diff options
Diffstat (limited to 'qemu_mode')
| -rw-r--r-- | qemu_mode/README.md | 5 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-cpu-inl.h | 6 |
2 files changed, 11 insertions, 0 deletions
diff --git a/qemu_mode/README.md b/qemu_mode/README.md index c88c1e41..87027f63 100644 --- a/qemu_mode/README.md +++ b/qemu_mode/README.md @@ -46,6 +46,11 @@ You can also compile statically-linked binaries by setting STATIC=1. This can be useful when compiling QEMU on a different system than the one you're planning to run the fuzzer on and is most often used with the HOST variable. +Note: when targetting the i386 architecture, on some bianries the forkserver +handshake may fail due to the lack of reversed memory. Fix it with + +export QEMU_RESERVED_VA=0x1000000 + Note: if you want the QEMU helper to be installed on your system for all users, you need to build it before issuing 'make install' in the parent directory. diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index f4c474d8..7c6d3341 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -84,6 +84,8 @@ __thread abi_ulong afl_prev_loc; /* Set in the child process in forkserver mode: */ static int forkserver_installed = 0; +static int disable_caching = 0; + unsigned char afl_fork_child; unsigned int afl_forksrv_pid; unsigned char is_persistent; @@ -205,6 +207,8 @@ static void afl_setup(void) { behaviour, and seems to work alright? */ rcu_disable_atfork(); + + disable_caching = getenv("AFL_QEMU_DISABLE_CACHE") != NULL; is_persistent = getenv("AFL_QEMU_PERSISTENT_ADDR") != NULL; @@ -422,6 +426,8 @@ static void afl_request_tsl(target_ulong pc, target_ulong cb, uint32_t flags, uint32_t cf_mask, TranslationBlock *last_tb, int tb_exit) { + if (disable_caching) return; + struct afl_tsl t; struct afl_chain c; |