aboutsummaryrefslogtreecommitdiff
path: root/frida_mode/src/persistent/persistent_x86.c
diff options
context:
space:
mode:
Diffstat (limited to 'frida_mode/src/persistent/persistent_x86.c')
-rw-r--r--frida_mode/src/persistent/persistent_x86.c117
1 files changed, 48 insertions, 69 deletions
diff --git a/frida_mode/src/persistent/persistent_x86.c b/frida_mode/src/persistent/persistent_x86.c
index 7add6e99..f50bccb0 100644
--- a/frida_mode/src/persistent/persistent_x86.c
+++ b/frida_mode/src/persistent/persistent_x86.c
@@ -1,45 +1,23 @@
-#include "frida-gum.h"
+#include "frida-gumjs.h"
#include "config.h"
+#include "debug.h"
#include "instrument.h"
#include "persistent.h"
#if defined(__i386__)
-struct x86_regs {
+typedef struct {
- uint32_t eax, ebx, ecx, edx, edi, esi, ebp;
+ GumCpuContext ctx;
+ uint32_t eflags;
- union {
+} persistent_ctx_t;
- uint32_t eip;
- uint32_t pc;
+static persistent_ctx_t saved_regs = {0};
- };
-
- union {
-
- uint32_t esp;
- uint32_t sp;
-
- };
-
- union {
-
- uint32_t eflags;
- uint32_t flags;
-
- };
-
- uint8_t xmm_regs[8][16];
-
-};
-
-typedef struct x86_regs arch_api_regs;
-
-static arch_api_regs saved_regs = {0};
-static gpointer saved_ret = NULL;
+static gpointer saved_ret = NULL;
gboolean persistent_is_supported(void) {
@@ -47,8 +25,8 @@ gboolean persistent_is_supported(void) {
}
-static void instrument_persitent_save_regs(GumX86Writer * cw,
- struct x86_regs *regs) {
+static void instrument_persitent_save_regs(GumX86Writer * cw,
+ persistent_ctx_t *regs) {
GumAddress regs_address = GUM_ADDRESS(regs);
@@ -58,80 +36,80 @@ static void instrument_persitent_save_regs(GumX86Writer * cw,
gum_x86_writer_put_mov_reg_address(cw, GUM_REG_EAX, regs_address);
- gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_EAX, (0x4 * 1),
- GUM_REG_EBX);
- gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_EAX, (0x4 * 2),
- GUM_REG_ECX);
- gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_EAX, (0x4 * 3),
- GUM_REG_EDX);
- gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_EAX, (0x4 * 4),
- GUM_REG_EDI);
- gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_EAX, (0x4 * 5),
- GUM_REG_ESI);
- gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_EAX, (0x4 * 6),
- GUM_REG_EBP);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(
+ cw, GUM_REG_EAX, offsetof(GumCpuContext, ebx), GUM_REG_EBX);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(
+ cw, GUM_REG_EAX, offsetof(GumCpuContext, ecx), GUM_REG_ECX);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(
+ cw, GUM_REG_EAX, offsetof(GumCpuContext, edx), GUM_REG_EDX);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(
+ cw, GUM_REG_EAX, offsetof(GumCpuContext, edi), GUM_REG_EDI);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(
+ cw, GUM_REG_EAX, offsetof(GumCpuContext, esi), GUM_REG_ESI);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(
+ cw, GUM_REG_EAX, offsetof(GumCpuContext, ebp), GUM_REG_EBP);
/* Store RIP */
gum_x86_writer_put_mov_reg_address(cw, GUM_REG_EBX,
GUM_ADDRESS(persistent_start));
- gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_EAX, (0x4 * 7),
- GUM_REG_EBX);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(
+ cw, GUM_REG_EAX, offsetof(GumCpuContext, eip), GUM_REG_EBX);
/* Store adjusted RSP */
gum_x86_writer_put_mov_reg_reg(cw, GUM_REG_EBX, GUM_REG_ESP);
/* RED_ZONE + Saved flags, RAX */
gum_x86_writer_put_add_reg_imm(cw, GUM_REG_EBX, (0x4 * 2));
- gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_EAX, (0x4 * 8),
- GUM_REG_EBX);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(
+ cw, GUM_REG_EAX, offsetof(GumCpuContext, esp), GUM_REG_EBX);
/* Save the flags */
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_EBX, GUM_REG_ESP, 0x4);
- gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_EAX, (0x4 * 9),
- GUM_REG_EBX);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(
+ cw, GUM_REG_EAX, offsetof(persistent_ctx_t, eflags), GUM_REG_EBX);
/* Save the RAX */
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_EBX, GUM_REG_ESP, 0x0);
- gum_x86_writer_put_mov_reg_offset_ptr_reg(cw, GUM_REG_EAX, (0x4 * 0),
- GUM_REG_EBX);
+ gum_x86_writer_put_mov_reg_offset_ptr_reg(
+ cw, GUM_REG_EAX, offsetof(GumCpuContext, eax), GUM_REG_EBX);
/* Pop the saved values */
gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_ESP, GUM_REG_ESP, 0x8);
}
-static void instrument_persitent_restore_regs(GumX86Writer * cw,
- struct x86_regs *regs) {
+static void instrument_persitent_restore_regs(GumX86Writer * cw,
+ persistent_ctx_t *regs) {
GumAddress regs_address = GUM_ADDRESS(regs);
gum_x86_writer_put_mov_reg_address(cw, GUM_REG_EAX, regs_address);
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_ECX, GUM_REG_EAX,
- (0x4 * 2));
+ offsetof(GumCpuContext, ecx));
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_EDX, GUM_REG_EAX,
- (0x4 * 3));
+ offsetof(GumCpuContext, edx));
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_EDI, GUM_REG_EAX,
- (0x4 * 4));
+ offsetof(GumCpuContext, edi));
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_ESI, GUM_REG_EAX,
- (0x4 * 5));
+ offsetof(GumCpuContext, esi));
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_EBP, GUM_REG_EAX,
- (0x4 * 6));
+ offsetof(GumCpuContext, ebp));
/* Don't restore RIP */
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_ESP, GUM_REG_EAX,
- (0x4 * 8));
+ offsetof(GumCpuContext, esp));
/* Restore RBX, RAX & Flags */
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_EBX, GUM_REG_EAX,
- (0x4 * 1));
+ offsetof(GumCpuContext, ebx));
gum_x86_writer_put_push_reg(cw, GUM_REG_EBX);
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_EBX, GUM_REG_EAX,
- (0x4 * 0));
+ offsetof(GumCpuContext, eax));
gum_x86_writer_put_push_reg(cw, GUM_REG_EBX);
gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_EBX, GUM_REG_EAX,
- (0x4 * 9));
+ offsetof(persistent_ctx_t, eflags));
gum_x86_writer_put_push_reg(cw, GUM_REG_EBX);
gum_x86_writer_put_popfx(cw);
@@ -152,7 +130,7 @@ static void instrument_exit(GumX86Writer *cw) {
static int instrument_afl_persistent_loop_func(void) {
int ret = __afl_persistent_loop(persistent_count);
- previous_pc = 0;
+ instrument_previous_pc = 0;
return ret;
}
@@ -165,9 +143,9 @@ static void instrument_afl_persistent_loop(GumX86Writer *cw) {
}
-static void persistent_prologue_hook(GumX86Writer *cw, struct x86_regs *regs) {
+static void persistent_prologue_hook(GumX86Writer *cw, persistent_ctx_t *regs) {
- if (hook == NULL) return;
+ if (persistent_hook == NULL) return;
gum_x86_writer_put_mov_reg_address(cw, GUM_REG_ECX,
GUM_ADDRESS(&__afl_fuzz_len));
@@ -180,9 +158,8 @@ static void persistent_prologue_hook(GumX86Writer *cw, struct x86_regs *regs) {
/* Base address is 64-bits (hence two zero arguments) */
gum_x86_writer_put_call_address_with_arguments(
- cw, GUM_CALL_CAPI, GUM_ADDRESS(hook), 5, GUM_ARG_ADDRESS,
- GUM_ADDRESS(regs), GUM_ARG_ADDRESS, GUM_ADDRESS(0), GUM_ARG_ADDRESS,
- GUM_ADDRESS(0), GUM_ARG_REGISTER, GUM_REG_EDX, GUM_ARG_REGISTER,
+ cw, GUM_CALL_CAPI, GUM_ADDRESS(persistent_hook), 3, GUM_ARG_ADDRESS,
+ GUM_ADDRESS(&regs->ctx), GUM_ARG_REGISTER, GUM_REG_EDX, GUM_ARG_REGISTER,
GUM_REG_ECX);
}
@@ -233,6 +210,8 @@ void persistent_prologue(GumStalkerOutput *output) {
gconstpointer loop = cw->code + 1;
+ OKF("Persistent loop reached");
+
/* Pop the return value */
gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_ESP, GUM_REG_ESP, 4);
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-16 08:33:02 +0000