diff options
| author | van Hauser <vh@thc.org> | 2019-06-03 14:04:44 +0200 |
|---|---|---|
| committer | van Hauser <vh@thc.org> | 2019-06-03 14:04:44 +0200 |
| commit | 22418f238d57c526d9d8509308a956e2b23537c2 (patch) | |
| tree | 8f301a23563266629396a395fdc0e69ffeb17b30 /qemu_mode/patches/elfload2.diff | |
| parent | 14bfde3f78ab7efdea0d72dc731a39e2e47bb2c3 (diff) | |
| download | afl++-22418f238d57c526d9d8509308a956e2b23537c2.tar.gz | |
qemu 3.1 support added
Diffstat (limited to 'qemu_mode/patches/elfload2.diff')
| -rw-r--r-- | qemu_mode/patches/elfload2.diff | 37 |
1 files changed, 30 insertions, 7 deletions
diff --git a/qemu_mode/patches/elfload2.diff b/qemu_mode/patches/elfload2.diff index e09d11c6..045060d4 100644 --- a/qemu_mode/patches/elfload2.diff +++ b/qemu_mode/patches/elfload2.diff @@ -1,6 +1,6 @@ ---- qemu-2.10.0/linux-user/elfload.c.after 2019-05-28 15:21:36.931618928 +0200 -+++ qemu-2.10.0/linux-user/elfload.c 2019-05-28 15:22:23.939617556 +0200 -@@ -2087,7 +2087,20 @@ +--- a/linux-user/elfload.c 2019-06-03 13:06:40.755755923 +0200 ++++ b/linux-user/elfload.c 2019-06-03 13:33:01.315709801 +0200 +@@ -2303,7 +2303,20 @@ info->brk = 0; info->elf_flags = ehdr->e_flags; @@ -10,15 +10,38 @@ + if ((ptr = getenv("AFL_ENTRYPOINT")) != NULL) { + afl_entry_point = strtoul(ptr, NULL, 16); + } else { -+ if (!afl_entry_point) afl_entry_point = info->entry; ++ afl_entry_point = info->entry; + } +#ifdef TARGET_ARM + /* The least significant bit indicates Thumb mode. */ + afl_entry_point = afl_entry_point & ~(target_ulong)1; +#endif -+ if (getenv("AFL_DEBUG") != NULL) -+ fprintf(stderr, "AFL forkserver entrypoint: %p\n", (void*)afl_entry_point); -+ } while(0); ++ } ++ if (getenv("AFL_DEBUG") != NULL) ++ fprintf(stderr, "AFL forkserver entrypoint: %p\n", (void*)afl_entry_point); for (i = 0; i < ehdr->e_phnum; i++) { struct elf_phdr *eppnt = phdr + i; +@@ -2668,6 +2681,22 @@ + change some of these later */ + bprm->p = setup_arg_pages(bprm, info); + ++ // On PowerPC64 the entry point is the _function descriptor_ ++ // of the entry function. For AFL to properly initialize, ++ // afl_entry_point needs to be set to the actual first instruction ++ // as opposed executed by the target program. This as opposed to ++ // where the function's descriptor sits in memory. ++ // copied from PPC init_thread ++#if defined(TARGET_PPC64) && !defined(TARGET_ABI32) ++ if (get_ppc64_abi(infop) < 2) { ++ uint64_t val; ++ get_user_u64(val, infop->entry + 8); ++ _regs->gpr[2] = val + infop->load_bias; ++ get_user_u64(val, infop->entry); ++ infop->entry = val + infop->load_bias; ++ } ++#endif ++ + scratch = g_new0(char, TARGET_PAGE_SIZE); + if (STACK_GROWS_DOWN) { + bprm->p = copy_elf_strings(1, &bprm->filename, scratch, |