aboutsummaryrefslogtreecommitdiff
path: root/frida_mode/src/stats
diff options
context:
space:
mode:
Diffstat (limited to 'frida_mode/src/stats')
-rw-r--r--frida_mode/src/stats/stats.c208
-rw-r--r--frida_mode/src/stats/stats_arm.c36
-rw-r--r--frida_mode/src/stats/stats_arm64.c36
-rw-r--r--frida_mode/src/stats/stats_x64.c307
-rw-r--r--frida_mode/src/stats/stats_x86.c36
5 files changed, 623 insertions, 0 deletions
diff --git a/frida_mode/src/stats/stats.c b/frida_mode/src/stats/stats.c
new file mode 100644
index 00000000..890a8d6b
--- /dev/null
+++ b/frida_mode/src/stats/stats.c
@@ -0,0 +1,208 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/shm.h>
+#include <sys/mman.h>
+
+#include "frida-gum.h"
+
+#include "config.h"
+#include "debug.h"
+#include "util.h"
+
+#include "stats.h"
+
+#define MICRO_TO_SEC 1000000
+
+stats_data_header_t *stats_data = NULL;
+
+static int stats_parent_pid = -1;
+static int stats_fd = -1;
+static gboolean stats_transitions = FALSE;
+static guint64 stats_interval = 0;
+
+void stats_init(void) {
+
+ stats_parent_pid = getpid();
+ char *filename = getenv("AFL_FRIDA_STATS_FILE");
+ stats_interval = util_read_num("AFL_FRIDA_STATS_INTERVAL");
+ if (getenv("AFL_FRIDA_STATS_TRANSITIONS") != NULL) {
+
+ stats_transitions = TRUE;
+
+ }
+
+ OKF("Stats - file [%s]", filename);
+ OKF("Stats - interval [%" G_GINT64_MODIFIER "u]", stats_interval);
+
+ if (stats_interval != 0 && filename == NULL) {
+
+ FATAL(
+ "AFL_FRIDA_STATS_FILE must be specified if "
+ "AFL_FRIDA_STATS_INTERVAL is");
+
+ }
+
+ if (stats_interval == 0) { stats_interval = 10; }
+
+ if (filename == NULL) { return; }
+
+ if (!stats_is_supported_arch()) {
+
+ FATAL("Stats is not supported on this architecture");
+
+ }
+
+ char *path = NULL;
+
+ if (filename == NULL) { return; }
+
+ if (stats_transitions) { gum_stalker_set_counters_enabled(TRUE); }
+
+ path = g_canonicalize_filename(filename, g_get_current_dir());
+
+ OKF("Stats - path [%s]", path);
+
+ stats_fd = open(path, O_RDWR | O_CREAT | O_TRUNC,
+ S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+
+ if (stats_fd < 0) { FATAL("Failed to open stats file '%s'", path); }
+
+ g_free(path);
+
+ size_t data_size = stats_data_size_arch();
+
+ int shm_id = shmget(IPC_PRIVATE, data_size, IPC_CREAT | IPC_EXCL | 0600);
+ if (shm_id < 0) { FATAL("shm_id < 0 - errno: %d\n", errno); }
+
+ stats_data = shmat(shm_id, NULL, 0);
+ g_assert(stats_data != MAP_FAILED);
+
+ /*
+ * Configure the shared memory region to be removed once the process dies.
+ */
+ if (shmctl(shm_id, IPC_RMID, NULL) < 0) {
+
+ FATAL("shmctl (IPC_RMID) < 0 - errno: %d\n", errno);
+
+ }
+
+ /* Clear it, not sure it's necessary, just seems like good practice */
+ memset(stats_data, '\0', data_size);
+
+}
+
+void stats_vprint(int fd, char *format, va_list ap) {
+
+ char buffer[4096] = {0};
+ int ret;
+ int len;
+
+ if(vsnprintf(buffer, sizeof(buffer) - 1, format, ap) < 0) { return; }
+
+ len = strnlen(buffer, sizeof(buffer));
+ IGNORED_RETURN(write(fd, buffer, len));
+
+}
+
+void stats_print_fd(int fd, char *format, ...) {
+
+ va_list ap;
+ va_start(ap, format);
+ stats_vprint(fd, format, ap);
+ va_end(ap);
+
+}
+
+void stats_print(char *format, ...) {
+
+ va_list ap;
+ va_start(ap, format);
+ stats_vprint(stats_fd, format, ap);
+ va_end(ap);
+
+}
+
+void stats_write(void) {
+
+ if (stats_parent_pid == getpid()) { return; }
+
+ GDateTime *date_time = g_date_time_new_now_local();
+ char *date_time_string = g_date_time_format(date_time, "%Y-%m-%e %H:%M:%S");
+
+ stats_print("stats\n");
+ stats_print("-----\n");
+
+ stats_print("Index: %" G_GINT64_MODIFIER "u\n",
+ stats_data->stats_idx++);
+ stats_print("Pid: %d\n", getpid());
+ stats_print("Time: %s\n", date_time_string);
+ stats_print("Blocks: %" G_GINT64_MODIFIER "u\n",
+ stats_data->num_blocks);
+ stats_print("Instructions: %" G_GINT64_MODIFIER "u\n",
+ stats_data->num_instructions);
+ stats_print("Avg Instructions / Block: %" G_GINT64_MODIFIER "u\n",
+ stats_data->num_instructions / stats_data->num_blocks);
+
+ stats_print("\n");
+
+ g_free(date_time_string);
+ g_date_time_unref(date_time);
+
+ stats_write_arch();
+
+ if (stats_transitions) {
+
+ GDateTime *date_time = g_date_time_new_now_local();
+ char *date_time_string = g_date_time_format(date_time, "%Y-%m-%e %H:%M:%S");
+
+ stats_print_fd(STDERR_FILENO, "stats\n");
+ stats_print_fd(STDERR_FILENO, "-----\n");
+ stats_print_fd(STDERR_FILENO, "Index: %" G_GINT64_MODIFIER "u\n",
+ stats_data->transitions_idx++);
+ stats_print_fd(STDERR_FILENO, "Pid: %d\n", getpid());
+ stats_print_fd(STDERR_FILENO, "Time: %s\n", date_time_string);
+
+ g_free(date_time_string);
+ g_date_time_unref(date_time);
+ gum_stalker_dump_counters();
+
+ }
+
+}
+
+static void stats_maybe_write(void) {
+
+ guint64 current_time;
+
+ if (stats_interval == 0) { return; }
+
+ current_time = g_get_monotonic_time();
+
+ if ((current_time - stats_data->stats_last_time) >
+ (stats_interval * MICRO_TO_SEC)) {
+
+ stats_write();
+ stats_data->stats_last_time = current_time;
+
+ }
+
+}
+
+void stats_collect(const cs_insn *instr, gboolean begin) {
+
+ UNUSED_PARAMETER(instr);
+ UNUSED_PARAMETER(begin);
+
+ if (stats_fd < 0) { return; }
+
+ if (begin) { stats_data->num_blocks++; }
+ stats_data->num_instructions++;
+
+ stats_collect_arch(instr);
+
+ stats_maybe_write();
+
+}
+
diff --git a/frida_mode/src/stats/stats_arm.c b/frida_mode/src/stats/stats_arm.c
new file mode 100644
index 00000000..7eea7f91
--- /dev/null
+++ b/frida_mode/src/stats/stats_arm.c
@@ -0,0 +1,36 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "stats.h"
+#include "util.h"
+
+#if defined(__arm__)
+
+gboolean stats_is_supported_arch(void) {
+
+ return FALSE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+ FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_write_arch(void) {
+
+ FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+ UNUSED_PARAMETER(instr);
+ FATAL("Stats not supported on this architecture");
+
+}
+
+#endif
+
diff --git a/frida_mode/src/stats/stats_arm64.c b/frida_mode/src/stats/stats_arm64.c
new file mode 100644
index 00000000..592af87a
--- /dev/null
+++ b/frida_mode/src/stats/stats_arm64.c
@@ -0,0 +1,36 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "stats.h"
+#include "util.h"
+
+#if defined(__aarch64__)
+
+gboolean stats_is_supported_arch(void) {
+
+ return FALSE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+ FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_write_arch(void) {
+
+ FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+ UNUSED_PARAMETER(instr);
+ FATAL("Stats not supported on this architecture");
+
+}
+
+#endif
+
diff --git a/frida_mode/src/stats/stats_x64.c b/frida_mode/src/stats/stats_x64.c
new file mode 100644
index 00000000..c3e8742a
--- /dev/null
+++ b/frida_mode/src/stats/stats_x64.c
@@ -0,0 +1,307 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "ranges.h"
+#include "stats.h"
+#include "util.h"
+
+#if defined(__x86_64__)
+
+typedef struct {
+
+ stats_data_header_t header;
+
+ guint64 num_call_imm;
+ guint64 num_call_imm_excluded;
+ guint64 num_call_reg;
+ guint64 num_call_mem;
+
+ guint64 num_jmp_imm;
+ guint64 num_jmp_reg;
+ guint64 num_jmp_mem;
+
+ guint64 num_jmp_cond_imm;
+ guint64 num_jmp_cond_reg;
+ guint64 num_jmp_cond_mem;
+
+ guint64 num_jmp_cond_jcxz;
+
+ guint64 num_ret;
+
+ guint64 num_rip_relative;
+
+} stats_data_arch_t;
+
+gboolean stats_is_supported_arch(void) {
+
+ return TRUE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+ return sizeof(stats_data_arch_t);
+
+}
+
+void stats_write_arch(void) {
+
+ stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+ guint64 num_instructions = stats_data_arch->header.num_instructions;
+
+ stats_print(
+ "Call Immediates: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_call_imm,
+ ((float)(stats_data_arch->num_call_imm * 100) / num_instructions));
+ stats_print("Call Immediates Excluded: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_call_imm_excluded,
+ ((float)(stats_data_arch->num_call_imm_excluded * 100) /
+ num_instructions));
+ stats_print(
+ "Call Register: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_call_reg,
+ ((float)(stats_data_arch->num_call_reg * 100) / num_instructions));
+ stats_print(
+ "Call Memory: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_call_mem,
+ ((float)(stats_data_arch->num_call_mem * 100) / num_instructions));
+
+ stats_print("\n");
+
+ stats_print("Jump Immediates: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_jmp_imm,
+ ((float)(stats_data_arch->num_jmp_imm * 100) / num_instructions));
+ stats_print("Jump Register: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_jmp_reg,
+ ((float)(stats_data_arch->num_jmp_reg * 100) / num_instructions));
+ stats_print("Jump Memory: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_jmp_mem,
+ ((float)(stats_data_arch->num_jmp_mem * 100) / num_instructions));
+
+ stats_print("\n");
+
+ stats_print(
+ "Conditional Jump Immediates: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_jmp_cond_imm,
+ ((float)(stats_data_arch->num_jmp_cond_imm * 100) / num_instructions));
+ stats_print(
+ "Conditional Jump CX Immediate: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_jmp_cond_jcxz,
+ ((float)(stats_data_arch->num_jmp_cond_jcxz * 100) / num_instructions));
+ stats_print(
+ "Conditional Jump Register: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_jmp_cond_reg,
+ ((float)(stats_data_arch->num_jmp_cond_reg * 100) / num_instructions));
+ stats_print(
+ "Conditional Jump Memory: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_jmp_cond_mem,
+ ((float)(stats_data_arch->num_jmp_cond_mem * 100) / num_instructions));
+
+ stats_print("\n");
+
+ stats_print("Returns: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_ret,
+ (stats_data_arch->num_ret * 100 / num_instructions));
+
+ stats_print("\n");
+
+ stats_print("Rip Relative: %" G_GINT64_MODIFIER
+ "u "
+ "(%3.2f%%)\n",
+ stats_data_arch->num_rip_relative,
+ (stats_data_arch->num_rip_relative * 100 / num_instructions));
+
+ stats_print("\n");
+ stats_print("\n");
+
+}
+
+static x86_op_type stats_get_operand_type(const cs_insn *instr) {
+
+ cs_x86 * x86 = &instr->detail->x86;
+ cs_x86_op *operand;
+
+ if (x86->op_count != 1) {
+
+ FATAL("Unexpected operand count (%d): %s %s\n", x86->op_count,
+ instr->mnemonic, instr->op_str);
+
+ }
+
+ operand = &x86->operands[0];
+
+ return operand->type;
+
+}
+
+static void stats_collect_call_imm_excluded_arch(const cs_insn *instr) {
+
+ stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+ cs_x86 * x86 = &instr->detail->x86;
+ cs_x86_op * operand = &x86->operands[0];
+
+ if (range_is_excluded((gpointer)operand->imm)) {
+
+ stats_data_arch->num_call_imm_excluded++;
+
+ }
+
+}
+
+static void stats_collect_call_arch(const cs_insn *instr) {
+
+ stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+ x86_op_type type = stats_get_operand_type(instr);
+ switch (type) {
+
+ case X86_OP_IMM:
+ stats_data_arch->num_call_imm++;
+ stats_collect_call_imm_excluded_arch(instr);
+ break;
+ case X86_OP_REG:
+ stats_data_arch->num_call_reg++;
+ break;
+ case X86_OP_MEM:
+ stats_data_arch->num_call_mem++;
+ break;
+ default:
+ FATAL("Invalid operand type: %s %s\n", instr->mnemonic, instr->op_str);
+
+ }
+
+}
+
+static void stats_collect_jump_arch(const cs_insn *instr) {
+
+ stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+ x86_op_type type = stats_get_operand_type(instr);
+ switch (type) {
+
+ case X86_OP_IMM:
+ stats_data_arch->num_jmp_imm++;
+ break;
+ case X86_OP_REG:
+ stats_data_arch->num_jmp_reg++;
+ break;
+ case X86_OP_MEM:
+ stats_data_arch->num_jmp_mem++;
+ break;
+ default:
+ FATAL("Invalid operand type: %s %s\n", instr->mnemonic, instr->op_str);
+
+ }
+
+}
+
+static void stats_collect_jump_cond_arch(const cs_insn *instr) {
+
+ stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+ x86_op_type type = stats_get_operand_type(instr);
+ switch (type) {
+
+ case X86_OP_IMM:
+ stats_data_arch->num_jmp_cond_imm++;
+ break;
+ case X86_OP_REG:
+ stats_data_arch->num_jmp_cond_reg++;
+ break;
+ case X86_OP_MEM:
+ stats_data_arch->num_jmp_cond_mem++;
+ break;
+ default:
+ FATAL("Invalid operand type: %s %s\n", instr->mnemonic, instr->op_str);
+
+ }
+
+}
+
+static void stats_collect_rip_relative_arch(const cs_insn *instr) {
+
+ stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+ cs_x86 * x86 = &instr->detail->x86;
+ guint mod;
+ guint rm;
+
+ if (x86->encoding.modrm_offset == 0) { return; }
+
+ mod = (x86->modrm & 0xc0) >> 6;
+ if (mod != 0) { return; }
+
+ rm = (x86->modrm & 0x07) >> 0;
+ if (rm != 5) { return; }
+
+ stats_data_arch->num_rip_relative++;
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+ stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+ switch (instr->id) {
+
+ case X86_INS_CALL:
+ stats_collect_call_arch(instr);
+ break;
+ case X86_INS_JMP:
+ stats_collect_jump_arch(instr);
+ break;
+ case X86_INS_JA:
+ case X86_INS_JAE:
+ case X86_INS_JB:
+ case X86_INS_JBE:
+ case X86_INS_JE:
+ case X86_INS_JG:
+ case X86_INS_JGE:
+ case X86_INS_JL:
+ case X86_INS_JLE:
+ case X86_INS_JNE:
+ case X86_INS_JNO:
+ case X86_INS_JNP:
+ case X86_INS_JNS:
+ case X86_INS_JO:
+ case X86_INS_JP:
+ case X86_INS_JS:
+ stats_collect_jump_cond_arch(instr);
+ break;
+ case X86_INS_JECXZ:
+ case X86_INS_JRCXZ:
+ stats_data_arch->num_jmp_cond_jcxz++;
+ break;
+ case X86_INS_RET:
+ stats_data_arch->num_ret++;
+ break;
+ default:
+ stats_collect_rip_relative_arch(instr);
+ break;
+
+ }
+
+}
+
+#endif
+
diff --git a/frida_mode/src/stats/stats_x86.c b/frida_mode/src/stats/stats_x86.c
new file mode 100644
index 00000000..1906e809
--- /dev/null
+++ b/frida_mode/src/stats/stats_x86.c
@@ -0,0 +1,36 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "stats.h"
+#include "util.h"
+
+#if defined(__i386__)
+
+gboolean stats_is_supported_arch(void) {
+
+ return FALSE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+ FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_write_arch(void) {
+
+ FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+ UNUSED_PARAMETER(instr);
+ FATAL("Stats not supported on this architecture");
+
+}
+
+#endif
+
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-14 23:35:58 +0000