about summary refs log tree commit diff
path: root/frida_mode/test/png/persistent
diff options
context:
space:
mode:
Diffstat (limited to 'frida_mode/test/png/persistent')
-rw-r--r--frida_mode/test/png/persistent/hook/cmodule.js39
-rw-r--r--frida_mode/test/png/persistent/hook/load.js27
2 files changed, 66 insertions, 0 deletions
diff --git a/frida_mode/test/png/persistent/hook/cmodule.js b/frida_mode/test/png/persistent/hook/cmodule.js
new file mode 100644
index 00000000..ab8bdc66
--- /dev/null
+++ b/frida_mode/test/png/persistent/hook/cmodule.js
@@ -0,0 +1,39 @@
+Afl.print('******************');
+Afl.print('* AFL FRIDA MODE *');
+Afl.print('******************');
+Afl.print('');
+
+Afl.print(`PID: ${Process.id}`);
+
+const name = Process.enumerateModules()[0].name;
+Afl.print(`Name: ${name}`);
+
+new ModuleMap().values().forEach(m => {
+    Afl.print(`${m.base}-${m.base.add(m.size)} ${m.name}`);
+});
+
+const persistent_addr = DebugSymbol.fromName('LLVMFuzzerTestOneInput').address;
+Afl.print(`persistent_addr: ${persistent_addr}`);
+Afl.setEntryPoint(persistent_addr);
+Afl.setPersistentAddress(persistent_addr);
+
+const cm = new CModule(`
+
+    #include <string.h>
+    #include <gum/gumdefs.h>
+
+    void afl_persistent_hook(GumCpuContext *regs, uint8_t *input_buf,
+      uint32_t input_buf_len) {
+
+      memcpy((void *)regs->rdi, input_buf, input_buf_len);
+      regs->rsi = input_buf_len;
+
+    }
+    `,
+    {
+        memcpy: Module.getExportByName(null, 'memcpy')
+    });
+Afl.setPersistentHook(cm.afl_persistent_hook);
+
+Afl.print("done");
+Afl.done();
diff --git a/frida_mode/test/png/persistent/hook/load.js b/frida_mode/test/png/persistent/hook/load.js
new file mode 100644
index 00000000..ea4d28c3
--- /dev/null
+++ b/frida_mode/test/png/persistent/hook/load.js
@@ -0,0 +1,27 @@
+Afl.print('******************');
+Afl.print('* AFL FRIDA MODE *');
+Afl.print('******************');
+Afl.print('');
+
+Afl.print(`PID: ${Process.id}`);
+
+const name = Process.enumerateModules()[0].name;
+Afl.print(`Name: ${name}`);
+
+new ModuleMap().values().forEach(m => {
+    Afl.print(`${m.base}-${m.base.add(m.size)} ${m.name}`);
+});
+
+const persistent_addr = DebugSymbol.fromName('LLVMFuzzerTestOneInput').address;
+Afl.print(`persistent_addr: ${persistent_addr}`);
+Afl.setEntryPoint(persistent_addr);
+Afl.setPersistentAddress(persistent_addr);
+
+const path = Afl.module.path;
+const dir = path.substring(0, path.lastIndexOf("/"));
+const mod = Module.load(`${dir}/frida_mode/build/frida_hook.so`);
+const hook = mod.getExportByName('afl_persistent_hook');
+Afl.setPersistentHook(hook);
+
+Afl.print("done");
+Afl.done();