diff options
Diffstat (limited to 'qemu_mode/patches/elfload.diff')
| -rw-r--r-- | qemu_mode/patches/elfload.diff | 44 |
1 files changed, 40 insertions, 4 deletions
diff --git a/qemu_mode/patches/elfload.diff b/qemu_mode/patches/elfload.diff index c8f6e80a..011b03ea 100644 --- a/qemu_mode/patches/elfload.diff +++ b/qemu_mode/patches/elfload.diff @@ -1,5 +1,5 @@ diff --git a/linux-user/elfload.c b/linux-user/elfload.c -index 5bccd2e2..94e928a4 100644 +index 5bccd2e2..fd7460b3 100644 --- a/linux-user/elfload.c +++ b/linux-user/elfload.c @@ -20,6 +20,8 @@ @@ -11,16 +11,29 @@ index 5bccd2e2..94e928a4 100644 /* from personality.h */ /* -@@ -2301,6 +2303,8 @@ static void load_elf_image(const char *image_name, int image_fd, +@@ -2301,6 +2303,21 @@ static void load_elf_image(const char *image_name, int image_fd, info->brk = 0; info->elf_flags = ehdr->e_flags; -+ if (!afl_entry_point) afl_entry_point = info->entry; ++ if (!afl_entry_point) { ++ char *ptr; ++ if ((ptr = getenv("AFL_ENTRYPOINT")) != NULL) { ++ afl_entry_point = strtoul(ptr, NULL, 16); ++ } else { ++ afl_entry_point = info->entry; ++ } ++#ifdef TARGET_ARM ++ /* The least significant bit indicates Thumb mode. */ ++ afl_entry_point = afl_entry_point & ~(target_ulong)1; ++#endif ++ } ++ if (getenv("AFL_DEBUG") != NULL) ++ fprintf(stderr, "AFL forkserver entrypoint: %p\n", (void*)afl_entry_point); + for (i = 0; i < ehdr->e_phnum; i++) { struct elf_phdr *eppnt = phdr + i; if (eppnt->p_type == PT_LOAD) { -@@ -2335,9 +2339,11 @@ static void load_elf_image(const char *image_name, int image_fd, +@@ -2335,9 +2352,11 @@ static void load_elf_image(const char *image_name, int image_fd, if (elf_prot & PROT_EXEC) { if (vaddr < info->start_code) { info->start_code = vaddr; @@ -32,3 +45,26 @@ index 5bccd2e2..94e928a4 100644 } } if (elf_prot & PROT_WRITE) { +@@ -2662,6 +2681,22 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info) + change some of these later */ + bprm->p = setup_arg_pages(bprm, info); + ++ // On PowerPC64 the entry point is the _function descriptor_ ++ // of the entry function. For AFL to properly initialize, ++ // afl_entry_point needs to be set to the actual first instruction ++ // as opposed executed by the target program. This as opposed to ++ // where the function's descriptor sits in memory. ++ // copied from PPC init_thread ++#if defined(TARGET_PPC64) && !defined(TARGET_ABI32) ++ if (get_ppc64_abi(infop) < 2) { ++ uint64_t val; ++ get_user_u64(val, infop->entry + 8); ++ _regs->gpr[2] = val + infop->load_bias; ++ get_user_u64(val, infop->entry); ++ infop->entry = val + infop->load_bias; ++ } ++#endif ++ + scratch = g_new0(char, TARGET_PAGE_SIZE); + if (STACK_GROWS_DOWN) { + bprm->p = copy_elf_strings(1, &bprm->filename, scratch, |