From 39ad3b89467d6de12cbb9d08ccd77d331c0d1f9e Mon Sep 17 00:00:00 2001
From: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>
Date: Wed, 28 Apr 2021 09:25:26 +0100
Subject: Frida persistent (#880)

* Added x64 support for persistent mode (function call only), in-memory teest cases and complog

* Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC

* Various minor fixes and finished support for AFL_INST_LIBS

* Review changes

Co-authored-by: Your Name <you@example.com>
---
 frida_mode/src/main.c | 59 +++++++++++++++++++++++++++++++--------------------
 1 file changed, 36 insertions(+), 23 deletions(-)

(limited to 'frida_mode/src/main.c')

diff --git a/frida_mode/src/main.c b/frida_mode/src/main.c
index 7505c2f9..f712a8c0 100644
--- a/frida_mode/src/main.c
+++ b/frida_mode/src/main.c
@@ -10,13 +10,17 @@
 #endif
 
 #include "frida-gum.h"
+
 #include "config.h"
 #include "debug.h"
 
-#include "interceptor.h"
 #include "instrument.h"
+#include "interceptor.h"
+#include "lib.h"
+#include "persistent.h"
 #include "prefetch.h"
 #include "ranges.h"
+#include "stalker.h"
 
 #ifdef __APPLE__
 extern mach_port_t mach_task_self();
@@ -30,16 +34,15 @@ extern int  __libc_start_main(int *(main)(int, char **, char **), int argc,
 
 typedef int *(*main_fn_t)(int argc, char **argv, char **envp);
 
-static main_fn_t      main_fn = NULL;
-static GumStalker *   stalker = NULL;
+static main_fn_t main_fn = NULL;
+
 static GumMemoryRange code_range = {0};
 
-extern void              __afl_manual_init();
-extern __thread uint64_t previous_pc;
+extern void __afl_manual_init();
 
-static int on_fork() {
+static int on_fork(void) {
 
-  prefetch_read(stalker);
+  prefetch_read();
   return fork();
 
 }
@@ -70,37 +73,46 @@ static void on_main_os(int argc, char **argv, char **envp) {
 
 static int *on_main(int argc, char **argv, char **envp) {
 
+  void *fork_addr;
   on_main_os(argc, argv, envp);
 
-  stalker = gum_stalker_new();
-  if (stalker == NULL) { FATAL("Failed to initialize stalker"); }
+  unintercept_self();
 
-  gum_stalker_set_trust_threshold(stalker, 0);
-
-  GumStalkerTransformer *transformer =
-      gum_stalker_transformer_make_from_callback(instr_basic_block, NULL, NULL);
+  stalker_init();
 
+  lib_init();
   instrument_init();
+  persistent_init();
   prefetch_init();
-  ranges_init(stalker);
+  ranges_init();
 
-  intercept(fork, on_fork, stalker);
+  fork_addr = GSIZE_TO_POINTER(gum_module_find_export_by_name(NULL, "fork"));
+  intercept(fork_addr, on_fork, NULL);
 
-  gum_stalker_follow_me(stalker, transformer, NULL);
-  gum_stalker_deactivate(stalker);
+  stalker_start();
+  stalker_pause();
 
   __afl_manual_init();
 
   /* Child here */
   previous_pc = 0;
-  prefetch_start(stalker);
+  stalker_resume();
   main_fn(argc, argv, envp);
-  _exit(0);
 
 }
 
-#ifdef __APPLE__
-static void intercept_main() {
+#if defined(EMBEDDED)
+extern int *main(int argc, char **argv, char **envp);
+
+static void intercept_main(void) {
+
+  main_fn = main;
+  intercept(main, on_main, NULL);
+
+}
+
+#elif defined(__APPLE__)
+static void intercept_main(void) {
 
   mach_port_t task = mach_task_self();
   OKF("Task Id: %u", task);
@@ -119,13 +131,14 @@ static int on_libc_start_main(int *(main)(int, char **, char **), int argc,
                               void(*stack_end)) {
 
   main_fn = main;
+  unintercept_self();
   intercept(main, on_main, NULL);
   return __libc_start_main(main, argc, ubp_av, init, fini, rtld_fini,
                            stack_end);
 
 }
 
-static void intercept_main() {
+static void intercept_main(void) {
 
   intercept(__libc_start_main, on_libc_start_main, NULL);
 
@@ -133,7 +146,7 @@ static void intercept_main() {
 
 #endif
 
-__attribute__((constructor)) static void init() {
+__attribute__((constructor)) static void init(void) {
 
   gum_init_embedded();
   if (!gum_stalker_is_supported()) {
-- 
cgit 1.4.1


From 3a0d4fe0d0a585d152a59ca4601d1981cedbf113 Mon Sep 17 00:00:00 2001
From: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>
Date: Wed, 28 Apr 2021 18:26:19 +0100
Subject: Bumped warnings up to the max and fixed remaining issues (#890)

Co-authored-by: Your Name <you@example.com>
---
 frida_mode/GNUmakefile                     | 64 +++++++++++++++++++++++++-----
 frida_mode/include/complog.h               |  5 +++
 frida_mode/include/instrument.h            | 11 +++--
 frida_mode/include/interceptor.h           |  5 +++
 frida_mode/include/lib.h                   |  5 +++
 frida_mode/include/persistent.h            |  8 ++--
 frida_mode/include/prefetch.h              |  5 +++
 frida_mode/include/ranges.h                |  5 +++
 frida_mode/include/stalker.h               |  5 +++
 frida_mode/include/util.h                  |  8 ++++
 frida_mode/src/complog/complog.c           |  3 ++
 frida_mode/src/complog/complog_x64.c       | 50 ++++++++++-------------
 frida_mode/src/instrument/instrument.c     |  9 +++--
 frida_mode/src/interceptor.c               |  2 +-
 frida_mode/src/main.c                      |  7 ++--
 frida_mode/src/persistent/persistent.c     |  3 ++
 frida_mode/src/persistent/persistent_x64.c |  2 +-
 frida_mode/src/ranges.c                    | 19 ++++-----
 frida_mode/test/png/GNUmakefile            |  1 -
 19 files changed, 153 insertions(+), 64 deletions(-)

(limited to 'frida_mode/src/main.c')

diff --git a/frida_mode/GNUmakefile b/frida_mode/GNUmakefile
index 6b193806..e317237a 100644
--- a/frida_mode/GNUmakefile
+++ b/frida_mode/GNUmakefile
@@ -3,9 +3,25 @@ ROOT:=$(shell realpath $(PWD)..)/
 INC_DIR:=$(PWD)include/
 SRC_DIR:=$(PWD)src/
 INCLUDES:=$(wildcard $(INC_DIR)*.h)
-SOURCES:=$(wildcard $(SRC_DIR)**/*.c) $(wildcard $(SRC_DIR)*.c)
 BUILD_DIR:=$(PWD)build/
-CFLAGS+=-fPIC -D_GNU_SOURCE -Wno-prio-ctor-dtor -fcommon -Wl,--allow-multiple-definition
+OBJ_DIR:=$(BUILD_DIR)obj/
+SOURCES:=$(wildcard $(SRC_DIR)**/*.c) $(wildcard $(SRC_DIR)*.c)
+OBJS:=$(foreach src,$(SOURCES),$(OBJ_DIR)$(notdir $(patsubst %.c, %.o, $(src))))
+CFLAGS+=-fPIC \
+		-D_GNU_SOURCE \
+		-D_FORTIFY_SOURCE=2 \
+		-Werror \
+		-Wall \
+		-Wextra \
+		-Wpointer-arith \
+		-g \
+		-O3 \
+		-funroll-loops \
+
+LDFLAGS+=-shared \
+		 -lpthread \
+		 -lresolv \
+		 -ldl \
 
 FRIDA_BUILD_DIR:=$(BUILD_DIR)frida/
 FRIDA_TRACE:=$(BUILD_DIR)afl-frida-trace.so
@@ -36,7 +52,8 @@ GUM_DEVKIT_TARBALL:=$(FRIDA_BUILD_DIR)$(GUM_DEVKIT_FILENAME)
 GUM_DEVIT_LIBRARY=$(FRIDA_BUILD_DIR)libfrida-gum.a
 GUM_DEVIT_HEADER=$(FRIDA_BUILD_DIR)frida-gum.h
 
-TEST_BUILD_DIR:=$(BUILD_DIR)test/
+AFL_COMPILER_RT_SRC:=$(ROOT)instrumentation/afl-compiler-rt.o.c
+AFL_COMPILER_RT_OBJ:=$(OBJ_DIR)afl-compiler-rt.o
 
 
 .PHONY: all clean format
@@ -49,6 +66,9 @@ all: $(FRIDA_TRACE)
 $(BUILD_DIR):
 	mkdir -p $(BUILD_DIR)
 
+$(OBJ_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
 $(FRIDA_BUILD_DIR): | $(BUILD_DIR)
 	mkdir -p $@
 
@@ -61,18 +81,40 @@ $(GUM_DEVIT_LIBRARY): | $(GUM_DEVKIT_TARBALL)
 $(GUM_DEVIT_HEADER): | $(GUM_DEVKIT_TARBALL)
 	tar Jxvf $(GUM_DEVKIT_TARBALL) -C $(FRIDA_BUILD_DIR)
 
-$(FRIDA_TRACE): $(GUM_DEVIT_LIBRARY) $(GUM_DEVIT_HEADER) $(SOURCES) $(QEMU_INC_API) Makefile | $(BUILD_DIR)
-	$(CC) -shared \
+$(AFL_COMPILER_RT_OBJ): $(AFL_COMPILER_RT_SRC)
+	$(CC) \
 		$(CFLAGS) \
-		-o $@ \
-		$(SOURCES) \
-		$(GUM_DEVIT_LIBRARY) \
-		-I $(FRIDA_BUILD_DIR) \
 		-I $(ROOT) \
 		-I $(ROOT)include \
+		-Wno-unused-parameter \
+		-Wno-sign-compare \
+		-Wno-unused-function \
+		-Wno-prio-ctor-dtor \
+		-Wno-unused-result \
+		-o $@ \
+		-c $<
+
+
+define BUILD_SOURCE =
+$(2): $(1) GNUmakefile | $(OBJ_DIR)
+	$(CC) \
+		$(CFLAGS) \
+		-I $(ROOT)include \
+		-I $(FRIDA_BUILD_DIR) \
 		-I $(INC_DIR) \
-		$(ROOT)instrumentation/afl-compiler-rt.o.c
-#		-lpthread -ldl -lresolv -lelf
+		-c $1 \
+		-o $2
+endef
+
+$(foreach src,$(SOURCES),$(eval $(call BUILD_SOURCE,$(src),$(OBJ_DIR)$(notdir $(patsubst %.c, %.o, $(src))))))
+
+$(FRIDA_TRACE): $(GUM_DEVIT_LIBRARY) $(GUM_DEVIT_HEADER) $(OBJS) $(AFL_COMPILER_RT_OBJ) GNUmakefile | $(BUILD_DIR)
+	$(CC) \
+		-o $@ \
+		$(OBJS) \
+		$(GUM_DEVIT_LIBRARY) \
+		$(AFL_COMPILER_RT_OBJ) \
+		$(LDFLAGS) \
 
 	cp -v $(FRIDA_TRACE) $(ROOT)
 
diff --git a/frida_mode/include/complog.h b/frida_mode/include/complog.h
index 094b7b93..1c1adb6d 100644
--- a/frida_mode/include/complog.h
+++ b/frida_mode/include/complog.h
@@ -1,3 +1,6 @@
+#ifndef _COMPLOG_H
+#define _COMPLOG_H
+
 extern struct cmp_map *__afl_cmp_map;
 
 void complog_init(void);
@@ -7,3 +10,5 @@ void complog_instrument(const cs_insn *instr, GumStalkerIterator *iterator);
 
 gboolean complog_is_readable(void *addr, size_t size);
 
+#endif
+
diff --git a/frida_mode/include/instrument.h b/frida_mode/include/instrument.h
index 1b6c6bba..03fd33e5 100644
--- a/frida_mode/include/instrument.h
+++ b/frida_mode/include/instrument.h
@@ -1,10 +1,13 @@
+#ifndef _INSTRUMENT_H
+#define _INSTRUMENT_H
+
 #include "frida-gum.h"
 
 #include "config.h"
 
-extern uint64_t __thread previous_pc;
-extern uint8_t *__afl_area_ptr;
-extern uint32_t __afl_map_size;
+extern __thread uint64_t previous_pc;
+extern uint8_t *         __afl_area_ptr;
+extern uint32_t          __afl_map_size;
 
 void instrument_init(void);
 
@@ -16,3 +19,5 @@ gboolean instrument_is_coverage_optimize_supported(void);
 void instrument_coverage_optimize(const cs_insn *   instr,
                                   GumStalkerOutput *output);
 
+#endif
+
diff --git a/frida_mode/include/interceptor.h b/frida_mode/include/interceptor.h
index 49c0630a..0ff754a4 100644
--- a/frida_mode/include/interceptor.h
+++ b/frida_mode/include/interceptor.h
@@ -1,6 +1,11 @@
+#ifndef _INTERCEPTOR_H
+#define _INTERCEPTOR_H
+
 #include "frida-gum.h"
 
 void intercept(void *address, gpointer replacement, gpointer user_data);
 void unintercept(void *address);
 void unintercept_self(void);
 
+#endif
+
diff --git a/frida_mode/include/lib.h b/frida_mode/include/lib.h
index 1dc426a2..237aecb0 100644
--- a/frida_mode/include/lib.h
+++ b/frida_mode/include/lib.h
@@ -1,3 +1,6 @@
+#ifndef _LIB_H
+#define _LIB_H
+
 #include "frida-gum.h"
 
 void lib_init(void);
@@ -6,3 +9,5 @@ guint64 lib_get_text_base(void);
 
 guint64 lib_get_text_limit(void);
 
+#endif
+
diff --git a/frida_mode/include/persistent.h b/frida_mode/include/persistent.h
index 017c26c7..e58c5301 100644
--- a/frida_mode/include/persistent.h
+++ b/frida_mode/include/persistent.h
@@ -1,6 +1,5 @@
 
 #ifndef _PERSISTENT_H
-
 #define _PERSISTENT_H
 
 #include "frida-gum.h"
@@ -17,9 +16,9 @@ extern int __afl_persistent_loop(unsigned int max_cnt);
 extern unsigned int * __afl_fuzz_len;
 extern unsigned char *__afl_fuzz_ptr;
 
-guint64                persistent_start;
-guint64                persistent_count;
-afl_persistent_hook_fn hook;
+extern guint64                persistent_start;
+extern guint64                persistent_count;
+extern afl_persistent_hook_fn hook;
 
 void persistent_init(void);
 
@@ -29,3 +28,4 @@ gboolean persistent_is_supported(void);
 void persistent_prologue(GumStalkerOutput *output);
 
 #endif
+
diff --git a/frida_mode/include/prefetch.h b/frida_mode/include/prefetch.h
index 110f717f..8f0cee68 100644
--- a/frida_mode/include/prefetch.h
+++ b/frida_mode/include/prefetch.h
@@ -1,6 +1,11 @@
+#ifndef _PREFETCH_H
+#define _PREFETCH_H
+
 #include "frida-gum.h"
 
 void prefetch_init(void);
 void prefetch_write(void *addr);
 void prefetch_read(void);
 
+#endif
+
diff --git a/frida_mode/include/ranges.h b/frida_mode/include/ranges.h
index a021f35c..f652eb8a 100644
--- a/frida_mode/include/ranges.h
+++ b/frida_mode/include/ranges.h
@@ -1,6 +1,11 @@
+#ifndef _RANGES_H
+#define _RANGES_H
+
 #include "frida-gum.h"
 
 void ranges_init(void);
 
 gboolean range_is_excluded(gpointer address);
 
+#endif
+
diff --git a/frida_mode/include/stalker.h b/frida_mode/include/stalker.h
index 1962eec9..1f1abb6b 100644
--- a/frida_mode/include/stalker.h
+++ b/frida_mode/include/stalker.h
@@ -1,3 +1,6 @@
+#ifndef _STALKER_H
+#define _STALKER_H
+
 #include "frida-gum.h"
 
 void        stalker_init(void);
@@ -6,3 +9,5 @@ void        stalker_start(void);
 void        stalker_pause(void);
 void        stalker_resume(void);
 
+#endif
+
diff --git a/frida_mode/include/util.h b/frida_mode/include/util.h
index 5b4ea76b..afd0b9c1 100644
--- a/frida_mode/include/util.h
+++ b/frida_mode/include/util.h
@@ -1,6 +1,14 @@
+#ifndef _UTIL_H
+#define _UTIL_H
+
 #include "frida-gum.h"
 
+#define UNUSED_PARAMETER(x) (void)(x)
+#define IGNORED_RERURN(x) (void)!(x)
+
 guint64 util_read_address(char *key);
 
 guint64 util_read_num(char *key);
 
+#endif
+
diff --git a/frida_mode/src/complog/complog.c b/frida_mode/src/complog/complog.c
index 3b679a5c..1857ea3b 100644
--- a/frida_mode/src/complog/complog.c
+++ b/frida_mode/src/complog/complog.c
@@ -2,6 +2,7 @@
 
 #include "debug.h"
 #include "cmplog.h"
+#include "util.h"
 
 extern struct cmp_map *__afl_cmp_map;
 
@@ -10,8 +11,10 @@ static GArray *complog_ranges = NULL;
 static gboolean complog_range(const GumRangeDetails *details,
                               gpointer               user_data) {
 
+  UNUSED_PARAMETER(user_data);
   GumMemoryRange range = *details->range;
   g_array_append_val(complog_ranges, range);
+  return TRUE;
 
 }
 
diff --git a/frida_mode/src/complog/complog_x64.c b/frida_mode/src/complog/complog_x64.c
index 253ec041..28010e7f 100644
--- a/frida_mode/src/complog/complog_x64.c
+++ b/frida_mode/src/complog/complog_x64.c
@@ -4,6 +4,7 @@
 #include "cmplog.h"
 
 #include "complog.h"
+#include "util.h"
 
 #if defined(__x86_64__)
 
@@ -148,7 +149,27 @@ static guint64 complog_read_mem(GumX64CpuContext *ctx, x86_op_mem *mem) {
 
 }
 
-static void complog_handle_call(GumCpuContext *context, guint64 target) {
+static guint64 cmplog_get_operand_value(GumCpuContext *context,
+                                        complog_ctx_t *ctx) {
+
+  switch (ctx->type) {
+
+    case X86_OP_REG:
+      return complog_read_reg(context, ctx->reg);
+    case X86_OP_IMM:
+      return ctx->imm;
+    case X86_OP_MEM:
+      return complog_read_mem(context, &ctx->mem);
+    default:
+      FATAL("Invalid operand type: %d\n", ctx->type);
+
+  }
+
+}
+
+static void complog_call_callout(GumCpuContext *context, gpointer user_data) {
+
+  UNUSED_PARAMETER(user_data);
 
   guint64 address = complog_read_reg(context, X86_REG_RIP);
   guint64 rdi = complog_read_reg(context, X86_REG_RDI);
@@ -179,33 +200,6 @@ static void complog_handle_call(GumCpuContext *context, guint64 target) {
 
 }
 
-static guint64 cmplog_get_operand_value(GumCpuContext *context,
-                                        complog_ctx_t *ctx) {
-
-  switch (ctx->type) {
-
-    case X86_OP_REG:
-      return complog_read_reg(context, ctx->reg);
-    case X86_OP_IMM:
-      return ctx->imm;
-    case X86_OP_MEM:
-      return complog_read_mem(context, &ctx->mem);
-    default:
-      FATAL("Invalid operand type: %d\n", ctx->type);
-
-  }
-
-}
-
-static void complog_call_callout(GumCpuContext *context, gpointer user_data) {
-
-  complog_ctx_t *ctx = (complog_ctx_t *)user_data;
-
-  guint64 target = cmplog_get_operand_value(context, ctx);
-  complog_handle_call(context, target);
-
-}
-
 static void complog_instrument_put_operand(complog_ctx_t *ctx,
                                            cs_x86_op *    operand) {
 
diff --git a/frida_mode/src/instrument/instrument.c b/frida_mode/src/instrument/instrument.c
index 81080bee..3806136a 100644
--- a/frida_mode/src/instrument/instrument.c
+++ b/frida_mode/src/instrument/instrument.c
@@ -11,17 +11,18 @@
 #include "prefetch.h"
 #include "ranges.h"
 #include "stalker.h"
+#include "util.h"
 
 static gboolean               tracing = false;
 static gboolean               optimize = false;
-static gboolean               strict = false;
 static GumStalkerTransformer *transformer = NULL;
 
-uint64_t __thread previous_pc = 0;
+__thread uint64_t previous_pc = 0;
 
 __attribute__((hot)) static void on_basic_block(GumCpuContext *context,
                                                 gpointer       user_data) {
 
+  UNUSED_PARAMETER(context);
   /*
    * This function is performance critical as it is called to instrument every
    * basic block. By moving our print buffer to a global, we avoid it affecting
@@ -44,7 +45,7 @@ __attribute__((hot)) static void on_basic_block(GumCpuContext *context,
                    "x, previous_pc: 0x%016" G_GINT64_MODIFIER "x\n",
                    current_pc, previous_pc);
 
-    write(STDOUT_FILENO, buffer, len + 1);
+    IGNORED_RERURN(write(STDOUT_FILENO, buffer, len + 1));
 
   }
 
@@ -72,6 +73,8 @@ __attribute__((hot)) static void on_basic_block(GumCpuContext *context,
 static void instr_basic_block(GumStalkerIterator *iterator,
                               GumStalkerOutput *output, gpointer user_data) {
 
+  UNUSED_PARAMETER(user_data);
+
   const cs_insn *instr;
   gboolean       begin = TRUE;
   while (gum_stalker_iterator_next(iterator, &instr)) {
diff --git a/frida_mode/src/interceptor.c b/frida_mode/src/interceptor.c
index 8d41b075..d2802752 100644
--- a/frida_mode/src/interceptor.c
+++ b/frida_mode/src/interceptor.c
@@ -10,7 +10,7 @@ void intercept(void *address, gpointer replacement, gpointer user_data) {
   gum_interceptor_begin_transaction(interceptor);
   GumReplaceReturn ret =
       gum_interceptor_replace(interceptor, address, replacement, user_data);
-  if (ret != GUM_ATTACH_OK) { FATAL("gum_interceptor_attach: %d", ret); }
+  if (ret != GUM_REPLACE_OK) { FATAL("gum_interceptor_attach: %d", ret); }
   gum_interceptor_end_transaction(interceptor);
 
 }
diff --git a/frida_mode/src/main.c b/frida_mode/src/main.c
index f712a8c0..11cf041c 100644
--- a/frida_mode/src/main.c
+++ b/frida_mode/src/main.c
@@ -21,6 +21,7 @@
 #include "prefetch.h"
 #include "ranges.h"
 #include "stalker.h"
+#include "util.h"
 
 #ifdef __APPLE__
 extern mach_port_t mach_task_self();
@@ -36,8 +37,6 @@ typedef int *(*main_fn_t)(int argc, char **argv, char **envp);
 
 static main_fn_t main_fn = NULL;
 
-static GumMemoryRange code_range = {0};
-
 extern void __afl_manual_init();
 
 static int on_fork(void) {
@@ -55,6 +54,8 @@ static void on_main_os(int argc, char **argv, char **envp) {
 #else
 static void on_main_os(int argc, char **argv, char **envp) {
 
+  UNUSED_PARAMETER(argc);
+
   /* Personality doesn't affect the current process, it only takes effect on
    * evec */
   int persona = personality(ADDR_NO_RANDOMIZE);
@@ -97,7 +98,7 @@ static int *on_main(int argc, char **argv, char **envp) {
   /* Child here */
   previous_pc = 0;
   stalker_resume();
-  main_fn(argc, argv, envp);
+  return main_fn(argc, argv, envp);
 
 }
 
diff --git a/frida_mode/src/persistent/persistent.c b/frida_mode/src/persistent/persistent.c
index 34e4093e..fe3a1d20 100644
--- a/frida_mode/src/persistent/persistent.c
+++ b/frida_mode/src/persistent/persistent.c
@@ -9,6 +9,9 @@
 #include "util.h"
 
 int                    __afl_sharedmem_fuzzing = 0;
+afl_persistent_hook_fn hook = NULL;
+guint64                persistent_start = 0;
+guint64                persistent_count = 0;
 
 void persistent_init(void) {
 
diff --git a/frida_mode/src/persistent/persistent_x64.c b/frida_mode/src/persistent/persistent_x64.c
index 0cabbf24..5b8493b2 100644
--- a/frida_mode/src/persistent/persistent_x64.c
+++ b/frida_mode/src/persistent/persistent_x64.c
@@ -231,7 +231,7 @@ static int instrument_afl_persistent_loop_func(void) {
 
 }
 
-static int instrument_afl_persistent_loop(GumX86Writer *cw) {
+static void instrument_afl_persistent_loop(GumX86Writer *cw) {
 
   gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
                                         -(GUM_RED_ZONE_SIZE));
diff --git a/frida_mode/src/ranges.c b/frida_mode/src/ranges.c
index 6fcbd258..e3f09f9e 100644
--- a/frida_mode/src/ranges.c
+++ b/frida_mode/src/ranges.c
@@ -5,6 +5,7 @@
 #include "lib.h"
 #include "ranges.h"
 #include "stalker.h"
+#include "util.h"
 
 #define MAX_RANGES 20
 
@@ -167,6 +168,7 @@ gint range_sort(gconstpointer a, gconstpointer b) {
 static gboolean print_ranges_callback(const GumRangeDetails *details,
                                       gpointer               user_data) {
 
+  UNUSED_PARAMETER(user_data);
   if (details->file == NULL) {
 
     OKF("MAP - 0x%016" G_GINT64_MODIFIER "x - 0x%016" G_GINT64_MODIFIER "X",
@@ -190,7 +192,7 @@ static gboolean print_ranges_callback(const GumRangeDetails *details,
 static void print_ranges(char *key, GArray *ranges) {
 
   OKF("Range: %s Length: %d", key, ranges->len);
-  for (int i = 0; i < ranges->len; i++) {
+  for (guint i = 0; i < ranges->len; i++) {
 
     GumMemoryRange *curr = &g_array_index(ranges, GumMemoryRange, i);
     GumAddress      curr_limit = curr->base_address + curr->size;
@@ -345,10 +347,10 @@ static GArray *intersect_ranges(GArray *a, GArray *b) {
 
   result = g_array_new(false, false, sizeof(GumMemoryRange));
 
-  for (int i = 0; i < a->len; i++) {
+  for (guint i = 0; i < a->len; i++) {
 
     ra = &g_array_index(a, GumMemoryRange, i);
-    for (int j = 0; j < b->len; j++) {
+    for (guint j = 0; j < b->len; j++) {
 
       rb = &g_array_index(b, GumMemoryRange, j);
 
@@ -377,11 +379,11 @@ static GArray *subtract_ranges(GArray *a, GArray *b) {
 
   result = g_array_new(false, false, sizeof(GumMemoryRange));
 
-  for (int i = 0; i < a->len; i++) {
+  for (guint i = 0; i < a->len; i++) {
 
     ra = &g_array_index(a, GumMemoryRange, i);
     ral = ra->base_address + ra->size;
-    for (int j = 0; j < b->len; j++) {
+    for (guint j = 0; j < b->len; j++) {
 
       rb = &g_array_index(b, GumMemoryRange, j);
 
@@ -453,7 +455,7 @@ static GArray *merge_ranges(GArray *a) {
 
   rp = g_array_index(a, GumMemoryRange, 0);
 
-  for (int i = 1; i < a->len; i++) {
+  for (guint i = 1; i < a->len; i++) {
 
     r = &g_array_index(a, GumMemoryRange, i);
 
@@ -535,7 +537,7 @@ void ranges_init(void) {
 
   stalker = stalker_get();
 
-  for (int i = 0; i < ranges->len; i++) {
+  for (guint i = 0; i < ranges->len; i++) {
 
     r = &g_array_index(ranges, GumMemoryRange, i);
     gum_stalker_exclude(stalker, r);
@@ -551,12 +553,11 @@ void ranges_init(void) {
 
 gboolean range_is_excluded(gpointer address) {
 
-  int        i;
   GumAddress test = GUM_ADDRESS(address);
 
   if (ranges == NULL) { return false; }
 
-  for (i = 0; i < ranges->len; i++) {
+  for (guint i = 0; i < ranges->len; i++) {
 
     GumMemoryRange *curr = &g_array_index(ranges, GumMemoryRange, i);
     GumAddress      curr_limit = curr->base_address + curr->size;
diff --git a/frida_mode/test/png/GNUmakefile b/frida_mode/test/png/GNUmakefile
index c381f5ab..7de3e85a 100644
--- a/frida_mode/test/png/GNUmakefile
+++ b/frida_mode/test/png/GNUmakefile
@@ -80,7 +80,6 @@ $(TEST_BIN): $(HARNESS_OBJ) $(PNGTEST_OBJ) $(LIBPNG_LIB)
 		-o $@ \
 		$(HARNESS_OBJ) $(PNGTEST_OBJ) $(LIBPNG_LIB) \
 		-lz \
-		$(TEST_LDFLAGS)
 
 clean:
 	rm -rf $(BUILD_DIR)
-- 
cgit 1.4.1


From 26b84e3521936ec11b7615bb833310d62795020e Mon Sep 17 00:00:00 2001
From: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>
Date: Thu, 29 Apr 2021 08:06:14 +0100
Subject: Fixes for aarch64, OSX and other minor issues (#891)

Co-authored-by: Your Name <you@example.com>
---
 frida_mode/GNUmakefile                       |  28 +++--
 frida_mode/src/complog/complog.c             |   5 +-
 frida_mode/src/complog/complog_arm.c         |   6 +-
 frida_mode/src/complog/complog_arm64.c       |   6 +-
 frida_mode/src/complog/complog_x86.c         |   6 +-
 frida_mode/src/lib.c                         | 169 -------------------------
 frida_mode/src/lib/lib                       | Bin 0 -> 4144 bytes
 frida_mode/src/lib/lib.c                     | 176 +++++++++++++++++++++++++++
 frida_mode/src/lib/lib_apple.c               |  82 +++++++++++++
 frida_mode/src/main.c                        |   4 +
 frida_mode/src/persistent/persistent.c       |   4 +-
 frida_mode/src/persistent/persistent_arm32.c |   2 +
 frida_mode/src/persistent/persistent_arm64.c |   2 +
 frida_mode/src/persistent/persistent_x86.c   |   2 +
 frida_mode/test/exe/GNUmakefile              |  50 ++++++++
 frida_mode/test/exe/Makefile                 |  12 ++
 frida_mode/test/exe/testinstr.c              | 112 +++++++++++++++++
 frida_mode/test/png/GNUmakefile              |   4 +
 18 files changed, 487 insertions(+), 183 deletions(-)
 delete mode 100644 frida_mode/src/lib.c
 create mode 100755 frida_mode/src/lib/lib
 create mode 100644 frida_mode/src/lib/lib.c
 create mode 100644 frida_mode/src/lib/lib_apple.c
 create mode 100644 frida_mode/test/exe/GNUmakefile
 create mode 100644 frida_mode/test/exe/Makefile
 create mode 100644 frida_mode/test/exe/testinstr.c

(limited to 'frida_mode/src/main.c')

diff --git a/frida_mode/GNUmakefile b/frida_mode/GNUmakefile
index 65a7a1c3..d2f5ba4b 100644
--- a/frida_mode/GNUmakefile
+++ b/frida_mode/GNUmakefile
@@ -10,16 +10,29 @@ OBJS:=$(foreach src,$(SOURCES),$(OBJ_DIR)$(notdir $(patsubst %.c, %.o, $(src))))
 CFLAGS+=-fPIC \
 		-D_GNU_SOURCE \
 		-D_FORTIFY_SOURCE=2 \
-		-Wno-pointer-arith \
 		-g \
 		-O3 \
 		-funroll-loops \
 
+RT_CFLAGS:=-Wno-unused-parameter \
+		   -Wno-sign-compare \
+		   -Wno-unused-function \
+		   -Wno-unused-result \
+
 LDFLAGS+=-shared \
 		 -lpthread \
 		 -lresolv \
 		 -ldl \
 
+ifdef DEBUG
+CFLAGS+=-Werror \
+		-Wall \
+		-Wextra \
+		-Wpointer-arith
+else
+CFLAGS+=-Wno-pointer-arith
+endif
+
 FRIDA_BUILD_DIR:=$(BUILD_DIR)frida/
 FRIDA_TRACE:=$(BUILD_DIR)afl-frida-trace.so
 FRIDA_TRACE_EMBEDDED:=$(BUILD_DIR)afl-frida-trace-embedded
@@ -31,7 +44,11 @@ endif
 
 ifeq "$(shell uname)" "Darwin"
  OS:=macos
- CFLAGS:=$(CFLAGS) -Wno-deprecated-declarations
+ RT_CFLAGS:=$(RT_CFLAGS) -Wno-deprecated-declarations
+else
+ifdef DEBUG
+ RT_CFLAGS:=$(RT_CFLAGS) -Wno-prio-ctor-dtor
+endif
 endif
 
 ifeq "$(shell uname)" "Linux"
@@ -81,17 +98,14 @@ $(GUM_DEVIT_HEADER): | $(GUM_DEVKIT_TARBALL)
 $(AFL_COMPILER_RT_OBJ): $(AFL_COMPILER_RT_SRC)
 	$(CC) \
 		$(CFLAGS) \
+		$(RT_CFLAGS) \
 		-I $(ROOT) \
 		-I $(ROOT)include \
-		-Wno-unused-parameter \
-		-Wno-sign-compare \
-		-Wno-unused-function \
-		-Wno-unused-result \
 		-o $@ \
 		-c $<
 
 
-define BUILD_SOURCE =
+define BUILD_SOURCE
 $(2): $(1) GNUmakefile | $(OBJ_DIR)
 	$(CC) \
 		$(CFLAGS) \
diff --git a/frida_mode/src/complog/complog.c b/frida_mode/src/complog/complog.c
index 1857ea3b..ce8a3f62 100644
--- a/frida_mode/src/complog/complog.c
+++ b/frida_mode/src/complog/complog.c
@@ -36,8 +36,9 @@ void complog_init(void) {
   for (guint i = 0; i < complog_ranges->len; i++) {
 
     GumMemoryRange *range = &g_array_index(complog_ranges, GumMemoryRange, i);
-    OKF("CompLog Range - 0x%016lX - 0x%016lX", range->base_address,
-        range->base_address + range->size);
+    OKF("CompLog Range - 0x%016" G_GINT64_MODIFIER
+        "X - 0x%016" G_GINT64_MODIFIER "X",
+        range->base_address, range->base_address + range->size);
 
   }
 
diff --git a/frida_mode/src/complog/complog_arm.c b/frida_mode/src/complog/complog_arm.c
index 82cc2557..1b8eb8f1 100644
--- a/frida_mode/src/complog/complog_arm.c
+++ b/frida_mode/src/complog/complog_arm.c
@@ -3,10 +3,14 @@
 #include "debug.h"
 
 #include "complog.h"
+#include "util.h"
 
-#if defined(__arm64__)
+#if defined(__arm__)
 void complog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
 
+  UNUSED_PARAMETER(instr);
+  UNUSED_PARAMETER(iterator);
+  if (__afl_cmp_map == NULL) { return; }
   FATAL("Complog mode not supported on this architecture");
 
 }
diff --git a/frida_mode/src/complog/complog_arm64.c b/frida_mode/src/complog/complog_arm64.c
index e4dbf322..ce62f6fd 100644
--- a/frida_mode/src/complog/complog_arm64.c
+++ b/frida_mode/src/complog/complog_arm64.c
@@ -3,10 +3,14 @@
 #include "debug.h"
 
 #include "complog.h"
+#include "util.h"
 
-#if defined(__i386__)
+#if defined(__aarch64__)
 void complog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
 
+  UNUSED_PARAMETER(instr);
+  UNUSED_PARAMETER(iterator);
+  if (__afl_cmp_map == NULL) { return; }
   FATAL("Complog mode not supported on this architecture");
 
 }
diff --git a/frida_mode/src/complog/complog_x86.c b/frida_mode/src/complog/complog_x86.c
index df7b7cc1..b2e5ddcf 100644
--- a/frida_mode/src/complog/complog_x86.c
+++ b/frida_mode/src/complog/complog_x86.c
@@ -3,10 +3,14 @@
 #include "debug.h"
 
 #include "complog.h"
+#include "util.h"
 
-#if defined(__arm__)
+#if defined(__i386__)
 void complog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
 
+  UNUSED_PARAMETER(instr);
+  UNUSED_PARAMETER(iterator);
+  if (__afl_cmp_map == NULL) { return; }
   FATAL("Complog mode not supported on this architecture");
 
 }
diff --git a/frida_mode/src/lib.c b/frida_mode/src/lib.c
deleted file mode 100644
index e50163ac..00000000
--- a/frida_mode/src/lib.c
+++ /dev/null
@@ -1,169 +0,0 @@
-#include <elf.h>
-#include <fcntl.h>
-#include <limits.h>
-#include <stdio.h>
-#include <sys/mman.h>
-#include <unistd.h>
-
-#include "frida-gum.h"
-
-#include "debug.h"
-
-#include "lib.h"
-
-#if defined(__arm__) || defined(__i386__)
-  #define ELFCLASS ELFCLASS32
-typedef Elf32_Ehdr Elf_Ehdr;
-typedef Elf32_Phdr Elf_Phdr;
-typedef Elf32_Shdr Elf_Shdr;
-#elif defined(__aarch64__) || defined(__x86_64__)
-  #define ELFCLASS ELFCLASS64
-typedef Elf64_Ehdr Elf_Ehdr;
-typedef Elf64_Phdr Elf_Phdr;
-typedef Elf64_Shdr Elf_Shdr;
-#else
-  #error "Unsupported platform"
-#endif
-
-typedef struct {
-
-  gchar      name[PATH_MAX + 1];
-  gchar      path[PATH_MAX + 1];
-  GumAddress base_address;
-  gsize      size;
-
-} lib_details_t;
-
-static guint64 text_base = 0;
-static guint64 text_limit = 0;
-
-static gboolean lib_find_exe(const GumModuleDetails *details,
-                             gpointer                user_data) {
-
-  lib_details_t *lib_details = (lib_details_t *)user_data;
-
-  memcpy(lib_details->name, details->name, PATH_MAX);
-  memcpy(lib_details->path, details->path, PATH_MAX);
-  lib_details->base_address = details->range->base_address;
-  lib_details->size = details->range->size;
-  return FALSE;
-
-}
-
-static gboolean lib_is_little_endian(void) {
-
-  int probe = 1;
-  return *(char *)&probe;
-
-}
-
-static void lib_validate_hdr(Elf_Ehdr *hdr) {
-
-  if (hdr->e_ident[0] != ELFMAG0) FATAL("Invalid e_ident[0]");
-  if (hdr->e_ident[1] != ELFMAG1) FATAL("Invalid e_ident[1]");
-  if (hdr->e_ident[2] != ELFMAG2) FATAL("Invalid e_ident[2]");
-  if (hdr->e_ident[3] != ELFMAG3) FATAL("Invalid e_ident[3]");
-  if (hdr->e_ident[4] != ELFCLASS) FATAL("Invalid class");
-/*
-  if (hdr->e_ident[5] != (lib_is_little_endian() ? ELFDATA2LSB : ELFDATA2MSB))
-    FATAL("Invalid endian");
-  if (hdr->e_ident[6] != EV_CURRENT) FATAL("Invalid version");
-  if (hdr->e_type != ET_DYN) FATAL("Invalid type");
-  if (hdr->e_version != EV_CURRENT) FATAL("Invalid e_version");
-  if (hdr->e_phoff != sizeof(Elf_Ehdr)) FATAL("Invalid e_phoff");
-  if (hdr->e_ehsize != sizeof(Elf_Ehdr)) FATAL("Invalid e_ehsize");
-  if (hdr->e_phentsize != sizeof(Elf_Phdr)) FATAL("Invalid e_phentsize");
-  if (hdr->e_shentsize != sizeof(Elf_Shdr)) FATAL("Invalid e_shentsize");
-*/
-
-}
-
-static void lib_read_text_section(lib_details_t *lib_details, Elf_Ehdr *hdr) {
-
-  Elf_Shdr *shdr;
-  Elf_Shdr *shstrtab;
-  char *    shstr;
-  char *    section_name;
-  Elf_Shdr *curr;
-  char      text_name[] = ".text";
-
-  shdr = (Elf_Shdr *)((char *)hdr + hdr->e_shoff);
-  shstrtab = &shdr[hdr->e_shstrndx];
-  shstr = (char *)hdr + shstrtab->sh_offset;
-
-  OKF("shdr: %p", shdr);
-  OKF("shstrtab: %p", shstrtab);
-  OKF("shstr: %p", shstr);
-
-  for (size_t i = 0; i < hdr->e_shnum; i++) {
-
-    curr = &shdr[i];
-
-    if (curr->sh_name == 0) continue;
-
-    section_name = &shstr[curr->sh_name];
-    OKF("Section: %2lu - base: 0x%016lX size: 0x%016lX %s", i, curr->sh_addr,
-        curr->sh_size, section_name);
-    if (memcmp(section_name, text_name, sizeof(text_name)) == 0 &&
-        text_base == 0) {
-
-      text_base = lib_details->base_address + curr->sh_addr;
-      text_limit = lib_details->base_address + curr->sh_addr + curr->sh_size;
-      OKF("> text_addr: 0x%016lX", text_base);
-      OKF("> text_limit: 0x%016lX", text_limit);
-
-    }
-
-  }
-
-}
-
-static void lib_get_text_section(lib_details_t *details) {
-
-  int       fd = -1;
-  off_t     len;
-  Elf_Ehdr *hdr;
-
-  fd = open(details->path, O_RDONLY);
-  if (fd < 0) { FATAL("Failed to open %s", details->path); }
-
-  len = lseek(fd, 0, SEEK_END);
-
-  if (len == (off_t)-1) { FATAL("Failed to lseek %s", details->path); }
-
-  OKF("len: %ld", len);
-
-  hdr = (Elf_Ehdr *)mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0);
-  if (hdr == MAP_FAILED) { FATAL("Failed to map %s", details->path); }
-
-  lib_validate_hdr(hdr);
-  lib_read_text_section(details, hdr);
-
-  munmap(hdr, len);
-  close(fd);
-
-}
-
-void lib_init(void) {
-
-  lib_details_t lib_details;
-  gum_process_enumerate_modules(lib_find_exe, &lib_details);
-  OKF("Executable: 0x%016lx - %s", lib_details.base_address, lib_details.path);
-  lib_get_text_section(&lib_details);
-
-}
-
-guint64 lib_get_text_base(void) {
-
-  if (text_base == 0) FATAL("Lib not initialized");
-  return text_base;
-
-}
-
-guint64 lib_get_text_limit(void) {
-
-  if (text_limit == 0) FATAL("Lib not initialized");
-  return text_limit;
-
-}
-
diff --git a/frida_mode/src/lib/lib b/frida_mode/src/lib/lib
new file mode 100755
index 00000000..8f09a3b1
Binary files /dev/null and b/frida_mode/src/lib/lib differ
diff --git a/frida_mode/src/lib/lib.c b/frida_mode/src/lib/lib.c
new file mode 100644
index 00000000..c5045533
--- /dev/null
+++ b/frida_mode/src/lib/lib.c
@@ -0,0 +1,176 @@
+#ifndef __APPLE__
+  #include <elf.h>
+  #include <fcntl.h>
+  #include <limits.h>
+  #include <stdio.h>
+  #include <sys/mman.h>
+  #include <unistd.h>
+
+  #include "frida-gum.h"
+
+  #include "debug.h"
+
+  #include "lib.h"
+
+  #if defined(__arm__) || defined(__i386__)
+    #define ELFCLASS ELFCLASS32
+typedef Elf32_Ehdr Elf_Ehdr;
+typedef Elf32_Phdr Elf_Phdr;
+typedef Elf32_Shdr Elf_Shdr;
+typedef Elf32_Addr Elf_Addr;
+  #elif defined(__aarch64__) || defined(__x86_64__)
+    #define ELFCLASS ELFCLASS64
+typedef Elf64_Ehdr Elf_Ehdr;
+typedef Elf64_Phdr Elf_Phdr;
+typedef Elf64_Shdr Elf_Shdr;
+typedef Elf64_Addr Elf_Addr;
+  #else
+    #error "Unsupported platform"
+  #endif
+
+typedef struct {
+
+  gchar      name[PATH_MAX + 1];
+  gchar      path[PATH_MAX + 1];
+  GumAddress base_address;
+  gsize      size;
+
+} lib_details_t;
+
+static guint64 text_base = 0;
+static guint64 text_limit = 0;
+
+static gboolean lib_find_exe(const GumModuleDetails *details,
+                             gpointer                user_data) {
+
+  lib_details_t *lib_details = (lib_details_t *)user_data;
+
+  memcpy(lib_details->name, details->name, PATH_MAX);
+  memcpy(lib_details->path, details->path, PATH_MAX);
+  lib_details->base_address = details->range->base_address;
+  lib_details->size = details->range->size;
+  return FALSE;
+
+}
+
+static void lib_validate_hdr(Elf_Ehdr *hdr) {
+
+  if (hdr->e_ident[0] != ELFMAG0) FATAL("Invalid e_ident[0]");
+  if (hdr->e_ident[1] != ELFMAG1) FATAL("Invalid e_ident[1]");
+  if (hdr->e_ident[2] != ELFMAG2) FATAL("Invalid e_ident[2]");
+  if (hdr->e_ident[3] != ELFMAG3) FATAL("Invalid e_ident[3]");
+  if (hdr->e_ident[4] != ELFCLASS) FATAL("Invalid class");
+
+}
+
+static void lib_read_text_section(lib_details_t *lib_details, Elf_Ehdr *hdr) {
+
+  Elf_Phdr *phdr;
+  gboolean  found_preferred_base = FALSE;
+  Elf_Addr  preferred_base;
+  Elf_Shdr *shdr;
+  Elf_Shdr *shstrtab;
+  char *    shstr;
+  char *    section_name;
+  Elf_Shdr *curr;
+  char      text_name[] = ".text";
+
+  phdr = (Elf_Phdr *)((char *)hdr + hdr->e_phoff);
+  for (size_t i = 0; i < hdr->e_phnum; i++) {
+
+    if (phdr[i].p_type == PT_LOAD) {
+
+      preferred_base = phdr[i].p_vaddr;
+      found_preferred_base = TRUE;
+      break;
+
+    }
+
+  }
+
+  if (!found_preferred_base) { FATAL("Failed to find preferred load address"); }
+
+  OKF("Image preferred load address 0x%016lx", preferred_base);
+
+  shdr = (Elf_Shdr *)((char *)hdr + hdr->e_shoff);
+  shstrtab = &shdr[hdr->e_shstrndx];
+  shstr = (char *)hdr + shstrtab->sh_offset;
+
+  OKF("shdr: %p", shdr);
+  OKF("shstrtab: %p", shstrtab);
+  OKF("shstr: %p", shstr);
+
+  for (size_t i = 0; i < hdr->e_shnum; i++) {
+
+    curr = &shdr[i];
+
+    if (curr->sh_name == 0) continue;
+
+    section_name = &shstr[curr->sh_name];
+    OKF("Section: %2lu - base: 0x%016lX size: 0x%016lX %s", i, curr->sh_addr,
+        curr->sh_size, section_name);
+    if (memcmp(section_name, text_name, sizeof(text_name)) == 0 &&
+        text_base == 0) {
+
+      text_base = lib_details->base_address + curr->sh_addr - preferred_base;
+      text_limit = text_base + curr->sh_size;
+      OKF("> text_addr: 0x%016lX", text_base);
+      OKF("> text_limit: 0x%016lX", text_limit);
+
+    }
+
+  }
+
+}
+
+static void lib_get_text_section(lib_details_t *details) {
+
+  int       fd = -1;
+  off_t     len;
+  Elf_Ehdr *hdr;
+
+  fd = open(details->path, O_RDONLY);
+  if (fd < 0) { FATAL("Failed to open %s", details->path); }
+
+  len = lseek(fd, 0, SEEK_END);
+
+  if (len == (off_t)-1) { FATAL("Failed to lseek %s", details->path); }
+
+  OKF("len: %ld", len);
+
+  hdr = (Elf_Ehdr *)mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0);
+  if (hdr == MAP_FAILED) { FATAL("Failed to map %s", details->path); }
+
+  lib_validate_hdr(hdr);
+  lib_read_text_section(details, hdr);
+
+  munmap(hdr, len);
+  close(fd);
+
+}
+
+void lib_init(void) {
+
+  lib_details_t lib_details;
+  gum_process_enumerate_modules(lib_find_exe, &lib_details);
+  OKF("Executable: 0x%016lx - %s", lib_details.base_address, lib_details.path);
+  lib_get_text_section(&lib_details);
+
+}
+
+guint64 lib_get_text_base(void) {
+
+  if (text_base == 0) FATAL("Lib not initialized");
+  return text_base;
+
+}
+
+guint64 lib_get_text_limit(void) {
+
+  if (text_limit == 0) FATAL("Lib not initialized");
+  return text_limit;
+
+}
+
+#endif
+
diff --git a/frida_mode/src/lib/lib_apple.c b/frida_mode/src/lib/lib_apple.c
new file mode 100644
index 00000000..8f863861
--- /dev/null
+++ b/frida_mode/src/lib/lib_apple.c
@@ -0,0 +1,82 @@
+#ifdef __APPLE__
+  #include "frida-gum.h"
+
+  #include "debug.h"
+
+  #include "lib.h"
+  #include "util.h"
+
+extern mach_port_t mach_task_self();
+extern void        gum_darwin_enumerate_modules(mach_port_t        task,
+                                                GumFoundModuleFunc func,
+                                                gpointer           user_data);
+
+static guint64 text_base = 0;
+static guint64 text_limit = 0;
+
+static gboolean lib_get_main_module(const GumModuleDetails *details,
+                                    gpointer                user_data) {
+
+  GumDarwinModule **ret = (GumDarwinModule **)user_data;
+  GumDarwinModule * module = gum_darwin_module_new_from_memory(
+      details->path, mach_task_self(), details->range->base_address,
+      GUM_DARWIN_MODULE_FLAGS_NONE, NULL);
+
+  OKF("Found main module: %s", module->name);
+
+  *ret = module;
+
+  return FALSE;
+
+}
+
+gboolean lib_get_text_section(const GumDarwinSectionDetails *details,
+                              gpointer                       user_data) {
+
+  UNUSED_PARAMETER(user_data);
+  static size_t idx = 0;
+  char          text_name[] = "__text";
+
+  OKF("Section: %2lu - base: 0x%016" G_GINT64_MODIFIER
+      "X size: 0x%016" G_GINT64_MODIFIER "X %s",
+      idx++, details->vm_address, details->vm_address + details->size,
+      details->section_name);
+
+  if (memcmp(details->section_name, text_name, sizeof(text_name)) == 0 &&
+      text_base == 0) {
+
+    text_base = details->vm_address;
+    text_limit = details->vm_address + details->size;
+    OKF("> text_addr: 0x%016" G_GINT64_MODIFIER "X", text_base);
+    OKF("> text_limit: 0x%016" G_GINT64_MODIFIER "X", text_limit);
+
+  }
+
+  return TRUE;
+
+}
+
+void lib_init(void) {
+
+  GumDarwinModule *module = NULL;
+  gum_darwin_enumerate_modules(mach_task_self(), lib_get_main_module, &module);
+  gum_darwin_module_enumerate_sections(module, lib_get_text_section, NULL);
+
+}
+
+guint64 lib_get_text_base(void) {
+
+  if (text_base == 0) FATAL("Lib not initialized");
+  return text_base;
+
+}
+
+guint64 lib_get_text_limit(void) {
+
+  if (text_limit == 0) FATAL("Lib not initialized");
+  return text_limit;
+
+}
+
+#endif
+
diff --git a/frida_mode/src/main.c b/frida_mode/src/main.c
index 11cf041c..5c64d192 100644
--- a/frida_mode/src/main.c
+++ b/frida_mode/src/main.c
@@ -49,6 +49,10 @@ static int on_fork(void) {
 #ifdef __APPLE__
 static void on_main_os(int argc, char **argv, char **envp) {
 
+  UNUSED_PARAMETER(argc);
+  UNUSED_PARAMETER(argv);
+  UNUSED_PARAMETER(envp);
+
 }
 
 #else
diff --git a/frida_mode/src/persistent/persistent.c b/frida_mode/src/persistent/persistent.c
index 5aad3724..918ff153 100644
--- a/frida_mode/src/persistent/persistent.c
+++ b/frida_mode/src/persistent/persistent.c
@@ -33,9 +33,9 @@ void persistent_init(void) {
   if (persistent_start != 0 && !persistent_is_supported())
     FATAL("Persistent mode not supported on this architecture");
 
-  OKF("Instrumentation - persistent mode [%c] (0x%016lX)",
+  OKF("Instrumentation - persistent mode [%c] (0x%016" G_GINT64_MODIFIER "X)",
       persistent_start == 0 ? ' ' : 'X', persistent_start);
-  OKF("Instrumentation - persistent count [%c] (%ld)",
+  OKF("Instrumentation - persistent count [%c] (%" G_GINT64_MODIFIER "d)",
       persistent_start == 0 ? ' ' : 'X', persistent_count);
   OKF("Instrumentation - hook [%s]", hook_name);
 
diff --git a/frida_mode/src/persistent/persistent_arm32.c b/frida_mode/src/persistent/persistent_arm32.c
index 10dab3b2..bc021ff3 100644
--- a/frida_mode/src/persistent/persistent_arm32.c
+++ b/frida_mode/src/persistent/persistent_arm32.c
@@ -3,6 +3,7 @@
 #include "debug.h"
 
 #include "persistent.h"
+#include "util.h"
 
 #if defined(__arm__)
 
@@ -62,6 +63,7 @@ gboolean persistent_is_supported(void) {
 
 void persistent_prologue(GumStalkerOutput *output) {
 
+  UNUSED_PARAMETER(output);
   FATAL("Persistent mode not supported on this architecture");
 
 }
diff --git a/frida_mode/src/persistent/persistent_arm64.c b/frida_mode/src/persistent/persistent_arm64.c
index 5a18ac2c..c198da69 100644
--- a/frida_mode/src/persistent/persistent_arm64.c
+++ b/frida_mode/src/persistent/persistent_arm64.c
@@ -4,6 +4,7 @@
 #include "debug.h"
 
 #include "instrument.h"
+#include "util.h"
 
 #if defined(__aarch64__)
 
@@ -105,6 +106,7 @@ gboolean persistent_is_supported(void) {
 
 void persistent_prologue(GumStalkerOutput *output) {
 
+  UNUSED_PARAMETER(output);
   FATAL("Persistent mode not supported on this architecture");
 
 }
diff --git a/frida_mode/src/persistent/persistent_x86.c b/frida_mode/src/persistent/persistent_x86.c
index 4daa61a9..9d39c4e9 100644
--- a/frida_mode/src/persistent/persistent_x86.c
+++ b/frida_mode/src/persistent/persistent_x86.c
@@ -3,6 +3,7 @@
 #include "debug.h"
 
 #include "persistent.h"
+#include "util.h"
 
 #if defined(__i386__)
 
@@ -45,6 +46,7 @@ gboolean persistent_is_supported(void) {
 
 void persistent_prologue(GumStalkerOutput *output) {
 
+  UNUSED_PARAMETER(output);
   FATAL("Persistent mode not supported on this architecture");
 
 }
diff --git a/frida_mode/test/exe/GNUmakefile b/frida_mode/test/exe/GNUmakefile
new file mode 100644
index 00000000..7719ad2b
--- /dev/null
+++ b/frida_mode/test/exe/GNUmakefile
@@ -0,0 +1,50 @@
+PWD:=$(shell pwd)/
+ROOT:=$(shell realpath $(PWD)../../..)/
+BUILD_DIR:=$(PWD)build/
+TESTINSTR_DATA_DIR:=$(BUILD_DIR)in/
+TESTINSTR_DATA_FILE:=$(TESTINSTR_DATA_DIR)in
+
+TESTINSTBIN:=$(BUILD_DIR)testinstr
+TESTINSTSRC:=$(PWD)testinstr.c
+
+QEMU_OUT:=$(BUILD_DIR)qemu-out
+FRIDA_OUT:=$(BUILD_DIR)frida-out
+
+.PHONY: all clean qemu frida
+
+all: $(TESTINSTBIN)
+	make -C $(ROOT)frida_mode/
+
+$(BUILD_DIR):
+	mkdir -p $@
+
+$(TESTINSTR_DATA_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(TESTINSTR_DATA_FILE): | $(TESTINSTR_DATA_DIR)
+	echo -n "000" > $@
+
+$(TESTINSTBIN): $(TESTINSTSRC) | $(BUILD_DIR)
+	$(CC) -o $@ $< -no-pie
+
+clean:
+	rm -rf $(BUILD_DIR)
+
+
+qemu: $(TESTINSTBIN) $(TESTINSTR_DATA_FILE)
+	$(ROOT)afl-fuzz \
+		-D \
+		-Q \
+		-i $(TESTINSTR_DATA_DIR) \
+		-o $(QEMU_OUT) \
+		-- \
+			$(TESTINSTBIN) @@
+
+frida: $(FRIDA_TRACE) $(TESTINSTBIN) $(TESTINSTR_DATA_FILE)
+	$(ROOT)afl-fuzz \
+		-D \
+		-O \
+		-i $(TESTINSTR_DATA_DIR) \
+		-o $(FRIDA_OUT) \
+		-- \
+			$(TESTINSTBIN) @@
\ No newline at end of file
diff --git a/frida_mode/test/exe/Makefile b/frida_mode/test/exe/Makefile
new file mode 100644
index 00000000..f322d1f5
--- /dev/null
+++ b/frida_mode/test/exe/Makefile
@@ -0,0 +1,12 @@
+all:
+	@echo trying to use GNU make...
+	@gmake all || echo please install GNUmake
+
+clean:
+	@gmake clean
+
+qemu:
+	@gmake qemu
+
+frida:
+	@gmake frida
\ No newline at end of file
diff --git a/frida_mode/test/exe/testinstr.c b/frida_mode/test/exe/testinstr.c
new file mode 100644
index 00000000..5e26fc46
--- /dev/null
+++ b/frida_mode/test/exe/testinstr.c
@@ -0,0 +1,112 @@
+/*
+   american fuzzy lop++ - a trivial program to test the build
+   --------------------------------------------------------
+   Originally written by Michal Zalewski
+   Copyright 2014 Google Inc. All rights reserved.
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+     http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifdef __APPLE__
+  #define TESTINSTR_SECTION
+#else
+  #define TESTINSTR_SECTION __attribute__((section(".testinstr")))
+#endif
+
+void testinstr(char *buf, int len) {
+
+  if (len < 1) return;
+  buf[len] = 0;
+
+  // we support three input cases
+  if (buf[0] == '0')
+    printf("Looks like a zero to me!\n");
+  else if (buf[0] == '1')
+    printf("Pretty sure that is a one!\n");
+  else
+    printf("Neither one or zero? How quaint!\n");
+
+}
+
+TESTINSTR_SECTION int main(int argc, char **argv) {
+
+  char * file;
+  int    fd = -1;
+  off_t  len;
+  char * buf = NULL;
+  size_t n_read;
+  int    result = -1;
+
+  if (argc != 2) { return 1; }
+
+  do {
+
+    file = argv[1];
+
+    dprintf(STDERR_FILENO, "Running: %s\n", file);
+
+    fd = open(file, O_RDONLY);
+    if (fd < 0) {
+
+      perror("open");
+      break;
+
+    }
+
+    len = lseek(fd, 0, SEEK_END);
+    if (len < 0) {
+
+      perror("lseek (SEEK_END)");
+      break;
+
+    }
+
+    if (lseek(fd, 0, SEEK_SET) != 0) {
+
+      perror("lseek (SEEK_SET)");
+      break;
+
+    }
+
+    buf = malloc(len);
+    if (buf == NULL) {
+
+      perror("malloc");
+      break;
+
+    }
+
+    n_read = read(fd, buf, len);
+    if (n_read != len) {
+
+      perror("read");
+      break;
+
+    }
+
+    dprintf(STDERR_FILENO, "Running:    %s: (%zd bytes)\n", file, n_read);
+
+    testinstr(buf, len);
+    dprintf(STDERR_FILENO, "Done:    %s: (%zd bytes)\n", file, n_read);
+
+    result = 0;
+
+  } while (false);
+
+  if (buf != NULL) { free(buf); }
+
+  if (fd != -1) { close(fd); }
+
+  return result;
+
+}
+
diff --git a/frida_mode/test/png/GNUmakefile b/frida_mode/test/png/GNUmakefile
index 7de3e85a..515728c4 100644
--- a/frida_mode/test/png/GNUmakefile
+++ b/frida_mode/test/png/GNUmakefile
@@ -21,6 +21,9 @@ PNGTEST_OBJ:=$(PNGTEST_BUILD_DIR)target.o
 PNGTEST_URL:="https://raw.githubusercontent.com/google/fuzzbench/master/benchmarks/libpng-1.2.56/target.cc"
 
 TEST_BIN:=$(BUILD_DIR)test
+ifeq "$(shell uname)" "Darwin"
+TEST_BIN_LDFLAGS:=-undefined dynamic_lookup
+endif
 
 TEST_DATA_DIR:=$(LIBPNG_DIR)contrib/pngsuite/
 
@@ -80,6 +83,7 @@ $(TEST_BIN): $(HARNESS_OBJ) $(PNGTEST_OBJ) $(LIBPNG_LIB)
 		-o $@ \
 		$(HARNESS_OBJ) $(PNGTEST_OBJ) $(LIBPNG_LIB) \
 		-lz \
+		$(TEST_BIN_LDFLAGS) \
 
 clean:
 	rm -rf $(BUILD_DIR)
-- 
cgit 1.4.1


From c6e8314446344d3a65b828feb31f627ce11ba352 Mon Sep 17 00:00:00 2001
From: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>
Date: Fri, 30 Apr 2021 22:42:50 +0100
Subject: Support for AFL_ENTRYPOINT (#898)

Co-authored-by: Your Name <you@example.com>
---
 frida_mode/GNUmakefile                          |   2 +-
 frida_mode/include/entry.h                      |  15 +++
 frida_mode/include/stalker.h                    |   2 -
 frida_mode/src/entry.c                          |  50 ++++++++++
 frida_mode/src/instrument/instrument.c          |   2 +
 frida_mode/src/main.c                           |  12 +--
 frida_mode/src/persistent/persistent_x64.c      |  11 ++-
 frida_mode/src/stalker.c                        |  19 ----
 frida_mode/test/entry_point/GNUmakefile         |  61 ++++++++++++
 frida_mode/test/entry_point/Makefile            |  12 +++
 frida_mode/test/entry_point/testinstr.c         | 119 ++++++++++++++++++++++++
 frida_mode/test/fuzzbench/fuzzer                | Bin 0 -> 1703936 bytes
 frida_mode/test/libxml/xml                      | Bin 0 -> 1849872 bytes
 frida_mode/test/png/persistent/GNUmakefile      |  27 +++++-
 frida_mode/test/png/persistent/Makefile         |   8 +-
 frida_mode/test/png/persistent/hook/GNUmakefile |  30 +++++-
 frida_mode/test/png/persistent/hook/Makefile    |   8 +-
 17 files changed, 341 insertions(+), 37 deletions(-)
 create mode 100644 frida_mode/include/entry.h
 create mode 100644 frida_mode/src/entry.c
 create mode 100644 frida_mode/test/entry_point/GNUmakefile
 create mode 100644 frida_mode/test/entry_point/Makefile
 create mode 100644 frida_mode/test/entry_point/testinstr.c
 create mode 100755 frida_mode/test/fuzzbench/fuzzer
 create mode 100755 frida_mode/test/libxml/xml

(limited to 'frida_mode/src/main.c')

diff --git a/frida_mode/GNUmakefile b/frida_mode/GNUmakefile
index 8199b337..7284cf86 100644
--- a/frida_mode/GNUmakefile
+++ b/frida_mode/GNUmakefile
@@ -137,7 +137,7 @@ $(AFL_COMPILER_RT_OBJ): $(AFL_COMPILER_RT_SRC)
 ############################# SOURCE ###########################################
 
 define BUILD_SOURCE
-$(2): $(1) GNUmakefile | $(OBJ_DIR)
+$(2): $(1) $(INCLUDES) GNUmakefile | $(OBJ_DIR)
 	$(CC) \
 		$(CFLAGS) \
 		-I $(ROOT)include \
diff --git a/frida_mode/include/entry.h b/frida_mode/include/entry.h
new file mode 100644
index 00000000..967831af
--- /dev/null
+++ b/frida_mode/include/entry.h
@@ -0,0 +1,15 @@
+#ifndef _ENTRY_H
+#define _ENTRY_H
+
+#include "frida-gum.h"
+
+extern guint64 entry_start;
+
+void entry_init(void);
+
+void entry_run(void);
+
+void entry_prologue(GumStalkerIterator *iterator, GumStalkerOutput *output);
+
+#endif
+
diff --git a/frida_mode/include/stalker.h b/frida_mode/include/stalker.h
index 1f1abb6b..186ead11 100644
--- a/frida_mode/include/stalker.h
+++ b/frida_mode/include/stalker.h
@@ -6,8 +6,6 @@
 void        stalker_init(void);
 GumStalker *stalker_get(void);
 void        stalker_start(void);
-void        stalker_pause(void);
-void        stalker_resume(void);
 
 #endif
 
diff --git a/frida_mode/src/entry.c b/frida_mode/src/entry.c
new file mode 100644
index 00000000..e71386a0
--- /dev/null
+++ b/frida_mode/src/entry.c
@@ -0,0 +1,50 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "entry.h"
+#include "instrument.h"
+#include "stalker.h"
+#include "util.h"
+
+extern void __afl_manual_init();
+
+guint64 entry_start = 0;
+
+static void entry_launch(void) {
+
+  __afl_manual_init();
+
+  /* Child here */
+  previous_pc = 0;
+
+}
+
+void entry_init(void) {
+
+  entry_start = util_read_address("AFL_ENTRYPOINT");
+  OKF("entry_point: 0x%016" G_GINT64_MODIFIER "X", entry_start);
+
+}
+
+void entry_run(void) {
+
+  if (entry_start == 0) { entry_launch(); }
+
+}
+
+static void entry_callout(GumCpuContext *cpu_context, gpointer user_data) {
+
+  UNUSED_PARAMETER(cpu_context);
+  UNUSED_PARAMETER(user_data);
+  entry_launch();
+
+}
+
+void entry_prologue(GumStalkerIterator *iterator, GumStalkerOutput *output) {
+
+  UNUSED_PARAMETER(output);
+  gum_stalker_iterator_put_callout(iterator, entry_callout, NULL, NULL);
+
+}
+
diff --git a/frida_mode/src/instrument/instrument.c b/frida_mode/src/instrument/instrument.c
index d93f37c7..971f80c0 100644
--- a/frida_mode/src/instrument/instrument.c
+++ b/frida_mode/src/instrument/instrument.c
@@ -5,6 +5,7 @@
 #include "config.h"
 #include "debug.h"
 
+#include "entry.h"
 #include "frida_cmplog.h"
 #include "instrument.h"
 #include "persistent.h"
@@ -79,6 +80,7 @@ static void instr_basic_block(GumStalkerIterator *iterator,
   gboolean       begin = TRUE;
   while (gum_stalker_iterator_next(iterator, &instr)) {
 
+    if (instr->address == entry_start) { entry_prologue(iterator, output); }
     if (instr->address == persistent_start) { persistent_prologue(output); }
 
     if (begin) {
diff --git a/frida_mode/src/main.c b/frida_mode/src/main.c
index 5c64d192..e031dbed 100644
--- a/frida_mode/src/main.c
+++ b/frida_mode/src/main.c
@@ -14,6 +14,7 @@
 #include "config.h"
 #include "debug.h"
 
+#include "entry.h"
 #include "instrument.h"
 #include "interceptor.h"
 #include "lib.h"
@@ -37,8 +38,6 @@ typedef int *(*main_fn_t)(int argc, char **argv, char **envp);
 
 static main_fn_t main_fn = NULL;
 
-extern void __afl_manual_init();
-
 static int on_fork(void) {
 
   prefetch_read();
@@ -79,6 +78,7 @@ static void on_main_os(int argc, char **argv, char **envp) {
 static int *on_main(int argc, char **argv, char **envp) {
 
   void *fork_addr;
+
   on_main_os(argc, argv, envp);
 
   unintercept_self();
@@ -86,6 +86,7 @@ static int *on_main(int argc, char **argv, char **envp) {
   stalker_init();
 
   lib_init();
+  entry_init();
   instrument_init();
   persistent_init();
   prefetch_init();
@@ -95,13 +96,8 @@ static int *on_main(int argc, char **argv, char **envp) {
   intercept(fork_addr, on_fork, NULL);
 
   stalker_start();
-  stalker_pause();
-
-  __afl_manual_init();
+  entry_run();
 
-  /* Child here */
-  previous_pc = 0;
-  stalker_resume();
   return main_fn(argc, argv, envp);
 
 }
diff --git a/frida_mode/src/persistent/persistent_x64.c b/frida_mode/src/persistent/persistent_x64.c
index 5b8493b2..49f1988c 100644
--- a/frida_mode/src/persistent/persistent_x64.c
+++ b/frida_mode/src/persistent/persistent_x64.c
@@ -252,15 +252,20 @@ static void persistent_prologue_hook(GumX86Writer *      cw,
                                         -(GUM_RED_ZONE_SIZE));
 
   gum_x86_writer_put_mov_reg_address(cw, GUM_REG_RCX,
-                                     GUM_ADDRESS(__afl_fuzz_len));
+                                     GUM_ADDRESS(&__afl_fuzz_len));
+  gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RCX, GUM_REG_RCX, 0);
   gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RCX, GUM_REG_RCX, 0);
   gum_x86_writer_put_mov_reg_u64(cw, GUM_REG_RDI, 0xffffffff);
   gum_x86_writer_put_and_reg_reg(cw, GUM_REG_RCX, GUM_REG_RDI);
 
+  gum_x86_writer_put_mov_reg_address(cw, GUM_REG_RDX,
+                                     GUM_ADDRESS(&__afl_fuzz_ptr));
+  gum_x86_writer_put_mov_reg_reg_offset_ptr(cw, GUM_REG_RDX, GUM_REG_RDX, 0);
+
   gum_x86_writer_put_call_address_with_arguments(
       cw, GUM_CALL_CAPI, GUM_ADDRESS(hook), 4, GUM_ARG_ADDRESS,
-      GUM_ADDRESS(regs), GUM_ARG_ADDRESS, GUM_ADDRESS(0), GUM_ARG_ADDRESS,
-      GUM_ADDRESS(__afl_fuzz_ptr), GUM_ARG_REGISTER, GUM_REG_RCX);
+      GUM_ADDRESS(regs), GUM_ARG_ADDRESS, GUM_ADDRESS(0), GUM_ARG_REGISTER,
+      GUM_REG_RDX, GUM_ARG_REGISTER, GUM_REG_RCX);
 
   gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
                                         (GUM_RED_ZONE_SIZE));
diff --git a/frida_mode/src/stalker.c b/frida_mode/src/stalker.c
index 5ee519ba..81973e9c 100644
--- a/frida_mode/src/stalker.c
+++ b/frida_mode/src/stalker.c
@@ -21,12 +21,6 @@ GumStalker *stalker_get(void) {
 
 }
 
-__attribute__((noinline)) static void stalker_activation(void) {
-
-  asm volatile("");
-
-}
-
 void stalker_start(void) {
 
   GumStalkerTransformer *transformer = instrument_get_transformer();
@@ -34,16 +28,3 @@ void stalker_start(void) {
 
 }
 
-void stalker_pause(void) {
-
-  gum_stalker_deactivate(stalker);
-
-}
-
-void stalker_resume(void) {
-
-  gum_stalker_activate(stalker, stalker_activation);
-  stalker_activation();
-
-}
-
diff --git a/frida_mode/test/entry_point/GNUmakefile b/frida_mode/test/entry_point/GNUmakefile
new file mode 100644
index 00000000..891827eb
--- /dev/null
+++ b/frida_mode/test/entry_point/GNUmakefile
@@ -0,0 +1,61 @@
+PWD:=$(shell pwd)/
+ROOT:=$(shell realpath $(PWD)../../..)/
+BUILD_DIR:=$(PWD)build/
+TESTINSTR_DATA_DIR:=$(BUILD_DIR)in/
+TESTINSTR_DATA_FILE:=$(TESTINSTR_DATA_DIR)in
+
+TESTINSTBIN:=$(BUILD_DIR)testinstr
+TESTINSTSRC:=$(PWD)testinstr.c
+
+QEMU_OUT:=$(BUILD_DIR)qemu-out
+FRIDA_OUT:=$(BUILD_DIR)frida-out
+
+GET_SYMBOL_ADDR:=$(ROOT)frida_mode/test/png/persistent/get_symbol_addr.py
+
+ARCH=$(shell uname -m)
+ifeq "$(ARCH)" "aarch64"
+ AFL_ENTRYPOINT=$(shell $(GET_SYMBOL_ADDR) -f $(TESTINSTBIN) -s run -b 0x0000aaaaaaaaa000)
+endif
+
+ifeq "$(ARCH)" "x86_64"
+ AFL_ENTRYPOINT=$(shell $(GET_SYMBOL_ADDR) -f $(TESTINSTBIN) -s run -b 0x0000555555554000)
+endif
+
+.PHONY: all clean qemu frida
+
+all: $(TESTINSTBIN)
+	make -C $(ROOT)frida_mode/
+
+$(BUILD_DIR):
+	mkdir -p $@
+
+$(TESTINSTR_DATA_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(TESTINSTR_DATA_FILE): | $(TESTINSTR_DATA_DIR)
+	echo -n "000" > $@
+
+$(TESTINSTBIN): $(TESTINSTSRC) | $(BUILD_DIR)
+	$(CC) -o $@ $<
+
+clean:
+	rm -rf $(BUILD_DIR)
+
+frida: $(TESTINSTBIN) $(TESTINSTR_DATA_FILE)
+	$(ROOT)afl-fuzz \
+		-D \
+		-O \
+		-i $(TESTINSTR_DATA_DIR) \
+		-o $(FRIDA_OUT) \
+		-- \
+			$(TESTINSTBIN) @@
+
+frida_entry: $(TESTINSTBIN) $(TESTINSTR_DATA_FILE)
+	AFL_ENTRYPOINT=$(AFL_ENTRYPOINT) \
+	$(ROOT)afl-fuzz \
+		-D \
+		-O \
+		-i $(TESTINSTR_DATA_DIR) \
+		-o $(FRIDA_OUT) \
+		-- \
+			$(TESTINSTBIN) @@
\ No newline at end of file
diff --git a/frida_mode/test/entry_point/Makefile b/frida_mode/test/entry_point/Makefile
new file mode 100644
index 00000000..3b41b94e
--- /dev/null
+++ b/frida_mode/test/entry_point/Makefile
@@ -0,0 +1,12 @@
+all:
+	@echo trying to use GNU make...
+	@gmake all || echo please install GNUmake
+
+clean:
+	@gmake clean
+
+frida:
+	@gmake frida
+
+frida_entry:
+	@gmake frida
\ No newline at end of file
diff --git a/frida_mode/test/entry_point/testinstr.c b/frida_mode/test/entry_point/testinstr.c
new file mode 100644
index 00000000..a6c655f9
--- /dev/null
+++ b/frida_mode/test/entry_point/testinstr.c
@@ -0,0 +1,119 @@
+/*
+   american fuzzy lop++ - a trivial program to test the build
+   --------------------------------------------------------
+   Originally written by Michal Zalewski
+   Copyright 2014 Google Inc. All rights reserved.
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+     http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifdef __APPLE__
+  #define TESTINSTR_SECTION
+#else
+  #define TESTINSTR_SECTION __attribute__((section(".testinstr")))
+#endif
+
+void testinstr(char *buf, int len) {
+
+  if (len < 1) return;
+  buf[len] = 0;
+
+  // we support three input cases
+  if (buf[0] == '0')
+    printf("Looks like a zero to me!\n");
+  else if (buf[0] == '1')
+    printf("Pretty sure that is a one!\n");
+  else
+    printf("Neither one or zero? How quaint!\n");
+
+}
+
+int run(char *file) {
+
+  int    fd = -1;
+  off_t  len;
+  char * buf = NULL;
+  size_t n_read;
+  int    result = -1;
+
+  do {
+
+    dprintf(STDERR_FILENO, "Running: %s\n", file);
+
+    fd = open(file, O_RDONLY);
+    if (fd < 0) {
+
+      perror("open");
+      break;
+
+    }
+
+    len = lseek(fd, 0, SEEK_END);
+    if (len < 0) {
+
+      perror("lseek (SEEK_END)");
+      break;
+
+    }
+
+    if (lseek(fd, 0, SEEK_SET) != 0) {
+
+      perror("lseek (SEEK_SET)");
+      break;
+
+    }
+
+    buf = malloc(len);
+    if (buf == NULL) {
+
+      perror("malloc");
+      break;
+
+    }
+
+    n_read = read(fd, buf, len);
+    if (n_read != len) {
+
+      perror("read");
+      break;
+
+    }
+
+    dprintf(STDERR_FILENO, "Running:    %s: (%zd bytes)\n", file, n_read);
+
+    testinstr(buf, len);
+    dprintf(STDERR_FILENO, "Done:    %s: (%zd bytes)\n", file, n_read);
+
+    result = 0;
+
+  } while (false);
+
+  if (buf != NULL) { free(buf); }
+
+  if (fd != -1) { close(fd); }
+
+  return result;
+
+}
+
+void slow() {
+  usleep(100000);
+}
+
+int main(int argc, char **argv) {
+
+  if (argc != 2) { return 1; }
+  slow();
+  return run(argv[1]);
+
+}
+
diff --git a/frida_mode/test/fuzzbench/fuzzer b/frida_mode/test/fuzzbench/fuzzer
new file mode 100755
index 00000000..5e8b7f70
Binary files /dev/null and b/frida_mode/test/fuzzbench/fuzzer differ
diff --git a/frida_mode/test/libxml/xml b/frida_mode/test/libxml/xml
new file mode 100755
index 00000000..fb5c7c76
Binary files /dev/null and b/frida_mode/test/libxml/xml differ
diff --git a/frida_mode/test/png/persistent/GNUmakefile b/frida_mode/test/png/persistent/GNUmakefile
index 25ddc782..531f9bce 100644
--- a/frida_mode/test/png/persistent/GNUmakefile
+++ b/frida_mode/test/png/persistent/GNUmakefile
@@ -19,7 +19,7 @@ ifeq "$(ARCH)" "x86_64"
  AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TEST_BIN) -s main -b 0x0000555555554000)
 endif
 
-.PHONY: all clean qemu frida
+.PHONY: all clean qemu qemu_entry frida frida_entry
 
 all:
 	make -C $(ROOT)frida_mode/test/png/
@@ -39,6 +39,19 @@ qemu: | $(BUILD_DIR)
 		-- \
 			$(TEST_BIN) @@
 
+qemu_entry: | $(BUILD_DIR)
+	AFL_QEMU_PERSISTENT_ADDR=$(AFL_QEMU_PERSISTENT_ADDR) \
+	AFL_QEMU_PERSISTENT_GPR=1 \
+	AFL_ENTRYPOINT=$(AFL_QEMU_PERSISTENT_ADDR) \
+	$(ROOT)afl-fuzz \
+		-D \
+		-V 30 \
+		-Q \
+		-i $(TEST_DATA_DIR) \
+		-o $(QEMU_OUT) \
+		-- \
+			$(TEST_BIN) @@
+
 frida: | $(BUILD_DIR)
 	AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
 	$(ROOT)afl-fuzz \
@@ -50,5 +63,17 @@ frida: | $(BUILD_DIR)
 		-- \
 			$(TEST_BIN) @@
 
+frida_entry: | $(BUILD_DIR)
+	AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
+	AFL_ENTRYPOINT=$(AFL_FRIDA_PERSISTENT_ADDR) \
+	$(ROOT)afl-fuzz \
+		-D \
+		-V 30 \
+		-O \
+		-i $(TEST_DATA_DIR) \
+		-o $(FRIDA_OUT) \
+		-- \
+			$(TEST_BIN) @@
+
 clean:
 	rm -rf $(BUILD_DIR)
\ No newline at end of file
diff --git a/frida_mode/test/png/persistent/Makefile b/frida_mode/test/png/persistent/Makefile
index f322d1f5..5fde63c2 100644
--- a/frida_mode/test/png/persistent/Makefile
+++ b/frida_mode/test/png/persistent/Makefile
@@ -8,5 +8,11 @@ clean:
 qemu:
 	@gmake qemu
 
+qemu_entry:
+	@gmake qemu_entry
+
 frida:
-	@gmake frida
\ No newline at end of file
+	@gmake frida
+
+frida_entry:
+	@gmake frida_entry
\ No newline at end of file
diff --git a/frida_mode/test/png/persistent/hook/GNUmakefile b/frida_mode/test/png/persistent/hook/GNUmakefile
index 2457287d..4f55fe98 100644
--- a/frida_mode/test/png/persistent/hook/GNUmakefile
+++ b/frida_mode/test/png/persistent/hook/GNUmakefile
@@ -23,7 +23,7 @@ ifeq "$(ARCH)" "x86_64"
  AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)../get_symbol_addr.py -f $(TEST_BIN) -s LLVMFuzzerTestOneInput -b 0x0000555555554000)
 endif
 
-.PHONY: all clean qemu frida
+.PHONY: all clean qemu qemu_entry frida frida_entry
 
 all:
 	make -C $(ROOT)frida_mode/test/png/persistent/
@@ -53,6 +53,20 @@ qemu: $(AFLPP_DRIVER_DUMMY_INPUT) $(AFLPP_DRIVER_HOOK_OBJ) | $(BUILD_DIR)
 		-- \
 			$(TEST_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
 
+qemu_entry: $(AFLPP_DRIVER_DUMMY_INPUT) $(AFLPP_DRIVER_HOOK_OBJ) | $(BUILD_DIR)
+	AFL_QEMU_PERSISTENT_HOOK=$(AFLPP_DRIVER_HOOK_OBJ) \
+	AFL_QEMU_PERSISTENT_ADDR=$(AFL_QEMU_PERSISTENT_ADDR) \
+	AFL_ENTRYPOINT=$(AFL_QEMU_PERSISTENT_ADDR) \
+	AFL_QEMU_PERSISTENT_GPR=1 \
+	$(ROOT)/afl-fuzz \
+		-D \
+		-V 30 \
+		-Q \
+		-i $(TEST_DATA_DIR) \
+		-o $(QEMU_OUT) \
+		-- \
+			$(TEST_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
+
 frida: $(AFLPP_DRIVER_DUMMY_INPUT) $(AFLPP_DRIVER_HOOK_OBJ) | $(BUILD_DIR)
 	AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_DRIVER_HOOK_OBJ) \
 	AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
@@ -65,6 +79,20 @@ frida: $(AFLPP_DRIVER_DUMMY_INPUT) $(AFLPP_DRIVER_HOOK_OBJ) | $(BUILD_DIR)
 		-- \
 			$(TEST_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
 
+
+frida_entry: $(AFLPP_DRIVER_DUMMY_INPUT) $(AFLPP_DRIVER_HOOK_OBJ) | $(BUILD_DIR)
+	AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_DRIVER_HOOK_OBJ) \
+	AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
+	AFL_ENTRYPOINT=$(AFL_FRIDA_PERSISTENT_ADDR) \
+	$(ROOT)afl-fuzz \
+		-D \
+		-V 30 \
+		-O \
+		-i $(TEST_DATA_DIR) \
+		-o $(FRIDA_OUT) \
+		-- \
+			$(TEST_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
+
 clean:
 	rm -rf $(BUILD_DIR)
 
diff --git a/frida_mode/test/png/persistent/hook/Makefile b/frida_mode/test/png/persistent/hook/Makefile
index f322d1f5..5fde63c2 100644
--- a/frida_mode/test/png/persistent/hook/Makefile
+++ b/frida_mode/test/png/persistent/hook/Makefile
@@ -8,5 +8,11 @@ clean:
 qemu:
 	@gmake qemu
 
+qemu_entry:
+	@gmake qemu_entry
+
 frida:
-	@gmake frida
\ No newline at end of file
+	@gmake frida
+
+frida_entry:
+	@gmake frida_entry
\ No newline at end of file
-- 
cgit 1.4.1


From 2ef9ff44682ff1a922536c9be461047f9e47ba25 Mon Sep 17 00:00:00 2001
From: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>
Date: Tue, 18 May 2021 19:27:02 +0100
Subject: Minor integration tweaks (#926)

Co-authored-by: Your Name <you@example.com>
---
 frida_mode/GNUmakefile   |  1 +
 frida_mode/src/main.c    | 37 ++++++++++++++++++++++++-------------
 frida_mode/src/stalker.c |  2 ++
 3 files changed, 27 insertions(+), 13 deletions(-)

(limited to 'frida_mode/src/main.c')

diff --git a/frida_mode/GNUmakefile b/frida_mode/GNUmakefile
index e915f157..bc77a451 100644
--- a/frida_mode/GNUmakefile
+++ b/frida_mode/GNUmakefile
@@ -25,6 +25,7 @@ LDFLAGS+=-shared \
 		 -lpthread \
 		 -lresolv \
 		 -ldl \
+		 -z noexecstack \
 
 ifdef DEBUG
 CFLAGS+=-Werror \
diff --git a/frida_mode/src/main.c b/frida_mode/src/main.c
index e031dbed..21073cbe 100644
--- a/frida_mode/src/main.c
+++ b/frida_mode/src/main.c
@@ -75,16 +75,22 @@ static void on_main_os(int argc, char **argv, char **envp) {
 
 #endif
 
-static int *on_main(int argc, char **argv, char **envp) {
+static void embedded_init() {
 
-  void *fork_addr;
+  static gboolean initialized = false;
+  if (!initialized) {
 
-  on_main_os(argc, argv, envp);
+    gum_init_embedded();
+    initialized = true;
 
-  unintercept_self();
+  }
 
-  stalker_init();
+}
+
+void afl_frida_start() {
 
+  embedded_init();
+  stalker_init();
   lib_init();
   entry_init();
   instrument_init();
@@ -92,12 +98,23 @@ static int *on_main(int argc, char **argv, char **envp) {
   prefetch_init();
   ranges_init();
 
-  fork_addr = GSIZE_TO_POINTER(gum_module_find_export_by_name(NULL, "fork"));
+  void *fork_addr =
+      GSIZE_TO_POINTER(gum_module_find_export_by_name(NULL, "fork"));
   intercept(fork_addr, on_fork, NULL);
 
   stalker_start();
   entry_run();
 
+}
+
+static int *on_main(int argc, char **argv, char **envp) {
+
+  on_main_os(argc, argv, envp);
+
+  unintercept_self();
+
+  afl_frida_start();
+
   return main_fn(argc, argv, envp);
 
 }
@@ -149,13 +166,7 @@ static void intercept_main(void) {
 
 __attribute__((constructor)) static void init(void) {
 
-  gum_init_embedded();
-  if (!gum_stalker_is_supported()) {
-
-    gum_deinit_embedded();
-    FATAL("Failed to initialize embedded");
-
-  }
+  embedded_init();
 
   intercept_main();
 
diff --git a/frida_mode/src/stalker.c b/frida_mode/src/stalker.c
index 81973e9c..63f3c529 100644
--- a/frida_mode/src/stalker.c
+++ b/frida_mode/src/stalker.c
@@ -7,6 +7,8 @@ static GumStalker *stalker = NULL;
 
 void stalker_init(void) {
 
+  if (!gum_stalker_is_supported()) { FATAL("Failed to initialize embedded"); }
+
   stalker = gum_stalker_new();
   if (stalker == NULL) { FATAL("Failed to initialize stalker"); }
 
-- 
cgit 1.4.1


From 14178141dcdc1a81ea4f4461790ec87f60606985 Mon Sep 17 00:00:00 2001
From: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>
Date: Thu, 27 May 2021 09:49:34 +0100
Subject: Frida (#940)

* Added re2 test

* Added libpcap test

* Fix validation of setting of ADDR_NO_RANDOMIZE

* Added support for printing original and instrumented code

Co-authored-by: Your Name <you@example.com>
---
 frida_mode/include/instrument.h                  |    3 +
 frida_mode/include/util.h                        |    2 +-
 frida_mode/src/instrument/instrument.c           |   45 +-
 frida_mode/src/instrument/instrument_debug.c     |  128 +++
 frida_mode/src/main.c                            |    3 +-
 frida_mode/src/ranges.c                          |   67 +-
 frida_mode/test/libpcap/GNUmakefile              |  188 ++++
 frida_mode/test/libpcap/Makefile                 | 1143 ++++++++++++++++++++++
 frida_mode/test/libpcap/aflpp_qemu_driver_hook.c |   97 ++
 frida_mode/test/libpcap/get_symbol_addr.py       |   36 +
 frida_mode/test/re2/GNUmakefile                  |  170 ++++
 frida_mode/test/re2/Makefile                     |   22 +
 frida_mode/test/re2/aflpp_qemu_driver_hook.c     |   97 ++
 frida_mode/test/re2/get_symbol_addr.py           |   36 +
 14 files changed, 2014 insertions(+), 23 deletions(-)
 create mode 100644 frida_mode/src/instrument/instrument_debug.c
 create mode 100644 frida_mode/test/libpcap/GNUmakefile
 create mode 100644 frida_mode/test/libpcap/Makefile
 create mode 100644 frida_mode/test/libpcap/aflpp_qemu_driver_hook.c
 create mode 100755 frida_mode/test/libpcap/get_symbol_addr.py
 create mode 100644 frida_mode/test/re2/GNUmakefile
 create mode 100644 frida_mode/test/re2/Makefile
 create mode 100644 frida_mode/test/re2/aflpp_qemu_driver_hook.c
 create mode 100755 frida_mode/test/re2/get_symbol_addr.py

(limited to 'frida_mode/src/main.c')

diff --git a/frida_mode/include/instrument.h b/frida_mode/include/instrument.h
index 03fd33e5..75ee6396 100644
--- a/frida_mode/include/instrument.h
+++ b/frida_mode/include/instrument.h
@@ -19,5 +19,8 @@ gboolean instrument_is_coverage_optimize_supported(void);
 void instrument_coverage_optimize(const cs_insn *   instr,
                                   GumStalkerOutput *output);
 
+void instrument_debug_start(uint64_t address, GumStalkerOutput *output);
+void instrument_debug_instruction(uint64_t address, uint16_t size);
+void instrument_debug_end(GumStalkerOutput *output);
 #endif
 
diff --git a/frida_mode/include/util.h b/frida_mode/include/util.h
index afd0b9c1..7b443b5e 100644
--- a/frida_mode/include/util.h
+++ b/frida_mode/include/util.h
@@ -4,7 +4,7 @@
 #include "frida-gum.h"
 
 #define UNUSED_PARAMETER(x) (void)(x)
-#define IGNORED_RERURN(x) (void)!(x)
+#define IGNORED_RETURN(x) (void)!(x)
 
 guint64 util_read_address(char *key);
 
diff --git a/frida_mode/src/instrument/instrument.c b/frida_mode/src/instrument/instrument.c
index 67eadc3f..f21849a6 100644
--- a/frida_mode/src/instrument/instrument.c
+++ b/frida_mode/src/instrument/instrument.c
@@ -47,7 +47,7 @@ __attribute__((hot)) static void on_basic_block(GumCpuContext *context,
                    "x, previous_pc: 0x%016" G_GINT64_MODIFIER "x\n",
                    current_pc, previous_pc);
 
-    IGNORED_RERURN(write(STDOUT_FILENO, buffer, len + 1));
+    IGNORED_RETURN(write(STDOUT_FILENO, buffer, len + 1));
 
   }
 
@@ -79,17 +79,48 @@ static void instr_basic_block(GumStalkerIterator *iterator,
 
   const cs_insn *instr;
   gboolean       begin = TRUE;
+  gboolean       excluded;
+
   while (gum_stalker_iterator_next(iterator, &instr)) {
 
     if (instr->address == entry_start) { entry_prologue(iterator, output); }
     if (instr->address == persistent_start) { persistent_prologue(output); }
 
-    if (begin) {
+    /*
+     * Until we reach AFL_ENTRYPOINT (assumed to be main if not specified) or
+     * AFL_FRIDA_PERSISTENT_ADDR (if specified), we don't mark our ranges
+     * excluded as we wish to remain inside stalker at all times so that we can
+     * instrument our entry point and persistent loop (if present). This allows
+     * the user to exclude ranges which would be traversed between main and the
+     * AFL_ENTRYPOINT, but which they don't want included in their coverage
+     * information when fuzzing.
+     *
+     * Since we have no means to discard the instrumented copies of blocks
+     * (setting the trust threshold simply causes a new copy to be made on each
+     * execution), we instead ensure that we honour the additional
+     * instrumentation requested (e.g. coverage, asan and complog) when a block
+     * is compiled no matter where we are during initialization. We will end up
+     * re-using these blocks if the code under test calls a block which is also
+     * used during initialization.
+     *
+     * Coverage data generated during initialization isn't a problem since the
+     * map is zeroed each time the target is forked or each time the persistent
+     * loop is run.
+     *
+     * Lastly, we don't enable pre-fetching back to the parent until we reach
+     * our AFL_ENTRYPOINT, since it is not until then that we start the
+     * fork-server and thus start executing in the child.
+     */
+    excluded = range_is_excluded(GSIZE_TO_POINTER(instr->address));
+    if (unlikely(begin)) {
+
+      instrument_debug_start(instr->address, output);
 
       prefetch_write(GSIZE_TO_POINTER(instr->address));
-      if (!range_is_excluded(GSIZE_TO_POINTER(instr->address))) {
 
-        if (optimize) {
+      if (likely(!excluded)) {
+
+        if (likely(optimize)) {
 
           instrument_coverage_optimize(instr, output);
 
@@ -106,7 +137,9 @@ static void instr_basic_block(GumStalkerIterator *iterator,
 
     }
 
-    if (!range_is_excluded(GSIZE_TO_POINTER(instr->address))) {
+    instrument_debug_instruction(instr->address, instr->size);
+
+    if (likely(!excluded)) {
 
       asan_instrument(instr, iterator);
       cmplog_instrument(instr, iterator);
@@ -117,6 +150,8 @@ static void instr_basic_block(GumStalkerIterator *iterator,
 
   }
 
+  instrument_debug_end(output);
+
 }
 
 void instrument_init(void) {
diff --git a/frida_mode/src/instrument/instrument_debug.c b/frida_mode/src/instrument/instrument_debug.c
new file mode 100644
index 00000000..3a554ad0
--- /dev/null
+++ b/frida_mode/src/instrument/instrument_debug.c
@@ -0,0 +1,128 @@
+#include <stdarg.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include "frida-gum.h"
+
+#include "util.h"
+
+#ifdef FRIDA_DEBUG
+
+static gpointer instrument_gen_start = NULL;
+
+static void instrument_debug(char *format, ...) {
+
+  va_list ap;
+  char    buffer[4096] = {0};
+
+  va_start(ap, format);
+
+  vsnprintf(buffer, sizeof(buffer) - 1, format, ap);
+  va_end(ap);
+
+  IGNORED_RETURN(write(STDOUT_FILENO, buffer, sizeof(buffer)));
+
+}
+
+static void instrument_disasm(guint8 *code, guint size) {
+
+  csh      capstone;
+  cs_err   err;
+  cs_insn *insn;
+  size_t   count, i;
+
+  err = cs_open(GUM_DEFAULT_CS_ARCH,
+                GUM_DEFAULT_CS_MODE | GUM_DEFAULT_CS_ENDIAN, &capstone);
+  g_assert(err == CS_ERR_OK);
+
+  count = cs_disasm(capstone, code, size, GPOINTER_TO_SIZE(code), 0, &insn);
+  g_assert(insn != NULL);
+
+  for (i = 0; i != count; i++) {
+
+    instrument_debug("\t0x%" G_GINT64_MODIFIER "x\t%s %s\n", insn[i].address,
+                     insn[i].mnemonic, insn[i].op_str);
+
+  }
+
+  cs_free(insn, count);
+
+  cs_close(&capstone);
+
+}
+
+static gpointer instrument_cur(GumStalkerOutput *output) {
+
+  #if defined(__i386__) || defined(__x86_64__)
+  return gum_x86_writer_cur(output->writer.x86);
+  #elif defined(__aarch64__)
+  return gum_arm64_writer_cur(output->writer.arm64);
+  #elif defined(__arm__)
+  return gum_arm_writer_cur(output->writer.arm);
+  #else
+    #error "Unsupported architecture"
+  #endif
+
+}
+
+void instrument_debug_start(uint64_t address, GumStalkerOutput *output) {
+
+  GumDebugSymbolDetails details;
+
+  instrument_gen_start = instrument_cur(output);
+
+  if (gum_symbol_details_from_address(GSIZE_TO_POINTER(address), &details)) {
+
+    instrument_debug("\n\n***\n\nCreating block for 0x%" G_GINT64_MODIFIER
+                     "x (%s!%s):\n",
+                     address, details.module_name, details.symbol_name);
+
+  } else {
+
+    instrument_debug(
+        "\n\n***\n\nCreating block for 0x%" G_GINT64_MODIFIER "x:\n", address);
+
+  }
+
+}
+
+void instrument_debug_instruction(uint64_t address, uint16_t size) {
+
+  uint8_t *start = (uint8_t *)GSIZE_TO_POINTER(address);
+  instrument_disasm(start, size);
+
+}
+
+void instrument_debug_end(GumStalkerOutput *output) {
+
+  gpointer instrument_gen_end = instrument_cur(output);
+  uint16_t size = GPOINTER_TO_SIZE(instrument_gen_end) -
+                  GPOINTER_TO_SIZE(instrument_gen_start);
+
+  instrument_debug("\nGenerated block %p\n", instrument_gen_start);
+  instrument_disasm(instrument_gen_start, size);
+
+}
+
+#else
+void instrument_debug_start(void *address) {
+
+  UNUSED_PARAMETER(address);
+
+}
+
+void instrument_debug_instruction(uint64_t address, uint16_t size) {
+
+  UNUSED_PARAMETER(address);
+  UNUSED_PARAMETER(size);
+
+}
+
+void instrument_debug_end(GumStalkerOutput *output) {
+
+  UNUSED_PARAMETER(output);
+
+}
+
+#endif
+
diff --git a/frida_mode/src/main.c b/frida_mode/src/main.c
index 21073cbe..e8015905 100644
--- a/frida_mode/src/main.c
+++ b/frida_mode/src/main.c
@@ -1,3 +1,4 @@
+#include <errno.h>
 #include <unistd.h>
 #include <sys/types.h>
 
@@ -58,10 +59,10 @@ static void on_main_os(int argc, char **argv, char **envp) {
 static void on_main_os(int argc, char **argv, char **envp) {
 
   UNUSED_PARAMETER(argc);
-
   /* Personality doesn't affect the current process, it only takes effect on
    * evec */
   int persona = personality(ADDR_NO_RANDOMIZE);
+  if (persona == -1) { WARNF("Failed to set ADDR_NO_RANDOMIZE: %d", errno); }
   if ((persona & ADDR_NO_RANDOMIZE) == 0) { execvpe(argv[0], argv, envp); }
 
   GumInterceptor *interceptor = gum_interceptor_obtain();
diff --git a/frida_mode/src/ranges.c b/frida_mode/src/ranges.c
index e3f09f9e..aa140708 100644
--- a/frida_mode/src/ranges.c
+++ b/frida_mode/src/ranges.c
@@ -480,15 +480,40 @@ static GArray *merge_ranges(GArray *a) {
 
 }
 
+static gboolean exclude_ranges_callback(const GumRangeDetails *details,
+                                        gpointer               user_data) {
+
+  UNUSED_PARAMETER(user_data);
+  gchar *     name;
+  gboolean    found;
+  GumStalker *stalker;
+  if (details->file == NULL) { return TRUE; }
+  name = g_path_get_basename(details->file->path);
+
+  found = (g_strcmp0(name, "afl-frida-trace.so") == 0);
+  g_free(name);
+  if (!found) { return TRUE; }
+
+  stalker = stalker_get();
+  gum_stalker_exclude(stalker, details->range);
+
+  return FALSE;
+
+}
+
+static void ranges_exclude_self(void) {
+
+  gum_process_enumerate_ranges(GUM_PAGE_EXECUTE, exclude_ranges_callback, NULL);
+
+}
+
 void ranges_init(void) {
 
-  GumMemoryRange  ri;
-  GArray *        step1;
-  GArray *        step2;
-  GArray *        step3;
-  GArray *        step4;
-  GumMemoryRange *r;
-  GumStalker *    stalker;
+  GumMemoryRange ri;
+  GArray *       step1;
+  GArray *       step2;
+  GArray *       step3;
+  GArray *       step4;
 
   if (getenv("AFL_FRIDA_DEBUG_MAPS") != NULL) {
 
@@ -535,20 +560,14 @@ void ranges_init(void) {
   ranges = merge_ranges(step4);
   print_ranges("final", ranges);
 
-  stalker = stalker_get();
-
-  for (guint i = 0; i < ranges->len; i++) {
-
-    r = &g_array_index(ranges, GumMemoryRange, i);
-    gum_stalker_exclude(stalker, r);
-
-  }
-
   g_array_free(step4, TRUE);
   g_array_free(step3, TRUE);
   g_array_free(step2, TRUE);
   g_array_free(step1, TRUE);
 
+  /* *NEVER* stalk the stalker, only bad things will ever come of this! */
+  ranges_exclude_self();
+
 }
 
 gboolean range_is_excluded(gpointer address) {
@@ -572,3 +591,19 @@ gboolean range_is_excluded(gpointer address) {
 
 }
 
+void ranges_exclude() {
+
+  GumMemoryRange *r;
+  GumStalker *    stalker = stalker_get();
+
+  OKF("Excluding ranges");
+
+  for (guint i = 0; i < ranges->len; i++) {
+
+    r = &g_array_index(ranges, GumMemoryRange, i);
+    gum_stalker_exclude(stalker, r);
+
+  }
+
+}
+
diff --git a/frida_mode/test/libpcap/GNUmakefile b/frida_mode/test/libpcap/GNUmakefile
new file mode 100644
index 00000000..e30f2049
--- /dev/null
+++ b/frida_mode/test/libpcap/GNUmakefile
@@ -0,0 +1,188 @@
+PWD:=$(shell pwd)/
+ROOT:=$(shell realpath $(PWD)../../..)/
+BUILD_DIR:=$(PWD)build/
+
+AFLPP_DRIVER_HOOK_SRC=$(PWD)aflpp_qemu_driver_hook.c
+AFLPP_DRIVER_HOOK_OBJ=$(BUILD_DIR)aflpp_qemu_driver_hook.so
+
+LIBPCAP_BUILD_DIR:=$(BUILD_DIR)libpcap/
+HARNESS_BUILD_DIR:=$(BUILD_DIR)harness/
+PCAPTEST_BUILD_DIR:=$(BUILD_DIR)libpcaptest/
+TCPDUMP_BUILD_DIR:=$(BUILD_DIR)tcpdump/
+
+LIBPCAP_PATCH_URL:=https://raw.githubusercontent.com/google/fuzzbench/master/benchmarks/libpcap_fuzz_both/patch.diff
+LIBPCAP_PATCH_FILE:=$(LIBPCAP_BUILD_DIR)patch.diff
+LIBPCAP_URL:=https://github.com/the-tcpdump-group/libpcap.git
+LIBPCAP_DIR:=$(LIBPCAP_BUILD_DIR)libpcap/
+LIBPCAP_CMAKEFILE:=$(LIBPCAP_DIR)CMakeLists.txt
+LIBPCAP_MAKEFILE:=$(LIBPCAP_DIR)Makefile
+LIBPCAP_LIB:=$(LIBPCAP_DIR)libpcap.a
+
+HARNESS_FILE:=$(HARNESS_BUILD_DIR)StandaloneFuzzTargetMain.c
+HARNESS_OBJ:=$(HARNESS_BUILD_DIR)StandaloneFuzzTargetMain.o
+HARNESS_URL:="https://raw.githubusercontent.com/llvm/llvm-project/main/compiler-rt/lib/fuzzer/standalone/StandaloneFuzzTargetMain.c"
+
+PCAPTEST_SRC_DIR:=$(LIBPCAP_DIR)testprogs/fuzz/
+PCAPTEST_FILE:=$(PCAPTEST_SRC_DIR)fuzz_both.c
+PCAPTEST_OBJ:=$(PCAPTEST_BUILD_DIR)fuzz_both.o
+
+TCPDUMP_URL:=https://github.com/the-tcpdump-group/tcpdump.git
+TCPDUMP_TESTS_DIR:=$(TCPDUMP_BUILD_DIR)tests/
+
+CFLAGS += -fpermissive
+
+LDFLAGS += -lpthread
+
+TEST_BIN:=$(BUILD_DIR)test
+ifeq "$(shell uname)" "Darwin"
+TEST_BIN_LDFLAGS:=-undefined dynamic_lookup
+endif
+
+AFLPP_DRIVER_DUMMY_INPUT:=$(TCPDUMP_TESTS_DIR)in
+
+QEMU_OUT:=$(BUILD_DIR)qemu-out
+FRIDA_OUT:=$(BUILD_DIR)frida-out
+
+ifndef ARCH
+
+ARCH=$(shell uname -m)
+ifeq "$(ARCH)" "aarch64"
+ ARCH:=arm64
+endif
+
+ifeq "$(ARCH)" "i686"
+ ARCH:=x86
+endif
+endif
+
+AFL_QEMU_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TEST_BIN) -s LLVMFuzzerTestOneInput -b 0x4000000000)
+
+ifeq "$(ARCH)" "aarch64"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TEST_BIN) -s LLVMFuzzerTestOneInput -b 0x0000aaaaaaaaa000)
+endif
+
+ifeq "$(ARCH)" "x86_64"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TEST_BIN) -s LLVMFuzzerTestOneInput -b 0x0000555555554000)
+endif
+
+ifeq "$(ARCH)" "x86"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TEST_BIN) -s LLVMFuzzerTestOneInput -b 0x56555000)
+endif
+
+.PHONY: all clean qemu frida hook
+
+all: $(TEST_BIN)
+	make -C $(ROOT)frida_mode/
+
+32:
+	CXXFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
+
+$(BUILD_DIR):
+	mkdir -p $@
+
+######### HARNESS ########
+$(HARNESS_BUILD_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(HARNESS_FILE): | $(HARNESS_BUILD_DIR)
+	wget -O $@ $(HARNESS_URL)
+
+$(HARNESS_OBJ): $(HARNESS_FILE)
+	$(CC) $(CXXFLAGS) $(LDFLAGS) -o $@ -c $<
+
+######### PCAPTEST ########
+
+$(PCAPTEST_BUILD_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(PCAPTEST_FILE): | $(LIBPCAP_CMAKEFILE)
+
+$(PCAPTEST_OBJ): $(PCAPTEST_FILE) | $(PCAPTEST_BUILD_DIR)
+	$(CC) $(CFLAGS) $(LDFLAGS) -I $(LIBPCAP_DIR) -o $@ -c $<
+
+######### LIBPCAP ########
+
+$(LIBPCAP_BUILD_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(LIBPCAP_PATCH_FILE): | $(LIBPCAP_BUILD_DIR)
+	wget -O $@ $(LIBPCAP_PATCH_URL)
+
+$(LIBPCAP_CMAKEFILE): $(LIBPCAP_PATCH_FILE) | $(LIBPCAP_BUILD_DIR)
+	git clone --depth 1 $(LIBPCAP_URL) $(LIBPCAP_DIR)
+	git apply $(LIBPCAP_PATCH_FILE)
+
+$(LIBPCAP_MAKEFILE): $(LIBPCAP_CMAKEFILE)
+	cd $(LIBPCAP_DIR) && cmake .
+
+$(LIBPCAP_LIB): $(LIBPCAP_MAKEFILE) $(LIBPCAP_PATCH_FILE)
+	make -C $(LIBPCAP_DIR)
+
+######## TCPDUMP ######
+
+$(TCPDUMP_BUILD_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(TCPDUMP_TESTS_DIR): | $(TCPDUMP_BUILD_DIR)
+	git clone --depth=1 $(TCPDUMP_URL) $(TCPDUMP_BUILD_DIR)
+
+######### TEST ########
+
+$(TEST_BIN): $(HARNESS_OBJ) $(PCAPTEST_OBJ) $(LIBPCAP_LIB)
+	$(CXX) \
+		$(CFLAGS) \
+		-o $@ \
+		$(HARNESS_OBJ) $(PCAPTEST_OBJ) $(LIBPCAP_LIB) \
+		-lz \
+		$(LDFLAGS) \
+		$(TEST_BIN_LDFLAGS) \
+
+########## HOOK ########
+
+$(AFLPP_DRIVER_HOOK_OBJ): $(AFLPP_DRIVER_HOOK_SRC) | $(BUILD_DIR)
+	$(CC) -shared $(CFLAGS) $(LDFLAGS) $< -o $@
+
+########## DUMMY #######
+
+$(AFLPP_DRIVER_DUMMY_INPUT): | $(TCPDUMP_TESTS_DIR)
+	truncate -s 1M $@
+
+###### TEST DATA #######
+
+hook: $(AFLPP_DRIVER_HOOK_OBJ)
+
+clean:
+	rm -rf $(BUILD_DIR)
+
+qemu: $(TEST_BIN) $(AFLPP_DRIVER_HOOK_OBJ) $(AFLPP_DRIVER_DUMMY_INPUT) | $(TCPDUMP_TESTS_DIR)
+	AFL_QEMU_PERSISTENT_HOOK=$(AFLPP_DRIVER_HOOK_OBJ) \
+	AFL_ENTRYPOINT=$(AFL_QEMU_PERSISTENT_ADDR) \
+	AFL_QEMU_PERSISTENT_ADDR=$(AFL_QEMU_PERSISTENT_ADDR) \
+	AFL_QEMU_PERSISTENT_GPR=1 \
+	$(ROOT)afl-fuzz \
+		-D \
+		-V 30 \
+		-Q \
+		-i $(TCPDUMP_TESTS_DIR) \
+		-o $(QEMU_OUT) \
+		-- \
+			$(TEST_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
+
+frida: $(TEST_BIN) $(AFLPP_DRIVER_HOOK_OBJ) $(AFLPP_DRIVER_DUMMY_INPUT) | $(TCPDUMP_TESTS_DIR)
+	AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_DRIVER_HOOK_OBJ) \
+	AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
+	AFL_ENTRYPOINT=$(AFL_FRIDA_PERSISTENT_ADDR) \
+	$(ROOT)afl-fuzz \
+		-D \
+		-V 30 \
+		-O \
+		-i $(TCPDUMP_TESTS_DIR) \
+		-o $(FRIDA_OUT) \
+		-- \
+			$(TEST_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
+
+debug:
+	gdb \
+		--ex 'set environment LD_PRELOAD=$(ROOT)afl-frida-trace.so' \
+		--ex 'set disassembly-flavor intel' \
+		--args $(TEST_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
diff --git a/frida_mode/test/libpcap/Makefile b/frida_mode/test/libpcap/Makefile
new file mode 100644
index 00000000..31cacb67
--- /dev/null
+++ b/frida_mode/test/libpcap/Makefile
@@ -0,0 +1,1143 @@
+# CMAKE generated file: DO NOT EDIT!
+# Generated by "Unix Makefiles" Generator, CMake Version 3.16
+
+# Default target executed when no arguments are given to make.
+default_target: all
+
+.PHONY : default_target
+
+# Allow only one "make -f Makefile2" at a time, but pass parallelism.
+.NOTPARALLEL:
+
+
+#=============================================================================
+# Special targets provided by cmake.
+
+# Disable implicit rules so canonical targets will work.
+.SUFFIXES:
+
+
+# Remove some rules from gmake that .SUFFIXES does not remove.
+SUFFIXES =
+
+.SUFFIXES: .hpux_make_needs_suffix_list
+
+
+# Suppress display of executed commands.
+$(VERBOSE).SILENT:
+
+
+# A target that is always out of date.
+cmake_force:
+
+.PHONY : cmake_force
+
+#=============================================================================
+# Set environment variables for the build.
+
+# The shell in which to execute make rules.
+SHELL = /bin/sh
+
+# The CMake executable.
+CMAKE_COMMAND = /usr/bin/cmake
+
+# The command to remove a file.
+RM = /usr/bin/cmake -E remove -f
+
+# Escaping for special characters.
+EQUALS = =
+
+# The top-level source directory on which CMake was run.
+CMAKE_SOURCE_DIR = /home/jon/git/AFLplusplus/frida_mode/test/libpcap/build/libpcap/libpcap
+
+# The top-level build directory on which CMake was run.
+CMAKE_BINARY_DIR = /home/jon/git/AFLplusplus/frida_mode/test/libpcap
+
+#=============================================================================
+# Targets provided globally by CMake.
+
+# Special rule for the target install/strip
+install/strip: preinstall
+	@$(CMAKE_COMMAND) -E cmake_echo_color --switch=$(COLOR) --cyan "Installing the project stripped..."
+	/usr/bin/cmake -DCMAKE_INSTALL_DO_STRIP=1 -P cmake_install.cmake
+.PHONY : install/strip
+
+# Special rule for the target install/strip
+install/strip/fast: preinstall/fast
+	@$(CMAKE_COMMAND) -E cmake_echo_color --switch=$(COLOR) --cyan "Installing the project stripped..."
+	/usr/bin/cmake -DCMAKE_INSTALL_DO_STRIP=1 -P cmake_install.cmake
+.PHONY : install/strip/fast
+
+# Special rule for the target install/local
+install/local: preinstall
+	@$(CMAKE_COMMAND) -E cmake_echo_color --switch=$(COLOR) --cyan "Installing only the local directory..."
+	/usr/bin/cmake -DCMAKE_INSTALL_LOCAL_ONLY=1 -P cmake_install.cmake
+.PHONY : install/local
+
+# Special rule for the target install/local
+install/local/fast: preinstall/fast
+	@$(CMAKE_COMMAND) -E cmake_echo_color --switch=$(COLOR) --cyan "Installing only the local directory..."
+	/usr/bin/cmake -DCMAKE_INSTALL_LOCAL_ONLY=1 -P cmake_install.cmake
+.PHONY : install/local/fast
+
+# Special rule for the target install
+install: preinstall
+	@$(CMAKE_COMMAND) -E cmake_echo_color --switch=$(COLOR) --cyan "Install the project..."
+	/usr/bin/cmake -P cmake_install.cmake
+.PHONY : install
+
+# Special rule for the target install
+install/fast: preinstall/fast
+	@$(CMAKE_COMMAND) -E cmake_echo_color --switch=$(COLOR) --cyan "Install the project..."
+	/usr/bin/cmake -P cmake_install.cmake
+.PHONY : install/fast
+
+# Special rule for the target list_install_components
+list_install_components:
+	@$(CMAKE_COMMAND) -E cmake_echo_color --switch=$(COLOR) --cyan "Available install components are: \"Unspecified\""
+.PHONY : list_install_components
+
+# Special rule for the target list_install_components
+list_install_components/fast: list_install_components
+
+.PHONY : list_install_components/fast
+
+# Special rule for the target rebuild_cache
+rebuild_cache:
+	@$(CMAKE_COMMAND) -E cmake_echo_color --switch=$(COLOR) --cyan "Running CMake to regenerate build system..."
+	/usr/bin/cmake -S$(CMAKE_SOURCE_DIR) -B$(CMAKE_BINARY_DIR)
+.PHONY : rebuild_cache
+
+# Special rule for the target rebuild_cache
+rebuild_cache/fast: rebuild_cache
+
+.PHONY : rebuild_cache/fast
+
+# Special rule for the target edit_cache
+edit_cache:
+	@$(CMAKE_COMMAND) -E cmake_echo_color --switch=$(COLOR) --cyan "No interactive CMake dialog available..."
+	/usr/bin/cmake -E echo No\ interactive\ CMake\ dialog\ available.
+.PHONY : edit_cache
+
+# Special rule for the target edit_cache
+edit_cache/fast: edit_cache
+
+.PHONY : edit_cache/fast
+
+# The main all target
+all: cmake_check_build_system
+	$(CMAKE_COMMAND) -E cmake_progress_start /home/jon/git/AFLplusplus/frida_mode/test/libpcap/CMakeFiles /home/jon/git/AFLplusplus/frida_mode/test/libpcap/CMakeFiles/progress.marks
+	$(MAKE) -f CMakeFiles/Makefile2 all
+	$(CMAKE_COMMAND) -E cmake_progress_start /home/jon/git/AFLplusplus/frida_mode/test/libpcap/CMakeFiles 0
+.PHONY : all
+
+# The main clean target
+clean:
+	$(MAKE) -f CMakeFiles/Makefile2 clean
+.PHONY : clean
+
+# The main clean target
+clean/fast: clean
+
+.PHONY : clean/fast
+
+# Prepare targets for installation.
+preinstall: all
+	$(MAKE) -f CMakeFiles/Makefile2 preinstall
+.PHONY : preinstall
+
+# Prepare targets for installation.
+preinstall/fast:
+	$(MAKE) -f CMakeFiles/Makefile2 preinstall
+.PHONY : preinstall/fast
+
+# clear depends
+depend:
+	$(CMAKE_COMMAND) -S$(CMAKE_SOURCE_DIR) -B$(CMAKE_BINARY_DIR) --check-build-system CMakeFiles/Makefile.cmake 1
+.PHONY : depend
+
+#=============================================================================
+# Target rules for targets named pcap
+
+# Build rule for target.
+pcap: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 pcap
+.PHONY : pcap
+
+# fast build rule for target.
+pcap/fast:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/build
+.PHONY : pcap/fast
+
+#=============================================================================
+# Target rules for targets named uninstall
+
+# Build rule for target.
+uninstall: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 uninstall
+.PHONY : uninstall
+
+# fast build rule for target.
+uninstall/fast:
+	$(MAKE) -f CMakeFiles/uninstall.dir/build.make CMakeFiles/uninstall.dir/build
+.PHONY : uninstall/fast
+
+#=============================================================================
+# Target rules for targets named pcap_static
+
+# Build rule for target.
+pcap_static: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 pcap_static
+.PHONY : pcap_static
+
+# fast build rule for target.
+pcap_static/fast:
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/build
+.PHONY : pcap_static/fast
+
+#=============================================================================
+# Target rules for targets named SerializeTarget
+
+# Build rule for target.
+SerializeTarget: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 SerializeTarget
+.PHONY : SerializeTarget
+
+# fast build rule for target.
+SerializeTarget/fast:
+	$(MAKE) -f CMakeFiles/SerializeTarget.dir/build.make CMakeFiles/SerializeTarget.dir/build
+.PHONY : SerializeTarget/fast
+
+#=============================================================================
+# Target rules for targets named testprogs
+
+# Build rule for target.
+testprogs: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 testprogs
+.PHONY : testprogs
+
+# fast build rule for target.
+testprogs/fast:
+	$(MAKE) -f testprogs/CMakeFiles/testprogs.dir/build.make testprogs/CMakeFiles/testprogs.dir/build
+.PHONY : testprogs/fast
+
+#=============================================================================
+# Target rules for targets named capturetest
+
+# Build rule for target.
+capturetest: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 capturetest
+.PHONY : capturetest
+
+# fast build rule for target.
+capturetest/fast:
+	$(MAKE) -f testprogs/CMakeFiles/capturetest.dir/build.make testprogs/CMakeFiles/capturetest.dir/build
+.PHONY : capturetest/fast
+
+#=============================================================================
+# Target rules for targets named findalldevstest
+
+# Build rule for target.
+findalldevstest: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 findalldevstest
+.PHONY : findalldevstest
+
+# fast build rule for target.
+findalldevstest/fast:
+	$(MAKE) -f testprogs/CMakeFiles/findalldevstest.dir/build.make testprogs/CMakeFiles/findalldevstest.dir/build
+.PHONY : findalldevstest/fast
+
+#=============================================================================
+# Target rules for targets named filtertest
+
+# Build rule for target.
+filtertest: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 filtertest
+.PHONY : filtertest
+
+# fast build rule for target.
+filtertest/fast:
+	$(MAKE) -f testprogs/CMakeFiles/filtertest.dir/build.make testprogs/CMakeFiles/filtertest.dir/build
+.PHONY : filtertest/fast
+
+#=============================================================================
+# Target rules for targets named findalldevstest-perf
+
+# Build rule for target.
+findalldevstest-perf: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 findalldevstest-perf
+.PHONY : findalldevstest-perf
+
+# fast build rule for target.
+findalldevstest-perf/fast:
+	$(MAKE) -f testprogs/CMakeFiles/findalldevstest-perf.dir/build.make testprogs/CMakeFiles/findalldevstest-perf.dir/build
+.PHONY : findalldevstest-perf/fast
+
+#=============================================================================
+# Target rules for targets named can_set_rfmon_test
+
+# Build rule for target.
+can_set_rfmon_test: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 can_set_rfmon_test
+.PHONY : can_set_rfmon_test
+
+# fast build rule for target.
+can_set_rfmon_test/fast:
+	$(MAKE) -f testprogs/CMakeFiles/can_set_rfmon_test.dir/build.make testprogs/CMakeFiles/can_set_rfmon_test.dir/build
+.PHONY : can_set_rfmon_test/fast
+
+#=============================================================================
+# Target rules for targets named opentest
+
+# Build rule for target.
+opentest: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 opentest
+.PHONY : opentest
+
+# fast build rule for target.
+opentest/fast:
+	$(MAKE) -f testprogs/CMakeFiles/opentest.dir/build.make testprogs/CMakeFiles/opentest.dir/build
+.PHONY : opentest/fast
+
+#=============================================================================
+# Target rules for targets named reactivatetest
+
+# Build rule for target.
+reactivatetest: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 reactivatetest
+.PHONY : reactivatetest
+
+# fast build rule for target.
+reactivatetest/fast:
+	$(MAKE) -f testprogs/CMakeFiles/reactivatetest.dir/build.make testprogs/CMakeFiles/reactivatetest.dir/build
+.PHONY : reactivatetest/fast
+
+#=============================================================================
+# Target rules for targets named writecaptest
+
+# Build rule for target.
+writecaptest: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 writecaptest
+.PHONY : writecaptest
+
+# fast build rule for target.
+writecaptest/fast:
+	$(MAKE) -f testprogs/CMakeFiles/writecaptest.dir/build.make testprogs/CMakeFiles/writecaptest.dir/build
+.PHONY : writecaptest/fast
+
+#=============================================================================
+# Target rules for targets named selpolltest
+
+# Build rule for target.
+selpolltest: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 selpolltest
+.PHONY : selpolltest
+
+# fast build rule for target.
+selpolltest/fast:
+	$(MAKE) -f testprogs/CMakeFiles/selpolltest.dir/build.make testprogs/CMakeFiles/selpolltest.dir/build
+.PHONY : selpolltest/fast
+
+#=============================================================================
+# Target rules for targets named threadsignaltest
+
+# Build rule for target.
+threadsignaltest: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 threadsignaltest
+.PHONY : threadsignaltest
+
+# fast build rule for target.
+threadsignaltest/fast:
+	$(MAKE) -f testprogs/CMakeFiles/threadsignaltest.dir/build.make testprogs/CMakeFiles/threadsignaltest.dir/build
+.PHONY : threadsignaltest/fast
+
+#=============================================================================
+# Target rules for targets named valgrindtest
+
+# Build rule for target.
+valgrindtest: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 valgrindtest
+.PHONY : valgrindtest
+
+# fast build rule for target.
+valgrindtest/fast:
+	$(MAKE) -f testprogs/CMakeFiles/valgrindtest.dir/build.make testprogs/CMakeFiles/valgrindtest.dir/build
+.PHONY : valgrindtest/fast
+
+#=============================================================================
+# Target rules for targets named fuzz_both
+
+# Build rule for target.
+fuzz_both: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 fuzz_both
+.PHONY : fuzz_both
+
+# fast build rule for target.
+fuzz_both/fast:
+	$(MAKE) -f testprogs/fuzz/CMakeFiles/fuzz_both.dir/build.make testprogs/fuzz/CMakeFiles/fuzz_both.dir/build
+.PHONY : fuzz_both/fast
+
+#=============================================================================
+# Target rules for targets named fuzz_filter
+
+# Build rule for target.
+fuzz_filter: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 fuzz_filter
+.PHONY : fuzz_filter
+
+# fast build rule for target.
+fuzz_filter/fast:
+	$(MAKE) -f testprogs/fuzz/CMakeFiles/fuzz_filter.dir/build.make testprogs/fuzz/CMakeFiles/fuzz_filter.dir/build
+.PHONY : fuzz_filter/fast
+
+#=============================================================================
+# Target rules for targets named fuzz_pcap
+
+# Build rule for target.
+fuzz_pcap: cmake_check_build_system
+	$(MAKE) -f CMakeFiles/Makefile2 fuzz_pcap
+.PHONY : fuzz_pcap
+
+# fast build rule for target.
+fuzz_pcap/fast:
+	$(MAKE) -f testprogs/fuzz/CMakeFiles/fuzz_pcap.dir/build.make testprogs/fuzz/CMakeFiles/fuzz_pcap.dir/build
+.PHONY : fuzz_pcap/fast
+
+bpf_dump.o: bpf_dump.c.o
+
+.PHONY : bpf_dump.o
+
+# target to build an object file
+bpf_dump.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/bpf_dump.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/bpf_dump.c.o
+.PHONY : bpf_dump.c.o
+
+bpf_dump.i: bpf_dump.c.i
+
+.PHONY : bpf_dump.i
+
+# target to preprocess a source file
+bpf_dump.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/bpf_dump.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/bpf_dump.c.i
+.PHONY : bpf_dump.c.i
+
+bpf_dump.s: bpf_dump.c.s
+
+.PHONY : bpf_dump.s
+
+# target to generate assembly for a file
+bpf_dump.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/bpf_dump.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/bpf_dump.c.s
+.PHONY : bpf_dump.c.s
+
+bpf_filter.o: bpf_filter.c.o
+
+.PHONY : bpf_filter.o
+
+# target to build an object file
+bpf_filter.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/bpf_filter.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/bpf_filter.c.o
+.PHONY : bpf_filter.c.o
+
+bpf_filter.i: bpf_filter.c.i
+
+.PHONY : bpf_filter.i
+
+# target to preprocess a source file
+bpf_filter.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/bpf_filter.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/bpf_filter.c.i
+.PHONY : bpf_filter.c.i
+
+bpf_filter.s: bpf_filter.c.s
+
+.PHONY : bpf_filter.s
+
+# target to generate assembly for a file
+bpf_filter.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/bpf_filter.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/bpf_filter.c.s
+.PHONY : bpf_filter.c.s
+
+bpf_image.o: bpf_image.c.o
+
+.PHONY : bpf_image.o
+
+# target to build an object file
+bpf_image.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/bpf_image.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/bpf_image.c.o
+.PHONY : bpf_image.c.o
+
+bpf_image.i: bpf_image.c.i
+
+.PHONY : bpf_image.i
+
+# target to preprocess a source file
+bpf_image.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/bpf_image.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/bpf_image.c.i
+.PHONY : bpf_image.c.i
+
+bpf_image.s: bpf_image.c.s
+
+.PHONY : bpf_image.s
+
+# target to generate assembly for a file
+bpf_image.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/bpf_image.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/bpf_image.c.s
+.PHONY : bpf_image.c.s
+
+etherent.o: etherent.c.o
+
+.PHONY : etherent.o
+
+# target to build an object file
+etherent.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/etherent.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/etherent.c.o
+.PHONY : etherent.c.o
+
+etherent.i: etherent.c.i
+
+.PHONY : etherent.i
+
+# target to preprocess a source file
+etherent.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/etherent.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/etherent.c.i
+.PHONY : etherent.c.i
+
+etherent.s: etherent.c.s
+
+.PHONY : etherent.s
+
+# target to generate assembly for a file
+etherent.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/etherent.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/etherent.c.s
+.PHONY : etherent.c.s
+
+fad-getad.o: fad-getad.c.o
+
+.PHONY : fad-getad.o
+
+# target to build an object file
+fad-getad.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/fad-getad.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/fad-getad.c.o
+.PHONY : fad-getad.c.o
+
+fad-getad.i: fad-getad.c.i
+
+.PHONY : fad-getad.i
+
+# target to preprocess a source file
+fad-getad.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/fad-getad.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/fad-getad.c.i
+.PHONY : fad-getad.c.i
+
+fad-getad.s: fad-getad.c.s
+
+.PHONY : fad-getad.s
+
+# target to generate assembly for a file
+fad-getad.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/fad-getad.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/fad-getad.c.s
+.PHONY : fad-getad.c.s
+
+fmtutils.o: fmtutils.c.o
+
+.PHONY : fmtutils.o
+
+# target to build an object file
+fmtutils.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/fmtutils.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/fmtutils.c.o
+.PHONY : fmtutils.c.o
+
+fmtutils.i: fmtutils.c.i
+
+.PHONY : fmtutils.i
+
+# target to preprocess a source file
+fmtutils.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/fmtutils.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/fmtutils.c.i
+.PHONY : fmtutils.c.i
+
+fmtutils.s: fmtutils.c.s
+
+.PHONY : fmtutils.s
+
+# target to generate assembly for a file
+fmtutils.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/fmtutils.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/fmtutils.c.s
+.PHONY : fmtutils.c.s
+
+gencode.o: gencode.c.o
+
+.PHONY : gencode.o
+
+# target to build an object file
+gencode.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/gencode.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/gencode.c.o
+.PHONY : gencode.c.o
+
+gencode.i: gencode.c.i
+
+.PHONY : gencode.i
+
+# target to preprocess a source file
+gencode.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/gencode.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/gencode.c.i
+.PHONY : gencode.c.i
+
+gencode.s: gencode.c.s
+
+.PHONY : gencode.s
+
+# target to generate assembly for a file
+gencode.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/gencode.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/gencode.c.s
+.PHONY : gencode.c.s
+
+grammar.o: grammar.c.o
+
+.PHONY : grammar.o
+
+# target to build an object file
+grammar.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/grammar.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/grammar.c.o
+.PHONY : grammar.c.o
+
+grammar.i: grammar.c.i
+
+.PHONY : grammar.i
+
+# target to preprocess a source file
+grammar.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/grammar.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/grammar.c.i
+.PHONY : grammar.c.i
+
+grammar.s: grammar.c.s
+
+.PHONY : grammar.s
+
+# target to generate assembly for a file
+grammar.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/grammar.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/grammar.c.s
+.PHONY : grammar.c.s
+
+missing/strlcat.o: missing/strlcat.c.o
+
+.PHONY : missing/strlcat.o
+
+# target to build an object file
+missing/strlcat.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/missing/strlcat.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/missing/strlcat.c.o
+.PHONY : missing/strlcat.c.o
+
+missing/strlcat.i: missing/strlcat.c.i
+
+.PHONY : missing/strlcat.i
+
+# target to preprocess a source file
+missing/strlcat.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/missing/strlcat.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/missing/strlcat.c.i
+.PHONY : missing/strlcat.c.i
+
+missing/strlcat.s: missing/strlcat.c.s
+
+.PHONY : missing/strlcat.s
+
+# target to generate assembly for a file
+missing/strlcat.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/missing/strlcat.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/missing/strlcat.c.s
+.PHONY : missing/strlcat.c.s
+
+missing/strlcpy.o: missing/strlcpy.c.o
+
+.PHONY : missing/strlcpy.o
+
+# target to build an object file
+missing/strlcpy.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/missing/strlcpy.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/missing/strlcpy.c.o
+.PHONY : missing/strlcpy.c.o
+
+missing/strlcpy.i: missing/strlcpy.c.i
+
+.PHONY : missing/strlcpy.i
+
+# target to preprocess a source file
+missing/strlcpy.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/missing/strlcpy.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/missing/strlcpy.c.i
+.PHONY : missing/strlcpy.c.i
+
+missing/strlcpy.s: missing/strlcpy.c.s
+
+.PHONY : missing/strlcpy.s
+
+# target to generate assembly for a file
+missing/strlcpy.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/missing/strlcpy.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/missing/strlcpy.c.s
+.PHONY : missing/strlcpy.c.s
+
+nametoaddr.o: nametoaddr.c.o
+
+.PHONY : nametoaddr.o
+
+# target to build an object file
+nametoaddr.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/nametoaddr.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/nametoaddr.c.o
+.PHONY : nametoaddr.c.o
+
+nametoaddr.i: nametoaddr.c.i
+
+.PHONY : nametoaddr.i
+
+# target to preprocess a source file
+nametoaddr.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/nametoaddr.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/nametoaddr.c.i
+.PHONY : nametoaddr.c.i
+
+nametoaddr.s: nametoaddr.c.s
+
+.PHONY : nametoaddr.s
+
+# target to generate assembly for a file
+nametoaddr.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/nametoaddr.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/nametoaddr.c.s
+.PHONY : nametoaddr.c.s
+
+optimize.o: optimize.c.o
+
+.PHONY : optimize.o
+
+# target to build an object file
+optimize.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/optimize.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/optimize.c.o
+.PHONY : optimize.c.o
+
+optimize.i: optimize.c.i
+
+.PHONY : optimize.i
+
+# target to preprocess a source file
+optimize.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/optimize.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/optimize.c.i
+.PHONY : optimize.c.i
+
+optimize.s: optimize.c.s
+
+.PHONY : optimize.s
+
+# target to generate assembly for a file
+optimize.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/optimize.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/optimize.c.s
+.PHONY : optimize.c.s
+
+pcap-common.o: pcap-common.c.o
+
+.PHONY : pcap-common.o
+
+# target to build an object file
+pcap-common.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-common.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-common.c.o
+.PHONY : pcap-common.c.o
+
+pcap-common.i: pcap-common.c.i
+
+.PHONY : pcap-common.i
+
+# target to preprocess a source file
+pcap-common.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-common.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-common.c.i
+.PHONY : pcap-common.c.i
+
+pcap-common.s: pcap-common.c.s
+
+.PHONY : pcap-common.s
+
+# target to generate assembly for a file
+pcap-common.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-common.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-common.c.s
+.PHONY : pcap-common.c.s
+
+pcap-linux.o: pcap-linux.c.o
+
+.PHONY : pcap-linux.o
+
+# target to build an object file
+pcap-linux.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-linux.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-linux.c.o
+.PHONY : pcap-linux.c.o
+
+pcap-linux.i: pcap-linux.c.i
+
+.PHONY : pcap-linux.i
+
+# target to preprocess a source file
+pcap-linux.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-linux.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-linux.c.i
+.PHONY : pcap-linux.c.i
+
+pcap-linux.s: pcap-linux.c.s
+
+.PHONY : pcap-linux.s
+
+# target to generate assembly for a file
+pcap-linux.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-linux.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-linux.c.s
+.PHONY : pcap-linux.c.s
+
+pcap-netfilter-linux.o: pcap-netfilter-linux.c.o
+
+.PHONY : pcap-netfilter-linux.o
+
+# target to build an object file
+pcap-netfilter-linux.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-netfilter-linux.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-netfilter-linux.c.o
+.PHONY : pcap-netfilter-linux.c.o
+
+pcap-netfilter-linux.i: pcap-netfilter-linux.c.i
+
+.PHONY : pcap-netfilter-linux.i
+
+# target to preprocess a source file
+pcap-netfilter-linux.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-netfilter-linux.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-netfilter-linux.c.i
+.PHONY : pcap-netfilter-linux.c.i
+
+pcap-netfilter-linux.s: pcap-netfilter-linux.c.s
+
+.PHONY : pcap-netfilter-linux.s
+
+# target to generate assembly for a file
+pcap-netfilter-linux.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-netfilter-linux.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-netfilter-linux.c.s
+.PHONY : pcap-netfilter-linux.c.s
+
+pcap-usb-linux.o: pcap-usb-linux.c.o
+
+.PHONY : pcap-usb-linux.o
+
+# target to build an object file
+pcap-usb-linux.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-usb-linux.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-usb-linux.c.o
+.PHONY : pcap-usb-linux.c.o
+
+pcap-usb-linux.i: pcap-usb-linux.c.i
+
+.PHONY : pcap-usb-linux.i
+
+# target to preprocess a source file
+pcap-usb-linux.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-usb-linux.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-usb-linux.c.i
+.PHONY : pcap-usb-linux.c.i
+
+pcap-usb-linux.s: pcap-usb-linux.c.s
+
+.PHONY : pcap-usb-linux.s
+
+# target to generate assembly for a file
+pcap-usb-linux.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap-usb-linux.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap-usb-linux.c.s
+.PHONY : pcap-usb-linux.c.s
+
+pcap.o: pcap.c.o
+
+.PHONY : pcap.o
+
+# target to build an object file
+pcap.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap.c.o
+.PHONY : pcap.c.o
+
+pcap.i: pcap.c.i
+
+.PHONY : pcap.i
+
+# target to preprocess a source file
+pcap.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap.c.i
+.PHONY : pcap.c.i
+
+pcap.s: pcap.c.s
+
+.PHONY : pcap.s
+
+# target to generate assembly for a file
+pcap.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/pcap.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/pcap.c.s
+.PHONY : pcap.c.s
+
+savefile.o: savefile.c.o
+
+.PHONY : savefile.o
+
+# target to build an object file
+savefile.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/savefile.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/savefile.c.o
+.PHONY : savefile.c.o
+
+savefile.i: savefile.c.i
+
+.PHONY : savefile.i
+
+# target to preprocess a source file
+savefile.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/savefile.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/savefile.c.i
+.PHONY : savefile.c.i
+
+savefile.s: savefile.c.s
+
+.PHONY : savefile.s
+
+# target to generate assembly for a file
+savefile.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/savefile.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/savefile.c.s
+.PHONY : savefile.c.s
+
+scanner.o: scanner.c.o
+
+.PHONY : scanner.o
+
+# target to build an object file
+scanner.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/scanner.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/scanner.c.o
+.PHONY : scanner.c.o
+
+scanner.i: scanner.c.i
+
+.PHONY : scanner.i
+
+# target to preprocess a source file
+scanner.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/scanner.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/scanner.c.i
+.PHONY : scanner.c.i
+
+scanner.s: scanner.c.s
+
+.PHONY : scanner.s
+
+# target to generate assembly for a file
+scanner.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/scanner.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/scanner.c.s
+.PHONY : scanner.c.s
+
+sf-pcap.o: sf-pcap.c.o
+
+.PHONY : sf-pcap.o
+
+# target to build an object file
+sf-pcap.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/sf-pcap.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/sf-pcap.c.o
+.PHONY : sf-pcap.c.o
+
+sf-pcap.i: sf-pcap.c.i
+
+.PHONY : sf-pcap.i
+
+# target to preprocess a source file
+sf-pcap.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/sf-pcap.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/sf-pcap.c.i
+.PHONY : sf-pcap.c.i
+
+sf-pcap.s: sf-pcap.c.s
+
+.PHONY : sf-pcap.s
+
+# target to generate assembly for a file
+sf-pcap.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/sf-pcap.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/sf-pcap.c.s
+.PHONY : sf-pcap.c.s
+
+sf-pcapng.o: sf-pcapng.c.o
+
+.PHONY : sf-pcapng.o
+
+# target to build an object file
+sf-pcapng.c.o:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/sf-pcapng.c.o
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/sf-pcapng.c.o
+.PHONY : sf-pcapng.c.o
+
+sf-pcapng.i: sf-pcapng.c.i
+
+.PHONY : sf-pcapng.i
+
+# target to preprocess a source file
+sf-pcapng.c.i:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/sf-pcapng.c.i
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/sf-pcapng.c.i
+.PHONY : sf-pcapng.c.i
+
+sf-pcapng.s: sf-pcapng.c.s
+
+.PHONY : sf-pcapng.s
+
+# target to generate assembly for a file
+sf-pcapng.c.s:
+	$(MAKE) -f CMakeFiles/pcap.dir/build.make CMakeFiles/pcap.dir/sf-pcapng.c.s
+	$(MAKE) -f CMakeFiles/pcap_static.dir/build.make CMakeFiles/pcap_static.dir/sf-pcapng.c.s
+.PHONY : sf-pcapng.c.s
+
+# Help Target
+help:
+	@echo "The following are some of the valid targets for this Makefile:"
+	@echo "... all (the default if no target is provided)"
+	@echo "... clean"
+	@echo "... depend"
+	@echo "... install/strip"
+	@echo "... install/local"
+	@echo "... install"
+	@echo "... list_install_components"
+	@echo "... rebuild_cache"
+	@echo "... edit_cache"
+	@echo "... pcap"
+	@echo "... uninstall"
+	@echo "... pcap_static"
+	@echo "... SerializeTarget"
+	@echo "... testprogs"
+	@echo "... capturetest"
+	@echo "... findalldevstest"
+	@echo "... filtertest"
+	@echo "... findalldevstest-perf"
+	@echo "... can_set_rfmon_test"
+	@echo "... opentest"
+	@echo "... reactivatetest"
+	@echo "... writecaptest"
+	@echo "... selpolltest"
+	@echo "... threadsignaltest"
+	@echo "... valgrindtest"
+	@echo "... fuzz_both"
+	@echo "... fuzz_filter"
+	@echo "... fuzz_pcap"
+	@echo "... bpf_dump.o"
+	@echo "... bpf_dump.i"
+	@echo "... bpf_dump.s"
+	@echo "... bpf_filter.o"
+	@echo "... bpf_filter.i"
+	@echo "... bpf_filter.s"
+	@echo "... bpf_image.o"
+	@echo "... bpf_image.i"
+	@echo "... bpf_image.s"
+	@echo "... etherent.o"
+	@echo "... etherent.i"
+	@echo "... etherent.s"
+	@echo "... fad-getad.o"
+	@echo "... fad-getad.i"
+	@echo "... fad-getad.s"
+	@echo "... fmtutils.o"
+	@echo "... fmtutils.i"
+	@echo "... fmtutils.s"
+	@echo "... gencode.o"
+	@echo "... gencode.i"
+	@echo "... gencode.s"
+	@echo "... grammar.o"
+	@echo "... grammar.i"
+	@echo "... grammar.s"
+	@echo "... missing/strlcat.o"
+	@echo "... missing/strlcat.i"
+	@echo "... missing/strlcat.s"
+	@echo "... missing/strlcpy.o"
+	@echo "... missing/strlcpy.i"
+	@echo "... missing/strlcpy.s"
+	@echo "... nametoaddr.o"
+	@echo "... nametoaddr.i"
+	@echo "... nametoaddr.s"
+	@echo "... optimize.o"
+	@echo "... optimize.i"
+	@echo "... optimize.s"
+	@echo "... pcap-common.o"
+	@echo "... pcap-common.i"
+	@echo "... pcap-common.s"
+	@echo "... pcap-linux.o"
+	@echo "... pcap-linux.i"
+	@echo "... pcap-linux.s"
+	@echo "... pcap-netfilter-linux.o"
+	@echo "... pcap-netfilter-linux.i"
+	@echo "... pcap-netfilter-linux.s"
+	@echo "... pcap-usb-linux.o"
+	@echo "... pcap-usb-linux.i"
+	@echo "... pcap-usb-linux.s"
+	@echo "... pcap.o"
+	@echo "... pcap.i"
+	@echo "... pcap.s"
+	@echo "... savefile.o"
+	@echo "... savefile.i"
+	@echo "... savefile.s"
+	@echo "... scanner.o"
+	@echo "... scanner.i"
+	@echo "... scanner.s"
+	@echo "... sf-pcap.o"
+	@echo "... sf-pcap.i"
+	@echo "... sf-pcap.s"
+	@echo "... sf-pcapng.o"
+	@echo "... sf-pcapng.i"
+	@echo "... sf-pcapng.s"
+.PHONY : help
+
+
+
+#=============================================================================
+# Special targets to cleanup operation of make.
+
+# Special rule to run CMake to check the build system integrity.
+# No rule that depends on this can have commands that come from listfiles
+# because they might be regenerated.
+cmake_check_build_system:
+	$(CMAKE_COMMAND) -S$(CMAKE_SOURCE_DIR) -B$(CMAKE_BINARY_DIR) --check-build-system CMakeFiles/Makefile.cmake 0
+.PHONY : cmake_check_build_system
+
diff --git a/frida_mode/test/libpcap/aflpp_qemu_driver_hook.c b/frida_mode/test/libpcap/aflpp_qemu_driver_hook.c
new file mode 100644
index 00000000..059d438d
--- /dev/null
+++ b/frida_mode/test/libpcap/aflpp_qemu_driver_hook.c
@@ -0,0 +1,97 @@
+#include <stdint.h>
+#include <string.h>
+
+#if defined(__x86_64__)
+
+struct x86_64_regs {
+
+  uint64_t rax, rbx, rcx, rdx, rdi, rsi, rbp, r8, r9, r10, r11, r12, r13, r14,
+      r15;
+
+  union {
+
+    uint64_t rip;
+    uint64_t pc;
+
+  };
+
+  union {
+
+    uint64_t rsp;
+    uint64_t sp;
+
+  };
+
+  union {
+
+    uint64_t rflags;
+    uint64_t flags;
+
+  };
+
+  uint8_t zmm_regs[32][64];
+
+};
+
+void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
+                         uint8_t *input_buf, uint32_t input_buf_len) {
+
+  memcpy((void *)regs->rdi, input_buf, input_buf_len);
+  regs->rsi = input_buf_len;
+
+}
+
+#elif defined(__i386__)
+
+struct x86_regs {
+
+  uint32_t eax, ebx, ecx, edx, edi, esi, ebp;
+
+  union {
+
+    uint32_t eip;
+    uint32_t pc;
+
+  };
+
+  union {
+
+    uint32_t esp;
+    uint32_t sp;
+
+  };
+
+  union {
+
+    uint32_t eflags;
+    uint32_t flags;
+
+  };
+
+  uint8_t xmm_regs[8][16];
+
+};
+
+void afl_persistent_hook(struct x86_regs *regs, uint64_t guest_base,
+                         uint8_t *input_buf, uint32_t input_buf_len) {
+
+  void **esp = (void **)regs->esp;
+  void * arg1 = esp[1];
+  void **arg2 = &esp[2];
+  memcpy(arg1, input_buf, input_buf_len);
+  *arg2 = (void *)input_buf_len;
+
+}
+
+#else
+  #pragma error "Unsupported architecture"
+#endif
+
+int afl_persistent_hook_init(void) {
+
+  // 1 for shared memory input (faster), 0 for normal input (you have to use
+  // read(), input_buf will be NULL)
+  return 1;
+
+}
+
diff --git a/frida_mode/test/libpcap/get_symbol_addr.py b/frida_mode/test/libpcap/get_symbol_addr.py
new file mode 100755
index 00000000..1c46e010
--- /dev/null
+++ b/frida_mode/test/libpcap/get_symbol_addr.py
@@ -0,0 +1,36 @@
+#!/usr/bin/python3
+import argparse
+from elftools.elf.elffile import ELFFile
+
+def process_file(file, symbol, base):
+    with open(file, 'rb') as f:
+        elf = ELFFile(f)
+        symtab = elf.get_section_by_name('.symtab')
+        mains = symtab.get_symbol_by_name(symbol)
+        if len(mains) != 1:
+            print ("Failed to find main")
+            return 1
+
+        main_addr = mains[0]['st_value']
+        main = base + main_addr
+        print ("0x%016x" % main)
+        return 0
+
+def hex_value(x):
+    return int(x, 16)
+
+def main():
+    parser = argparse.ArgumentParser(description='Process some integers.')
+    parser.add_argument('-f', '--file', dest='file', type=str,
+                    help='elf file name', required=True)
+    parser.add_argument('-s', '--symbol', dest='symbol', type=str,
+                    help='symbol name', required=True)
+    parser.add_argument('-b', '--base', dest='base', type=hex_value,
+                    help='elf base address', required=True)
+
+    args = parser.parse_args()
+    return process_file (args.file, args.symbol, args.base)
+
+if __name__ == "__main__":
+    ret = main()
+    exit(ret)
diff --git a/frida_mode/test/re2/GNUmakefile b/frida_mode/test/re2/GNUmakefile
new file mode 100644
index 00000000..9f0b31d3
--- /dev/null
+++ b/frida_mode/test/re2/GNUmakefile
@@ -0,0 +1,170 @@
+PWD:=$(shell pwd)/
+ROOT:=$(shell realpath $(PWD)../../..)/
+BUILD_DIR:=$(PWD)build/
+
+AFLPP_DRIVER_HOOK_SRC=$(PWD)aflpp_qemu_driver_hook.c
+AFLPP_DRIVER_HOOK_OBJ=$(BUILD_DIR)aflpp_qemu_driver_hook.so
+
+LIBRE2_BUILD_DIR:=$(BUILD_DIR)libre2/
+HARNESS_BUILD_DIR:=$(BUILD_DIR)harness/
+RE2TEST_BUILD_DIR:=$(BUILD_DIR)re2test/
+
+LIBRE2_URL:=https://github.com/google/re2.git
+LIBRE2_DIR:=$(LIBRE2_BUILD_DIR)libre2/
+LIBRE2_MAKEFILE:=$(LIBRE2_DIR)Makefile
+LIBRE2_LIB:=$(LIBRE2_DIR)obj/libre2.a
+
+HARNESS_FILE:=$(HARNESS_BUILD_DIR)StandaloneFuzzTargetMain.c
+HARNESS_OBJ:=$(HARNESS_BUILD_DIR)StandaloneFuzzTargetMain.o
+HARNESS_URL:="https://raw.githubusercontent.com/llvm/llvm-project/main/compiler-rt/lib/fuzzer/standalone/StandaloneFuzzTargetMain.c"
+
+RE2TEST_FILE:=$(RE2TEST_BUILD_DIR)target.cc
+RE2TEST_OBJ:=$(RE2TEST_BUILD_DIR)target.o
+RE2TEST_URL:="https://raw.githubusercontent.com/google/fuzzbench/master/benchmarks/re2-2014-12-09/target.cc"
+
+LDFLAGS += -lpthread
+
+TEST_BIN:=$(BUILD_DIR)test
+ifeq "$(shell uname)" "Darwin"
+TEST_BIN_LDFLAGS:=-undefined dynamic_lookup
+endif
+
+TEST_DATA_DIR:=$(BUILD_DIR)in/
+AFLPP_DRIVER_DUMMY_INPUT:=$(TEST_DATA_DIR)in
+
+QEMU_OUT:=$(BUILD_DIR)qemu-out
+FRIDA_OUT:=$(BUILD_DIR)frida-out
+
+ifndef ARCH
+
+ARCH=$(shell uname -m)
+ifeq "$(ARCH)" "aarch64"
+ ARCH:=arm64
+endif
+
+ifeq "$(ARCH)" "i686"
+ ARCH:=x86
+endif
+endif
+
+AFL_QEMU_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TEST_BIN) -s LLVMFuzzerTestOneInput -b 0x4000000000)
+
+ifeq "$(ARCH)" "aarch64"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TEST_BIN) -s LLVMFuzzerTestOneInput -b 0x0000aaaaaaaaa000)
+endif
+
+ifeq "$(ARCH)" "x86_64"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TEST_BIN) -s LLVMFuzzerTestOneInput -b 0x0000555555554000)
+endif
+
+ifeq "$(ARCH)" "x86"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TEST_BIN) -s LLVMFuzzerTestOneInput -b 0x56555000)
+endif
+
+.PHONY: all clean qemu frida hook
+
+all: $(TEST_BIN)
+	make -C $(ROOT)frida_mode/
+
+32:
+	CXXFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
+
+$(BUILD_DIR):
+	mkdir -p $@
+
+######### HARNESS ########
+$(HARNESS_BUILD_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(HARNESS_FILE): | $(HARNESS_BUILD_DIR)
+	wget -O $@ $(HARNESS_URL)
+
+$(HARNESS_OBJ): $(HARNESS_FILE)
+	$(CC) $(CXXFLAGS) $(LDFLAGS) -o $@ -c $<
+
+######### RE2TEST ########
+
+$(RE2TEST_BUILD_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(RE2TEST_FILE): | $(RE2TEST_BUILD_DIR)
+	wget -O $@ $(RE2TEST_URL)
+
+$(RE2TEST_OBJ): $(RE2TEST_FILE) | $(LIBRE2_MAKEFILE)
+	$(CXX) $(CXXFLAGS) $(LDFLAGS) -std=c++11 -I $(LIBRE2_DIR) -o $@ -c $<
+
+######### LIBRE2 ########
+
+$(LIBRE2_BUILD_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(LIBRE2_MAKEFILE): $(LIBRE2_BUILD_DIR)
+	git clone https://github.com/google/re2.git $(LIBRE2_DIR)
+	cd $(LIBRE2_DIR) && git checkout 499ef7eff7455ce9c9fae86111d4a77b6ac335de
+
+$(LIBRE2_LIB): $(LIBRE2_MAKEFILE)
+	make -C $(LIBRE2_DIR) -j $(shell nproc)
+
+######### TEST ########
+
+$(TEST_BIN): $(HARNESS_OBJ) $(RE2TEST_OBJ) $(LIBRE2_LIB)
+	$(CXX) \
+		$(CFLAGS) \
+		-o $@ \
+		$(HARNESS_OBJ) $(RE2TEST_OBJ) $(LIBRE2_LIB) \
+		-lz \
+		$(LDFLAGS) \
+		$(TEST_BIN_LDFLAGS) \
+
+########## HOOK ########
+
+$(AFLPP_DRIVER_HOOK_OBJ): $(AFLPP_DRIVER_HOOK_SRC) | $(BUILD_DIR)
+	$(CC) -shared $(CFLAGS) $(LDFLAGS) $< -o $@
+
+########## DUMMY #######
+
+$(TEST_DATA_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(AFLPP_DRIVER_DUMMY_INPUT): | $(TEST_DATA_DIR)
+	truncate -s 1M $@
+
+###### TEST DATA #######
+
+hook: $(AFLPP_DRIVER_HOOK_OBJ)
+
+clean:
+	rm -rf $(BUILD_DIR)
+
+qemu: $(TEST_BIN) $(AFLPP_DRIVER_HOOK_OBJ) $(AFLPP_DRIVER_DUMMY_INPUT)
+	AFL_QEMU_PERSISTENT_HOOK=$(AFLPP_DRIVER_HOOK_OBJ) \
+	AFL_ENTRYPOINT=$(AFL_QEMU_PERSISTENT_ADDR) \
+	AFL_QEMU_PERSISTENT_ADDR=$(AFL_QEMU_PERSISTENT_ADDR) \
+	AFL_QEMU_PERSISTENT_GPR=1 \
+	$(ROOT)afl-fuzz \
+		-D \
+		-V 30 \
+		-Q \
+		-i $(TEST_DATA_DIR) \
+		-o $(QEMU_OUT) \
+		-- \
+			$(TEST_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
+
+frida: $(TEST_BIN) $(AFLPP_DRIVER_HOOK_OBJ) $(AFLPP_DRIVER_DUMMY_INPUT)
+	AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_DRIVER_HOOK_OBJ) \
+	AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
+	AFL_ENTRYPOINT=$(AFL_FRIDA_PERSISTENT_ADDR) \
+	$(ROOT)afl-fuzz \
+		-D \
+		-V 30 \
+		-O \
+		-i $(TEST_DATA_DIR) \
+		-o $(FRIDA_OUT) \
+		-- \
+			$(TEST_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
+
+debug:
+	gdb \
+		--ex 'set environment LD_PRELOAD=$(ROOT)afl-frida-trace.so' \
+		--ex 'set disassembly-flavor intel' \
+		--args $(TEST_BIN) $(TEST_DATA_DIR)basn0g01.re2
diff --git a/frida_mode/test/re2/Makefile b/frida_mode/test/re2/Makefile
new file mode 100644
index 00000000..00b2b287
--- /dev/null
+++ b/frida_mode/test/re2/Makefile
@@ -0,0 +1,22 @@
+all:
+	@echo trying to use GNU make...
+	@gmake all || echo please install GNUmake
+
+32:
+	@echo trying to use GNU make...
+	@gmake 32 || echo please install GNUmake
+
+clean:
+	@gmake clean
+
+qemu:
+	@gmake qemu
+
+frida:
+	@gmake frida
+
+debug:
+	@gmake debug
+
+hook:
+	@gmake hook
diff --git a/frida_mode/test/re2/aflpp_qemu_driver_hook.c b/frida_mode/test/re2/aflpp_qemu_driver_hook.c
new file mode 100644
index 00000000..059d438d
--- /dev/null
+++ b/frida_mode/test/re2/aflpp_qemu_driver_hook.c
@@ -0,0 +1,97 @@
+#include <stdint.h>
+#include <string.h>
+
+#if defined(__x86_64__)
+
+struct x86_64_regs {
+
+  uint64_t rax, rbx, rcx, rdx, rdi, rsi, rbp, r8, r9, r10, r11, r12, r13, r14,
+      r15;
+
+  union {
+
+    uint64_t rip;
+    uint64_t pc;
+
+  };
+
+  union {
+
+    uint64_t rsp;
+    uint64_t sp;
+
+  };
+
+  union {
+
+    uint64_t rflags;
+    uint64_t flags;
+
+  };
+
+  uint8_t zmm_regs[32][64];
+
+};
+
+void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
+                         uint8_t *input_buf, uint32_t input_buf_len) {
+
+  memcpy((void *)regs->rdi, input_buf, input_buf_len);
+  regs->rsi = input_buf_len;
+
+}
+
+#elif defined(__i386__)
+
+struct x86_regs {
+
+  uint32_t eax, ebx, ecx, edx, edi, esi, ebp;
+
+  union {
+
+    uint32_t eip;
+    uint32_t pc;
+
+  };
+
+  union {
+
+    uint32_t esp;
+    uint32_t sp;
+
+  };
+
+  union {
+
+    uint32_t eflags;
+    uint32_t flags;
+
+  };
+
+  uint8_t xmm_regs[8][16];
+
+};
+
+void afl_persistent_hook(struct x86_regs *regs, uint64_t guest_base,
+                         uint8_t *input_buf, uint32_t input_buf_len) {
+
+  void **esp = (void **)regs->esp;
+  void * arg1 = esp[1];
+  void **arg2 = &esp[2];
+  memcpy(arg1, input_buf, input_buf_len);
+  *arg2 = (void *)input_buf_len;
+
+}
+
+#else
+  #pragma error "Unsupported architecture"
+#endif
+
+int afl_persistent_hook_init(void) {
+
+  // 1 for shared memory input (faster), 0 for normal input (you have to use
+  // read(), input_buf will be NULL)
+  return 1;
+
+}
+
diff --git a/frida_mode/test/re2/get_symbol_addr.py b/frida_mode/test/re2/get_symbol_addr.py
new file mode 100755
index 00000000..1c46e010
--- /dev/null
+++ b/frida_mode/test/re2/get_symbol_addr.py
@@ -0,0 +1,36 @@
+#!/usr/bin/python3
+import argparse
+from elftools.elf.elffile import ELFFile
+
+def process_file(file, symbol, base):
+    with open(file, 'rb') as f:
+        elf = ELFFile(f)
+        symtab = elf.get_section_by_name('.symtab')
+        mains = symtab.get_symbol_by_name(symbol)
+        if len(mains) != 1:
+            print ("Failed to find main")
+            return 1
+
+        main_addr = mains[0]['st_value']
+        main = base + main_addr
+        print ("0x%016x" % main)
+        return 0
+
+def hex_value(x):
+    return int(x, 16)
+
+def main():
+    parser = argparse.ArgumentParser(description='Process some integers.')
+    parser.add_argument('-f', '--file', dest='file', type=str,
+                    help='elf file name', required=True)
+    parser.add_argument('-s', '--symbol', dest='symbol', type=str,
+                    help='symbol name', required=True)
+    parser.add_argument('-b', '--base', dest='base', type=hex_value,
+                    help='elf base address', required=True)
+
+    args = parser.parse_args()
+    return process_file (args.file, args.symbol, args.base)
+
+if __name__ == "__main__":
+    ret = main()
+    exit(ret)
-- 
cgit 1.4.1


From 6883605d1314503ad6ef8aadcadc90222da5c576 Mon Sep 17 00:00:00 2001
From: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>
Date: Fri, 28 May 2021 23:43:14 +0100
Subject: Support writing Stalker stats (#945)

* Support writing Stalker stats

* Fixed string handling in print functions

Co-authored-by: Your Name <you@example.com>
---
 frida_mode/GNUmakefile                       |    4 -
 frida_mode/README.md                         |  148 +-
 frida_mode/include/instrument.h              |    1 +
 frida_mode/include/output.h                  |    9 +
 frida_mode/include/stats.h                   |   28 +
 frida_mode/src/instrument/instrument.c       |    5 +
 frida_mode/src/instrument/instrument_debug.c |   88 +-
 frida_mode/src/main.c                        |    4 +
 frida_mode/src/output.c                      |   45 +
 frida_mode/src/stats/stats.c                 |  208 ++
 frida_mode/src/stats/stats_arm.c             |   36 +
 frida_mode/src/stats/stats_arm64.c           |   36 +
 frida_mode/src/stats/stats_x64.c             |  307 +++
 frida_mode/src/stats/stats_x86.c             |   36 +
 frida_mode/test/output/GNUmakefile           |   47 +
 frida_mode/test/output/Makefile              |   13 +
 frida_mode/test/output/frida_stderr.txt      | 2824 ++++++++++++++++++++++++++
 frida_mode/test/output/frida_stdout.txt      |  349 ++++
 frida_mode/test/output/testinstr.c           |  112 +
 include/envs.h                               |    7 +-
 20 files changed, 4241 insertions(+), 66 deletions(-)
 create mode 100644 frida_mode/include/output.h
 create mode 100644 frida_mode/include/stats.h
 create mode 100644 frida_mode/src/output.c
 create mode 100644 frida_mode/src/stats/stats.c
 create mode 100644 frida_mode/src/stats/stats_arm.c
 create mode 100644 frida_mode/src/stats/stats_arm64.c
 create mode 100644 frida_mode/src/stats/stats_x64.c
 create mode 100644 frida_mode/src/stats/stats_x86.c
 create mode 100644 frida_mode/test/output/GNUmakefile
 create mode 100644 frida_mode/test/output/Makefile
 create mode 100644 frida_mode/test/output/frida_stderr.txt
 create mode 100644 frida_mode/test/output/frida_stdout.txt
 create mode 100644 frida_mode/test/output/testinstr.c

(limited to 'frida_mode/src/main.c')

diff --git a/frida_mode/GNUmakefile b/frida_mode/GNUmakefile
index f9c0f1f7..a0387cac 100644
--- a/frida_mode/GNUmakefile
+++ b/frida_mode/GNUmakefile
@@ -36,10 +36,6 @@ else
 CFLAGS+=-Wno-pointer-arith
 endif
 
-ifdef FRIDA_DEBUG
-CFLAGS += -DFRIDA_DEBUG
-endif
-
 FRIDA_BUILD_DIR:=$(BUILD_DIR)frida/
 FRIDA_TRACE:=$(BUILD_DIR)afl-frida-trace.so
 FRIDA_TRACE_EMBEDDED:=$(BUILD_DIR)afl-frida-trace-embedded
diff --git a/frida_mode/README.md b/frida_mode/README.md
index ecce0bfd..0103a395 100644
--- a/frida_mode/README.md
+++ b/frida_mode/README.md
@@ -21,7 +21,7 @@ perhaps leverage some of its design and implementation.
   | Feature/Instrumentation  | frida-mode | Notes                                        |
   | -------------------------|:----------:|:--------------------------------------------:|
   | NeverZero                |     x      |                                              |
-  | Persistent Mode          |     x      | (x86/x64 only)(Only on function boundaries)  |  
+  | Persistent Mode          |     x      | (x86/x64 only)(Only on function boundaries)  |
   | LAF-Intel / CompCov      |     -      | (CMPLOG is better 90% of the time)           |
   | CMPLOG                   |     x      | (x86/x64 only)                               |
   | Selective Instrumentation|     x      |                                              |
@@ -43,16 +43,16 @@ system does not support cross compilation.
 
 ## Getting Started
 
-To build everything run `make`. To build for x86 run `make 32`. Note that in 
+To build everything run `make`. To build for x86 run `make 32`. Note that in
 x86 bit mode, it is not necessary for afl-fuzz to be built for 32-bit. However,
 the shared library for frida_mode must be since it is injected into the target
 process.
 
 Various tests can be found in subfolders within the `test/` directory. To use
 these, first run `make` to build any dependencies. Then run `make qemu` or
-`make frida` to run on either QEMU of FRIDA mode respectively. To run frida 
-tests in 32-bit mode, run `make ARCH=x86 frida`. When switching between 
-architectures it may be necessary to run `make clean` first for a given build 
+`make frida` to run on either QEMU of FRIDA mode respectively. To run frida
+tests in 32-bit mode, run `make ARCH=x86 frida`. When switching between
+architectures it may be necessary to run `make clean` first for a given build
 target to remove previously generated binaries for a different architecture.
 
 ## Usage
@@ -74,6 +74,8 @@ following options are currently supported:
 * `AFL_FRIDA_PERSISTENT_ADDR` - See `AFL_QEMU_PERSISTENT_ADDR`
 * `AFL_FRIDA_PERSISTENT_CNT` - See `AFL_QEMU_PERSISTENT_CNT`
 * `AFL_FRIDA_PERSISTENT_HOOK` - See `AFL_QEMU_PERSISTENT_HOOK`
+* `AFL_FRIDA_PERSISTENT_RET` - See `AFL_QEMU_PERSISTENT_RET`
+* `AFL_FRIDA_PERSISTENT_RETADDR_OFFSET` - See `AFL_QEMU_PERSISTENT_RETADDR_OFFSET`
 
 To enable the powerful CMPLOG mechanism, set `-c 0` for `afl-fuzz`.
 
@@ -127,34 +129,144 @@ instances run CMPLOG mode and instrumentation of the binary is less frequent
 
 ## Advanced configuration options
 
+* `AFL_FRIDA_INST_DEBUG_FILE` - File to write raw assembly of original blocks
+and their instrumented counterparts during block compilation.
+```
+***
+
+Creating block for 0x7ffff7953313:
+        0x7ffff7953313  mov qword ptr [rax], 0
+        0x7ffff795331a  add rsp, 8
+        0x7ffff795331e  ret
+
+Generated block 0x7ffff75e98e2
+        0x7ffff75e98e2  mov qword ptr [rax], 0
+        0x7ffff75e98e9  add rsp, 8
+        0x7ffff75e98ed  lea rsp, [rsp - 0x80]
+        0x7ffff75e98f5  push rcx
+        0x7ffff75e98f6  movabs rcx, 0x7ffff795331e
+        0x7ffff75e9900  jmp 0x7ffff75e9384
+
+
+***
+```
 * `AFL_FRIDA_INST_NO_OPTIMIZE` - Don't use optimized inline assembly coverage
 instrumentation (the default where available). Required to use
 `AFL_FRIDA_INST_TRACE`.
 * `AFL_FRIDA_INST_NO_PREFETCH` - Disable prefetching. By default the child will
 report instrumented blocks back to the parent so that it can also instrument
 them and they be inherited by the next child on fork.
-* `AFL_FRIDA_INST_TRACE` - Generate some logging when running instrumented code.
-Requires `AFL_FRIDA_INST_NO_OPTIMIZE`.
-
+* `AFL_FRIDA_INST_TRACE` - Log to stdout the address of executed blocks
+`AFL_FRIDA_INST_NO_OPTIMIZE`.
+* `AFL_FRIDA_OUTPUT_STDOUT` - Redirect the standard output of the target
+application to the named file (supersedes the setting of `AFL_DEBUG_CHILD`)
+* `AFL_FRIDA_OUTPUT_STDERR` - Redirect the standard error of the target
+application to the named file (supersedes the setting of `AFL_DEBUG_CHILD`)
+* `AFL_FRIDA_PERSISTENT_DEBUG` - Insert a Breakpoint into the instrumented code
+at `AFL_FRIDA_PERSISTENT_HOOK` and `AFL_FRIDA_PERSISTENT_RET` to allow the user
+to determine the value of `AFL_FRIDA_PERSISTENT_RETADDR_OFFSET` using a
+debugger.
+
+```
+
+gdb \
+		--ex 'set environment AFL_FRIDA_PERSISTENT_ADDR=XXXXXXXXXX' \
+		--ex 'set environment AFL_FRIDA_PERSISTENT_RET=XXXXXXXXXX' \
+		--ex 'set environment AFL_FRIDA_PERSISTENT_DEBUG=1' \
+		--ex 'set environment AFL_DEBUG_CHILD=1' \
+		--ex 'set environment LD_PRELOAD=afl-frida-trace.so' \
+		--args <my-executable> [my arguments]
+
+```
+* `AFL_FRIDA_STATS_FILE` - Write statistics information about the code being
+instrumented to the given file name. The statistics are written only for the
+child process when new block is instrumented (when the
+`AFL_FRIDA_STATS_INTERVAL` has expired). Note that simply because a new path is
+found does not mean a new block needs to be compiled. It could simply be that
+the existing blocks instrumented have been executed in a different order.
+```
+stats
+-----
+Index:                          2
+Pid:                            1815944
+Time:                           2021-05-28 15:26:41
+Blocks:                         1985
+Instructions:                   9192
+Avg Instructions / Block:       4
+
+Call Immediates:                391 (4.25%)
+Call Immediates Excluded:       65 (0.71%)
+Call Register:                  0 (0.00%)
+Call Memory:                    0 (0.00%)
+
+Jump Immediates:                202 (2.20%)
+Jump Register:                  10 (0.11%)
+Jump Memory:                    12 (0.13%)
+
+Conditional Jump Immediates:    1210 (13.16%)
+Conditional Jump CX Immediate:  0 (0.00%)
+Conditional Jump Register:      0 (0.00%)
+Conditional Jump Memory:        0 (0.00%)
+
+Returns:                        159 (0.00%)
+
+Rip Relative:                   247 (0.00%)
+
+```
+* `AFL_FRIDA_STATS_INTERVAL` - The maximum frequency to output statistics
+information. Stats will be written whenever they are updated if the given
+interval has elapsed since last time they were written.
+* `AFL_FRIDA_STATS_TRANSITIONS` - Also dump the internal stalker counters to
+stderr when the regular stats are written. Note that these stats are reset in
+the child each time a new fork occurs since they are not stored in shared
+memory. Unfortunately, these stats are internal to stalker, so this is the best
+we can do for now.
+```
+stats
+-----
+Index: 2
+Pid:   1816794
+Time:  2021-05-28 15:26:41
+
+
+total_transitions: 786
+        call_imms: 97
+        call_regs: 0
+        call_mems: 0
+        post_call_invokes: 86
+        excluded_call_imms: 29
+        ret_slow_paths: 23
+
+        jmp_imms: 58
+        jmp_mems: 7
+        jmp_regs: 26
+
+        jmp_cond_imms: 460
+        jmp_cond_mems: 0
+        jmp_cond_regs: 0
+        jmp_cond_jcxzs: 0
+
+        jmp_continuations: 0
+```
 ## FASAN - Frida Address Sanitizer Mode
 Frida mode also supports FASAN. The design of this is actually quite simple and
 very similar to that used when instrumenting applications compiled from source.
 
 ### Address Sanitizer Basics
 
-When Address Sanitizer is used to instrument programs built from source, the 
+When Address Sanitizer is used to instrument programs built from source, the
 compiler first adds a dependency (`DT_NEEDED` entry) for the Address Sanitizer
 dynamic shared object (DSO). This shared object contains the main logic for Address
 Sanitizer, including setting and managing up the shadow memory. It also provides
-replacement implementations for a number of functions in standard libraries. 
+replacement implementations for a number of functions in standard libraries.
 
 These replacements include things like `malloc` and `free` which allows for those
 allocations to be marked in the shadow memory, but also a number of other fuctions.
-Consider `memcpy` for example, this is instrumented to validate the paramters 
-(test the source and destination buffers against the shadow memory. This is much 
-easier than instrumenting those standard libraries since, first it would require 
+Consider `memcpy` for example, this is instrumented to validate the paramters
+(test the source and destination buffers against the shadow memory. This is much
+easier than instrumenting those standard libraries since, first it would require
 you to re-compile them and secondly it would mean that the instrumentation would
-be applied at a more expensive granular level. Lastly, load-widening (typically 
+be applied at a more expensive granular level. Lastly, load-widening (typically
 found in highy optimized code) can also make this instrumentation more difficult.
 
 Since the DSO is loaded before all of the standard libraries (in fact it insists
@@ -165,9 +277,9 @@ modules which depend on it.
 
 FASAN takes a similar approach. It requires the user to add the Address Sanitizer
 DSO to the `AFL_PRELOAD` environment variable such that it is loaded into the target.
-Again, it must be first in the list. This means that it is not necessary to 
-instrument the standard libraries to detect when an application has provided an 
-incorrect argument to `memcpy` for example. This avoids issues with load-widening 
+Again, it must be first in the list. This means that it is not necessary to
+instrument the standard libraries to detect when an application has provided an
+incorrect argument to `memcpy` for example. This avoids issues with load-widening
 and should also mean a huge improvement in performance.
 
 FASAN then adds instrumentation for any instrucutions which use memory operands and
@@ -176,7 +288,7 @@ to validate memory accesses against the shadow memory.
 
 ## TODO
 
-The next features to be added are Aarch64 and Aarch32 support as well as looking at 
+The next features to be added are Aarch64 and Aarch32 support as well as looking at
 potential performance improvements. The intention is to achieve feature parity with
 QEMU mode in due course. Contributions are welcome, but please get in touch to
 ensure that efforts are deconflicted.
diff --git a/frida_mode/include/instrument.h b/frida_mode/include/instrument.h
index 75ee6396..ed92c25a 100644
--- a/frida_mode/include/instrument.h
+++ b/frida_mode/include/instrument.h
@@ -19,6 +19,7 @@ gboolean instrument_is_coverage_optimize_supported(void);
 void instrument_coverage_optimize(const cs_insn *   instr,
                                   GumStalkerOutput *output);
 
+void instrument_debug_init(void);
 void instrument_debug_start(uint64_t address, GumStalkerOutput *output);
 void instrument_debug_instruction(uint64_t address, uint16_t size);
 void instrument_debug_end(GumStalkerOutput *output);
diff --git a/frida_mode/include/output.h b/frida_mode/include/output.h
new file mode 100644
index 00000000..53a9fdd3
--- /dev/null
+++ b/frida_mode/include/output.h
@@ -0,0 +1,9 @@
+#ifndef _OUTPUT_H
+#define _OUTPUT_H
+
+#include "frida-gum.h"
+
+void output_init(void);
+
+#endif
+
diff --git a/frida_mode/include/stats.h b/frida_mode/include/stats.h
new file mode 100644
index 00000000..4271132a
--- /dev/null
+++ b/frida_mode/include/stats.h
@@ -0,0 +1,28 @@
+#ifndef _STATS_H
+#define _STATS_H
+
+#include "frida-gum.h"
+
+typedef struct {
+
+  guint64 num_blocks;
+  guint64 num_instructions;
+  guint64 stats_last_time;
+  guint64 stats_idx;
+  guint64 transitions_idx;
+
+} stats_data_header_t;
+
+extern stats_data_header_t *stats_data;
+
+void stats_init(void);
+void stats_collect(const cs_insn *instr, gboolean begin);
+void stats_print(char *format, ...);
+
+gboolean stats_is_supported_arch(void);
+size_t   stats_data_size_arch(void);
+void     stats_collect_arch(const cs_insn *instr);
+void     stats_write_arch(void);
+
+#endif
+
diff --git a/frida_mode/src/instrument/instrument.c b/frida_mode/src/instrument/instrument.c
index c4f18797..cd1ac0be 100644
--- a/frida_mode/src/instrument/instrument.c
+++ b/frida_mode/src/instrument/instrument.c
@@ -13,6 +13,7 @@
 #include "prefetch.h"
 #include "ranges.h"
 #include "stalker.h"
+#include "stats.h"
 #include "util.h"
 
 static gboolean               tracing = false;
@@ -113,6 +114,9 @@ static void instr_basic_block(GumStalkerIterator *iterator,
      * fork-server and thus start executing in the child.
      */
     excluded = range_is_excluded(GSIZE_TO_POINTER(instr->address));
+
+    stats_collect(instr, begin);
+
     if (unlikely(begin)) {
 
       instrument_debug_start(instr->address, output);
@@ -180,6 +184,7 @@ void instrument_init(void) {
   transformer =
       gum_stalker_transformer_make_from_callback(instr_basic_block, NULL, NULL);
 
+  instrument_debug_init();
   asan_init();
   cmplog_init();
 
diff --git a/frida_mode/src/instrument/instrument_debug.c b/frida_mode/src/instrument/instrument_debug.c
index 3a554ad0..124843d8 100644
--- a/frida_mode/src/instrument/instrument_debug.c
+++ b/frida_mode/src/instrument/instrument_debug.c
@@ -1,26 +1,34 @@
+#include <fcntl.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <unistd.h>
 
 #include "frida-gum.h"
 
-#include "util.h"
+#include "debug.h"
 
-#ifdef FRIDA_DEBUG
+#include "util.h"
 
+static int      debugging_fd = -1;
 static gpointer instrument_gen_start = NULL;
 
 static void instrument_debug(char *format, ...) {
 
   va_list ap;
   char    buffer[4096] = {0};
+  int     ret;
+  int len;
 
   va_start(ap, format);
 
-  vsnprintf(buffer, sizeof(buffer) - 1, format, ap);
+  ret = vsnprintf(buffer, sizeof(buffer) - 1, format, ap);
   va_end(ap);
 
-  IGNORED_RETURN(write(STDOUT_FILENO, buffer, sizeof(buffer)));
+  if (ret < 0) { return; }
+
+  len = strnlen(buffer, sizeof(buffer));
+
+  IGNORED_RETURN(write(debugging_fd, buffer, len));
 
 }
 
@@ -53,76 +61,70 @@ static void instrument_disasm(guint8 *code, guint size) {
 
 static gpointer instrument_cur(GumStalkerOutput *output) {
 
-  #if defined(__i386__) || defined(__x86_64__)
+#if defined(__i386__) || defined(__x86_64__)
   return gum_x86_writer_cur(output->writer.x86);
-  #elif defined(__aarch64__)
+#elif defined(__aarch64__)
   return gum_arm64_writer_cur(output->writer.arm64);
-  #elif defined(__arm__)
+#elif defined(__arm__)
   return gum_arm_writer_cur(output->writer.arm);
-  #else
-    #error "Unsupported architecture"
-  #endif
+#else
+  #error "Unsupported architecture"
+#endif
 
 }
 
-void instrument_debug_start(uint64_t address, GumStalkerOutput *output) {
-
-  GumDebugSymbolDetails details;
+void instrument_debug_init(void) {
 
-  instrument_gen_start = instrument_cur(output);
+  char *filename = getenv("AFL_FRIDA_INST_DEBUG_FILE");
+  OKF("Instrumentation debugging - enabled [%c]", filename == NULL ? ' ' : 'X');
 
-  if (gum_symbol_details_from_address(GSIZE_TO_POINTER(address), &details)) {
+  if (filename == NULL) { return; }
 
-    instrument_debug("\n\n***\n\nCreating block for 0x%" G_GINT64_MODIFIER
-                     "x (%s!%s):\n",
-                     address, details.module_name, details.symbol_name);
+  OKF("Instrumentation debugging - file [%s]", filename);
 
-  } else {
+  if (filename == NULL) { return; }
 
-    instrument_debug(
-        "\n\n***\n\nCreating block for 0x%" G_GINT64_MODIFIER "x:\n", address);
+  char *path = g_canonicalize_filename(filename, g_get_current_dir());
 
-  }
+  OKF("Instrumentation debugging - path [%s]", path);
 
-}
+  debugging_fd = open(path, O_RDWR | O_CREAT | O_TRUNC,
+                      S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
 
-void instrument_debug_instruction(uint64_t address, uint16_t size) {
+  if (debugging_fd < 0) { FATAL("Failed to open stats file '%s'", path); }
 
-  uint8_t *start = (uint8_t *)GSIZE_TO_POINTER(address);
-  instrument_disasm(start, size);
+  g_free(path);
 
 }
 
-void instrument_debug_end(GumStalkerOutput *output) {
-
-  gpointer instrument_gen_end = instrument_cur(output);
-  uint16_t size = GPOINTER_TO_SIZE(instrument_gen_end) -
-                  GPOINTER_TO_SIZE(instrument_gen_start);
-
-  instrument_debug("\nGenerated block %p\n", instrument_gen_start);
-  instrument_disasm(instrument_gen_start, size);
+void instrument_debug_start(uint64_t address, GumStalkerOutput *output) {
 
-}
+  if (likely(debugging_fd < 0)) { return; }
 
-#else
-void instrument_debug_start(void *address) {
+  instrument_gen_start = instrument_cur(output);
 
-  UNUSED_PARAMETER(address);
+  instrument_debug("\n\n***\n\nCreating block for 0x%" G_GINT64_MODIFIER "x:\n",
+                   address);
 
 }
 
 void instrument_debug_instruction(uint64_t address, uint16_t size) {
 
-  UNUSED_PARAMETER(address);
-  UNUSED_PARAMETER(size);
+  if (likely(debugging_fd < 0)) { return; }
+  uint8_t *start = (uint8_t *)GSIZE_TO_POINTER(address);
+  instrument_disasm(start, size);
 
 }
 
 void instrument_debug_end(GumStalkerOutput *output) {
 
-  UNUSED_PARAMETER(output);
+  if (likely(debugging_fd < 0)) { return; }
+  gpointer instrument_gen_end = instrument_cur(output);
+  uint16_t size = GPOINTER_TO_SIZE(instrument_gen_end) -
+                  GPOINTER_TO_SIZE(instrument_gen_start);
 
-}
+  instrument_debug("\nGenerated block %p\n", instrument_gen_start);
+  instrument_disasm(instrument_gen_start, size);
 
-#endif
+}
 
diff --git a/frida_mode/src/main.c b/frida_mode/src/main.c
index e8015905..1ab9993f 100644
--- a/frida_mode/src/main.c
+++ b/frida_mode/src/main.c
@@ -19,10 +19,12 @@
 #include "instrument.h"
 #include "interceptor.h"
 #include "lib.h"
+#include "output.h"
 #include "persistent.h"
 #include "prefetch.h"
 #include "ranges.h"
 #include "stalker.h"
+#include "stats.h"
 #include "util.h"
 
 #ifdef __APPLE__
@@ -95,9 +97,11 @@ void afl_frida_start() {
   lib_init();
   entry_init();
   instrument_init();
+  output_init();
   persistent_init();
   prefetch_init();
   ranges_init();
+  stats_init();
 
   void *fork_addr =
       GSIZE_TO_POINTER(gum_module_find_export_by_name(NULL, "fork"));
diff --git a/frida_mode/src/output.c b/frida_mode/src/output.c
new file mode 100644
index 00000000..8a222b25
--- /dev/null
+++ b/frida_mode/src/output.c
@@ -0,0 +1,45 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "output.h"
+
+static int output_fd = -1;
+
+static void output_redirect(int fd, char *variable) {
+
+  char *filename = getenv(variable);
+  char *path = NULL;
+
+  if (filename == NULL) { return; }
+
+  path = g_canonicalize_filename(filename, g_get_current_dir());
+
+  OKF("Redirect %d -> '%s'", fd, path);
+
+  output_fd = open(path, O_RDWR | O_CREAT | O_TRUNC,
+                   S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+
+  g_free(path);
+
+  if (output_fd < 0) { FATAL("Failed to open fd(%d) error %d", fd, errno); }
+
+  if (dup2(output_fd, fd) < 0) {
+
+    FATAL("Failed to set fd(%d) error %d", fd, errno);
+
+  }
+
+}
+
+void output_init(void) {
+
+  output_redirect(STDOUT_FILENO, "AFL_FRIDA_OUTPUT_STDOUT");
+  output_redirect(STDERR_FILENO, "AFL_FRIDA_OUTPUT_STDERR");
+
+}
+
diff --git a/frida_mode/src/stats/stats.c b/frida_mode/src/stats/stats.c
new file mode 100644
index 00000000..890a8d6b
--- /dev/null
+++ b/frida_mode/src/stats/stats.c
@@ -0,0 +1,208 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/shm.h>
+#include <sys/mman.h>
+
+#include "frida-gum.h"
+
+#include "config.h"
+#include "debug.h"
+#include "util.h"
+
+#include "stats.h"
+
+#define MICRO_TO_SEC 1000000
+
+stats_data_header_t *stats_data = NULL;
+
+static int      stats_parent_pid = -1;
+static int      stats_fd = -1;
+static gboolean stats_transitions = FALSE;
+static guint64  stats_interval = 0;
+
+void stats_init(void) {
+
+  stats_parent_pid = getpid();
+  char *filename = getenv("AFL_FRIDA_STATS_FILE");
+  stats_interval = util_read_num("AFL_FRIDA_STATS_INTERVAL");
+  if (getenv("AFL_FRIDA_STATS_TRANSITIONS") != NULL) {
+
+    stats_transitions = TRUE;
+
+  }
+
+  OKF("Stats - file [%s]", filename);
+  OKF("Stats - interval [%" G_GINT64_MODIFIER "u]", stats_interval);
+
+  if (stats_interval != 0 && filename == NULL) {
+
+    FATAL(
+        "AFL_FRIDA_STATS_FILE must be specified if "
+        "AFL_FRIDA_STATS_INTERVAL is");
+
+  }
+
+  if (stats_interval == 0) { stats_interval = 10; }
+
+  if (filename == NULL) { return; }
+
+  if (!stats_is_supported_arch()) {
+
+    FATAL("Stats is not supported on this architecture");
+
+  }
+
+  char *path = NULL;
+
+  if (filename == NULL) { return; }
+
+  if (stats_transitions) { gum_stalker_set_counters_enabled(TRUE); }
+
+  path = g_canonicalize_filename(filename, g_get_current_dir());
+
+  OKF("Stats - path [%s]", path);
+
+  stats_fd = open(path, O_RDWR | O_CREAT | O_TRUNC,
+                  S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+
+  if (stats_fd < 0) { FATAL("Failed to open stats file '%s'", path); }
+
+  g_free(path);
+
+  size_t data_size = stats_data_size_arch();
+
+  int shm_id = shmget(IPC_PRIVATE, data_size, IPC_CREAT | IPC_EXCL | 0600);
+  if (shm_id < 0) { FATAL("shm_id < 0 - errno: %d\n", errno); }
+
+  stats_data = shmat(shm_id, NULL, 0);
+  g_assert(stats_data != MAP_FAILED);
+
+  /*
+   * Configure the shared memory region to be removed once the process dies.
+   */
+  if (shmctl(shm_id, IPC_RMID, NULL) < 0) {
+
+    FATAL("shmctl (IPC_RMID) < 0 - errno: %d\n", errno);
+
+  }
+
+  /* Clear it, not sure it's necessary, just seems like good practice */
+  memset(stats_data, '\0', data_size);
+
+}
+
+void stats_vprint(int fd, char *format, va_list ap) {
+
+  char buffer[4096] = {0};
+  int ret;
+  int  len;
+
+  if(vsnprintf(buffer, sizeof(buffer) - 1, format, ap) < 0) { return; }
+
+  len = strnlen(buffer, sizeof(buffer));
+  IGNORED_RETURN(write(fd, buffer, len));
+
+}
+
+void stats_print_fd(int fd, char *format, ...) {
+
+  va_list ap;
+  va_start(ap, format);
+  stats_vprint(fd, format, ap);
+  va_end(ap);
+
+}
+
+void stats_print(char *format, ...) {
+
+  va_list ap;
+  va_start(ap, format);
+  stats_vprint(stats_fd, format, ap);
+  va_end(ap);
+
+}
+
+void stats_write(void) {
+
+  if (stats_parent_pid == getpid()) { return; }
+
+  GDateTime *date_time = g_date_time_new_now_local();
+  char *date_time_string = g_date_time_format(date_time, "%Y-%m-%e %H:%M:%S");
+
+  stats_print("stats\n");
+  stats_print("-----\n");
+
+  stats_print("Index:                          %" G_GINT64_MODIFIER "u\n",
+              stats_data->stats_idx++);
+  stats_print("Pid:                            %d\n", getpid());
+  stats_print("Time:                           %s\n", date_time_string);
+  stats_print("Blocks:                         %" G_GINT64_MODIFIER "u\n",
+              stats_data->num_blocks);
+  stats_print("Instructions:                   %" G_GINT64_MODIFIER "u\n",
+              stats_data->num_instructions);
+  stats_print("Avg Instructions / Block:       %" G_GINT64_MODIFIER "u\n",
+              stats_data->num_instructions / stats_data->num_blocks);
+
+  stats_print("\n");
+
+  g_free(date_time_string);
+  g_date_time_unref(date_time);
+
+  stats_write_arch();
+
+  if (stats_transitions) {
+
+    GDateTime *date_time = g_date_time_new_now_local();
+    char *date_time_string = g_date_time_format(date_time, "%Y-%m-%e %H:%M:%S");
+
+    stats_print_fd(STDERR_FILENO, "stats\n");
+    stats_print_fd(STDERR_FILENO, "-----\n");
+    stats_print_fd(STDERR_FILENO, "Index: %" G_GINT64_MODIFIER "u\n",
+                   stats_data->transitions_idx++);
+    stats_print_fd(STDERR_FILENO, "Pid:   %d\n", getpid());
+    stats_print_fd(STDERR_FILENO, "Time:  %s\n", date_time_string);
+
+    g_free(date_time_string);
+    g_date_time_unref(date_time);
+    gum_stalker_dump_counters();
+
+  }
+
+}
+
+static void stats_maybe_write(void) {
+
+  guint64 current_time;
+
+  if (stats_interval == 0) { return; }
+
+  current_time = g_get_monotonic_time();
+
+  if ((current_time - stats_data->stats_last_time) >
+      (stats_interval * MICRO_TO_SEC)) {
+
+    stats_write();
+    stats_data->stats_last_time = current_time;
+
+  }
+
+}
+
+void stats_collect(const cs_insn *instr, gboolean begin) {
+
+  UNUSED_PARAMETER(instr);
+  UNUSED_PARAMETER(begin);
+
+  if (stats_fd < 0) { return; }
+
+  if (begin) { stats_data->num_blocks++; }
+  stats_data->num_instructions++;
+
+  stats_collect_arch(instr);
+
+  stats_maybe_write();
+
+}
+
diff --git a/frida_mode/src/stats/stats_arm.c b/frida_mode/src/stats/stats_arm.c
new file mode 100644
index 00000000..7eea7f91
--- /dev/null
+++ b/frida_mode/src/stats/stats_arm.c
@@ -0,0 +1,36 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "stats.h"
+#include "util.h"
+
+#if defined(__arm__)
+
+gboolean stats_is_supported_arch(void) {
+
+  return FALSE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_write_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+  UNUSED_PARAMETER(instr);
+  FATAL("Stats not supported on this architecture");
+
+}
+
+#endif
+
diff --git a/frida_mode/src/stats/stats_arm64.c b/frida_mode/src/stats/stats_arm64.c
new file mode 100644
index 00000000..592af87a
--- /dev/null
+++ b/frida_mode/src/stats/stats_arm64.c
@@ -0,0 +1,36 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "stats.h"
+#include "util.h"
+
+#if defined(__aarch64__)
+
+gboolean stats_is_supported_arch(void) {
+
+  return FALSE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_write_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+  UNUSED_PARAMETER(instr);
+  FATAL("Stats not supported on this architecture");
+
+}
+
+#endif
+
diff --git a/frida_mode/src/stats/stats_x64.c b/frida_mode/src/stats/stats_x64.c
new file mode 100644
index 00000000..c3e8742a
--- /dev/null
+++ b/frida_mode/src/stats/stats_x64.c
@@ -0,0 +1,307 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "ranges.h"
+#include "stats.h"
+#include "util.h"
+
+#if defined(__x86_64__)
+
+typedef struct {
+
+  stats_data_header_t header;
+
+  guint64 num_call_imm;
+  guint64 num_call_imm_excluded;
+  guint64 num_call_reg;
+  guint64 num_call_mem;
+
+  guint64 num_jmp_imm;
+  guint64 num_jmp_reg;
+  guint64 num_jmp_mem;
+
+  guint64 num_jmp_cond_imm;
+  guint64 num_jmp_cond_reg;
+  guint64 num_jmp_cond_mem;
+
+  guint64 num_jmp_cond_jcxz;
+
+  guint64 num_ret;
+
+  guint64 num_rip_relative;
+
+} stats_data_arch_t;
+
+gboolean stats_is_supported_arch(void) {
+
+  return TRUE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+  return sizeof(stats_data_arch_t);
+
+}
+
+void stats_write_arch(void) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  guint64 num_instructions = stats_data_arch->header.num_instructions;
+
+  stats_print(
+      "Call Immediates:                %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_call_imm,
+      ((float)(stats_data_arch->num_call_imm * 100) / num_instructions));
+  stats_print("Call Immediates Excluded:       %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_call_imm_excluded,
+              ((float)(stats_data_arch->num_call_imm_excluded * 100) /
+               num_instructions));
+  stats_print(
+      "Call Register:                  %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_call_reg,
+      ((float)(stats_data_arch->num_call_reg * 100) / num_instructions));
+  stats_print(
+      "Call Memory:                    %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_call_mem,
+      ((float)(stats_data_arch->num_call_mem * 100) / num_instructions));
+
+  stats_print("\n");
+
+  stats_print("Jump Immediates:                %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_jmp_imm,
+              ((float)(stats_data_arch->num_jmp_imm * 100) / num_instructions));
+  stats_print("Jump Register:                  %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_jmp_reg,
+              ((float)(stats_data_arch->num_jmp_reg * 100) / num_instructions));
+  stats_print("Jump Memory:                    %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_jmp_mem,
+              ((float)(stats_data_arch->num_jmp_mem * 100) / num_instructions));
+
+  stats_print("\n");
+
+  stats_print(
+      "Conditional Jump Immediates:    %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_jmp_cond_imm,
+      ((float)(stats_data_arch->num_jmp_cond_imm * 100) / num_instructions));
+  stats_print(
+      "Conditional Jump CX Immediate:  %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_jmp_cond_jcxz,
+      ((float)(stats_data_arch->num_jmp_cond_jcxz * 100) / num_instructions));
+  stats_print(
+      "Conditional Jump Register:      %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_jmp_cond_reg,
+      ((float)(stats_data_arch->num_jmp_cond_reg * 100) / num_instructions));
+  stats_print(
+      "Conditional Jump Memory:        %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_jmp_cond_mem,
+      ((float)(stats_data_arch->num_jmp_cond_mem * 100) / num_instructions));
+
+  stats_print("\n");
+
+  stats_print("Returns:                        %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_ret,
+              (stats_data_arch->num_ret * 100 / num_instructions));
+
+  stats_print("\n");
+
+  stats_print("Rip Relative:                   %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_rip_relative,
+              (stats_data_arch->num_rip_relative * 100 / num_instructions));
+
+  stats_print("\n");
+  stats_print("\n");
+
+}
+
+static x86_op_type stats_get_operand_type(const cs_insn *instr) {
+
+  cs_x86 *   x86 = &instr->detail->x86;
+  cs_x86_op *operand;
+
+  if (x86->op_count != 1) {
+
+    FATAL("Unexpected operand count (%d): %s %s\n", x86->op_count,
+          instr->mnemonic, instr->op_str);
+
+  }
+
+  operand = &x86->operands[0];
+
+  return operand->type;
+
+}
+
+static void stats_collect_call_imm_excluded_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  cs_x86 *           x86 = &instr->detail->x86;
+  cs_x86_op *        operand = &x86->operands[0];
+
+  if (range_is_excluded((gpointer)operand->imm)) {
+
+    stats_data_arch->num_call_imm_excluded++;
+
+  }
+
+}
+
+static void stats_collect_call_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  x86_op_type        type = stats_get_operand_type(instr);
+  switch (type) {
+
+    case X86_OP_IMM:
+      stats_data_arch->num_call_imm++;
+      stats_collect_call_imm_excluded_arch(instr);
+      break;
+    case X86_OP_REG:
+      stats_data_arch->num_call_reg++;
+      break;
+    case X86_OP_MEM:
+      stats_data_arch->num_call_mem++;
+      break;
+    default:
+      FATAL("Invalid operand type: %s %s\n", instr->mnemonic, instr->op_str);
+
+  }
+
+}
+
+static void stats_collect_jump_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  x86_op_type        type = stats_get_operand_type(instr);
+  switch (type) {
+
+    case X86_OP_IMM:
+      stats_data_arch->num_jmp_imm++;
+      break;
+    case X86_OP_REG:
+      stats_data_arch->num_jmp_reg++;
+      break;
+    case X86_OP_MEM:
+      stats_data_arch->num_jmp_mem++;
+      break;
+    default:
+      FATAL("Invalid operand type: %s %s\n", instr->mnemonic, instr->op_str);
+
+  }
+
+}
+
+static void stats_collect_jump_cond_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  x86_op_type        type = stats_get_operand_type(instr);
+  switch (type) {
+
+    case X86_OP_IMM:
+      stats_data_arch->num_jmp_cond_imm++;
+      break;
+    case X86_OP_REG:
+      stats_data_arch->num_jmp_cond_reg++;
+      break;
+    case X86_OP_MEM:
+      stats_data_arch->num_jmp_cond_mem++;
+      break;
+    default:
+      FATAL("Invalid operand type: %s %s\n", instr->mnemonic, instr->op_str);
+
+  }
+
+}
+
+static void stats_collect_rip_relative_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  cs_x86 *           x86 = &instr->detail->x86;
+  guint              mod;
+  guint              rm;
+
+  if (x86->encoding.modrm_offset == 0) { return; }
+
+  mod = (x86->modrm & 0xc0) >> 6;
+  if (mod != 0) { return; }
+
+  rm = (x86->modrm & 0x07) >> 0;
+  if (rm != 5) { return; }
+
+  stats_data_arch->num_rip_relative++;
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  switch (instr->id) {
+
+    case X86_INS_CALL:
+      stats_collect_call_arch(instr);
+      break;
+    case X86_INS_JMP:
+      stats_collect_jump_arch(instr);
+      break;
+    case X86_INS_JA:
+    case X86_INS_JAE:
+    case X86_INS_JB:
+    case X86_INS_JBE:
+    case X86_INS_JE:
+    case X86_INS_JG:
+    case X86_INS_JGE:
+    case X86_INS_JL:
+    case X86_INS_JLE:
+    case X86_INS_JNE:
+    case X86_INS_JNO:
+    case X86_INS_JNP:
+    case X86_INS_JNS:
+    case X86_INS_JO:
+    case X86_INS_JP:
+    case X86_INS_JS:
+      stats_collect_jump_cond_arch(instr);
+      break;
+    case X86_INS_JECXZ:
+    case X86_INS_JRCXZ:
+      stats_data_arch->num_jmp_cond_jcxz++;
+      break;
+    case X86_INS_RET:
+      stats_data_arch->num_ret++;
+      break;
+    default:
+      stats_collect_rip_relative_arch(instr);
+      break;
+
+  }
+
+}
+
+#endif
+
diff --git a/frida_mode/src/stats/stats_x86.c b/frida_mode/src/stats/stats_x86.c
new file mode 100644
index 00000000..1906e809
--- /dev/null
+++ b/frida_mode/src/stats/stats_x86.c
@@ -0,0 +1,36 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "stats.h"
+#include "util.h"
+
+#if defined(__i386__)
+
+gboolean stats_is_supported_arch(void) {
+
+  return FALSE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_write_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+  UNUSED_PARAMETER(instr);
+  FATAL("Stats not supported on this architecture");
+
+}
+
+#endif
+
diff --git a/frida_mode/test/output/GNUmakefile b/frida_mode/test/output/GNUmakefile
new file mode 100644
index 00000000..eaa1c4dc
--- /dev/null
+++ b/frida_mode/test/output/GNUmakefile
@@ -0,0 +1,47 @@
+PWD:=$(shell pwd)/
+ROOT:=$(shell realpath $(PWD)../../..)/
+BUILD_DIR:=$(PWD)build/
+TESTINSTR_DATA_DIR:=$(BUILD_DIR)in/
+TESTINSTR_DATA_FILE:=$(TESTINSTR_DATA_DIR)in
+
+TESTINSTBIN:=$(BUILD_DIR)testinstr
+TESTINSTSRC:=$(PWD)testinstr.c
+
+QEMU_OUT:=$(BUILD_DIR)qemu-out
+FRIDA_OUT:=$(BUILD_DIR)frida-out
+
+.PHONY: all 32 clean qemu frida
+
+all: $(TESTINSTBIN)
+	make -C $(ROOT)frida_mode/
+
+32:
+	CFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
+
+$(BUILD_DIR):
+	mkdir -p $@
+
+$(TESTINSTR_DATA_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(TESTINSTR_DATA_FILE): | $(TESTINSTR_DATA_DIR)
+	echo -n "000" > $@
+
+$(TESTINSTBIN): $(TESTINSTSRC) | $(BUILD_DIR)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $<
+
+clean:
+	rm -rf $(BUILD_DIR)
+
+frida: $(TESTINSTBIN) $(TESTINSTR_DATA_FILE)
+	AFL_FRIDA_OUTPUT_STDOUT=frida_stdout.txt \
+	AFL_FRIDA_OUTPUT_STDERR=frida_stderr.txt \
+	AFL_FRIDA_STATS_FILE=frida_stats.txt \
+	AFL_FRIDA_STATS_INTERVAL=1 \
+	$(ROOT)afl-fuzz \
+		-D \
+		-O \
+		-i $(TESTINSTR_DATA_DIR) \
+		-o $(FRIDA_OUT) \
+		-- \
+			$(TESTINSTBIN) @@
diff --git a/frida_mode/test/output/Makefile b/frida_mode/test/output/Makefile
new file mode 100644
index 00000000..07b139e9
--- /dev/null
+++ b/frida_mode/test/output/Makefile
@@ -0,0 +1,13 @@
+all:
+	@echo trying to use GNU make...
+	@gmake all || echo please install GNUmake
+
+32:
+	@echo trying to use GNU make...
+	@gmake 32 || echo please install GNUmake
+
+clean:
+	@gmake clean
+
+frida:
+	@gmake frida
diff --git a/frida_mode/test/output/frida_stderr.txt b/frida_mode/test/output/frida_stderr.txt
new file mode 100644
index 00000000..103216cf
--- /dev/null
+++ b/frida_mode/test/output/frida_stderr.txt
@@ -0,0 +1,2824 @@
+
+
+total_transitions: 9
+	call_imms: 1
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 1
+	jmp_mems: 2
+	jmp_regs: 0
+
+	jmp_cond_imms: 2
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 19
+	call_imms: 4
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 2
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 1
+	jmp_mems: 3
+	jmp_regs: 0
+
+	jmp_cond_imms: 6
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 29
+	call_imms: 6
+	call_regs: 1
+	call_mems: 0
+	post_call_invokes: 3
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 2
+	jmp_mems: 3
+	jmp_regs: 0
+
+	jmp_cond_imms: 11
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 39
+	call_imms: 6
+	call_regs: 2
+	call_mems: 0
+	post_call_invokes: 5
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 2
+	jmp_mems: 3
+	jmp_regs: 0
+
+	jmp_cond_imms: 18
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 49
+	call_imms: 7
+	call_regs: 2
+	call_mems: 1
+	post_call_invokes: 6
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 2
+	jmp_mems: 3
+	jmp_regs: 0
+
+	jmp_cond_imms: 25
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 59
+	call_imms: 8
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 6
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 3
+	jmp_mems: 3
+	jmp_regs: 0
+
+	jmp_cond_imms: 31
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 69
+	call_imms: 9
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 7
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 3
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 38
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 79
+	call_imms: 10
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 7
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 4
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 46
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 89
+	call_imms: 10
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 7
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 4
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 56
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 99
+	call_imms: 11
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 9
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 4
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 63
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 109
+	call_imms: 12
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 12
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 5
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 68
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 119
+	call_imms: 12
+	call_regs: 2
+	call_mems: 4
+	post_call_invokes: 14
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 6
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 74
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 129
+	call_imms: 14
+	call_regs: 2
+	call_mems: 4
+	post_call_invokes: 16
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 6
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 80
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 139
+	call_imms: 14
+	call_regs: 2
+	call_mems: 5
+	post_call_invokes: 17
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 6
+	jmp_mems: 5
+	jmp_regs: 0
+
+	jmp_cond_imms: 87
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 149
+	call_imms: 14
+	call_regs: 2
+	call_mems: 6
+	post_call_invokes: 17
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 6
+	jmp_mems: 5
+	jmp_regs: 0
+
+	jmp_cond_imms: 96
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 159
+	call_imms: 15
+	call_regs: 2
+	call_mems: 6
+	post_call_invokes: 18
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 8
+	jmp_mems: 5
+	jmp_regs: 0
+
+	jmp_cond_imms: 102
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 170
+	call_imms: 15
+	call_regs: 2
+	call_mems: 6
+	post_call_invokes: 18
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 10
+	jmp_mems: 5
+	jmp_regs: 0
+
+	jmp_cond_imms: 111
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 180
+	call_imms: 15
+	call_regs: 2
+	call_mems: 6
+	post_call_invokes: 20
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 11
+	jmp_mems: 5
+	jmp_regs: 0
+
+	jmp_cond_imms: 118
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 190
+	call_imms: 16
+	call_regs: 2
+	call_mems: 6
+	post_call_invokes: 20
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 11
+	jmp_mems: 6
+	jmp_regs: 1
+
+	jmp_cond_imms: 125
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 201
+	call_imms: 16
+	call_regs: 2
+	call_mems: 7
+	post_call_invokes: 21
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 13
+	jmp_mems: 6
+	jmp_regs: 1
+
+	jmp_cond_imms: 132
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 211
+	call_imms: 17
+	call_regs: 2
+	call_mems: 7
+	post_call_invokes: 22
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 14
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 138
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 223
+	call_imms: 18
+	call_regs: 2
+	call_mems: 8
+	post_call_invokes: 24
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 15
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 145
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 233
+	call_imms: 18
+	call_regs: 2
+	call_mems: 8
+	post_call_invokes: 25
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 16
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 153
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 244
+	call_imms: 19
+	call_regs: 2
+	call_mems: 9
+	post_call_invokes: 26
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 16
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 161
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+
+
+total_transitions: 254
+	call_imms: 20
+	call_regs: 2
+	call_mems: 9
+	post_call_invokes: 27
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 18
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 167
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 264
+	call_imms: 20
+	call_regs: 2
+	call_mems: 9
+	post_call_invokes: 29
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 20
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 173
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 275
+	call_imms: 21
+	call_regs: 2
+	call_mems: 10
+	post_call_invokes: 30
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 22
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 179
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 285
+	call_imms: 22
+	call_regs: 2
+	call_mems: 10
+	post_call_invokes: 30
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 23
+	jmp_mems: 8
+	jmp_regs: 1
+
+	jmp_cond_imms: 186
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 295
+	call_imms: 22
+	call_regs: 2
+	call_mems: 10
+	post_call_invokes: 30
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 23
+	jmp_mems: 8
+	jmp_regs: 1
+
+	jmp_cond_imms: 196
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 305
+	call_imms: 22
+	call_regs: 2
+	call_mems: 10
+	post_call_invokes: 30
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 24
+	jmp_mems: 8
+	jmp_regs: 1
+
+	jmp_cond_imms: 205
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 315
+	call_imms: 22
+	call_regs: 2
+	call_mems: 10
+	post_call_invokes: 31
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 26
+	jmp_mems: 8
+	jmp_regs: 1
+
+	jmp_cond_imms: 212
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 326
+	call_imms: 22
+	call_regs: 3
+	call_mems: 10
+	post_call_invokes: 32
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 27
+	jmp_mems: 8
+	jmp_regs: 1
+
+	jmp_cond_imms: 220
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 337
+	call_imms: 23
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 36
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 27
+	jmp_mems: 9
+	jmp_regs: 1
+
+	jmp_cond_imms: 224
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 348
+	call_imms: 24
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 38
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 27
+	jmp_mems: 10
+	jmp_regs: 1
+
+	jmp_cond_imms: 231
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 362
+	call_imms: 26
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 39
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 28
+	jmp_mems: 11
+	jmp_regs: 1
+
+	jmp_cond_imms: 240
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 375
+	call_imms: 27
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 40
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 28
+	jmp_mems: 12
+	jmp_regs: 1
+
+	jmp_cond_imms: 250
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 387
+	call_imms: 28
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 41
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 28
+	jmp_mems: 12
+	jmp_regs: 3
+
+	jmp_cond_imms: 258
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 397
+	call_imms: 29
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 42
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 30
+	jmp_mems: 12
+	jmp_regs: 3
+
+	jmp_cond_imms: 264
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 407
+	call_imms: 29
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 42
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 31
+	jmp_mems: 12
+	jmp_regs: 3
+
+	jmp_cond_imms: 273
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 418
+	call_imms: 29
+	call_regs: 4
+	call_mems: 11
+	post_call_invokes: 43
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 32
+	jmp_mems: 12
+	jmp_regs: 3
+
+	jmp_cond_imms: 281
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+
+
+total_transitions: 430
+	call_imms: 32
+	call_regs: 4
+	call_mems: 11
+	post_call_invokes: 45
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 33
+	jmp_mems: 13
+	jmp_regs: 3
+
+	jmp_cond_imms: 286
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 441
+	call_imms: 32
+	call_regs: 4
+	call_mems: 12
+	post_call_invokes: 46
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 33
+	jmp_mems: 13
+	jmp_regs: 3
+
+	jmp_cond_imms: 295
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+
+
+total_transitions: 453
+	call_imms: 33
+	call_regs: 4
+	call_mems: 12
+	post_call_invokes: 49
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 34
+	jmp_mems: 13
+	jmp_regs: 3
+
+	jmp_cond_imms: 302
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 465
+	call_imms: 35
+	call_regs: 4
+	call_mems: 12
+	post_call_invokes: 50
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 35
+	jmp_mems: 15
+	jmp_regs: 3
+
+	jmp_cond_imms: 308
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 475
+	call_imms: 38
+	call_regs: 4
+	call_mems: 12
+	post_call_invokes: 51
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 35
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 310
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 485
+	call_imms: 38
+	call_regs: 5
+	call_mems: 12
+	post_call_invokes: 52
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 36
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 317
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 495
+	call_imms: 38
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 52
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 38
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 324
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 506
+	call_imms: 38
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 53
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 39
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 333
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 516
+	call_imms: 40
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 53
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 40
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 340
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 526
+	call_imms: 40
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 54
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 40
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 349
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 540
+	call_imms: 42
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 55
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 42
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 358
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 552
+	call_imms: 43
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 57
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 43
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 366
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 563
+	call_imms: 43
+	call_regs: 5
+	call_mems: 14
+	post_call_invokes: 58
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 43
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 375
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 573
+	call_imms: 43
+	call_regs: 5
+	call_mems: 15
+	post_call_invokes: 59
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 44
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 382
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 583
+	call_imms: 44
+	call_regs: 5
+	call_mems: 15
+	post_call_invokes: 59
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 45
+	jmp_mems: 17
+	jmp_regs: 3
+
+	jmp_cond_imms: 389
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 593
+	call_imms: 45
+	call_regs: 5
+	call_mems: 15
+	post_call_invokes: 60
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 46
+	jmp_mems: 17
+	jmp_regs: 3
+
+	jmp_cond_imms: 396
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 603
+	call_imms: 46
+	call_regs: 6
+	call_mems: 15
+	post_call_invokes: 64
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 46
+	jmp_mems: 17
+	jmp_regs: 3
+
+	jmp_cond_imms: 400
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 615
+	call_imms: 46
+	call_regs: 7
+	call_mems: 17
+	post_call_invokes: 64
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 46
+	jmp_mems: 17
+	jmp_regs: 3
+
+	jmp_cond_imms: 407
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 626
+	call_imms: 48
+	call_regs: 8
+	call_mems: 18
+	post_call_invokes: 66
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 46
+	jmp_mems: 18
+	jmp_regs: 3
+
+	jmp_cond_imms: 411
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 637
+	call_imms: 50
+	call_regs: 9
+	call_mems: 19
+	post_call_invokes: 68
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 47
+	jmp_mems: 19
+	jmp_regs: 3
+
+	jmp_cond_imms: 414
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 648
+	call_imms: 52
+	call_regs: 9
+	call_mems: 20
+	post_call_invokes: 70
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 47
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 419
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 660
+	call_imms: 52
+	call_regs: 10
+	call_mems: 20
+	post_call_invokes: 72
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 49
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 426
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 672
+	call_imms: 52
+	call_regs: 10
+	call_mems: 20
+	post_call_invokes: 72
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 51
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 436
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 683
+	call_imms: 53
+	call_regs: 11
+	call_mems: 21
+	post_call_invokes: 73
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 52
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 442
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 697
+	call_imms: 53
+	call_regs: 11
+	call_mems: 22
+	post_call_invokes: 74
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 53
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 453
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 709
+	call_imms: 53
+	call_regs: 13
+	call_mems: 22
+	post_call_invokes: 77
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 53
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 460
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 720
+	call_imms: 53
+	call_regs: 13
+	call_mems: 22
+	post_call_invokes: 77
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 55
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 469
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 730
+	call_imms: 54
+	call_regs: 13
+	call_mems: 24
+	post_call_invokes: 77
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 56
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 475
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 740
+	call_imms: 54
+	call_regs: 13
+	call_mems: 24
+	post_call_invokes: 80
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 57
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 481
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 753
+	call_imms: 54
+	call_regs: 14
+	call_mems: 24
+	post_call_invokes: 81
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 58
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 491
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
diff --git a/frida_mode/test/output/frida_stdout.txt b/frida_mode/test/output/frida_stdout.txt
new file mode 100644
index 00000000..8832681d
--- /dev/null
+++ b/frida_mode/test/output/frida_stdout.txt
@@ -0,0 +1,349 @@
+OG Range - 0x00007FFFF7FFE000 - 0x00007FFFF7FFF000
+[+] CMPLOG Range - 0x00007FFFF7FFD000 - 0x00007FFFF7FFE000
+[+] CMPLOG Range - 0x00007FFFF7FFC000 - 0x00007FFFF7FFD000
+[+] CMPLOG Range - 0x00007FFFF7FF3000 - 0x00007FFFF7FFB000
+[+] CMPLOG Range - 0x00007FFFF7FD0000 - 0x00007FFFF7FF3000
+[+] CMPLOG Range - 0x00007FFFF7FCF000 - 0x00007FFFF7FD0000
+[+] CMPLOG Range - 0x00007FFFF7FCE000 - 0x00007FFFF7FCF000
+[+] CMPLOG Range - 0x00007FFFF7FCB000 - 0x00007FFFF7FCE000
+[+] CMPLOG Range - 0x00007FFFF7DC4000 - 0x00007FFFF7FCB000
+[+] CMPLOG Range - 0x00007FFFF7DBC000 - 0x00007FFFF7DC4000
+[+] CMPLOG Range - 0x00007FFFF7DB0000 - 0x00007FFFF7DBC000
+[+] CMPLOG Range - 0x00007FFFF7A94000 - 0x00007FFFF7DB0000
+[+] CMPLOG Range - 0x00007FFFF7942000 - 0x00007FFFF7A94000
+[+] CMPLOG Range - 0x00007FFFF78BF000 - 0x00007FFFF7942000
+[+] CMPLOG Range - 0x00007FFFF78AF000 - 0x00007FFFF78BF000
+[+] CMPLOG Range - 0x00007FFFF78AA000 - 0x00007FFFF78AB000
+[+] CMPLOG Range - 0x00007FFFF78A9000 - 0x00007FFFF78AA000
+[+] CMPLOG Range - 0x00007FFFF78A2000 - 0x00007FFFF78A6000
+[+] CMPLOG Range - 0x00007FFFF789F000 - 0x00007FFFF78A2000
+[+] CMPLOG Range - 0x00007FFFF789C000 - 0x00007FFFF789F000
+[+] CMPLOG Range - 0x00007FFFF7851000 - 0x00007FFFF789B000
+[+] CMPLOG Range - 0x00007FFFF76DB000 - 0x00007FFFF7851000
+[+] CMPLOG Range - 0x00007FFFF76DA000 - 0x00007FFFF76DB000
+[+] CMPLOG Range - 0x00007FFFF76D9000 - 0x00007FFFF76DA000
+[+] CMPLOG Range - 0x00007FFFF76B4000 - 0x00007FFFF76D9000
+[+] CMPLOG Range - 0x00007FFFF76B0000 - 0x00007FFFF76B4000
+[+] CMPLOG Range - 0x00007FFFF76AF000 - 0x00007FFFF76B0000
+[+] CMPLOG Range - 0x00007FFFF76AE000 - 0x00007FFFF76AF000
+[+] CMPLOG Range - 0x00007FFFF76A9000 - 0x00007FFFF76AE000
+[+] CMPLOG Range - 0x00007FFFF7698000 - 0x00007FFFF76A9000
+[+] CMPLOG Range - 0x00007FFFF7691000 - 0x00007FFFF7698000
+[+] CMPLOG Range - 0x00007FFFF768F000 - 0x00007FFFF7691000
+[+] CMPLOG Range - 0x00007FFFF768E000 - 0x00007FFFF768F000
+[+] CMPLOG Range - 0x00007FFFF768D000 - 0x00007FFFF768E000
+[+] CMPLOG Range - 0x00007FFFF7689000 - 0x00007FFFF768C000
+[+] CMPLOG Range - 0x00007FFFF7679000 - 0x00007FFFF7689000
+[+] CMPLOG Range - 0x00007FFFF7675000 - 0x00007FFFF7679000
+[+] CMPLOG Range - 0x00007FFFF7674000 - 0x00007FFFF7675000
+[+] CMPLOG Range - 0x00007FFFF7673000 - 0x00007FFFF7674000
+[+] CMPLOG Range - 0x00007FFFF7672000 - 0x00007FFFF7673000
+[+] CMPLOG Range - 0x00007FFFF7670000 - 0x00007FFFF7672000
+[+] CMPLOG Range - 0x00007FFFF766F000 - 0x00007FFFF7670000
+[+] CMPLOG Range - 0x00007FFFF766D000 - 0x00007FFFF766F000
+[+] Redirect 1 -> '/home/jon/git/AFLplusplus/frida_mode/test/output/frida_stdout.txt'
+[+] Redirect 2 -> '/home/jon/git/AFLplusplus/frida_mode/test/output/frida_stderr.txt'
+[+] Instrumentation - persistent mode [ ] (0x0000000000000000)
+[+] Instrumentation - persistent count [ ] (0)
+[+] Instrumentation - hook [(null)]
+[+] Instrumentation - persistent ret [ ] (0x0000000000000000)
+[+] Instrumentation - persistent ret offset [ ] (0)
+[+] Instrumentation - prefetch [X]
+[+] Range: Modules Length: 54
+[+] Range: Modules Idx:   0 - 0x0000555555554000-0x0000555555555000
+[+] Range: Modules Idx:   1 - 0x0000555555555000-0x0000555555556000
+[+] Range: Modules Idx:   2 - 0x0000555555556000-0x0000555555557000
+[+] Range: Modules Idx:   3 - 0x0000555555557000-0x0000555555558000
+[+] Range: Modules Idx:   4 - 0x0000555555558000-0x0000555555559000
+[+] Range: Modules Idx:   5 - 0x0000555555559000-0x000055555557a000
+[+] Range: Modules Idx:   6 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: Modules Idx:   7 - 0x00007ffff766d000-0x00007ffff766f000
+[+] Range: Modules Idx:   8 - 0x00007ffff766f000-0x00007ffff7670000
+[+] Range: Modules Idx:   9 - 0x00007ffff7670000-0x00007ffff7672000
+[+] Range: Modules Idx:  10 - 0x00007ffff7672000-0x00007ffff7673000
+[+] Range: Modules Idx:  11 - 0x00007ffff7673000-0x00007ffff7674000
+[+] Range: Modules Idx:  12 - 0x00007ffff7674000-0x00007ffff7675000
+[+] Range: Modules Idx:  13 - 0x00007ffff7675000-0x00007ffff7679000
+[+] Range: Modules Idx:  14 - 0x00007ffff7679000-0x00007ffff7689000
+[+] Range: Modules Idx:  15 - 0x00007ffff7689000-0x00007ffff768c000
+[+] Range: Modules Idx:  16 - 0x00007ffff768c000-0x00007ffff768d000
+[+] Range: Modules Idx:  17 - 0x00007ffff768d000-0x00007ffff768e000
+[+] Range: Modules Idx:  18 - 0x00007ffff768e000-0x00007ffff768f000
+[+] Range: Modules Idx:  19 - 0x00007ffff768f000-0x00007ffff7691000
+[+] Range: Modules Idx:  20 - 0x00007ffff7691000-0x00007ffff7698000
+[+] Range: Modules Idx:  21 - 0x00007ffff7698000-0x00007ffff76a9000
+[+] Range: Modules Idx:  22 - 0x00007ffff76a9000-0x00007ffff76ae000
+[+] Range: Modules Idx:  23 - 0x00007ffff76ae000-0x00007ffff76af000
+[+] Range: Modules Idx:  24 - 0x00007ffff76af000-0x00007ffff76b0000
+[+] Range: Modules Idx:  25 - 0x00007ffff76b0000-0x00007ffff76b4000
+[+] Range: Modules Idx:  26 - 0x00007ffff76b4000-0x00007ffff76d9000
+[+] Range: Modules Idx:  27 - 0x00007ffff76d9000-0x00007ffff76da000
+[+] Range: Modules Idx:  28 - 0x00007ffff76da000-0x00007ffff76db000
+[+] Range: Modules Idx:  29 - 0x00007ffff76db000-0x00007ffff7851000
+[+] Range: Modules Idx:  30 - 0x00007ffff7851000-0x00007ffff789b000
+[+] Range: Modules Idx:  31 - 0x00007ffff789b000-0x00007ffff789c000
+[+] Range: Modules Idx:  32 - 0x00007ffff789c000-0x00007ffff789f000
+[+] Range: Modules Idx:  33 - 0x00007ffff789f000-0x00007ffff78a2000
+[+] Range: Modules Idx:  34 - 0x00007ffff78a2000-0x00007ffff78a6000
+[+] Range: Modules Idx:  35 - 0x00007ffff78a9000-0x00007ffff78aa000
+[+] Range: Modules Idx:  36 - 0x00007ffff78aa000-0x00007ffff78ab000
+[+] Range: Modules Idx:  37 - 0x00007ffff78af000-0x00007ffff78bf000
+[+] Range: Modules Idx:  38 - 0x00007ffff78bf000-0x00007ffff7942000
+[+] Range: Modules Idx:  39 - 0x00007ffff7942000-0x00007ffff7a94000
+[+] Range: Modules Idx:  40 - 0x00007ffff7a94000-0x00007ffff7db0000
+[+] Range: Modules Idx:  41 - 0x00007ffff7db0000-0x00007ffff7dbc000
+[+] Range: Modules Idx:  42 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: Modules Idx:  43 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: Modules Idx:  44 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: Modules Idx:  45 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: Modules Idx:  46 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: Modules Idx:  47 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: Modules Idx:  48 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: Modules Idx:  49 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: Modules Idx:  50 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: Modules Idx:  51 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: Modules Idx:  52 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: Modules Idx:  53 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: AFL_INST_LIBS Length: 1
+[+] Range: AFL_INST_LIBS Idx:   0 - 0x0000555555555160-0x0000555555555335
+[+] Range: step1 Length: 1
+[+] Range: step1 Idx:   0 - 0x0000555555555160-0x0000555555555335
+[+] Range: step2 Length: 1
+[+] Range: step2 Idx:   0 - 0x0000555555555160-0x0000555555555335
+[+] Range: step3 Length: 1
+[+] Range: step3 Idx:   0 - 0x0000555555555160-0x0000555555555335
+[+] Range: step4 Length: 55
+[+] Range: step4 Idx:   0 - 0x0000555555554000-0x0000555555555000
+[+] Range: step4 Idx:   1 - 0x0000555555555000-0x0000555555555160
+[+] Range: step4 Idx:   2 - 0x0000555555555335-0x0000555555556000
+[+] Range: step4 Idx:   3 - 0x0000555555556000-0x0000555555557000
+[+] Range: step4 Idx:   4 - 0x0000555555557000-0x0000555555558000
+[+] Range: step4 Idx:   5 - 0x0000555555558000-0x0000555555559000
+[+] Range: step4 Idx:   6 - 0x0000555555559000-0x000055555557a000
+[+] Range: step4 Idx:   7 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: step4 Idx:   8 - 0x00007ffff766d000-0x00007ffff766f000
+[+] Range: step4 Idx:   9 - 0x00007ffff766f000-0x00007ffff7670000
+[+] Range: step4 Idx:  10 - 0x00007ffff7670000-0x00007ffff7672000
+[+] Range: step4 Idx:  11 - 0x00007ffff7672000-0x00007ffff7673000
+[+] Range: step4 Idx:  12 - 0x00007ffff7673000-0x00007ffff7674000
+[+] Range: step4 Idx:  13 - 0x00007ffff7674000-0x00007ffff7675000
+[+] Range: step4 Idx:  14 - 0x00007ffff7675000-0x00007ffff7679000
+[+] Range: step4 Idx:  15 - 0x00007ffff7679000-0x00007ffff7689000
+[+] Range: step4 Idx:  16 - 0x00007ffff7689000-0x00007ffff768c000
+[+] Range: step4 Idx:  17 - 0x00007ffff768c000-0x00007ffff768d000
+[+] Range: step4 Idx:  18 - 0x00007ffff768d000-0x00007ffff768e000
+[+] Range: step4 Idx:  19 - 0x00007ffff768e000-0x00007ffff768f000
+[+] Range: step4 Idx:  20 - 0x00007ffff768f000-0x00007ffff7691000
+[+] Range: step4 Idx:  21 - 0x00007ffff7691000-0x00007ffff7698000
+[+] Range: step4 Idx:  22 - 0x00007ffff7698000-0x00007ffff76a9000
+[+] Range: step4 Idx:  23 - 0x00007ffff76a9000-0x00007ffff76ae000
+[+] Range: step4 Idx:  24 - 0x00007ffff76ae000-0x00007ffff76af000
+[+] Range: step4 Idx:  25 - 0x00007ffff76af000-0x00007ffff76b0000
+[+] Range: step4 Idx:  26 - 0x00007ffff76b0000-0x00007ffff76b4000
+[+] Range: step4 Idx:  27 - 0x00007ffff76b4000-0x00007ffff76d9000
+[+] Range: step4 Idx:  28 - 0x00007ffff76d9000-0x00007ffff76da000
+[+] Range: step4 Idx:  29 - 0x00007ffff76da000-0x00007ffff76db000
+[+] Range: step4 Idx:  30 - 0x00007ffff76db000-0x00007ffff7851000
+[+] Range: step4 Idx:  31 - 0x00007ffff7851000-0x00007ffff789b000
+[+] Range: step4 Idx:  32 - 0x00007ffff789b000-0x00007ffff789c000
+[+] Range: step4 Idx:  33 - 0x00007ffff789c000-0x00007ffff789f000
+[+] Range: step4 Idx:  34 - 0x00007ffff789f000-0x00007ffff78a2000
+[+] Range: step4 Idx:  35 - 0x00007ffff78a2000-0x00007ffff78a6000
+[+] Range: step4 Idx:  36 - 0x00007ffff78a9000-0x00007ffff78aa000
+[+] Range: step4 Idx:  37 - 0x00007ffff78aa000-0x00007ffff78ab000
+[+] Range: step4 Idx:  38 - 0x00007ffff78af000-0x00007ffff78bf000
+[+] Range: step4 Idx:  39 - 0x00007ffff78bf000-0x00007ffff7942000
+[+] Range: step4 Idx:  40 - 0x00007ffff7942000-0x00007ffff7a94000
+[+] Range: step4 Idx:  41 - 0x00007ffff7a94000-0x00007ffff7db0000
+[+] Range: step4 Idx:  42 - 0x00007ffff7db0000-0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
diff --git a/frida_mode/test/output/testinstr.c b/frida_mode/test/output/testinstr.c
new file mode 100644
index 00000000..5e26fc46
--- /dev/null
+++ b/frida_mode/test/output/testinstr.c
@@ -0,0 +1,112 @@
+/*
+   american fuzzy lop++ - a trivial program to test the build
+   --------------------------------------------------------
+   Originally written by Michal Zalewski
+   Copyright 2014 Google Inc. All rights reserved.
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+     http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifdef __APPLE__
+  #define TESTINSTR_SECTION
+#else
+  #define TESTINSTR_SECTION __attribute__((section(".testinstr")))
+#endif
+
+void testinstr(char *buf, int len) {
+
+  if (len < 1) return;
+  buf[len] = 0;
+
+  // we support three input cases
+  if (buf[0] == '0')
+    printf("Looks like a zero to me!\n");
+  else if (buf[0] == '1')
+    printf("Pretty sure that is a one!\n");
+  else
+    printf("Neither one or zero? How quaint!\n");
+
+}
+
+TESTINSTR_SECTION int main(int argc, char **argv) {
+
+  char * file;
+  int    fd = -1;
+  off_t  len;
+  char * buf = NULL;
+  size_t n_read;
+  int    result = -1;
+
+  if (argc != 2) { return 1; }
+
+  do {
+
+    file = argv[1];
+
+    dprintf(STDERR_FILENO, "Running: %s\n", file);
+
+    fd = open(file, O_RDONLY);
+    if (fd < 0) {
+
+      perror("open");
+      break;
+
+    }
+
+    len = lseek(fd, 0, SEEK_END);
+    if (len < 0) {
+
+      perror("lseek (SEEK_END)");
+      break;
+
+    }
+
+    if (lseek(fd, 0, SEEK_SET) != 0) {
+
+      perror("lseek (SEEK_SET)");
+      break;
+
+    }
+
+    buf = malloc(len);
+    if (buf == NULL) {
+
+      perror("malloc");
+      break;
+
+    }
+
+    n_read = read(fd, buf, len);
+    if (n_read != len) {
+
+      perror("read");
+      break;
+
+    }
+
+    dprintf(STDERR_FILENO, "Running:    %s: (%zd bytes)\n", file, n_read);
+
+    testinstr(buf, len);
+    dprintf(STDERR_FILENO, "Done:    %s: (%zd bytes)\n", file, n_read);
+
+    result = 0;
+
+  } while (false);
+
+  if (buf != NULL) { free(buf); }
+
+  if (fd != -1) { close(fd); }
+
+  return result;
+
+}
+
diff --git a/include/envs.h b/include/envs.h
index 73cd82a8..08b3284a 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -55,17 +55,22 @@ static char *afl_environment_variables[] = {
     "AFL_FORCE_UI",
     "AFL_FRIDA_DEBUG_MAPS",
     "AFL_FRIDA_EXCLUDE_RANGES",
+    "AFL_FRIDA_INST_DEBUG_FILE",
     "AFL_FRIDA_INST_NO_OPTIMIZE",
     "AFL_FRIDA_INST_NO_PREFETCH",
     "AFL_FRIDA_INST_RANGES",
-    "AFL_FRIDA_INST_STRICT",
     "AFL_FRIDA_INST_TRACE",
+    "AFL_FRIDA_OUTPUT_STDOUT",
+    "AFL_FRIDA_OUTPUT_STDERR",
     "AFL_FRIDA_PERSISTENT_ADDR",
     "AFL_FRIDA_PERSISTENT_CNT",
     "AFL_FRIDA_PERSISTENT_DEBUG",
     "AFL_FRIDA_PERSISTENT_HOOK",
     "AFL_FRIDA_PERSISTENT_RET",
     "AFL_FRIDA_PERSISTENT_RETADDR_OFFSET",
+    "AFL_FRIDA_STATS_FILE",
+    "AFL_FRIDA_STATS_INTERVAL",
+    "AFL_FRIDA_STATS_TRANSITIONS",
     "AFL_FUZZER_ARGS",  // oss-fuzz
     "AFL_GDB",
     "AFL_GCC_ALLOWLIST",
-- 
cgit 1.4.1