From a42a3a9ccf41389bea41302c079eaa853187549e Mon Sep 17 00:00:00 2001 From: s1341 Date: Mon, 8 Nov 2021 08:51:58 +0200 Subject: [PATCH] Support suppression of hooked functions (#369) --- libafl_frida/src/asan_rt.rs | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/libafl_frida/src/asan_rt.rs b/libafl_frida/src/asan_rt.rs index 8fa61fde9e..fdbc275baa 100644 --- a/libafl_frida/src/asan_rt.rs +++ b/libafl_frida/src/asan_rt.rs @@ -7,7 +7,7 @@ this helps finding mem errors early. */ use frida_gum::NativePointer; -use frida_gum::RangeDetails; +use frida_gum::{ModuleDetails, RangeDetails}; use hashbrown::HashMap; use nix::sys::mman::{mmap, MapFlags, ProtFlags}; @@ -114,6 +114,7 @@ pub struct AsanRuntime { stalked_addresses: HashMap, options: FridaOptions, module_map: Option, + suppressed_addresses: Vec, shadow_check_func: Option bool>, } @@ -140,6 +141,7 @@ impl AsanRuntime { stalked_addresses: HashMap::new(), options, module_map: None, + suppressed_addresses: Vec::new(), shadow_check_func: None, } } @@ -157,6 +159,13 @@ impl AsanRuntime { self.unpoison_all_existing_memory(); self.module_map = Some(ModuleMap::new_from_names(modules_to_instrument)); + if let Some(suppressed_specifiers) = self.options.dont_instrument_locations() { + for (module_name, offset) in suppressed_specifiers { + let module_details = ModuleDetails::with_name(module_name).unwrap(); + let lib_start = module_details.range().base_address().0 as usize; + self.suppressed_addresses.push(lib_start + offset); + } + } self.hook_functions(_gum); @@ -1466,7 +1475,8 @@ impl AsanRuntime { unsafe extern "C" fn []($($param: $param_type),*) -> $return_type { let mut invocation = Interceptor::current_invocation(); let this = &mut *(invocation.replacement_data().unwrap().0 as *mut AsanRuntime); - if this.module_map.as_ref().unwrap().find(this.real_address_for_stalked(invocation.return_addr() as usize) as u64).is_some() { + let real_address = this.real_address_for_stalked(invocation.return_addr() as usize); + if !this.suppressed_addresses.contains(&real_address) && this.module_map.as_ref().unwrap().find(real_address as u64).is_some() { this.[]($($param),*) } else { $name($($param),*)