SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix frida-mode for debug builds, ensure it will continue to work on release builds (#427)

Browse Source 
* Fix cfg directives so that we actually build on all combinations of release/debug x86_64/aarch64

* Include fuzzer for stalker purposes

* Get rid of cfg on use
This commit is contained in:
s1341 2021-12-21 15:30:47 +02:00 committed by GitHub
parent 785cddc1f0
commit b0019ae4a9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 29 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
libafl_frida/src/executor.rs
View File

@ -7,7 +7,6 @@ use frida_gum::{
Gum, NativePointer,
};
#[cfg(any(debug_assertions, target_arch = "aarch64"))]
use frida_gum::MemoryRange;
use libafl::{
@ -59,9 +58,7 @@ where
self.helper.pre_exec(input);
if self.helper.stalker_enabled() {
if self.followed {
self.stalker.activate(NativePointer(
self.base.harness_mut() as *mut _ as *mut c_void
));
self.stalker.activate(NativePointer(core::ptr::null_mut()));
} else {
self.followed = true;
self.stalker
@ -111,13 +108,22 @@ where
OT: ObserversTuple<I, S>,
{
pub fn new(gum: &'a Gum, base: InProcessExecutor<'a, H, I, OT, S>, helper: &'c mut FH) -> Self {
#[cfg(all(not(debug_assertions), target_arch = "x86_64"))]
let stalker = Stalker::new(gum);
#[cfg(any(debug_assertions, target_arch = "aarch64"))]
let mut stalker = Stalker::new(gum);
#[cfg(any(debug_assertions, target_arch = "aarch64"))]
for range in helper.ranges().gaps(&(0..usize::MAX)) {
// Include the current module (the fuzzer) in stalked ranges. We clone the ranges so that
// we don't add it to the INSTRUMENTED ranges.
let mut ranges = helper.ranges().clone();
for module in frida_gum::Module::enumerate_modules() {
if module.base_address < Self::new as usize
&& (Self::new as usize) < module.base_address + module.size
{
ranges.insert(
module.base_address..(module.base_address + module.size),
(0xffff, "fuzzer".to_string()),
);
break;
}
}
for range in ranges.gaps(&(0..usize::MAX)) {
println!("excluding range: {:x}-{:x}", range.start, range.end);
stalker.exclude(&MemoryRange::new(
NativePointer(range.start as *mut c_void),

20
libafl_frida/src/helper.rs
View File

@ -78,6 +78,8 @@ pub trait FridaHelper<'a> {
fn map_ptr_mut(&mut self) -> *mut u8;
fn ranges(&self) -> &RangeMap<usize, (u16, String)>;
fn ranges_mut(&mut self) -> &mut RangeMap<usize, (u16, String)>;
}
/// An helper that feeds `FridaInProcessExecutor` with edge-coverage instrumentation
@ -156,6 +158,10 @@ impl<'a> FridaHelper<'a> for FridaInstrumentationHelper<'a> {
fn ranges(&self) -> &RangeMap<usize, (u16, String)> {
&self.ranges
}
fn ranges_mut(&mut self) -> &mut RangeMap<usize, (u16, String)> {
&mut self.ranges
}
}
/// Helper function to get the size of a module's CODE section from frida
@ -279,13 +285,13 @@ impl<'a> FridaInstrumentationHelper<'a> {
let instr = instruction.instr();
let address = instr.address();
// println!("block @ {:x} transformed to {:x}", address, output.writer().pc());
/*
println!(
"address: {:x} contains: {:?}",
address,
helper.ranges.contains_key(&(address as usize))
);
*/
//println!(
//"address: {:x} contains: {:?}",
//address,
//helper.ranges.contains_key(&(address as usize))
//);
// println!("Ranges: {:#?}", helper.ranges);
if helper.ranges.contains_key(&(address as usize)) {
if first {