From fced3e00cedf1fe4a100c20dc64ee7e4f3bc3223 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Wed, 29 Apr 2020 20:44:30 +0200 Subject: wip: afl-untracer --- examples/afl_untracer/ida_get_patchpoints.py | 52 ++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 examples/afl_untracer/ida_get_patchpoints.py (limited to 'examples/afl_untracer/ida_get_patchpoints.py') diff --git a/examples/afl_untracer/ida_get_patchpoints.py b/examples/afl_untracer/ida_get_patchpoints.py new file mode 100644 index 00000000..5a79658d --- /dev/null +++ b/examples/afl_untracer/ida_get_patchpoints.py @@ -0,0 +1,52 @@ +# +# IDAPython script for IDA Pro +# Slightly modified from https://github.com/googleprojectzero/p0tools/blob/master/TrapFuzz/findPatchPoints.py +# + +import idautils +import idaapi +import ida_nalt +import idc + +# See https://www.hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml + +from os.path import expanduser +home = expanduser("~") + +patchpoints = set() + +max_offset = 0 +for seg_ea in idautils.Segments(): + name = idc.get_segm_name(seg_ea) + #print("Segment: " + name) + if name != "__text" and name != ".text": + continue + + start = idc.get_segm_start(seg_ea) + end = idc.get_segm_end(seg_ea) + #print("Start: " + hex(start) + " End: " + hex(end)) + for func_ea in idautils.Functions(start, end): + f = idaapi.get_func(func_ea) + if not f: + continue + for block in idaapi.FlowChart(f): + if start <= block.start_ea < end: + max_offset = max(max_offset, block.start_ea) + patchpoints.add(block.start_ea) + #else: + # print("Warning: broken CFG?") + +# Round up max_offset to page size +size = max_offset +rem = size % 0x1000 +if rem != 0: + size += 0x1000 - rem + +print("Writing to " + home + "/Desktop/patches.txt") + +with open(home + "/Desktop/patches.txt", "w") as f: + f.write(ida_nalt.get_root_filename() + ':' + hex(size) + '\n') + f.write('\n'.join(map(hex, sorted(patchpoints)))) + f.write('\n') + +print("Done, found {} patchpoints".format(len(patchpoints))) -- cgit 1.4.1 From 33ddf6ea0e090ec2ef18dfa7c53b4dfe8130de26 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Fri, 1 May 2020 17:07:44 +0200 Subject: add ghidra script and workaround ghidra/linux/ida weirdness --- examples/afl_untracer/README.md | 4 ++ examples/afl_untracer/afl-untracer.c | 16 +---- examples/afl_untracer/ghidra_get_patchpoints.java | 84 +++++++++++++++++++++++ examples/afl_untracer/ida_get_patchpoints.py | 9 ++- 4 files changed, 99 insertions(+), 14 deletions(-) create mode 100644 examples/afl_untracer/ghidra_get_patchpoints.java (limited to 'examples/afl_untracer/ida_get_patchpoints.py') diff --git a/examples/afl_untracer/README.md b/examples/afl_untracer/README.md index d3af0ceb..4ff96423 100644 --- a/examples/afl_untracer/README.md +++ b/examples/afl_untracer/README.md @@ -10,6 +10,10 @@ or cmplog. Read and modify afl-untracer.c then `make` and use it as the afl-fuzz target (or even remote via afl-network-proxy). +To generate the `patches.txt` file for your target library use the +`ida_get_patchpoints.py` script for IDA Pro or +`ghidra_get_patchpoints.java` for Ghidra. + This idea is based on [UnTracer](https://github.com/FoRTE-Research/UnTracer-AFL) and modified by [Trapfuzz](https://github.com/googleprojectzero/p0tools/tree/master/TrapFuzz). This implementation is slower because the traps are not patched out with each diff --git a/examples/afl_untracer/afl-untracer.c b/examples/afl_untracer/afl-untracer.c index 5338bfd5..f812958c 100644 --- a/examples/afl_untracer/afl-untracer.c +++ b/examples/afl_untracer/afl-untracer.c @@ -506,18 +506,6 @@ void setup_trap_instrumentation() { // It's an offset, parse it and do the patching. unsigned long offset = strtoul(line, NULL, 16); - // I dont know what it is. /proc//maps shows the right start address - // and the offsets generated by the python scripts are fine as well. - // And loading the library into gdb also shows the offsets generated - // by the script are correct. However when loaded via dlopen the first - // 0x1000 are skipped ... -#if defined(__linux__) - if (offset >= 0x1000) - offset -= 0x1000; - else - fprintf(stderr, "Warning: offset is < 0x1000: %x\n", offset); -#endif - if (offset > lib_size) FATAL("Invalid offset: 0x%lx. Current library is 0x%zx bytes large", offset, lib_size); @@ -526,10 +514,12 @@ void setup_trap_instrumentation() { FATAL("Too many basic blocks to instrument"); uint32_t *shadow = SHADOW(lib_addr + offset); - if (*shadow != 0) FATAL("Duplicate patch entry: 0x%lx", offset); + if (*shadow != 0) continue; // skip duplicates // Make lookup entry in shadow memory. + #if ((defined(__APPLE__) && defined(__LP64__)) || defined(__x86_64__)) + // this is for Intel x64 uint8_t orig_byte = lib_addr[offset]; diff --git a/examples/afl_untracer/ghidra_get_patchpoints.java b/examples/afl_untracer/ghidra_get_patchpoints.java new file mode 100644 index 00000000..d341bea4 --- /dev/null +++ b/examples/afl_untracer/ghidra_get_patchpoints.java @@ -0,0 +1,84 @@ +/* ### + * IP: GHIDRA + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +// Find patch points for untracer tools (e.g. afl++ examples/afl_untracer) +// +// Copy to ..../Ghidra/Features/Search/ghidra_scripts/ +// Writes the results to ~/Desktop/patches.txt +// +// This is my very first Ghidra script. I am sure this could be done better. +// +//@category Search + +import ghidra.app.script.GhidraScript; +import ghidra.program.model.address.*; +import ghidra.program.model.block.*; +import ghidra.program.model.listing.*; +import ghidra.program.model.symbol.*; +import ghidra.program.model.mem.*; + +import java.io.*; + +public class ghidra_get_patchpoints extends GhidraScript { + + @Override + public void run() throws Exception { + + long segment_start = 0; + Memory memory = currentProgram.getMemory(); + MultEntSubModel model = new MultEntSubModel(currentProgram); + CodeBlockIterator subIter = model.getCodeBlocks(monitor); + BufferedWriter out = new BufferedWriter(new FileWriter(System.getProperty("user.home") + File.separator + "Desktop" + File.separator + "patches.txt")); + + while (subIter.hasNext()) { + + CodeBlock multiEntryBlock = subIter.next(); + SimpleBlockModel basicBlockModel = new SimpleBlockModel(currentProgram); + CodeBlockIterator bbIter = basicBlockModel.getCodeBlocksContaining(multiEntryBlock, monitor); + + while (bbIter.hasNext()) { + + CodeBlock basicBlock = bbIter.next(); + + if (segment_start == 0) { + + Address firstAddr = basicBlock.getFirstStartAddress(); + long firstBlockAddr = firstAddr.getAddressableWordOffset(); + MemoryBlock mb = memory.getBlock(firstAddr); + Address startAddr = mb.getStart(); + Address endAddr = mb.getEnd(); + segment_start = startAddr.getAddressableWordOffset(); + if ((firstBlockAddr - segment_start) >= 0x1000) + segment_start += 0x1000; + long segment_end = endAddr.getAddressableWordOffset(); + long segment_size = segment_end - segment_start; + if ((segment_size % 0x1000) > 0) + segment_size = (((segment_size / 0x1000) + 1) * 0x1000); + out.write(currentProgram.getName() + ":0x" + Long.toHexString(segment_size) + "\n"); + //println("Start: " + Long.toHexString(segment_start)); + //println("End: " + Long.toHexString(segment_end)); + + } + + if (basicBlock.getFirstStartAddress().getAddressableWordOffset() - segment_start > 0) + out.write("0x" + Long.toHexString(basicBlock.getFirstStartAddress().getAddressableWordOffset() - segment_start) + "\n"); + + } + } + + out.close(); + + } +} diff --git a/examples/afl_untracer/ida_get_patchpoints.py b/examples/afl_untracer/ida_get_patchpoints.py index 5a79658d..c7e8f899 100644 --- a/examples/afl_untracer/ida_get_patchpoints.py +++ b/examples/afl_untracer/ida_get_patchpoints.py @@ -24,6 +24,8 @@ for seg_ea in idautils.Segments(): start = idc.get_segm_start(seg_ea) end = idc.get_segm_end(seg_ea) + first = 0 + subtract_addr = 0 #print("Start: " + hex(start) + " End: " + hex(end)) for func_ea in idautils.Functions(start, end): f = idaapi.get_func(func_ea) @@ -31,8 +33,13 @@ for seg_ea in idautils.Segments(): continue for block in idaapi.FlowChart(f): if start <= block.start_ea < end: + if first == 0: + if block.start_ea >= 0x1000: + subtract_addr = 0x1000 + first = 1 + max_offset = max(max_offset, block.start_ea) - patchpoints.add(block.start_ea) + patchpoints.add(block.start_ea - subtract_addr) #else: # print("Warning: broken CFG?") -- cgit 1.4.1