINARY`.
 
 If this address is not valid, afl-fuzz will error during startup with the
 message that the forkserver was not found.