diff --git a/libafl_frida/src/executor.rs b/libafl_frida/src/executor.rs index fab4639cd3..8a2eb15b20 100644 --- a/libafl_frida/src/executor.rs +++ b/libafl_frida/src/executor.rs @@ -7,7 +7,6 @@ use frida_gum::{ Gum, NativePointer, }; -#[cfg(any(debug_assertions, target_arch = "aarch64"))] use frida_gum::MemoryRange; use libafl::{ @@ -59,9 +58,7 @@ where self.helper.pre_exec(input); if self.helper.stalker_enabled() { if self.followed { - self.stalker.activate(NativePointer( - self.base.harness_mut() as *mut _ as *mut c_void - )); + self.stalker.activate(NativePointer(core::ptr::null_mut())); } else { self.followed = true; self.stalker @@ -111,13 +108,22 @@ where OT: ObserversTuple, { pub fn new(gum: &'a Gum, base: InProcessExecutor<'a, H, I, OT, S>, helper: &'c mut FH) -> Self { - #[cfg(all(not(debug_assertions), target_arch = "x86_64"))] - let stalker = Stalker::new(gum); - #[cfg(any(debug_assertions, target_arch = "aarch64"))] let mut stalker = Stalker::new(gum); - - #[cfg(any(debug_assertions, target_arch = "aarch64"))] - for range in helper.ranges().gaps(&(0..usize::MAX)) { + // Include the current module (the fuzzer) in stalked ranges. We clone the ranges so that + // we don't add it to the INSTRUMENTED ranges. + let mut ranges = helper.ranges().clone(); + for module in frida_gum::Module::enumerate_modules() { + if module.base_address < Self::new as usize + && (Self::new as usize) < module.base_address + module.size + { + ranges.insert( + module.base_address..(module.base_address + module.size), + (0xffff, "fuzzer".to_string()), + ); + break; + } + } + for range in ranges.gaps(&(0..usize::MAX)) { println!("excluding range: {:x}-{:x}", range.start, range.end); stalker.exclude(&MemoryRange::new( NativePointer(range.start as *mut c_void), diff --git a/libafl_frida/src/helper.rs b/libafl_frida/src/helper.rs index bfa096162b..480ab63064 100644 --- a/libafl_frida/src/helper.rs +++ b/libafl_frida/src/helper.rs @@ -78,6 +78,8 @@ pub trait FridaHelper<'a> { fn map_ptr_mut(&mut self) -> *mut u8; fn ranges(&self) -> &RangeMap; + + fn ranges_mut(&mut self) -> &mut RangeMap; } /// An helper that feeds `FridaInProcessExecutor` with edge-coverage instrumentation @@ -156,6 +158,10 @@ impl<'a> FridaHelper<'a> for FridaInstrumentationHelper<'a> { fn ranges(&self) -> &RangeMap { &self.ranges } + + fn ranges_mut(&mut self) -> &mut RangeMap { + &mut self.ranges + } } /// Helper function to get the size of a module's CODE section from frida @@ -279,13 +285,13 @@ impl<'a> FridaInstrumentationHelper<'a> { let instr = instruction.instr(); let address = instr.address(); // println!("block @ {:x} transformed to {:x}", address, output.writer().pc()); - /* - println!( - "address: {:x} contains: {:?}", - address, - helper.ranges.contains_key(&(address as usize)) - ); - */ + + //println!( + //"address: {:x} contains: {:?}", + //address, + //helper.ranges.contains_key(&(address as usize)) + //); + // println!("Ranges: {:#?}", helper.ranges); if helper.ranges.contains_key(&(address as usize)) { if first {