aboutsummaryrefslogtreecommitdiff
path: root/frida_mode/src/instrument
diff options
context:
space:
mode:
Diffstat (limited to 'frida_mode/src/instrument')
-rw-r--r--frida_mode/src/instrument/instrument.c38
-rw-r--r--frida_mode/src/instrument/instrument_arm32.c171
-rw-r--r--frida_mode/src/instrument/instrument_arm64.c2
-rw-r--r--frida_mode/src/instrument/instrument_coverage.c150
-rw-r--r--frida_mode/src/instrument/instrument_debug.c2
-rw-r--r--frida_mode/src/instrument/instrument_x64.c2
-rw-r--r--frida_mode/src/instrument/instrument_x86.c2
7 files changed, 307 insertions, 60 deletions
diff --git a/frida_mode/src/instrument/instrument.c b/frida_mode/src/instrument/instrument.c
index 93c498e8..e1e4ac22 100644
--- a/frida_mode/src/instrument/instrument.c
+++ b/frida_mode/src/instrument/instrument.c
@@ -1,7 +1,5 @@
#include <fcntl.h>
#include <unistd.h>
-#include <sys/shm.h>
-#include <sys/mman.h>
#include <sys/syscall.h>
#include "frida-gumjs.h"
@@ -17,6 +15,7 @@
#include "persistent.h"
#include "prefetch.h"
#include "ranges.h"
+#include "shm.h"
#include "stalker.h"
#include "stats.h"
#include "util.h"
@@ -33,7 +32,7 @@ gboolean instrument_use_fixed_seed = FALSE;
guint64 instrument_fixed_seed = 0;
char *instrument_coverage_unstable_filename = NULL;
gboolean instrument_coverage_insn = FALSE;
-char * instrument_regs_filename = NULL;
+char *instrument_regs_filename = NULL;
static GumStalkerTransformer *transformer = NULL;
@@ -237,9 +236,12 @@ static void instrument_basic_block(GumStalkerIterator *iterator,
}
if (unlikely(instrument_regs_filename != NULL)) {
+
gum_stalker_iterator_put_callout(iterator, instrument_write_regs,
(void *)(size_t)regs_fd, NULL);
+
}
+
}
}
@@ -274,6 +276,7 @@ static void instrument_basic_block(GumStalkerIterator *iterator,
instrument_flush(output);
instrument_debug_end(output);
instrument_coverage_end(instr->address + instr->size);
+
}
void instrument_config(void) {
@@ -344,29 +347,7 @@ void instrument_init(void) {
transformer = gum_stalker_transformer_make_from_callback(
instrument_basic_block, NULL, NULL);
- if (instrument_unique) {
-
- int shm_id =
- shmget(IPC_PRIVATE, __afl_map_size, IPC_CREAT | IPC_EXCL | 0600);
- if (shm_id < 0) { FATAL("shm_id < 0 - errno: %d\n", errno); }
-
- edges_notified = shmat(shm_id, NULL, 0);
- g_assert(edges_notified != MAP_FAILED);
-
- /*
- * Configure the shared memory region to be removed once the process
- * dies.
- */
- if (shmctl(shm_id, IPC_RMID, NULL) < 0) {
-
- FATAL("shmctl (IPC_RMID) < 0 - errno: %d\n", errno);
-
- }
-
- /* Clear it, not sure it's necessary, just seems like good practice */
- memset(edges_notified, '\0', __afl_map_size);
-
- }
+ if (instrument_unique) { edges_notified = shm_create(__afl_map_size); }
if (instrument_use_fixed_seed) {
@@ -404,6 +385,7 @@ void instrument_init(void) {
instrument_regs_filename == NULL ? " " : instrument_regs_filename);
if (instrument_regs_filename != NULL) {
+
char *path =
g_canonicalize_filename(instrument_regs_filename, g_get_current_dir());
@@ -415,6 +397,7 @@ void instrument_init(void) {
if (regs_fd < 0) { FFATAL("Failed to open regs file '%s'", path); }
g_free(path);
+
}
asan_init();
@@ -444,6 +427,7 @@ void instrument_on_fork() {
}
void instrument_regs_format(int fd, char *format, ...) {
+
va_list ap;
char buffer[4096] = {0};
int ret;
@@ -458,4 +442,6 @@ void instrument_regs_format(int fd, char *format, ...) {
len = strnlen(buffer, sizeof(buffer));
IGNORED_RETURN(write(fd, buffer, len));
+
}
+
diff --git a/frida_mode/src/instrument/instrument_arm32.c b/frida_mode/src/instrument/instrument_arm32.c
index 73923326..f2e825ee 100644
--- a/frida_mode/src/instrument/instrument_arm32.c
+++ b/frida_mode/src/instrument/instrument_arm32.c
@@ -5,21 +5,159 @@
#if defined(__arm__)
+ #define PAGE_MASK (~(GUM_ADDRESS(0xfff)))
+ #define PAGE_ALIGNED(x) ((GUM_ADDRESS(x) & PAGE_MASK) == GUM_ADDRESS(x))
+
gboolean instrument_cache_enabled = FALSE;
gsize instrument_cache_size = 0;
+extern __thread guint64 instrument_previous_pc;
+
+__attribute__((aligned(0x1000))) static guint8 area_ptr_dummy[MAP_SIZE];
+
+ #pragma pack(push, 1)
+typedef struct {
+
+ // cur_location = (block_address >> 4) ^ (block_address << 8);
+ // shared_mem[cur_location ^ prev_location]++;
+ // prev_location = cur_location >> 1;
+
+ /* We can remove this branch when we add support for branch suppression */
+ uint32_t b_code; /* b imm */
+ uint8_t *shared_mem;
+ uint64_t *prev_location;
+
+ /* code */
+
+ /* save regs */
+ uint32_t str_r0_sp_rz; /* str r0, [sp - RED_ZONE] */
+ uint32_t str_r1_sp_rz_4; /* str r1, [sp - (RED_ZONE + 4)] */
+
+ /* load prev */
+ uint32_t ldr_r0_pprev; /* ldr r0, [pc-x] */
+ uint32_t ldrh_r1_r0; /* ldrh r1, [r0] */
+
+ /* load curr */
+ uint32_t mov_r0_block_id; /* mov r0, #imm16 */
+
+ /* calculate new */
+ uint32_t eor_r0_r0_r1; /* eor r0, r0, r1 */
+
+ /* load map */
+ uint32_t ldr_r1_pmap; /* ldr r1, [pc-x] */
+
+ /* calculate offset */
+ uint32_t add_r1_r1_r0; /* add r1, r1, r0 */
+
+ /* Load the value */
+ uint32_t ldrb_r0_r1; /* ldrb r0, [r1] */
+
+ /* Increment the value */
+ uint32_t add_r0_r0_1; /* add r0, r0, #1 */
+ uint32_t add_r0_r0_r0_lsr_8; /* add r0, r0, r0, lsr #8 */
+
+ /* Save the value */
+ uint32_t strb_r0_r1; /* strb r0, [r1] */
+
+ /* load curr shifted */
+ uint32_t mov_r0_block_id_shr_1; /* mov r0, #imm16 >> 1*/
+
+ /* Update prev */
+ uint32_t ldr_r1_pprev; /* ldr r1, [pc-x] */
+ uint32_t strh_r0_r1; /* strh r0, [r1] */
+
+ /* restore regs */
+ uint32_t ldr_r1_sp_rz_4; /* ldr r1, [sp - (RED_ZONE + 4)] */
+ uint32_t ldr_r0_sp_rz; /* ldr r0, [sp - RED_ZONE] */
+
+} afl_log_code_asm_t;
+
+typedef union {
+
+ afl_log_code_asm_t code;
+ uint8_t bytes[0];
+
+} afl_log_code;
+
+ #pragma pack(pop)
+
+static const afl_log_code_asm_t template =
+ {
+
+ .b_code = GUINT32_TO_LE(0xea000001),
+ .shared_mem = (uint8_t *)GUINT32_TO_LE(0xcefaadde),
+ .prev_location = (uint64_t *)GUINT32_TO_LE(0xadba0df0),
+ .str_r0_sp_rz = GUINT32_TO_LE(0xe50d0080),
+ .str_r1_sp_rz_4 = GUINT32_TO_LE(0xe50d1084),
+ .ldr_r0_pprev = GUINT32_TO_LE(0xe51f0014),
+ .ldrh_r1_r0 = GUINT32_TO_LE(0xe1d010b0),
+ .mov_r0_block_id = GUINT32_TO_LE(0xe3000000),
+ .eor_r0_r0_r1 = GUINT32_TO_LE(0xe0200001),
+ .ldr_r1_pmap = GUINT32_TO_LE(0xe51f1028),
+ .add_r1_r1_r0 = GUINT32_TO_LE(0xe0811000),
+ .ldrb_r0_r1 = GUINT32_TO_LE(0xe5d10000),
+ .add_r0_r0_1 = GUINT32_TO_LE(0xe2800001),
+ .add_r0_r0_r0_lsr_8 = GUINT32_TO_LE(0xe0800420),
+ .strb_r0_r1 = GUINT32_TO_LE(0xe5c10000),
+ .mov_r0_block_id_shr_1 = GUINT32_TO_LE(0xe3000000),
+ .ldr_r1_pprev = GUINT32_TO_LE(0xe51f1040),
+ .strh_r0_r1 = GUINT32_TO_LE(0xe1c100b0),
+ .ldr_r1_sp_rz_4 = GUINT32_TO_LE(0xe51d1084),
+ .ldr_r0_sp_rz = GUINT32_TO_LE(0xe51d0080),
+
+}
+
+;
+
gboolean instrument_is_coverage_optimize_supported(void) {
- return false;
+ return true;
+
+}
+
+static void patch_t3_insn(uint32_t *insn, uint16_t val) {
+
+ uint32_t orig = GUINT32_FROM_LE(*insn);
+ uint32_t imm12 = (val & 0xfff);
+ uint32_t imm4 = (val >> 12);
+ orig |= imm12;
+ orig |= (imm4 << 16);
+ *insn = GUINT32_TO_LE(orig);
}
void instrument_coverage_optimize(const cs_insn *instr,
GumStalkerOutput *output) {
- UNUSED_PARAMETER(instr);
- UNUSED_PARAMETER(output);
- FFATAL("Optimized coverage not supported on this architecture");
+ afl_log_code code = {0};
+ GumArmWriter *cw = output->writer.arm;
+ gpointer block_start;
+ guint64 area_offset = instrument_get_offset_hash(GUM_ADDRESS(instr->address));
+ gsize map_size_pow2;
+ gsize area_offset_ror;
+ GumAddress code_addr = 0;
+
+ // gum_arm64_writer_put_brk_imm(cw, 0x0);
+
+ code_addr = cw->pc;
+
+ block_start = GSIZE_TO_POINTER(GUM_ADDRESS(cw->code));
+
+ code.code = template;
+
+ g_assert(PAGE_ALIGNED(__afl_area_ptr));
+
+ map_size_pow2 = util_log2(__afl_map_size);
+ area_offset_ror = util_rotate(area_offset, 1, map_size_pow2);
+
+ code.code.shared_mem = __afl_area_ptr;
+ code.code.prev_location = instrument_previous_pc_addr;
+
+ patch_t3_insn(&code.code.mov_r0_block_id, (uint16_t)area_offset);
+ patch_t3_insn(&code.code.mov_r0_block_id_shr_1, (uint16_t)area_offset_ror);
+
+ // gum_arm_writer_put_breakpoint(cw);
+ gum_arm_writer_put_bytes(cw, code.bytes, sizeof(afl_log_code));
}
@@ -28,13 +166,32 @@ void instrument_coverage_optimize_insn(const cs_insn *instr,
UNUSED_PARAMETER(instr);
UNUSED_PARAMETER(output);
- FFATAL("Optimized coverage not supported on this architecture");
}
void instrument_coverage_optimize_init(void) {
- FWARNF("Optimized coverage not supported on this architecture");
+ char *shm_env = getenv(SHM_ENV_VAR);
+ FVERBOSE("SHM_ENV_VAR: %s", shm_env);
+
+ if (shm_env == NULL) {
+
+ FWARNF("SHM_ENV_VAR not set, using dummy for debugging purposes");
+
+ __afl_area_ptr = area_ptr_dummy;
+ memset(area_ptr_dummy, '\0', sizeof(area_ptr_dummy));
+
+ }
+
+ FVERBOSE("__afl_area_ptr: %p", __afl_area_ptr);
+
+ if (instrument_previous_pc_addr == NULL) {
+
+ instrument_previous_pc_addr = &instrument_previous_pc;
+ *instrument_previous_pc_addr = instrument_hash_zero;
+ FVERBOSE("instrument_previous_pc_addr: %p", instrument_previous_pc_addr);
+
+ }
}
@@ -81,6 +238,7 @@ void instrument_cache(const cs_insn *instr, GumStalkerOutput *output) {
}
void instrument_write_regs(GumCpuContext *cpu_context, gpointer user_data) {
+
int fd = (int)user_data;
instrument_regs_format(fd,
"r0 : 0x%08x, r1 : 0x%08x, r2 : 0x%08x, r3 : 0x%08x\n",
@@ -97,6 +255,7 @@ void instrument_write_regs(GumCpuContext *cpu_context, gpointer user_data) {
fd, "r12: 0x%08x, sp : 0x%08x, lr : 0x%08x, pc : 0x%08x\n",
cpu_context->r12, cpu_context->sp, cpu_context->lr, cpu_context->pc);
instrument_regs_format(fd, "cpsr: 0x%08x\n\n", cpu_context->cpsr);
+
}
#endif
diff --git a/frida_mode/src/instrument/instrument_arm64.c b/frida_mode/src/instrument/instrument_arm64.c
index 9157f8f5..87811b38 100644
--- a/frida_mode/src/instrument/instrument_arm64.c
+++ b/frida_mode/src/instrument/instrument_arm64.c
@@ -407,6 +407,7 @@ void instrument_cache(const cs_insn *instr, GumStalkerOutput *output) {
}
void instrument_write_regs(GumCpuContext *cpu_context, gpointer user_data) {
+
int fd = (int)(size_t)user_data;
instrument_regs_format(
fd, "x0 : 0x%016x, x1 : 0x%016x, x2 : 0x%016x, x3 : 0x%016x\n",
@@ -440,6 +441,7 @@ void instrument_write_regs(GumCpuContext *cpu_context, gpointer user_data) {
fd, "x28: 0x%016x, fp : 0x%016x, lr : 0x%016x, sp : 0x%016x\n",
cpu_context->x[28], cpu_context->fp, cpu_context->lr, cpu_context->sp);
instrument_regs_format(fd, "pc : 0x%016x\n\n", cpu_context->pc);
+
}
#endif
diff --git a/frida_mode/src/instrument/instrument_coverage.c b/frida_mode/src/instrument/instrument_coverage.c
index 07d4d622..ff2f4024 100644
--- a/frida_mode/src/instrument/instrument_coverage.c
+++ b/frida_mode/src/instrument/instrument_coverage.c
@@ -9,6 +9,7 @@
#include "util.h"
char *instrument_coverage_filename = NULL;
+bool instrument_coverage_absolute = false;
static int normal_coverage_fd = -1;
static int normal_coverage_pipes[2] = {-1, -1};
@@ -237,6 +238,18 @@ static void instrument_coverage_mark(void *key, void *value, void *user_data) {
}
+static void instrument_coverage_mark_first(void *key, void *value,
+ void *user_data) {
+
+ UNUSED_PARAMETER(key);
+ coverage_range_t *module = (coverage_range_t *)user_data;
+ normal_coverage_data_t *val = (normal_coverage_data_t *)value;
+
+ val->module = module;
+ module->count++;
+
+}
+
static void coverage_write(int fd, void *data, size_t size) {
ssize_t written;
@@ -404,28 +417,69 @@ static void instrument_coverage_normal_run() {
instrument_coverage_print("Coverage - Preparing\n");
- GArray *coverage_modules = coverage_get_modules();
+ if (instrument_coverage_absolute) {
- guint size = g_hash_table_size(coverage_hash);
- instrument_coverage_print("Coverage - Total Entries: %u\n", size);
+ guint size = g_hash_table_size(coverage_hash);
+ instrument_coverage_print("Coverage - Total Entries: %u\n", size);
- coverage_mark_ctx_t ctx = {.modules = coverage_modules, .count = 0};
+ coverage_range_t module = {
- g_hash_table_foreach(coverage_hash, instrument_coverage_mark, &ctx);
- instrument_coverage_print("Coverage - Marked Entries: %u\n", ctx.count);
+ .base_address = GUM_ADDRESS(0),
+ .limit = GUM_ADDRESS(-1),
+ .size = GUM_ADDRESS(-1),
+ .path = "absolute",
+ .offset = 0,
+ .is_executable = true,
+ .count = size,
+ .id = 0,
- guint coverage_marked_modules = coverage_mark_modules(coverage_modules);
- instrument_coverage_print("Coverage - Marked Modules: %u\n",
- coverage_marked_modules);
+ };
- coverage_write_header(normal_coverage_fd, coverage_marked_modules);
- coverage_write_modules(normal_coverage_fd, coverage_modules);
- coverage_format(normal_coverage_fd, "BB Table: %u bbs\n", ctx.count);
- g_hash_table_foreach(coverage_hash, coverage_write_events,
- &normal_coverage_fd);
+ instrument_coverage_print("Coverage Module - 0x%016" G_GINT64_MODIFIER
+ "X - 0x%016" G_GINT64_MODIFIER "X (%s)\n",
+ module.base_address, module.limit, module.path);
- g_hash_table_unref(coverage_hash);
+ GArray *coverage_modules =
+ g_array_sized_new(false, false, sizeof(coverage_range_t), 1);
+ g_array_append_val(coverage_modules, module);
+
+ g_hash_table_foreach(coverage_hash, instrument_coverage_mark_first,
+ &module);
+
+ coverage_write_header(normal_coverage_fd, 1);
+ coverage_write_modules(normal_coverage_fd, coverage_modules);
+ coverage_format(normal_coverage_fd, "BB Table: %u bbs\n", size);
+ g_hash_table_foreach(coverage_hash, coverage_write_events,
+ &normal_coverage_fd);
+
+ } else {
+
+ GArray *coverage_modules = coverage_get_modules();
+
+ guint size = g_hash_table_size(coverage_hash);
+ instrument_coverage_print("Coverage - Total Entries: %u\n", size);
+
+ coverage_mark_ctx_t ctx = {.modules = coverage_modules, .count = 0};
+
+ /* For each coverage event in the hashtable associate it with a module and
+ * count the number of entries per module */
+ g_hash_table_foreach(coverage_hash, instrument_coverage_mark, &ctx);
+ instrument_coverage_print("Coverage - Marked Entries: %u\n", ctx.count);
+
+ /* For each module with coverage events assign it an incrementing number */
+ guint coverage_marked_modules = coverage_mark_modules(coverage_modules);
+ instrument_coverage_print("Coverage - Marked Modules: %u\n",
+ coverage_marked_modules);
+
+ coverage_write_header(normal_coverage_fd, coverage_marked_modules);
+ coverage_write_modules(normal_coverage_fd, coverage_modules);
+ coverage_format(normal_coverage_fd, "BB Table: %u bbs\n", ctx.count);
+ g_hash_table_foreach(coverage_hash, coverage_write_events,
+ &normal_coverage_fd);
+ }
+
+ g_hash_table_unref(coverage_hash);
instrument_coverage_print("Coverage - Completed\n");
}
@@ -622,8 +676,6 @@ static void instrument_coverage_unstable_run(void) {
instrument_coverage_print("Coverage - Preparing\n");
- GArray *coverage_modules = coverage_get_modules();
-
instrument_coverage_print("Found edges: %u\n", edges);
GArray *unstable_edge_ids = instrument_coverage_unstable_read_unstable_ids();
@@ -634,20 +686,60 @@ static void instrument_coverage_unstable_run(void) {
guint size = g_hash_table_size(unstable_blocks);
instrument_coverage_print("Unstable blocks: %u\n", size);
- coverage_mark_ctx_t ctx = {.modules = coverage_modules, .count = 0};
+ if (instrument_coverage_absolute) {
+
+ instrument_coverage_print("Coverage - Total Entries: %u\n", size);
+
+ coverage_range_t module = {
+
+ .base_address = GUM_ADDRESS(0),
+ .limit = GUM_ADDRESS(-1),
+ .size = GUM_ADDRESS(-1),
+ .path = "absolute",
+ .offset = 0,
+ .is_executable = true,
+ .count = size,
+ .id = 0,
+
+ };
+
+ instrument_coverage_print("Coverage Module - 0x%016" G_GINT64_MODIFIER
+ "X - 0x%016" G_GINT64_MODIFIER "X (%s)\n",
+ module.base_address, module.limit, module.path);
- g_hash_table_foreach(unstable_blocks, instrument_coverage_mark, &ctx);
- instrument_coverage_print("Coverage - Marked Entries: %u\n", ctx.count);
+ GArray *coverage_modules =
+ g_array_sized_new(false, false, sizeof(coverage_range_t), 1);
+ g_array_append_val(coverage_modules, module);
- guint coverage_marked_modules = coverage_mark_modules(coverage_modules);
- instrument_coverage_print("Coverage - Marked Modules: %u\n",
- coverage_marked_modules);
+ g_hash_table_foreach(unstable_blocks, instrument_coverage_mark_first,
+ &module);
- coverage_write_header(unstable_coverage_fd, coverage_marked_modules);
- coverage_write_modules(unstable_coverage_fd, coverage_modules);
- coverage_format(unstable_coverage_fd, "BB Table: %u bbs\n", ctx.count);
- g_hash_table_foreach(unstable_blocks, coverage_write_events,
- &unstable_coverage_fd);
+ coverage_write_header(unstable_coverage_fd, 1);
+ coverage_write_modules(unstable_coverage_fd, coverage_modules);
+ coverage_format(unstable_coverage_fd, "BB Table: %u bbs\n", size);
+ g_hash_table_foreach(unstable_blocks, coverage_write_events,
+ &unstable_coverage_fd);
+
+ } else {
+
+ GArray *coverage_modules = coverage_get_modules();
+
+ coverage_mark_ctx_t ctx = {.modules = coverage_modules, .count = 0};
+
+ g_hash_table_foreach(unstable_blocks, instrument_coverage_mark, &ctx);
+ instrument_coverage_print("Coverage - Marked Entries: %u\n", ctx.count);
+
+ guint coverage_marked_modules = coverage_mark_modules(coverage_modules);
+ instrument_coverage_print("Coverage - Marked Modules: %u\n",
+ coverage_marked_modules);
+
+ coverage_write_header(unstable_coverage_fd, coverage_marked_modules);
+ coverage_write_modules(unstable_coverage_fd, coverage_modules);
+ coverage_format(unstable_coverage_fd, "BB Table: %u bbs\n", ctx.count);
+ g_hash_table_foreach(unstable_blocks, coverage_write_events,
+ &unstable_coverage_fd);
+
+ }
g_hash_table_unref(unstable_blocks);
g_array_free(unstable_edge_ids, TRUE);
@@ -660,6 +752,8 @@ static void instrument_coverage_unstable_run(void) {
void instrument_coverage_config(void) {
instrument_coverage_filename = getenv("AFL_FRIDA_INST_COVERAGE_FILE");
+ instrument_coverage_absolute =
+ (getenv("AFL_FRIDA_INST_COVERAGE_ABSOLUTE") != NULL);
}
diff --git a/frida_mode/src/instrument/instrument_debug.c b/frida_mode/src/instrument/instrument_debug.c
index 17245d65..5577a588 100644
--- a/frida_mode/src/instrument/instrument_debug.c
+++ b/frida_mode/src/instrument/instrument_debug.c
@@ -63,12 +63,14 @@ static void instrument_disasm(guint8 *start, guint8 *end,
count = cs_disasm(capstone, curr, size, GPOINTER_TO_SIZE(curr), 0, &insn);
if (insn == NULL) {
+
instrument_debug("\t0x%" G_GINT64_MODIFIER "x\t* 0x%016" G_GSIZE_MODIFIER
"x\n",
(uint64_t)(size_t)curr, *(size_t *)curr);
len += sizeof(size_t);
continue;
+
}
for (i = 0; i != count; i++) {
diff --git a/frida_mode/src/instrument/instrument_x64.c b/frida_mode/src/instrument/instrument_x64.c
index 9d754082..13ced4a3 100644
--- a/frida_mode/src/instrument/instrument_x64.c
+++ b/frida_mode/src/instrument/instrument_x64.c
@@ -469,6 +469,7 @@ gpointer instrument_cur(GumStalkerOutput *output) {
}
void instrument_write_regs(GumCpuContext *cpu_context, gpointer user_data) {
+
int fd = (int)(size_t)user_data;
instrument_regs_format(
fd, "rax: 0x%016x, rbx: 0x%016x, rcx: 0x%016x, rdx: 0x%016x\n",
@@ -483,6 +484,7 @@ void instrument_write_regs(GumCpuContext *cpu_context, gpointer user_data) {
fd, "r12: 0x%016x, r13: 0x%016x, r14: 0x%016x, r15: 0x%016x\n",
cpu_context->r12, cpu_context->r13, cpu_context->r14, cpu_context->r15);
instrument_regs_format(fd, "rip: 0x%016x\n\n", cpu_context->rip);
+
}
#endif
diff --git a/frida_mode/src/instrument/instrument_x86.c b/frida_mode/src/instrument/instrument_x86.c
index eb0c7184..eabd5be4 100644
--- a/frida_mode/src/instrument/instrument_x86.c
+++ b/frida_mode/src/instrument/instrument_x86.c
@@ -271,6 +271,7 @@ void instrument_cache(const cs_insn *instr, GumStalkerOutput *output) {
}
void instrument_write_regs(GumCpuContext *cpu_context, gpointer user_data) {
+
int fd = (int)(size_t)user_data;
instrument_regs_format(
fd, "eax: 0x%08x, ebx: 0x%08x, ecx: 0x%08x, edx: 0x%08x\n",
@@ -279,6 +280,7 @@ void instrument_write_regs(GumCpuContext *cpu_context, gpointer user_data) {
fd, "esi: 0x%08x, edi: 0x%08x, ebp: 0x%08x, esp: 0x%08x\n",
cpu_context->esi, cpu_context->edi, cpu_context->ebp, cpu_context->esp);
instrument_regs_format(fd, "eip: 0x%08x\n\n", cpu_context->eip);
+
}
#endif
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-23 13:38:00 +0000