Rename LibAFL_GdiPlus to _Windows_ (#2604)
* Rename LibAFL_GdiPlus to _Windows_ * Readme more
6
.github/workflows/build_and_test.yml
vendored
@ -247,7 +247,7 @@ jobs:
|
|||||||
# Binary-only
|
# Binary-only
|
||||||
- ./fuzzers/binary_only/fuzzbench_fork_qemu
|
- ./fuzzers/binary_only/fuzzbench_fork_qemu
|
||||||
- ./fuzzers/binary_only/frida_executable_libpng
|
- ./fuzzers/binary_only/frida_executable_libpng
|
||||||
- ./fuzzers/binary_only/frida_gdiplus
|
- ./fuzzers/binary_only/frida_windows_gdiplus
|
||||||
- ./fuzzers/binary_only/frida_libpng
|
- ./fuzzers/binary_only/frida_libpng
|
||||||
- ./fuzzers/binary_only/fuzzbench_qemu
|
- ./fuzzers/binary_only/fuzzbench_qemu
|
||||||
- ./fuzzers/binary_only/tinyinst_simple
|
- ./fuzzers/binary_only/tinyinst_simple
|
||||||
@ -432,8 +432,8 @@ jobs:
|
|||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: actions/checkout@v4
|
||||||
- uses: ./.github/workflows/windows-tester-prepare
|
- uses: ./.github/workflows/windows-tester-prepare
|
||||||
- name: Build fuzzers/binary_only/frida_gdiplus
|
- name: Build fuzzers/binary_only/frida_windows_gdiplus
|
||||||
run: cd fuzzers/binary_only/frida_gdiplus/ && cargo make test && cargo make test_cmplog
|
run: cd fuzzers/binary_only/frida_windows_gdiplus/ && cargo make test && cargo make test_cmplog
|
||||||
|
|
||||||
windows-tinyinst-simple:
|
windows-tinyinst-simple:
|
||||||
runs-on: windows-latest
|
runs-on: windows-latest
|
||||||
|
@ -4,7 +4,7 @@ LibAFL supports different instrumentation engines for binary-only fuzzing.
|
|||||||
A potent cross-platform (Windows, MacOS, Android, Linux, iOS) option for binary-only fuzzing is Frida; the dynamic instrumentation tool.
|
A potent cross-platform (Windows, MacOS, Android, Linux, iOS) option for binary-only fuzzing is Frida; the dynamic instrumentation tool.
|
||||||
|
|
||||||
In this section, we will talk about the components in fuzzing with `libafl_frida`.
|
In this section, we will talk about the components in fuzzing with `libafl_frida`.
|
||||||
You can take a look at a working example in our [`fuzzers/binary_only/frida_libpng`](https://github.com/AFLplusplus/LibAFL/tree/main/fuzzers/binary_only/frida_libpng) folder for Linux, and [`fuzzers/binary_only/frida_gdiplus`](https://github.com/AFLplusplus/LibAFL/tree/main/fuzzers/binary_only/frida_gdiplus) for Windows.
|
You can take a look at a working example in our [`fuzzers/binary_only/frida_libpng`](https://github.com/AFLplusplus/LibAFL/tree/main/fuzzers/binary_only/frida_libpng) folder for Linux, and [`fuzzers/binary_only/frida_windows_gdiplus`](https://github.com/AFLplusplus/LibAFL/tree/main/fuzzers/binary_only/frida_windows_gdiplus) for Windows.
|
||||||
|
|
||||||
## Dependencies
|
## Dependencies
|
||||||
|
|
||||||
|
@ -1,9 +0,0 @@
|
|||||||
## Build
|
|
||||||
|
|
||||||
To build this example, run `cargo build --release` in this folder.
|
|
||||||
|
|
||||||
Then compile the harness `cl.exe /LD harness.cc /link /dll gdiplus.lib ole32.lib`
|
|
||||||
|
|
||||||
## Run
|
|
||||||
|
|
||||||
To run the example `target\release\frida_gdiplus.exe -H harness.dll -i corpus -o output --libs-to-instrument gdi32.dll --libs-to-instrument gdi32full.dll --libs-to-instrument gdiplus.dll --libs-to-instrument WindowsCodecs.dll --disable-excludes`
|
|
@ -1,5 +1,5 @@
|
|||||||
[package]
|
[package]
|
||||||
name = "frida_gdiplus"
|
name = "frida_windows_gdiplus"
|
||||||
version = "0.13.2"
|
version = "0.13.2"
|
||||||
authors = ["Richard Johnson <richinseattle@gmail.com>"]
|
authors = ["Richard Johnson <richinseattle@gmail.com>"]
|
||||||
edition = "2021"
|
edition = "2021"
|
@ -3,7 +3,7 @@
|
|||||||
CARGO_TARGET_DIR = { value = "target", condition = { env_not_set = [
|
CARGO_TARGET_DIR = { value = "target", condition = { env_not_set = [
|
||||||
"CARGO_TARGET_DIR",
|
"CARGO_TARGET_DIR",
|
||||||
] } }
|
] } }
|
||||||
FUZZER_NAME = { source = "${CARGO_MAKE_RUST_TARGET_OS}", default_value = "frida_gdiplus", mapping = { "linux" = "frida_gdiplus", "macos" = "frida_gdiplus", "windows" = "frida_gdiplus.exe" } }
|
FUZZER_NAME = { source = "${CARGO_MAKE_RUST_TARGET_OS}", default_value = "frida_windows_gdiplus", mapping = { "linux" = "frida_windows_gdiplus", "macos" = "frida_windows_gdiplus", "windows" = "frida_windows_gdiplus.exe" } }
|
||||||
PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
|
PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
|
||||||
PROFILE_DIR = { value = "release", condition = { env_not_set = [
|
PROFILE_DIR = { value = "release", condition = { env_not_set = [
|
||||||
"PROFILE_DIR",
|
"PROFILE_DIR",
|
||||||
@ -79,8 +79,8 @@ script = '''
|
|||||||
for %%i in (t1 t2 t3 t4 t5 t6 t7) do (
|
for %%i in (t1 t2 t3 t4 t5 t6 t7) do (
|
||||||
echo Testing %%i...
|
echo Testing %%i...
|
||||||
rmdir /s /q output_%%i
|
rmdir /s /q output_%%i
|
||||||
start "" "frida_gdiplus.exe" -H cmplog.dll -i corpus -o output_%%i --libs-to-instrument cmplog.dll -F %%i -C
|
start "" "frida_windows_gdiplus.exe" -H cmplog.dll -i corpus -o output_%%i --libs-to-instrument cmplog.dll -F %%i -C
|
||||||
ping -n 3 127.0.0.1>NUL && taskkill /im frida_gdiplus.exe /F
|
ping -n 3 127.0.0.1>NUL && taskkill /im frida_windows_gdiplus.exe /F
|
||||||
>nul 2>nul dir /a-d "output_%%i" && (echo Files exist) || (exit /b 1337)
|
>nul 2>nul dir /a-d "output_%%i" && (echo Files exist) || (exit /b 1337)
|
||||||
)
|
)
|
||||||
|
|
||||||
@ -91,9 +91,9 @@ dependencies = ["fuzzer", "harness_windows_cmplog_test"]
|
|||||||
[tasks.test_windows]
|
[tasks.test_windows]
|
||||||
script_runner = "@shell"
|
script_runner = "@shell"
|
||||||
script = '''
|
script = '''
|
||||||
start "" "frida_gdiplus.exe" -H harness.dll -i corpus -o output --libs-to-instrument gdi32.dll --libs-to-instrument gdi32full.dll --libs-to-instrument gdiplus.dll --libs-to-instrument WindowsCodecs.dll --disable-excludes
|
start "" "frida_windows_gdiplus.exe" -H harness.dll -i corpus -o output --libs-to-instrument gdi32.dll --libs-to-instrument gdi32full.dll --libs-to-instrument gdiplus.dll --libs-to-instrument WindowsCodecs.dll --disable-excludes
|
||||||
#ping is for timeout
|
#ping is for timeout
|
||||||
ping -n 10 127.0.0.1>NUL && taskkill /im frida_gdiplus.exe /F
|
ping -n 10 127.0.0.1>NUL && taskkill /im frida_windows_gdiplus.exe /F
|
||||||
>nul 2>nul dir /a-d "corpus_discovered\*" && (echo Files exist) || (exit /b 1337)
|
>nul 2>nul dir /a-d "corpus_discovered\*" && (echo Files exist) || (exit /b 1337)
|
||||||
'''
|
'''
|
||||||
dependencies = ["fuzzer", "harness"]
|
dependencies = ["fuzzer", "harness"]
|
14
fuzzers/binary_only/frida_windows_gdiplus/README.md
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
# LibAFL Frida_Windows_GdiPlus Example
|
||||||
|
|
||||||
|
This is a an example how to fuzz binary-only dlls on Windows.
|
||||||
|
The example fuzzer will explore [gdiplus](https://learn.microsoft.com/en-us/windows/win32/gdiplus/-gdiplus-gdi-start) on Windows, using the [Frida](https://frida.re/) DBI.
|
||||||
|
|
||||||
|
## Build
|
||||||
|
|
||||||
|
To build this example, run `cargo build --release` in this folder.
|
||||||
|
|
||||||
|
Then compile the harness `cl.exe /LD harness.cc /link /dll gdiplus.lib ole32.lib`
|
||||||
|
|
||||||
|
## Run
|
||||||
|
|
||||||
|
To run the example `target\release\frida_windows_gdiplus.exe -H harness.dll -i corpus -o output --libs-to-instrument gdi32.dll --libs-to-instrument gdi32full.dll --libs-to-instrument gdiplus.dll --libs-to-instrument WindowsCodecs.dll --disable-excludes`
|
Before Width: | Height: | Size: 218 B After Width: | Height: | Size: 218 B |
Before Width: | Height: | Size: 376 B After Width: | Height: | Size: 376 B |
Before Width: | Height: | Size: 228 B After Width: | Height: | Size: 228 B |
Before Width: | Height: | Size: 427 B After Width: | Height: | Size: 427 B |
@ -286,7 +286,9 @@ mod swap {
|
|||||||
|
|
||||||
impl<I, S> Observer<I, S> for DifferentialAFLMapSwapObserver<'_, '_> {}
|
impl<I, S> Observer<I, S> for DifferentialAFLMapSwapObserver<'_, '_> {}
|
||||||
|
|
||||||
impl<OTA, OTB, I, S> DifferentialObserver<OTA, OTB, I, S> for DifferentialAFLMapSwapObserver<'_, '_> {
|
impl<OTA, OTB, I, S> DifferentialObserver<OTA, OTB, I, S>
|
||||||
|
for DifferentialAFLMapSwapObserver<'_, '_>
|
||||||
|
{
|
||||||
fn pre_observe_first(&mut self, _: &mut OTA) -> Result<(), Error> {
|
fn pre_observe_first(&mut self, _: &mut OTA) -> Result<(), Error> {
|
||||||
let slice = self.first_map.as_slice_mut();
|
let slice = self.first_map.as_slice_mut();
|
||||||
unsafe {
|
unsafe {
|
||||||
|