diff options
| author | vanhauser-thc <vh@thc.org> | 2020-12-01 14:40:30 +0100 |
|---|---|---|
| committer | vanhauser-thc <vh@thc.org> | 2020-12-01 14:40:30 +0100 |
| commit | c05e4efbe9b4e7d1ff078b7a392621f2ca7572e6 (patch) | |
| tree | e005593b09169435cbad53c9990c6485e8fd9d06 /utils/qemu_persistent_hook/read_into_rdi.c | |
| parent | 8584f9d2b5de9687c518c672e471f4f8cd9166fa (diff) | |
| download | afl++-c05e4efbe9b4e7d1ff078b7a392621f2ca7572e6.tar.gz | |
renamed examples/ to utils/
Diffstat (limited to 'utils/qemu_persistent_hook/read_into_rdi.c')
| -rw-r--r-- | utils/qemu_persistent_hook/read_into_rdi.c | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/utils/qemu_persistent_hook/read_into_rdi.c b/utils/qemu_persistent_hook/read_into_rdi.c new file mode 100644 index 00000000..f4a8ae59 --- /dev/null +++ b/utils/qemu_persistent_hook/read_into_rdi.c @@ -0,0 +1,34 @@ +#include "../../qemu_mode/qemuafl/qemuafl/api.h" + +#include <stdio.h> +#include <string.h> + +void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base, + uint8_t *input_buf, uint32_t input_buf_len) { +\ +#define g2h(x) ((void *)((unsigned long)(x) + guest_base)) +#define h2g(x) ((uint64_t)(x)-guest_base) + + // In this example the register RDI is pointing to the memory location + // of the target buffer, and the length of the input is in RSI. + // This can be seen with a debugger, e.g. gdb (and "disass main") + + printf("Placing input into 0x%lx\n", regs->rdi); + + if (input_buf_len > 1024) input_buf_len = 1024; + memcpy(g2h(regs->rdi), input_buf, input_buf_len); + regs->rsi = input_buf_len; + +#undef g2h +#undef h2g + +} + +int afl_persistent_hook_init(void) { + + // 1 for shared memory input (faster), 0 for normal input (you have to use + // read(), input_buf will be NULL) + return 1; + +} + |
