diff options
author | van Hauser <vh@thc.org> | 2022-10-11 15:40:55 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2022-10-11 15:40:55 +0200 |
commit | cbfa5207ba2853e249ffb256d99880368ee224e0 (patch) | |
tree | 0ca719900045ab9171b9fb2590b2323e31e9bd5f /qemu_mode/README.persistent.md | |
parent | 7e0171006a32bf6b510e08df76ca6d8555272140 (diff) | |
parent | bac6ba89074019e0f095774ecebc435970f4940d (diff) | |
download | afl++-cbfa5207ba2853e249ffb256d99880368ee224e0.tar.gz |
Merge pull request #1551 from AFLplusplus/dev 4.04c
push to stable
Diffstat (limited to 'qemu_mode/README.persistent.md')
-rw-r--r-- | qemu_mode/README.persistent.md | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/qemu_mode/README.persistent.md b/qemu_mode/README.persistent.md index ab45860d..ef8fb71b 100644 --- a/qemu_mode/README.persistent.md +++ b/qemu_mode/README.persistent.md @@ -27,11 +27,12 @@ function and will patch the return address (on stack or in the link register) to return to START (like WinAFL). *Note:* If the target is compiled with position independent code (PIE/PIC) qemu -loads these to a specific base address. For 64 bit you have to add 0x4000000000 -(9 zeroes) and for 32 bit 0x40000000 (7 zeroes) to the address. On strange -setups the base address set by QEMU for PIE executable may change. You can check -it printing the process map using `AFL_QEMU_DEBUG_MAPS=1 afl-qemu-trace -TARGET-BINARY`. +loads these to a specific base address. For amd64 bit you have to add +0x4000000000 (9 zeroes) and for 32 bit 0x40000000 (7 zeroes) to the address. +For aarch64 it is usually 0x5500000000. +On strange setups the base address set by QEMU for PIE executable may change. +You can check it printing the process map using +`AFL_QEMU_DEBUG_MAPS=1 afl-qemu-trace TARGET-BINARY`. If this address is not valid, afl-fuzz will error during startup with the message that the forkserver was not found. |