diff options
author | Maik Betka <9078425+voidptr127@users.noreply.github.com> | 2023-04-21 11:31:22 +0200 |
---|---|---|
committer | Maik Betka <9078425+voidptr127@users.noreply.github.com> | 2023-04-21 11:31:22 +0200 |
commit | 7101ffa1ae79e15d70905b09decbe69cdf53367b (patch) | |
tree | fd34b5686a4522dd6d29c9a40cee3d9826b2c7c6 /qemu_mode/README.persistent.md | |
parent | 9ab902402cd33156257fc0355c0105e7e03f5ba3 (diff) | |
parent | 4e5f42cab6b8c501eeaf76ec7ca920089f6e0f3a (diff) | |
download | afl++-7101ffa1ae79e15d70905b09decbe69cdf53367b.tar.gz |
Merge remote-tracking branch 'origin/dev' into atnwalk
# Conflicts: # include/afl-fuzz.h # src/afl-fuzz-run.c
Diffstat (limited to 'qemu_mode/README.persistent.md')
-rw-r--r-- | qemu_mode/README.persistent.md | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/qemu_mode/README.persistent.md b/qemu_mode/README.persistent.md index ab45860d..ef8fb71b 100644 --- a/qemu_mode/README.persistent.md +++ b/qemu_mode/README.persistent.md @@ -27,11 +27,12 @@ function and will patch the return address (on stack or in the link register) to return to START (like WinAFL). *Note:* If the target is compiled with position independent code (PIE/PIC) qemu -loads these to a specific base address. For 64 bit you have to add 0x4000000000 -(9 zeroes) and for 32 bit 0x40000000 (7 zeroes) to the address. On strange -setups the base address set by QEMU for PIE executable may change. You can check -it printing the process map using `AFL_QEMU_DEBUG_MAPS=1 afl-qemu-trace -TARGET-BINARY`. +loads these to a specific base address. For amd64 bit you have to add +0x4000000000 (9 zeroes) and for 32 bit 0x40000000 (7 zeroes) to the address. +For aarch64 it is usually 0x5500000000. +On strange setups the base address set by QEMU for PIE executable may change. +You can check it printing the process map using +`AFL_QEMU_DEBUG_MAPS=1 afl-qemu-trace TARGET-BINARY`. If this address is not valid, afl-fuzz will error during startup with the message that the forkserver was not found. |