"use strict"; class Afl { /** * This is equivalent to setting a value in `AFL_FRIDA_EXCLUDE_RANGES`, * it takes as arguments a `NativePointer` and a `number`. It can be * called multiple times to exclude several ranges. */ static addExcludedRange(addressess, size) { Afl.jsApiAddExcludeRange(addressess, size); } /** * This is equivalent to setting a value in `AFL_FRIDA_INST_RANGES`, * it takes as arguments a `NativePointer` and a `number`. It can be * called multiple times to include several ranges. */ static addIncludedRange(addressess, size) { Afl.jsApiAddIncludeRange(addressess, size); } /** * This must always be called at the end of your script. This lets * FRIDA mode know that your configuration is finished and that * execution has reached the end of your script. Failure to call * this will result in a fatal error. */ static done() { Afl.jsApiDone(); } /** * This function can be called within your script to cause FRIDA * mode to trigger a fatal error. This is useful if for example you * discover a problem you weren't expecting and want everything to * stop. The user will need to enable `AFL_DEBUG_CHILD=1` to view * this error message. */ static error(msg) { const buf = Memory.allocUtf8String(msg); Afl.jsApiError(buf); } /** * Function used to provide access to `__afl_fuzz_ptr`, which contains the length of * fuzzing data when using in-memory test case fuzzing. */ static getAflFuzzLen() { return Afl.jsApiGetSymbol("__afl_fuzz_len"); } /** * Function used to provide access to `__afl_fuzz_ptr`, which contains the fuzzing * data when using in-memory test case fuzzing. */ static getAflFuzzPtr() { return Afl.jsApiGetSymbol("__afl_fuzz_ptr"); } /** * Print a message to the STDOUT. This should be preferred to * FRIDA's `console.log` since FRIDA will queue it's log messages. * If `console.log` is used in a callback in particular, then there * may no longer be a thread running to service this queue. */ static print(msg) { const STDOUT_FILENO = 2; const log = `${msg}\n`; const buf = Memory.allocUtf8String(log); Afl.jsApiWrite(STDOUT_FILENO, buf, log.length); } /** * See `AFL_FRIDA_STALKER_NO_BACKPATCH`. */ static setBackpatchDisable() { Afl.jsApiSetBackpatchDisable(); } /** * See `AFL_FRIDA_INST_NO_CACHE`. */ static setCacheDisable() { Afl.jsApiSetCacheDisable(); } /** * See `AFL_FRIDA_DEBUG_MAPS`. */ static setDebugMaps() { Afl.jsApiSetDebugMaps(); } /** * This has the same effect as setting `AFL_ENTRYPOINT`, but has the * convenience of allowing you to use FRIDAs APIs to determine the * address you would like to configure, rather than having to grep * the output of `readelf` or something similarly ugly. This * function should be called with a `NativePointer` as its * argument. */ static setEntryPoint(address) { Afl.jsApiSetEntryPoint(address); } /** * Function used to enable in-memory test cases for fuzzing. */ static setInMemoryFuzzing() { Afl.jsApiAflSharedMemFuzzing.writeInt(1); } /** * See `AFL_FRIDA_INST_CACHE_SIZE`. This function takes a single `number` * as an argument. */ static setInstrumentCacheSize(size) { Afl.jsApiSetInstrumentCacheSize(size); } /** * See `AFL_FRIDA_INST_COVERAGE_FILE`. This function takes a single `string` * as an argument. */ static setInstrumentCoverageFile(file) { const buf = Memory.allocUtf8String(file); Afl.jsApiSetInstrumentCoverageFile(buf); } /** * See `AFL_FRIDA_INST_DEBUG_FILE`. This function takes a single `string` as * an argument. */ static setInstrumentDebugFile(file) { const buf = Memory.allocUtf8String(file); Afl.jsApiSetInstrumentDebugFile(buf); } /** * See `AFL_FRIDA_INST_TRACE`. */ static setInstrumentEnableTracing() { Afl.jsApiSetInstrumentTrace(); } /** * See `AFL_FRIDA_INST_INSN` */ static setInstrumentInstructions() { Afl.jsApiSetInstrumentInstructions(); } /** * See `AFL_FRIDA_INST_JIT`. */ static setInstrumentJit() { Afl.jsApiSetInstrumentJit(); } /** * See `AFL_INST_LIBS`. */ static setInstrumentLibraries() { Afl.jsApiSetInstrumentLibraries(); } /** * See `AFL_FRIDA_INST_NO_OPTIMIZE` */ static setInstrumentNoOptimize() { Afl.jsApiSetInstrumentNoOptimize(); } /* * See `AFL_FRIDA_INST_SEED` */ static setInstrumentSeed(seed) { Afl.jsApiSetInstrumentSeed(seed); } /** * See `AFL_FRIDA_INST_TRACE_UNIQUE`. */ static setInstrumentTracingUnique() { Afl.jsApiSetInstrumentTraceUnique(); } /** * See `AFL_FRIDA_INST_UNSTABLE_COVERAGE_FILE`. This function takes a single * `string` as an argument. */ static setInstrumentUnstableCoverageFile(file) { const buf = Memory.allocUtf8String(file); Afl.jsApiSetInstrumentUnstableCoverageFile(buf); } /* * Set a callback to be called in place of the usual `main` function. This see * `Scripting.md` for details. */ static setJsMainHook(address) { Afl.jsApiSetJsMainHook(address); } /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_ADDR`, again a * `NativePointer` should be provided as it's argument. */ static setPersistentAddress(address) { Afl.jsApiSetPersistentAddress(address); } /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_CNT`, a * `number` should be provided as it's argument. */ static setPersistentCount(count) { Afl.jsApiSetPersistentCount(count); } /** * See `AFL_FRIDA_PERSISTENT_DEBUG`. */ static setPersistentDebug() { Afl.jsApiSetPersistentDebug(); } /** * See `AFL_FRIDA_PERSISTENT_ADDR`. This function takes a NativePointer as an * argument. See above for examples of use. */ static setPersistentHook(address) { Afl.jsApiSetPersistentHook(address); } /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_RET`, again a * `NativePointer` should be provided as it's argument. */ static setPersistentReturn(address) { Afl.jsApiSetPersistentReturn(address); } /** * See `AFL_FRIDA_INST_NO_PREFETCH_BACKPATCH`. */ static setPrefetchBackpatchDisable() { Afl.jsApiSetPrefetchBackpatchDisable(); } /** * See `AFL_FRIDA_INST_NO_PREFETCH`. */ static setPrefetchDisable() { Afl.jsApiSetPrefetchDisable(); } /** * See `AFL_FRIDA_SECCOMP_FILE`. This function takes a single `string` as * an argument. */ static setSeccompFile(file) { const buf = Memory.allocUtf8String(file); Afl.jsApiSetSeccompFile(buf); } /** * See `AFL_FRIDA_STALKER_ADJACENT_BLOCKS`. */ static setStalkerAdjacentBlocks(val) { Afl.jsApiSetStalkerAdjacentBlocks(val); } /* * Set a function to be called for each instruction which is instrumented * by AFL FRIDA mode. */ static setStalkerCallback(callback) { Afl.jsApiSetStalkerCallback(callback); } /** * See `AFL_FRIDA_STALKER_IC_ENTRIES`. */ static setStalkerIcEntries(val) { Afl.jsApiSetStalkerIcEntries(val); } /** * See `AFL_FRIDA_STATS_FILE`. This function takes a single `string` as * an argument. */ static setStatsFile(file) { const buf = Memory.allocUtf8String(file); Afl.jsApiSetStatsFile(buf); } /** * See `AFL_FRIDA_STATS_INTERVAL`. This function takes a `number` as an * argument */ static setStatsInterval(interval) { Afl.jsApiSetStatsInterval(interval); } /** * See `AFL_FRIDA_OUTPUT_STDERR`. This function takes a single `string` as * an argument. */ static setStdErr(file) { const buf = Memory.allocUtf8String(file); Afl.jsApiSetStdErr(buf); } /** * See `AFL_FRIDA_OUTPUT_STDOUT`. This function takes a single `string` as * an argument. */ static setStdOut(file) { const buf = Memory.allocUtf8String(file); Afl.jsApiSetStdOut(buf); } /** * See `AFL_FRIDA_TRACEABLE`. */ static setTraceable() { Afl.jsApiSetTraceable(); } /** * See `AFL_FRIDA_VERBOSE` */ static setVerbose() { Afl.jsApiSetVerbose(); } static jsApiGetFunction(name, retType, argTypes) { const addr = Afl.module.getExportByName(name); return new NativeFunction(addr, retType, argTypes); } static jsApiGetSymbol(name) { return Afl.module.getExportByName(name); } } /** * Field containing the `Module` object for `afl-frida-trace.so` (the FRIDA mode * implementation). */ Afl.module = Process.getModuleByName("afl-frida-trace.so"); Afl.jsApiAddExcludeRange = Afl.jsApiGetFunction("js_api_add_exclude_range", "void", ["pointer", "size_t"]); Afl.jsApiAddIncludeRange = Afl.jsApiGetFunction("js_api_add_include_range", "void", ["pointer", "size_t"]); Afl.jsApiAflSharedMemFuzzing = Afl.jsApiGetSymbol("__afl_sharedmem_fuzzing"); Afl.jsApiDone = Afl.jsApiGetFunction("js_api_done", "void", []); Afl.jsApiError = Afl.jsApiGetFunction("js_api_error", "void", ["pointer"]); Afl.jsApiSetBackpatchDisable = Afl.jsApiGetFunction("js_api_set_backpatch_disable", "void", []); Afl.jsApiSetCacheDisable = Afl.jsApiGetFunction("js_api_set_cache_disable", "void", []); Afl.jsApiSetDebugMaps = Afl.jsApiGetFunction("js_api_set_debug_maps", "void", []); Afl.jsApiSetEntryPoint = Afl.jsApiGetFunction("js_api_set_entrypoint", "void", ["pointer"]); Afl.jsApiSetInstrumentCacheSize = Afl.jsApiGetFunction("js_api_set_instrument_cache_size", "void", ["size_t"]); Afl.jsApiSetInstrumentCoverageFile = Afl.jsApiGetFunction("js_api_set_instrument_coverage_file", "void", ["pointer"]); Afl.jsApiSetInstrumentDebugFile = Afl.jsApiGetFunction("js_api_set_instrument_debug_file", "void", ["pointer"]); Afl.jsApiSetInstrumentInstructions = Afl.jsApiGetFunction("js_api_set_instrument_instructions", "void", []); Afl.jsApiSetInstrumentJit = Afl.jsApiGetFunction("js_api_set_instrument_jit", "void", []); Afl.jsApiSetInstrumentLibraries = Afl.jsApiGetFunction("js_api_set_instrument_libraries", "void", []); Afl.jsApiSetInstrumentNoOptimize = Afl.jsApiGetFunction("js_api_set_instrument_no_optimize", "void", []); Afl.jsApiSetInstrumentSeed = Afl.jsApiGetFunction("js_api_set_instrument_seed", "void", ["uint64"]); Afl.jsApiSetInstrumentTrace = Afl.jsApiGetFunction("js_api_set_instrument_trace", "void", []); Afl.jsApiSetInstrumentTraceUnique = Afl.jsApiGetFunction("js_api_set_instrument_trace_unique", "void", []); Afl.jsApiSetInstrumentUnstableCoverageFile = Afl.jsApiGetFunction("js_api_set_instrument_unstable_coverage_file", "void", ["pointer"]); Afl.jsApiSetJsMainHook = Afl.jsApiGetFunction("js_api_set_js_main_hook", "void", ["pointer"]); Afl.jsApiSetPersistentAddress = Afl.jsApiGetFunction("js_api_set_persistent_address", "void", ["pointer"]); Afl.jsApiSetPersistentCount = Afl.jsApiGetFunction("js_api_set_persistent_count", "void", ["uint64"]); Afl.jsApiSetPersistentDebug = Afl.jsApiGetFunction("js_api_set_persistent_debug", "void", []); Afl.jsApiSetPersistentHook = Afl.jsApiGetFunction("js_api_set_persistent_hook", "void", ["pointer"]); Afl.jsApiSetPersistentReturn = Afl.jsApiGetFunction("js_api_set_persistent_return", "void", ["pointer"]); Afl.jsApiSetPrefetchBackpatchDisable = Afl.jsApiGetFunction("js_api_set_prefetch_backpatch_disable", "void", []); Afl.jsApiSetPrefetchDisable = Afl.jsApiGetFunction("js_api_set_prefetch_disable", "void", []); Afl.jsApiSetSeccompFile = Afl.jsApiGetFunction("js_api_set_seccomp_file", "void", ["pointer"]); Afl.jsApiSetStalkerAdjacentBlocks = Afl.jsApiGetFunction("js_api_set_stalker_adjacent_blocks", "void", ["uint32"]); Afl.jsApiSetStalkerCallback = Afl.jsApiGetFunction("js_api_set_stalker_callback", "void", ["pointer"]); Afl.jsApiSetStalkerIcEntries = Afl.jsApiGetFunction("js_api_set_stalker_ic_entries", "void", ["uint32"]); Afl.jsApiSetStatsFile = Afl.jsApiGetFunction("js_api_set_stats_file", "void", ["pointer"]); Afl.jsApiSetStatsInterval = Afl.jsApiGetFunction("js_api_set_stats_interval", "void", ["uint64"]); Afl.jsApiSetStdErr = Afl.jsApiGetFunction("js_api_set_stderr", "void", ["pointer"]); Afl.jsApiSetStdOut = Afl.jsApiGetFunction("js_api_set_stdout", "void", ["pointer"]); Afl.jsApiSetTraceable = Afl.jsApiGetFunction("js_api_set_traceable", "void", []); Afl.jsApiSetVerbose = Afl.jsApiGetFunction("js_api_set_verbose", "void", []); Afl.jsApiWrite = new NativeFunction( /* tslint:disable-next-line:no-null-keyword */ Module.getExportByName(null, "write"), "int", ["int", "pointer", "int"]);