From 39ad3b89467d6de12cbb9d08ccd77d331c0d1f9e Mon Sep 17 00:00:00 2001
From: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>
Date: Wed, 28 Apr 2021 09:25:26 +0100
Subject: Frida persistent (#880)

* Added x64 support for persistent mode (function call only), in-memory teest cases and complog

* Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC

* Various minor fixes and finished support for AFL_INST_LIBS

* Review changes

Co-authored-by: Your Name <you@example.com>
---
 frida_mode/include/complog.h     |  9 +++++++++
 frida_mode/include/instrument.h  | 17 ++++++++++++++---
 frida_mode/include/interceptor.h |  2 ++
 frida_mode/include/lib.h         |  8 ++++++++
 frida_mode/include/persistent.h  | 26 ++++++++++++++++++++++++++
 frida_mode/include/prefetch.h    |  7 ++++---
 frida_mode/include/ranges.h      |  2 +-
 frida_mode/include/stalker.h     |  8 ++++++++
 frida_mode/include/util.h        |  6 ++++++
 9 files changed, 78 insertions(+), 7 deletions(-)
 create mode 100644 frida_mode/include/complog.h
 create mode 100644 frida_mode/include/lib.h
 create mode 100644 frida_mode/include/persistent.h
 create mode 100644 frida_mode/include/stalker.h
 create mode 100644 frida_mode/include/util.h

(limited to 'frida_mode/include')

diff --git a/frida_mode/include/complog.h b/frida_mode/include/complog.h
new file mode 100644
index 00000000..094b7b93
--- /dev/null
+++ b/frida_mode/include/complog.h
@@ -0,0 +1,9 @@
+extern struct cmp_map *__afl_cmp_map;
+
+void complog_init(void);
+
+/* Functions to be implemented by the different architectures */
+void complog_instrument(const cs_insn *instr, GumStalkerIterator *iterator);
+
+gboolean complog_is_readable(void *addr, size_t size);
+
diff --git a/frida_mode/include/instrument.h b/frida_mode/include/instrument.h
index ff71bed4..1b6c6bba 100644
--- a/frida_mode/include/instrument.h
+++ b/frida_mode/include/instrument.h
@@ -1,7 +1,18 @@
 #include "frida-gum.h"
 
-void instr_basic_block(GumStalkerIterator *iterator, GumStalkerOutput *output,
-                       gpointer user_data);
+#include "config.h"
 
-void instrument_init();
+extern uint64_t __thread previous_pc;
+extern uint8_t *__afl_area_ptr;
+extern uint32_t __afl_map_size;
+
+void instrument_init(void);
+
+GumStalkerTransformer *instrument_get_transformer(void);
+
+/* Functions to be implemented by the different architectures */
+gboolean instrument_is_coverage_optimize_supported(void);
+
+void instrument_coverage_optimize(const cs_insn *   instr,
+                                  GumStalkerOutput *output);
 
diff --git a/frida_mode/include/interceptor.h b/frida_mode/include/interceptor.h
index 5ed3cf49..49c0630a 100644
--- a/frida_mode/include/interceptor.h
+++ b/frida_mode/include/interceptor.h
@@ -1,4 +1,6 @@
 #include "frida-gum.h"
 
 void intercept(void *address, gpointer replacement, gpointer user_data);
+void unintercept(void *address);
+void unintercept_self(void);
 
diff --git a/frida_mode/include/lib.h b/frida_mode/include/lib.h
new file mode 100644
index 00000000..1dc426a2
--- /dev/null
+++ b/frida_mode/include/lib.h
@@ -0,0 +1,8 @@
+#include "frida-gum.h"
+
+void lib_init(void);
+
+guint64 lib_get_text_base(void);
+
+guint64 lib_get_text_limit(void);
+
diff --git a/frida_mode/include/persistent.h b/frida_mode/include/persistent.h
new file mode 100644
index 00000000..14c8a268
--- /dev/null
+++ b/frida_mode/include/persistent.h
@@ -0,0 +1,26 @@
+#include "frida-gum.h"
+
+#include "config.h"
+
+typedef struct arch_api_regs api_regs;
+
+typedef void (*afl_persistent_hook_fn)(api_regs *regs, uint64_t guest_base,
+                                       uint8_t *input_buf,
+                                       uint32_t input_buf_len);
+
+extern int __afl_persistent_loop(unsigned int max_cnt);
+
+extern unsigned int * __afl_fuzz_len;
+extern unsigned char *__afl_fuzz_ptr;
+
+guint64                persistent_start;
+guint64                persistent_count;
+afl_persistent_hook_fn hook;
+
+void persistent_init(void);
+
+/* Functions to be implemented by the different architectures */
+gboolean persistent_is_supported(void);
+
+void persistent_prologue(GumStalkerOutput *output);
+
diff --git a/frida_mode/include/prefetch.h b/frida_mode/include/prefetch.h
index b7f25a97..110f717f 100644
--- a/frida_mode/include/prefetch.h
+++ b/frida_mode/include/prefetch.h
@@ -1,5 +1,6 @@
-void prefetch_init();
-void prefetch_start(GumStalker *stalker);
+#include "frida-gum.h"
+
+void prefetch_init(void);
 void prefetch_write(void *addr);
-void prefetch_read(GumStalker *stalker);
+void prefetch_read(void);
 
diff --git a/frida_mode/include/ranges.h b/frida_mode/include/ranges.h
index b9394dbc..a021f35c 100644
--- a/frida_mode/include/ranges.h
+++ b/frida_mode/include/ranges.h
@@ -1,6 +1,6 @@
 #include "frida-gum.h"
 
-void ranges_init(GumStalker *stalker);
+void ranges_init(void);
 
 gboolean range_is_excluded(gpointer address);
 
diff --git a/frida_mode/include/stalker.h b/frida_mode/include/stalker.h
new file mode 100644
index 00000000..1962eec9
--- /dev/null
+++ b/frida_mode/include/stalker.h
@@ -0,0 +1,8 @@
+#include "frida-gum.h"
+
+void        stalker_init(void);
+GumStalker *stalker_get(void);
+void        stalker_start(void);
+void        stalker_pause(void);
+void        stalker_resume(void);
+
diff --git a/frida_mode/include/util.h b/frida_mode/include/util.h
new file mode 100644
index 00000000..5b4ea76b
--- /dev/null
+++ b/frida_mode/include/util.h
@@ -0,0 +1,6 @@
+#include "frida-gum.h"
+
+guint64 util_read_address(char *key);
+
+guint64 util_read_num(char *key);
+
-- 
cgit 1.4.1