aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--frida_mode/src/asan/asan.c2
-rw-r--r--frida_mode/src/ctx/ctx_arm32.c1
-rw-r--r--frida_mode/src/ctx/ctx_arm64.c1
-rw-r--r--frida_mode/src/ctx/ctx_x86.c1
-rw-r--r--frida_mode/src/instrument/instrument_x64.c24
-rw-r--r--frida_mode/src/instrument/instrument_x86.c202
-rw-r--r--frida_mode/src/persistent/persistent_x86.c1
-rw-r--r--frida_mode/test/freetype2/GNUmakefile4
-rw-r--r--frida_mode/test/vorbis/GNUmakefile200
-rw-r--r--frida_mode/test/vorbis/Makefile13
-rwxr-xr-xfrida_mode/test/vorbis/get_symbol_addr.py36
11 files changed, 431 insertions, 54 deletions
diff --git a/frida_mode/src/asan/asan.c b/frida_mode/src/asan/asan.c
index f095fb46..884bec53 100644
--- a/frida_mode/src/asan/asan.c
+++ b/frida_mode/src/asan/asan.c
@@ -49,7 +49,7 @@ static gboolean asan_exclude_module(const GumModuleDetails *details,
void asan_exclude_module_by_symbol(gchar *symbol_name) {
- gum_process_enumerate_modules(asan_exclude_module, "__asan_loadN");
+ gum_process_enumerate_modules(asan_exclude_module, symbol_name);
}
diff --git a/frida_mode/src/ctx/ctx_arm32.c b/frida_mode/src/ctx/ctx_arm32.c
index 049b5548..28fc706b 100644
--- a/frida_mode/src/ctx/ctx_arm32.c
+++ b/frida_mode/src/ctx/ctx_arm32.c
@@ -1,6 +1,7 @@
#include "frida-gumjs.h"
#include "ctx.h"
+#include "util.h"
#if defined(__arm__)
diff --git a/frida_mode/src/ctx/ctx_arm64.c b/frida_mode/src/ctx/ctx_arm64.c
index 01f321e3..63b6cf09 100644
--- a/frida_mode/src/ctx/ctx_arm64.c
+++ b/frida_mode/src/ctx/ctx_arm64.c
@@ -1,6 +1,7 @@
#include "frida-gumjs.h"
#include "ctx.h"
+#include "util.h"
#if defined(__aarch64__)
diff --git a/frida_mode/src/ctx/ctx_x86.c b/frida_mode/src/ctx/ctx_x86.c
index abfeafc8..438e1fde 100644
--- a/frida_mode/src/ctx/ctx_x86.c
+++ b/frida_mode/src/ctx/ctx_x86.c
@@ -1,6 +1,7 @@
#include "frida-gumjs.h"
#include "ctx.h"
+#include "util.h"
#if defined(__i386__)
diff --git a/frida_mode/src/instrument/instrument_x64.c b/frida_mode/src/instrument/instrument_x64.c
index c271adc1..f0bce7e2 100644
--- a/frida_mode/src/instrument/instrument_x64.c
+++ b/frida_mode/src/instrument/instrument_x64.c
@@ -68,10 +68,10 @@ typedef struct {
// sahf
// mov rax,QWORD PTR [rsp-0x80]
- uint8_t mov_rax_rsp_80[5];
- uint8_t lahf;
uint8_t mov_rax_rsp_88[8];
- uint8_t mov_rbx_rsp_90[8];
+ uint8_t lahf;
+ uint8_t mov_rax_rsp_90[8];
+ uint8_t mov_rbx_rsp_98[8];
uint8_t mov_eax_prev_loc[6];
uint8_t mov_prev_loc_curr_loc_shr1[10];
@@ -83,10 +83,10 @@ typedef struct {
uint8_t adc_bl_0[3];
uint8_t mov_ptr_rax_rbx[2];
- uint8_t mov_rsp_90_rbx[8];
- uint8_t mov_rsp_88_rax[8];
+ uint8_t mov_rsp_98_rbx[8];
+ uint8_t mov_rsp_90_rax[8];
uint8_t sahf;
- uint8_t mov_rsp_80_rax[5];
+ uint8_t mov_rsp_88_rax[8];
} afl_log_code_asm_t;
@@ -102,10 +102,10 @@ typedef union {
static const afl_log_code_asm_t template =
{
- .mov_rax_rsp_80 = {0x48, 0x89, 0x44, 0x24, 0x80},
- .lahf = 0x9f,
.mov_rax_rsp_88 = {0x48, 0x89, 0x84, 0x24, 0x78, 0xFF, 0xFF, 0xFF},
- .mov_rbx_rsp_90 = {0x48, 0x89, 0x9C, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
+ .lahf = 0x9f,
+ .mov_rax_rsp_90 = {0x48, 0x89, 0x84, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
+ .mov_rbx_rsp_98 = {0x48, 0x89, 0x9C, 0x24, 0x68, 0xFF, 0xFF, 0xFF},
.mov_eax_prev_loc = {0x8b, 0x05},
.mov_prev_loc_curr_loc_shr1 = {0xc7, 0x05},
@@ -116,10 +116,10 @@ static const afl_log_code_asm_t template =
.adc_bl_0 = {0x80, 0xd3, 0x00},
.mov_ptr_rax_rbx = {0x88, 0x18},
- .mov_rsp_90_rbx = {0x48, 0x8B, 0x9C, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
- .mov_rsp_88_rax = {0x48, 0x8B, 0x84, 0x24, 0x78, 0xFF, 0xFF, 0xFF},
+ .mov_rsp_98_rbx = {0x48, 0x8B, 0x9C, 0x24, 0x68, 0xFF, 0xFF, 0xFF},
+ .mov_rsp_90_rax = {0x48, 0x8B, 0x84, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
.sahf = 0x9e,
- .mov_rsp_80_rax = {0x48, 0x8B, 0x44, 0x24, 0x80},
+ .mov_rsp_88_rax = {0x48, 0x8B, 0x84, 0x24, 0x78, 0xFF, 0xFF, 0xFF},
}
diff --git a/frida_mode/src/instrument/instrument_x86.c b/frida_mode/src/instrument/instrument_x86.c
index 79664afa..ad837e2d 100644
--- a/frida_mode/src/instrument/instrument_x86.c
+++ b/frida_mode/src/instrument/instrument_x86.c
@@ -1,67 +1,144 @@
#include "frida-gumjs.h"
#include "instrument.h"
+#include "stalker.h"
#include "util.h"
#if defined(__i386__)
-static GumAddress current_log_impl = GUM_ADDRESS(0);
+static GHashTable *coverage_blocks = NULL;
-static void instrument_coverage_function(GumX86Writer *cw) {
+ #pragma pack(push, 1)
+typedef struct {
- gum_x86_writer_put_pushfx(cw);
- gum_x86_writer_put_push_reg(cw, GUM_REG_ECX);
- gum_x86_writer_put_push_reg(cw, GUM_REG_EDX);
+ // cur_location = (block_address >> 4) ^ (block_address << 8);
+ // shared_mem[cur_location ^ prev_location]++;
+ // prev_location = cur_location >> 1;
- gum_x86_writer_put_mov_reg_address(cw, GUM_REG_ECX,
- GUM_ADDRESS(&instrument_previous_pc));
- gum_x86_writer_put_mov_reg_reg_ptr(cw, GUM_REG_EDX, GUM_REG_ECX);
- gum_x86_writer_put_xor_reg_reg(cw, GUM_REG_EDX, GUM_REG_EDI);
+ uint8_t mov_eax_esp_4[4];
+ uint8_t lahf;
+ uint8_t mov_eax_esp_8[4];
+ uint8_t mov_ebx_esp_c[4];
- gum_x86_writer_put_add_reg_imm(cw, GUM_REG_EDX, GUM_ADDRESS(__afl_area_ptr));
+ uint8_t mov_eax_prev_loc[5];
+ uint8_t mov_prev_loc_curr_loc_shr1[10];
- /* add byte ptr [edx], 1 */
- uint8_t add_byte_ptr_edx_1[] = {0x80, 0x02, 0x01};
- gum_x86_writer_put_bytes(cw, add_byte_ptr_edx_1, sizeof(add_byte_ptr_edx_1));
+ uint8_t xor_eax_curr_loc[5];
+ uint8_t add_eax_area_ptr[5];
- /* adc byte ptr [edx], 0 */
- uint8_t adc_byte_ptr_edx_0[] = {0x80, 0x12, 0x00};
- gum_x86_writer_put_bytes(cw, adc_byte_ptr_edx_0, sizeof(adc_byte_ptr_edx_0));
+ uint8_t mov_ebx_ptr_eax[2];
+ uint8_t add_bl_1[3];
+ uint8_t adc_bl_0[3];
+ uint8_t mov_ptr_eax_ebx[2];
- uint8_t ror_di_1[] = {0x66, 0xd1, 0xcf};
- gum_x86_writer_put_bytes(cw, ror_di_1, sizeof(ror_di_1));
- gum_x86_writer_put_mov_reg_ptr_reg(cw, GUM_REG_ECX, GUM_REG_EDI);
+ uint8_t mov_esp_c_ebx[4];
+ uint8_t mov_esp_8_eax[4];
+ uint8_t sahf;
+ uint8_t mov_esp_4_eax[4];
- gum_x86_writer_put_pop_reg(cw, GUM_REG_EDX);
- gum_x86_writer_put_pop_reg(cw, GUM_REG_ECX);
- gum_x86_writer_put_popfx(cw);
- gum_x86_writer_put_ret(cw);
+} afl_log_code_asm_t;
+
+ #pragma pack(pop)
+
+typedef union {
+
+ afl_log_code_asm_t code;
+ uint8_t bytes[0];
+
+} afl_log_code;
+
+static const afl_log_code_asm_t template =
+ {
+
+ .mov_eax_esp_4 = {0x89, 0x44, 0x24, 0xFC},
+ .lahf = 0x9f,
+ .mov_eax_esp_8 = {0x89, 0x44, 0x24, 0xF8},
+ .mov_ebx_esp_c = {0x89, 0x5C, 0x24, 0xF4},
+
+ .mov_eax_prev_loc = {0xA1},
+ .mov_prev_loc_curr_loc_shr1 = {0xc7, 0x05},
+
+ .xor_eax_curr_loc = {0x35},
+ .add_eax_area_ptr = {0x05},
+ .mov_ebx_ptr_eax = {0x8a, 0x18},
+ .add_bl_1 = {0x80, 0xc3, 0x01},
+ .adc_bl_0 = {0x80, 0xd3, 0x00},
+ .mov_ptr_eax_ebx = {0x88, 0x18},
+
+ .mov_esp_c_ebx = {0x8B, 0x5C, 0x24, 0xF4},
+ .mov_esp_8_eax = {0x8B, 0x44, 0x24, 0xF8},
+ .sahf = 0x9e,
+ .mov_esp_4_eax = {0x8B, 0x44, 0x24, 0xFC},
}
+;
+
gboolean instrument_is_coverage_optimize_supported(void) {
return true;
}
-static void instrument_coverate_write_function(GumStalkerOutput *output) {
+static void instrument_coverage_switch(GumStalkerObserver *self,
+ gpointer start_address,
+ const cs_insn * from_insn,
+ gpointer * target) {
- GumX86Writer *cw = output->writer.x86;
+ UNUSED_PARAMETER(self);
+ UNUSED_PARAMETER(start_address);
+
+ cs_x86 * x86;
+ cs_x86_op *op;
+ if (from_insn == NULL) { return; }
+
+ x86 = &from_insn->detail->x86;
+ op = x86->operands;
+
+ if (!g_hash_table_contains(coverage_blocks, GSIZE_TO_POINTER(*target))) {
+
+ return;
+
+ }
+
+ switch (from_insn->id) {
+
+ case X86_INS_CALL:
+ case X86_INS_JMP:
+ if (x86->op_count != 1) {
+
+ FATAL("Unexpected operand count: %d", x86->op_count);
+
+ }
+
+ if (op[0].type != X86_OP_IMM) { return; }
+
+ break;
+ case X86_INS_RET:
+ break;
+ default:
+ return;
- if (current_log_impl == 0 ||
- !gum_x86_writer_can_branch_directly_between(cw->pc, current_log_impl) ||
- !gum_x86_writer_can_branch_directly_between(cw->pc + 128,
- current_log_impl)) {
+ }
+
+ *target = (guint8 *)*target + sizeof(afl_log_code);
+
+}
+
+static void instrument_coverage_suppress_init(void) {
- gconstpointer after_log_impl = cw->code + 1;
+ static gboolean initialized = false;
+ if (initialized) { return; }
+ initialized = true;
- gum_x86_writer_put_jmp_near_label(cw, after_log_impl);
+ GumStalkerObserver * observer = stalker_get_observer();
+ GumStalkerObserverInterface *iface = GUM_STALKER_OBSERVER_GET_IFACE(observer);
+ iface->switch_callback = instrument_coverage_switch;
- current_log_impl = cw->pc;
- instrument_coverage_function(cw);
+ coverage_blocks = g_hash_table_new(g_direct_hash, g_direct_equal);
+ if (coverage_blocks == NULL) {
- gum_x86_writer_put_label(cw, after_log_impl);
+ FATAL("Failed to g_hash_table_new, errno: %d", errno);
}
@@ -70,14 +147,61 @@ static void instrument_coverate_write_function(GumStalkerOutput *output) {
void instrument_coverage_optimize(const cs_insn * instr,
GumStalkerOutput *output) {
+ afl_log_code code = {0};
GumX86Writer *cw = output->writer.x86;
guint64 area_offset = instrument_get_offset_hash(GUM_ADDRESS(instr->address));
- instrument_coverate_write_function(output);
+ gsize map_size_pow2;
+ gsize area_offset_ror;
+
+ code.code = template;
+
+ instrument_coverage_suppress_init();
+
+ // gum_x86_writer_put_breakpoint(cw);
+
+ if (!g_hash_table_add(coverage_blocks, GSIZE_TO_POINTER(cw->code))) {
+
+ FATAL("Failed - g_hash_table_add");
+
+ }
+
+ gssize prev_loc_value_offset2 =
+ offsetof(afl_log_code, code.mov_eax_prev_loc) +
+ sizeof(code.code.mov_eax_prev_loc) - sizeof(gint);
+
+ *((gint *)&code.bytes[prev_loc_value_offset2]) =
+ (gint)GPOINTER_TO_SIZE(&instrument_previous_pc);
+
+ gssize curr_loc_shr_1_offset =
+ offsetof(afl_log_code, code.mov_prev_loc_curr_loc_shr1) +
+ sizeof(code.code.mov_prev_loc_curr_loc_shr1) - sizeof(guint32);
+
+ map_size_pow2 = util_log2(__afl_map_size);
+ area_offset_ror = util_rotate(area_offset, 1, map_size_pow2);
+
+ *((guint32 *)&code.bytes[curr_loc_shr_1_offset]) = (guint32)(area_offset_ror);
+
+ gssize prev_loc_value_offset =
+ offsetof(afl_log_code, code.mov_prev_loc_curr_loc_shr1) +
+ sizeof(code.code.mov_prev_loc_curr_loc_shr1) - sizeof(gint) -
+ sizeof(guint32);
+
+ *((gint *)&code.bytes[prev_loc_value_offset]) =
+ (gint)GPOINTER_TO_SIZE(&instrument_previous_pc);
+
+ gssize xor_curr_loc_offset = offsetof(afl_log_code, code.xor_eax_curr_loc) +
+ sizeof(code.code.xor_eax_curr_loc) -
+ sizeof(guint32);
+
+ *((guint32 *)&code.bytes[xor_curr_loc_offset]) = (guint32)area_offset;
+
+ gssize add_area_ptr_offset = offsetof(afl_log_code, code.add_eax_area_ptr) +
+ sizeof(code.code.add_eax_area_ptr) -
+ sizeof(guint32);
+
+ *((guint32 *)&code.bytes[add_area_ptr_offset]) = (guint32)__afl_area_ptr;
- gum_x86_writer_put_push_reg(cw, GUM_REG_EDI);
- gum_x86_writer_put_mov_reg_address(cw, GUM_REG_EDI, area_offset);
- gum_x86_writer_put_call_address(cw, current_log_impl);
- gum_x86_writer_put_pop_reg(cw, GUM_REG_EDI);
+ gum_x86_writer_put_bytes(cw, code.bytes, sizeof(afl_log_code));
}
diff --git a/frida_mode/src/persistent/persistent_x86.c b/frida_mode/src/persistent/persistent_x86.c
index 902274b3..5425b01b 100644
--- a/frida_mode/src/persistent/persistent_x86.c
+++ b/frida_mode/src/persistent/persistent_x86.c
@@ -4,6 +4,7 @@
#include "instrument.h"
#include "persistent.h"
+#include "util.h"
#if defined(__i386__)
diff --git a/frida_mode/test/freetype2/GNUmakefile b/frida_mode/test/freetype2/GNUmakefile
index 891660ca..f7a50de2 100644
--- a/frida_mode/test/freetype2/GNUmakefile
+++ b/frida_mode/test/freetype2/GNUmakefile
@@ -84,7 +84,7 @@ all: $(TEST_BIN)
make -C $(ROOT)frida_mode/
32:
- CXXFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
+ CFLAGS="-m32" CXXFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
$(BUILD_DIR):
mkdir -p $@
@@ -126,7 +126,7 @@ $(HARNESS_SRC):
wget -O $@ $(HARNESS_URL)
$(HARNESS_OBJ): $(HARNESS_SRC)
- $(CC) -o $@ -c $<
+ $(CC) $(CFLAGS) -o $@ -c $<
########## TEST #######
diff --git a/frida_mode/test/vorbis/GNUmakefile b/frida_mode/test/vorbis/GNUmakefile
new file mode 100644
index 00000000..59ae9a59
--- /dev/null
+++ b/frida_mode/test/vorbis/GNUmakefile
@@ -0,0 +1,200 @@
+PWD:=$(shell pwd)/
+ROOT:=$(PWD)../../../
+BUILD_DIR:=$(PWD)build/
+
+AFLPP_FRIDA_DRIVER_HOOK_OBJ=$(ROOT)frida_mode/build/frida_hook.so
+AFLPP_QEMU_DRIVER_HOOK_OBJ=$(ROOT)frida_mode/build/qemu_hook.so
+
+OGG_GIT_REPO:=https://github.com/xiph/ogg.git
+OGG_BUILD_DIR:=$(BUILD_DIR)ogg/
+OGG_DIR:=$(OGG_BUILD_DIR)ogg/
+OGG_INSTALL:=$(OGG_BUILD_DIR)install/
+OGG_LIB:=$(OGG_INSTALL)lib/libogg.a
+
+VORBIS_GIT_REPO:=https://github.com/xiph/vorbis.git
+VORBIS_BUILD_DIR:=$(BUILD_DIR)vorbis/
+VORBIS_DIR:=$(VORBIS_BUILD_DIR)vorbis/
+VORBIS_INSTALL:=$(VORBIS_BUILD_DIR)install/
+VORBIS_LIB:=$(VORBIS_INSTALL)lib/libvorbis.a
+VORBISFILE_LIB:=$(VORBIS_INSTALL)lib/libvorbisfile.a
+
+DECODE_URL:=https://raw.githubusercontent.com/google/oss-fuzz/688aadaf44499ddada755562109e5ca5eb3c5662/projects/vorbis/decode_fuzzer.cc
+DECODE_SRC:=$(BUILD_DIR)decode_fuzzer.cc
+DECODE_OBJ:=$(BUILD_DIR)decode_fuzzer.o
+
+HARNESS_URL:=https://raw.githubusercontent.com/llvm/llvm-project/main/compiler-rt/lib/fuzzer/standalone/StandaloneFuzzTargetMain.c
+HARNESS_SRC:=$(BUILD_DIR)StandaloneFuzzTargetMain.c
+HARNESS_OBJ:=$(BUILD_DIR)StandaloneFuzzTargetMain.o
+
+LDFLAGS += -lpthread
+
+TEST_BIN:=$(BUILD_DIR)decode_fuzzer
+ifeq "$(shell uname)" "Darwin"
+TEST_BIN_LDFLAGS:=-undefined dynamic_lookup -Wl,-no_pie
+endif
+
+TEST_DATA_DIR:=$(BUILD_DIR)in/
+TEST_DATA_SRC:=https://github.com/google/fuzzbench/blob/master/benchmarks/vorbis-2017-12-11/seeds/sound.ogg?raw=true
+TEST_DATA_FILE:=$(TEST_DATA_DIR)sound.ogg
+DUMMY_DATA_FILE:=$(BUILD_DIR)default_seed
+
+FRIDA_OUT:=$(BUILD_DIR)frida-out
+QEMU_OUT:=$(BUILD_DIR)qemu-out
+
+ifndef ARCH
+
+ARCH=$(shell uname -m)
+ifeq "$(ARCH)" "aarch64"
+ ARCH:=arm64
+endif
+
+ifeq "$(ARCH)" "i686"
+ ARCH:=x86
+endif
+endif
+
+GET_SYMBOL_ADDR:=$(ROOT)frida_mode/util/get_symbol_addr.sh
+
+AFL_QEMU_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x4000000000)
+
+ifeq "$(ARCH)" "aarch64"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x0000aaaaaaaaa000)
+endif
+
+ifeq "$(ARCH)" "x86_64"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x0000555555554000)
+endif
+
+ifeq "$(ARCH)" "x86"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x56555000)
+endif
+
+.PHONY: all clean frida hook
+
+all: $(TEST_BIN)
+ make -C $(ROOT)frida_mode/
+
+32:
+ CXXFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
+
+$(BUILD_DIR):
+ mkdir -p $@
+
+########## OGG #######
+
+$(OGG_BUILD_DIR): | $(BUILD_DIR)
+ mkdir -p $@
+
+$(OGG_DIR): | $(OGG_BUILD_DIR)
+ git clone $(OGG_GIT_REPO) $@
+ git -C $(OGG_DIR) checkout c8391c2b267a7faf9a09df66b1f7d324e9eb7766
+
+$(OGG_LIB): | $(OGG_DIR)
+ cd $(OGG_DIR) && ./autogen.sh
+ cd $(OGG_DIR) && ./configure \
+ --prefix=$(OGG_INSTALL) \
+ --enable-static \
+ --disable-shared \
+ --disable-crc
+ make -C $(OGG_DIR) install
+
+ogg: $(OGG_LIB)
+
+########## VORBIS #######
+
+$(VORBIS_BUILD_DIR): | $(BUILD_DIR)
+ mkdir -p $@
+
+$(VORBIS_DIR): | $(VORBIS_BUILD_DIR)
+ git clone $(VORBIS_GIT_REPO) $@
+ git -C $(VORBIS_DIR) checkout c1c2831fc7306d5fbd7bc800324efd12b28d327f
+
+$(VORBIS_LIB): $(OGG_LIB) | $(VORBIS_DIR)
+ cd $(VORBIS_DIR) && ./autogen.sh
+ cd $(VORBIS_DIR) && ./configure \
+ --prefix=$(VORBIS_INSTALL) \
+ --enable-static \
+ --disable-shared \
+ --with-ogg=$(OGG_INSTALL)
+ make -C $(VORBIS_DIR) install
+
+vorbis: $(VORBIS_LIB)
+
+########## HARNESS #######
+
+$(DECODE_SRC):
+ wget -O $@ $(DECODE_URL)
+
+$(DECODE_OBJ): $(DECODE_SRC)
+ $(CXX) -o $@ -c $< -I$(VORBIS_DIR)include/ -I$(OGG_DIR)include/
+
+decode: $(DECODE_OBJ)
+
+########## HARNESS #######
+
+$(HARNESS_SRC):
+ wget -O $@ $(HARNESS_URL)
+
+$(HARNESS_OBJ): $(HARNESS_SRC)
+ $(CC) -o $@ -c $<
+
+harness: $(HARNESS_OBJ)
+
+########## TEST #######
+
+$(TEST_BIN): $(VORBIS_LIB) $(OGG_LIB) $(HARNESS_OBJ) $(DECODE_OBJ)
+ $(CXX) \
+ $(CXXFLAGS) \
+ -std=c++11 \
+ $(DECODE_OBJ) \
+ $(HARNESS_OBJ) \
+ $(VORBISFILE_LIB) \
+ $(VORBIS_LIB) \
+ $(OGG_LIB) \
+ -o $@
+
+########## DUMMY #######
+
+$(TEST_DATA_DIR): | $(BUILD_DIR)
+ mkdir -p $@
+
+$(DUMMY_DATA_FILE): | $(TEST_DATA_DIR)
+ dd if=/dev/zero bs=1048576 count=1 of=$@
+
+###### TEST DATA #######
+
+$(TEST_DATA_FILE):
+ wget -O $@ $(TEST_DATA_SRC)
+
+clean:
+ rm -rf $(BUILD_DIR)
+
+frida: $(TEST_BIN) $(AFLPP_FRIDA_DRIVER_HOOK_OBJ) $(TEST_DATA_FILE) $(DUMMY_DATA_FILE)
+ AFL_FRIDA_PERSISTENT_CNT=1000000 \
+ AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
+ AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
+ AFL_ENTRYPOINT=$(AFL_FRIDA_PERSISTENT_ADDR) \
+ $(ROOT)afl-fuzz \
+ -i $(TEST_DATA_DIR) \
+ -o $(FRIDA_OUT) \
+ -m none \
+ -d \
+ -O \
+ -V 30 \
+ -- \
+ $(TEST_BIN) $(DUMMY_DATA_FILE)
+
+qemu: $(TEST_BIN) $(AFLPP_QEMU_DRIVER_HOOK_OBJ) $(TEST_DATA_FILE) $(DUMMY_DATA_FILE)
+ AFL_QEMU_PERSISTENT_CNT=1000000 \
+ AFL_QEMU_PERSISTENT_HOOK=$(AFLPP_QEMU_DRIVER_HOOK_OBJ) \
+ AFL_QEMU_PERSISTENT_ADDR=$(AFL_QEMU_PERSISTENT_ADDR) \
+ AFL_ENTRYPOINT=$(AFL_QEMU_PERSISTENT_ADDR) \
+ $(ROOT)afl-fuzz \
+ -i $(TEST_DATA_DIR) \
+ -o $(QEMU_OUT) \
+ -m none \
+ -d \
+ -Q \
+ -V 30 \
+ -- \
+ $(TEST_BIN) $(DUMMY_DATA_FILE)
diff --git a/frida_mode/test/vorbis/Makefile b/frida_mode/test/vorbis/Makefile
new file mode 100644
index 00000000..07b139e9
--- /dev/null
+++ b/frida_mode/test/vorbis/Makefile
@@ -0,0 +1,13 @@
+all:
+ @echo trying to use GNU make...
+ @gmake all || echo please install GNUmake
+
+32:
+ @echo trying to use GNU make...
+ @gmake 32 || echo please install GNUmake
+
+clean:
+ @gmake clean
+
+frida:
+ @gmake frida
diff --git a/frida_mode/test/vorbis/get_symbol_addr.py b/frida_mode/test/vorbis/get_symbol_addr.py
new file mode 100755
index 00000000..1c46e010
--- /dev/null
+++ b/frida_mode/test/vorbis/get_symbol_addr.py
@@ -0,0 +1,36 @@
+#!/usr/bin/python3
+import argparse
+from elftools.elf.elffile import ELFFile
+
+def process_file(file, symbol, base):
+ with open(file, 'rb') as f:
+ elf = ELFFile(f)
+ symtab = elf.get_section_by_name('.symtab')
+ mains = symtab.get_symbol_by_name(symbol)
+ if len(mains) != 1:
+ print ("Failed to find main")
+ return 1
+
+ main_addr = mains[0]['st_value']
+ main = base + main_addr
+ print ("0x%016x" % main)
+ return 0
+
+def hex_value(x):
+ return int(x, 16)
+
+def main():
+ parser = argparse.ArgumentParser(description='Process some integers.')
+ parser.add_argument('-f', '--file', dest='file', type=str,
+ help='elf file name', required=True)
+ parser.add_argument('-s', '--symbol', dest='symbol', type=str,
+ help='symbol name', required=True)
+ parser.add_argument('-b', '--base', dest='base', type=hex_value,
+ help='elf base address', required=True)
+
+ args = parser.parse_args()
+ return process_file (args.file, args.symbol, args.base)
+
+if __name__ == "__main__":
+ ret = main()
+ exit(ret)
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-23 13:03:58 +0000