diff options
Diffstat (limited to 'unicorn_mode/patches')
| -rw-r--r-- | unicorn_mode/patches/afl-unicorn-common.h | 48 | ||||
| -rw-r--r-- | unicorn_mode/patches/afl-unicorn-cpu-inl.h | 141 | ||||
| -rw-r--r-- | unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h | 57 | ||||
| -rw-r--r-- | unicorn_mode/patches/afl-unicorn-tcg-op-inl.h | 59 | ||||
| -rw-r--r-- | unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h | 106 | ||||
| -rw-r--r-- | unicorn_mode/patches/compcov.diff | 113 |
6 files changed, 455 insertions, 69 deletions
diff --git a/unicorn_mode/patches/afl-unicorn-common.h b/unicorn_mode/patches/afl-unicorn-common.h new file mode 100644 index 00000000..fd88e21b --- /dev/null +++ b/unicorn_mode/patches/afl-unicorn-common.h @@ -0,0 +1,48 @@ +/* + american fuzzy lop++ - unicorn instrumentation + ---------------------------------------------- + + Originally written by Andrew Griffiths <agriffiths@google.com> and + Michal Zalewski <lcamtuf@google.com> + + Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co> + + CompareCoverage and NeverZero counters by Andrea Fioraldi + <andreafioraldi@gmail.com> + + Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at: + + http://www.apache.org/licenses/LICENSE-2.0 + + This code is a shim patched into the separately-distributed source + code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality + to implement AFL-style instrumentation and to take care of the remaining + parts of the AFL fork server logic. + + The resulting libunicorn binary is essentially a standalone instrumentation + tool; for an example of how to leverage it for other purposes, you can + have a look at afl-showmap.c. + + */ + +#include "../../config.h" + +/* NeverZero */ + +#if (defined(__x86_64__) || defined(__i386__)) && defined(AFL_QEMU_NOT_ZERO) +#define INC_AFL_AREA(loc) \ + asm volatile( \ + "incb (%0, %1, 1)\n" \ + "adcb $0, (%0, %1, 1)\n" \ + : /* no out */ \ + : "r"(afl_area_ptr), "r"(loc) \ + : "memory", "eax") +#else +#define INC_AFL_AREA(loc) afl_area_ptr[loc]++ +#endif + diff --git a/unicorn_mode/patches/afl-unicorn-cpu-inl.h b/unicorn_mode/patches/afl-unicorn-cpu-inl.h index 892c3f72..082d6d68 100644 --- a/unicorn_mode/patches/afl-unicorn-cpu-inl.h +++ b/unicorn_mode/patches/afl-unicorn-cpu-inl.h @@ -1,17 +1,17 @@ /* - american fuzzy lop - high-performance binary-only instrumentation - ----------------------------------------------------------------- + american fuzzy lop++ - unicorn instrumentation + ---------------------------------------------- - Written by Andrew Griffiths <agriffiths@google.com> and - Michal Zalewski <lcamtuf@google.com> + Originally written by Andrew Griffiths <agriffiths@google.com> and + Michal Zalewski <lcamtuf@google.com> - TCG instrumentation and block chaining support by Andrea Biondo - <andrea.biondo965@gmail.com> Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co> - Idea & design very much by Andrew Griffiths. + CompareCoverage and NeverZero counters by Andrea Fioraldi + <andreafioraldi@gmail.com> - Copyright 2015, 2016 Google Inc. All rights reserved. + Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -24,7 +24,7 @@ to implement AFL-style instrumentation and to take care of the remaining parts of the AFL fork server logic. - The resulting QEMU binary is essentially a standalone instrumentation + The resulting libunicorn binary is essentially a standalone instrumentation tool; for an example of how to leverage it for other purposes, you can have a look at afl-showmap.c. @@ -33,7 +33,7 @@ #include <sys/shm.h> #include <sys/types.h> #include <sys/wait.h> -#include "../../config.h" +#include "afl-unicorn-common.h" /*************************** * VARIOUS AUXILIARY STUFF * @@ -44,21 +44,29 @@ it to translate within its own context, too (this avoids translation overhead in the next forked-off copy). */ -#define AFL_UNICORN_CPU_SNIPPET1 do { \ +#define AFL_UNICORN_CPU_SNIPPET1 \ + do { \ + \ afl_request_tsl(pc, cs_base, flags); \ + \ } while (0) /* This snippet kicks in when the instruction pointer is positioned at _start and does the usual forkserver stuff, not very different from regular instrumentation injected via afl-as.h. */ -#define AFL_UNICORN_CPU_SNIPPET2 do { \ - if(unlikely(afl_first_instr == 0)) { \ - afl_setup(); \ - afl_forkserver(env); \ - afl_first_instr = 1; \ - } \ - afl_maybe_log(tb->pc); \ +#define AFL_UNICORN_CPU_SNIPPET2 \ + do { \ + \ + if (unlikely(afl_first_instr == 0)) { \ + \ + afl_setup(env->uc); \ + afl_forkserver(env); \ + afl_first_instr = 1; \ + \ + } \ + afl_maybe_log(env->uc, tb->pc); \ + \ } while (0) /* We use one additional file descriptor to relay "needs translation" @@ -66,37 +74,31 @@ #define TSL_FD (FORKSRV_FD - 1) -/* This is equivalent to afl-as.h: */ - -static unsigned char *afl_area_ptr; - /* Set in the child process in forkserver mode: */ static unsigned char afl_fork_child; -static unsigned int afl_forksrv_pid; - -/* Instrumentation ratio: */ - -static unsigned int afl_inst_rms = MAP_SIZE; +static unsigned int afl_forksrv_pid; /* Function declarations. */ -static void afl_setup(void); -static void afl_forkserver(CPUArchState*); -static inline void afl_maybe_log(unsigned long); +static void afl_setup(struct uc_struct* uc); +static void afl_forkserver(CPUArchState*); +static inline void afl_maybe_log(struct uc_struct* uc, unsigned long); static void afl_wait_tsl(CPUArchState*, int); static void afl_request_tsl(target_ulong, target_ulong, uint64_t); -static TranslationBlock *tb_find_slow(CPUArchState*, target_ulong, - target_ulong, uint64_t); +static TranslationBlock* tb_find_slow(CPUArchState*, target_ulong, target_ulong, + uint64_t); /* Data structure passed around by the translate handlers: */ struct afl_tsl { + target_ulong pc; target_ulong cs_base; - uint64_t flags; + uint64_t flags; + }; /************************* @@ -105,10 +107,9 @@ struct afl_tsl { /* Set up SHM region and initialize other stuff. */ -static void afl_setup(void) { +static void afl_setup(struct uc_struct* uc) { - char *id_str = getenv(SHM_ENV_VAR), - *inst_r = getenv("AFL_INST_RATIO"); + char *id_str = getenv(SHM_ENV_VAR), *inst_r = getenv("AFL_INST_RATIO"); int shm_id; @@ -121,31 +122,45 @@ static void afl_setup(void) { if (r > 100) r = 100; if (!r) r = 1; - afl_inst_rms = MAP_SIZE * r / 100; + uc->afl_inst_rms = MAP_SIZE * r / 100; + + } else { + + uc->afl_inst_rms = MAP_SIZE; } if (id_str) { shm_id = atoi(id_str); - afl_area_ptr = shmat(shm_id, NULL, 0); + uc->afl_area_ptr = shmat(shm_id, NULL, 0); - if (afl_area_ptr == (void*)-1) exit(1); + if (uc->afl_area_ptr == (void*)-1) exit(1); /* With AFL_INST_RATIO set to a low value, we want to touch the bitmap so that the parent doesn't give up on us. */ - if (inst_r) afl_area_ptr[0] = 1; + if (inst_r) uc->afl_area_ptr[0] = 1; + } + + /* Maintain for compatibility */ + if (getenv("AFL_QEMU_COMPCOV")) { uc->afl_compcov_level = 1; } + if (getenv("AFL_COMPCOV_LEVEL")) { + + uc->afl_compcov_level = atoi(getenv("AFL_COMPCOV_LEVEL")); + + } + } /* Fork server logic, invoked once we hit first emulated instruction. */ -static void afl_forkserver(CPUArchState *env) { +static void afl_forkserver(CPUArchState* env) { static unsigned char tmp[4]; - if (!afl_area_ptr) return; + if (!env->uc->afl_area_ptr) return; /* Tell the parent that we're alive. If the parent doesn't want to talk, assume that we're not running in forkserver mode. */ @@ -159,13 +174,13 @@ static void afl_forkserver(CPUArchState *env) { while (1) { pid_t child_pid; - int status, t_fd[2]; + int status, t_fd[2]; /* Whoops, parent dead? */ if (read(FORKSRV_FD, tmp, 4) != 4) exit(2); - /* Establish a channel with child to grab translation commands. We'll + /* Establish a channel with child to grab translation commands. We'll read from t_fd[0], child will write to TSL_FD. */ if (pipe(t_fd) || dup2(t_fd[1], TSL_FD) < 0) exit(3); @@ -205,48 +220,36 @@ static void afl_forkserver(CPUArchState *env) { } - /* The equivalent of the tuple logging routine from afl-as.h. */ -static inline void afl_maybe_log(unsigned long cur_loc) { +static inline void afl_maybe_log(struct uc_struct* uc, unsigned long cur_loc) { static __thread unsigned long prev_loc; - // DEBUG - //printf("IN AFL_MAYBE_LOG 0x%lx\n", cur_loc); - - // MODIFIED FOR UNICORN MODE -> We want to log all addresses, - // so the checks for 'start < addr < end' are removed - if(!afl_area_ptr) - return; + u8* afl_area_ptr = uc->afl_area_ptr; - // DEBUG - //printf("afl_area_ptr = %p\n", afl_area_ptr); + if (!afl_area_ptr) return; /* Looks like QEMU always maps to fixed locations, so ASAN is not a concern. Phew. But instruction addresses may be aligned. Let's mangle the value to get something quasi-uniform. */ - cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc &= MAP_SIZE - 1; /* Implement probabilistic instrumentation by looking at scrambled block address. This keeps the instrumented locations stable across runs. */ - // DEBUG - //printf("afl_inst_rms = 0x%lx\n", afl_inst_rms); + if (cur_loc >= uc->afl_inst_rms) return; - if (cur_loc >= afl_inst_rms) return; + register uintptr_t afl_idx = cur_loc ^ prev_loc; - // DEBUG - //printf("cur_loc = 0x%lx\n", cur_loc); + INC_AFL_AREA(afl_idx); - afl_area_ptr[cur_loc ^ prev_loc]++; prev_loc = cur_loc >> 1; } - /* This code is invoked whenever QEMU decides that it doesn't have a translation of a particular block and needs to compute it. When this happens, we tell the parent to mirror the operation, so that the next fork() has a @@ -258,20 +261,19 @@ static void afl_request_tsl(target_ulong pc, target_ulong cb, uint64_t flags) { if (!afl_fork_child) return; - t.pc = pc; + t.pc = pc; t.cs_base = cb; - t.flags = flags; + t.flags = flags; if (write(TSL_FD, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl)) return; } - /* This is the other side of the same channel. Since timeouts are handled by afl-fuzz simply killing the child, we can just wait until the pipe breaks. */ -static void afl_wait_tsl(CPUArchState *env, int fd) { +static void afl_wait_tsl(CPUArchState* env, int fd) { struct afl_tsl t; @@ -279,12 +281,13 @@ static void afl_wait_tsl(CPUArchState *env, int fd) { /* Broken pipe means it's time to return to the fork server routine. */ - if (read(fd, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl)) - break; + if (read(fd, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl)) break; tb_find_slow(env, t.pc, t.cs_base, t.flags); + } close(fd); + } diff --git a/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h b/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h new file mode 100644 index 00000000..7c84058f --- /dev/null +++ b/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h @@ -0,0 +1,57 @@ +/* + american fuzzy lop++ - unicorn instrumentation + ---------------------------------------------- + + Originally written by Andrew Griffiths <agriffiths@google.com> and + Michal Zalewski <lcamtuf@google.com> + + Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co> + + CompareCoverage and NeverZero counters by Andrea Fioraldi + <andreafioraldi@gmail.com> + + Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at: + + http://www.apache.org/licenses/LICENSE-2.0 + + This code is a shim patched into the separately-distributed source + code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality + to implement AFL-style instrumentation and to take care of the remaining + parts of the AFL fork server logic. + + The resulting libunicorn binary is essentially a standalone instrumentation + tool; for an example of how to leverage it for other purposes, you can + have a look at afl-showmap.c. + + */ + +#include "../../config.h" + +static void afl_gen_compcov(TCGContext *s, uint64_t cur_loc, TCGv_i64 arg1, + TCGv_i64 arg2, TCGMemOp ot, int is_imm) { + + if (!s->uc->afl_compcov_level || !s->uc->afl_area_ptr) return; + + if (!is_imm && s->uc->afl_compcov_level < 2) return; + + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 7; + + if (cur_loc >= s->uc->afl_inst_rms) return; + + switch (ot) { + + case MO_64: gen_afl_compcov_log_64(s, cur_loc, arg1, arg2); break; + case MO_32: gen_afl_compcov_log_32(s, cur_loc, arg1, arg2); break; + case MO_16: gen_afl_compcov_log_16(s, cur_loc, arg1, arg2); break; + default: return; + + } + +} + diff --git a/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h b/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h new file mode 100644 index 00000000..d21bbcc7 --- /dev/null +++ b/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h @@ -0,0 +1,59 @@ +/* + american fuzzy lop++ - unicorn instrumentation + ---------------------------------------------- + + Originally written by Andrew Griffiths <agriffiths@google.com> and + Michal Zalewski <lcamtuf@google.com> + + Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co> + + CompareCoverage and NeverZero counters by Andrea Fioraldi + <andreafioraldi@gmail.com> + + Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at: + + http://www.apache.org/licenses/LICENSE-2.0 + + This code is a shim patched into the separately-distributed source + code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality + to implement AFL-style instrumentation and to take care of the remaining + parts of the AFL fork server logic. + + The resulting libunicorn binary is essentially a standalone instrumentation + tool; for an example of how to leverage it for other purposes, you can + have a look at afl-showmap.c. + + */ + +static inline void gen_afl_compcov_log_16(TCGContext *tcg_ctx, uint64_t cur_loc, + TCGv_i64 arg1, TCGv_i64 arg2) { + + TCGv_ptr tuc = tcg_const_ptr(tcg_ctx, tcg_ctx->uc); + TCGv_i64 tcur_loc = tcg_const_i64(tcg_ctx, cur_loc); + gen_helper_afl_compcov_log_16(tcg_ctx, tuc, tcur_loc, arg1, arg2); + +} + +static inline void gen_afl_compcov_log_32(TCGContext *tcg_ctx, uint64_t cur_loc, + TCGv_i64 arg1, TCGv_i64 arg2) { + + TCGv_ptr tuc = tcg_const_ptr(tcg_ctx, tcg_ctx->uc); + TCGv_i64 tcur_loc = tcg_const_i64(tcg_ctx, cur_loc); + gen_helper_afl_compcov_log_32(tcg_ctx, tuc, tcur_loc, arg1, arg2); + +} + +static inline void gen_afl_compcov_log_64(TCGContext *tcg_ctx, uint64_t cur_loc, + TCGv_i64 arg1, TCGv_i64 arg2) { + + TCGv_ptr tuc = tcg_const_ptr(tcg_ctx, tcg_ctx->uc); + TCGv_i64 tcur_loc = tcg_const_i64(tcg_ctx, cur_loc); + gen_helper_afl_compcov_log_64(tcg_ctx, tuc, tcur_loc, arg1, arg2); + +} + diff --git a/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h new file mode 100644 index 00000000..95e68302 --- /dev/null +++ b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h @@ -0,0 +1,106 @@ +/* + american fuzzy lop++ - unicorn instrumentation + ---------------------------------------------- + + Originally written by Andrew Griffiths <agriffiths@google.com> and + Michal Zalewski <lcamtuf@google.com> + + Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co> + + CompareCoverage and NeverZero counters by Andrea Fioraldi + <andreafioraldi@gmail.com> + + Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at: + + http://www.apache.org/licenses/LICENSE-2.0 + + This code is a shim patched into the separately-distributed source + code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality + to implement AFL-style instrumentation and to take care of the remaining + parts of the AFL fork server logic. + + The resulting libunicorn binary is essentially a standalone instrumentation + tool; for an example of how to leverage it for other purposes, you can + have a look at afl-showmap.c. + + */ + +#include "uc_priv.h" +#include "afl-unicorn-common.h" + +void HELPER(afl_compcov_log_16)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1, + uint64_t arg2) { + + u8* afl_area_ptr = ((struct uc_struct*)uc_ptr)->afl_area_ptr; + + if ((arg1 & 0xff) == (arg2 & 0xff)) { INC_AFL_AREA(cur_loc); } + +} + +void HELPER(afl_compcov_log_32)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1, + uint64_t arg2) { + + u8* afl_area_ptr = ((struct uc_struct*)uc_ptr)->afl_area_ptr; + + if ((arg1 & 0xff) == (arg2 & 0xff)) { + + INC_AFL_AREA(cur_loc); + if ((arg1 & 0xffff) == (arg2 & 0xffff)) { + + INC_AFL_AREA(cur_loc + 1); + if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) { INC_AFL_AREA(cur_loc + 2); } + + } + + } + +} + +void HELPER(afl_compcov_log_64)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1, + uint64_t arg2) { + + u8* afl_area_ptr = ((struct uc_struct*)uc_ptr)->afl_area_ptr; + + if ((arg1 & 0xff) == (arg2 & 0xff)) { + + INC_AFL_AREA(cur_loc); + if ((arg1 & 0xffff) == (arg2 & 0xffff)) { + + INC_AFL_AREA(cur_loc + 1); + if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) { + + INC_AFL_AREA(cur_loc + 2); + if ((arg1 & 0xffffffff) == (arg2 & 0xffffffff)) { + + INC_AFL_AREA(cur_loc + 3); + if ((arg1 & 0xffffffffff) == (arg2 & 0xffffffffff)) { + + INC_AFL_AREA(cur_loc + 4); + if ((arg1 & 0xffffffffffff) == (arg2 & 0xffffffffffff)) { + + INC_AFL_AREA(cur_loc + 5); + if ((arg1 & 0xffffffffffffff) == (arg2 & 0xffffffffffffff)) { + + INC_AFL_AREA(cur_loc + 6); + + } + + } + + } + + } + + } + + } + + } + +} + diff --git a/unicorn_mode/patches/compcov.diff b/unicorn_mode/patches/compcov.diff new file mode 100644 index 00000000..8ec867d1 --- /dev/null +++ b/unicorn_mode/patches/compcov.diff @@ -0,0 +1,113 @@ +diff --git a/include/uc_priv.h b/include/uc_priv.h +index 22f494e..1aa7b3a 100644 +--- a/include/uc_priv.h ++++ b/include/uc_priv.h +@@ -245,6 +245,12 @@ struct uc_struct { + uint32_t target_page_align; + uint64_t next_pc; // save next PC for some special cases + bool hook_insert; // insert new hook at begin of the hook list (append by default) ++ ++#ifdef UNICORN_AFL ++ unsigned char *afl_area_ptr; ++ int afl_compcov_level; ++ unsigned int afl_inst_rms; ++#endif + }; + + // Metadata stub for the variable-size cpu context used with uc_context_*() +diff --git a/qemu/target-i386/translate.c b/qemu/target-i386/translate.c +index 36fae09..196d346 100644 +--- a/qemu/target-i386/translate.c ++++ b/qemu/target-i386/translate.c +@@ -33,6 +33,12 @@ + + #include "uc_priv.h" + ++#if defined(UNICORN_AFL) ++#include "../../afl-unicorn-cpu-translate-inl.h" ++#else ++#define afl_gen_compcov(a,b,c,d,e,f) do {} while (0) ++#endif ++ + #define PREFIX_REPZ 0x01 + #define PREFIX_REPNZ 0x02 + #define PREFIX_LOCK 0x04 +@@ -1555,6 +1561,7 @@ static void gen_op(DisasContext *s, int op, TCGMemOp ot, int d) + case OP_SUBL: + tcg_gen_mov_tl(tcg_ctx, cpu_cc_srcT, *cpu_T[0]); + tcg_gen_sub_tl(tcg_ctx, *cpu_T[0], *cpu_T[0], *cpu_T[1]); ++ afl_gen_compcov(tcg_ctx, s->pc, *cpu_T[0], *cpu_T[1], ot, d == OR_EAX); + gen_op_st_rm_T0_A0(s, ot, d); + gen_op_update2_cc(tcg_ctx); + set_cc_op(s, CC_OP_SUBB + ot); +@@ -1582,6 +1589,7 @@ static void gen_op(DisasContext *s, int op, TCGMemOp ot, int d) + tcg_gen_mov_tl(tcg_ctx, cpu_cc_src, *cpu_T[1]); + tcg_gen_mov_tl(tcg_ctx, cpu_cc_srcT, *cpu_T[0]); + tcg_gen_sub_tl(tcg_ctx, cpu_cc_dst, *cpu_T[0], *cpu_T[1]); ++ afl_gen_compcov(tcg_ctx, s->pc, *cpu_T[0], *cpu_T[1], ot, d == OR_EAX); + set_cc_op(s, CC_OP_SUBB + ot); + break; + } +diff --git a/qemu/tcg-runtime.c b/qemu/tcg-runtime.c +index 21b022a..14d7891 100644 +--- a/qemu/tcg-runtime.c ++++ b/qemu/tcg-runtime.c +@@ -31,9 +31,14 @@ + + #define DEF_HELPER_FLAGS_2(name, flags, ret, t1, t2) \ + dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2)); ++#define DEF_HELPER_FLAGS_4(name, flags, ret, t1, t2, t3, t4) \ ++ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), dh_ctype(t4)); + + #include "tcg-runtime.h" + ++#ifdef UNICORN_AFL ++#include "../afl-unicorn-tcg-runtime-inl.h" ++#endif + + /* 32-bit helpers */ + +diff --git a/qemu/tcg/tcg-op.h b/qemu/tcg/tcg-op.h +index 38b7dd9..c5a9af9 100644 +--- a/qemu/tcg/tcg-op.h ++++ b/qemu/tcg/tcg-op.h +@@ -27,6 +27,10 @@ + + int gen_new_label(TCGContext *); + ++#ifdef UNICORN_AFL ++#include "../../afl-unicorn-tcg-op-inl.h" ++#endif ++ + static inline void gen_uc_tracecode(TCGContext *tcg_ctx, int32_t size, int32_t type, void *uc, uint64_t pc) + { + TCGv_i32 tsize = tcg_const_i32(tcg_ctx, size); +diff --git a/qemu/tcg/tcg-runtime.h b/qemu/tcg/tcg-runtime.h +index 23a0c37..90b993c 100644 +--- a/qemu/tcg/tcg-runtime.h ++++ b/qemu/tcg/tcg-runtime.h +@@ -14,3 +14,9 @@ DEF_HELPER_FLAGS_2(sar_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64) + + DEF_HELPER_FLAGS_2(mulsh_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64) + DEF_HELPER_FLAGS_2(muluh_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64) ++ ++#ifdef UNICORN_AFL ++DEF_HELPER_FLAGS_4(afl_compcov_log_16, 0, void, ptr, i64, i64, i64) ++DEF_HELPER_FLAGS_4(afl_compcov_log_32, 0, void, ptr, i64, i64, i64) ++DEF_HELPER_FLAGS_4(afl_compcov_log_64, 0, void, ptr, i64, i64, i64) ++#endif +diff --git a/qemu/unicorn_common.h b/qemu/unicorn_common.h +index 8dcbb3e..11e18b4 100644 +--- a/qemu/unicorn_common.h ++++ b/qemu/unicorn_common.h +@@ -84,6 +84,10 @@ static inline void uc_common_init(struct uc_struct* uc) + + if (!uc->release) + uc->release = release_common; ++ ++#ifdef UNICORN_AFL ++ uc->afl_area_ptr = 0; ++#endif + } + + #endif |