1 #include <iostream>
2
3 #include <stdio.h>
4 #include <string.h>
5 #include <unistd.h>
6 #include <sys/types.h>
7 #include <sys/stat.h>
8 #include <sys/mman.h>
9 #include <sys/wait.h>
10 #include <fcntl.h>
11 #include <dlfcn.h>
12
13 #ifdef __ANDROID__
14 #include "../include/android-ashmem.h"
15 #endif
16
17 #include <sys/ipc.h>
18 #include <sys/shm.h>
19 #include "../config.h"
20
21 #include <QBDI.h>
22
23 /* NeverZero */
24
25 #if (defined(__x86_64__) || defined(__i386__)) && defined(AFL_QEMU_NOT_ZERO)
26 #define INC_AFL_AREA(loc) \
27 asm volatile( \
28 "addb $1, (%0, %1, 1)\n" \
29 "adcb $0, (%0, %1, 1)\n" \
30 : /* no out */ \
31 : "r"(afl_area_ptr), "r"(loc) \
32 : "memory", "eax")
33 #else
34 #define INC_AFL_AREA(loc) afl_area_ptr[loc]++
35 #endif
36
37 using namespace QBDI;
38
39 typedef int (*target_func)(char *buf, int size);
40
41 static const size_t STACK_SIZE = 0x100000; // 1MB
42 static const QBDI::rword FAKE_RET_ADDR = 0x40000;
43 target_func p_target_func = NULL;
44 rword module_base = 0;
45 rword module_end = 0;
46 static unsigned char
47 dummy[MAP_SIZE]; /* costs MAP_SIZE but saves a few instructions */
48 unsigned char *afl_area_ptr = NULL; /* Exported for afl_gen_trace */
49
50 unsigned long afl_prev_loc = 0;
51
52 char input_pathname[PATH_MAX];
53
54 /* Set up SHM region and initialize other stuff. */
55
afl_setup(void)56 int afl_setup(void) {
57
58 char *id_str = getenv(SHM_ENV_VAR);
59 int shm_id;
60 if (id_str) {
61
62 shm_id = atoi(id_str);
63 afl_area_ptr = (unsigned char *)shmat(shm_id, NULL, 0);
64 if (afl_area_ptr == (void *)-1) return 0;
65 memset(afl_area_ptr, 0, MAP_SIZE);
66
67 }
68
69 return 1;
70
71 }
72
73 /* Fork server logic, invoked once we hit _start. */
afl_forkserver()74 static void afl_forkserver() {
75
76 static unsigned char tmp[4];
77 pid_t child_pid;
78
79 if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
80
81 while (1) {
82
83 int status;
84 u32 was_killed;
85 // wait for afl-fuzz
86 if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(2);
87
88 child_pid = fork();
89 if (child_pid < 0) exit(4);
90
91 if (!child_pid) {
92
93 // child return to execute code
94 close(FORKSRV_FD);
95 close(FORKSRV_FD + 1);
96 return;
97
98 }
99
100 // write child pid to afl-fuzz
101 if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(5);
102
103 // wait child stop
104 if (waitpid(child_pid, &status, 0) < 0) exit(6);
105
106 // send child stop status to afl-fuzz
107 if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7);
108
109 }
110
111 }
112
afl_maybe_log(unsigned long cur_loc)113 void afl_maybe_log(unsigned long cur_loc) {
114
115 if (afl_area_ptr == NULL) { return; }
116 unsigned long afl_idx = cur_loc ^ afl_prev_loc;
117 afl_idx &= MAP_SIZE - 1;
118 INC_AFL_AREA(afl_idx);
119 afl_prev_loc = cur_loc >> 1;
120
121 }
122
read_file(char * path,unsigned long * length)123 char *read_file(char *path, unsigned long *length) {
124
125 unsigned long len;
126 char * buf;
127
128 FILE *fp = fopen(path, "rb");
129 fseek(fp, 0, SEEK_END);
130 len = ftell(fp);
131 buf = (char *)malloc(len);
132 rewind(fp);
133 fread(buf, 1, len, fp);
134 fclose(fp);
135 *length = len;
136 return buf;
137
138 }
139
fuzz_func()140 QBDI_NOINLINE int fuzz_func() {
141
142 if (afl_setup()) { afl_forkserver(); }
143
144 unsigned long len = 0;
145 char * data = read_file(input_pathname, &len);
146
147 // printf("In fuzz_func\n");
148 p_target_func(data, len);
149 return 1;
150
151 }
152
bbcallback(QBDI::VMInstanceRef vm,const QBDI::VMState * state,QBDI::GPRState * gprState,QBDI::FPRState * fprState,void * data)153 static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm,
154 const QBDI::VMState *state,
155 QBDI::GPRState * gprState,
156 QBDI::FPRState *fprState, void *data) {
157
158 // errno = SAVED_ERRNO;
159
160 #ifdef __x86_64__
161 unsigned long pc = gprState->rip;
162 #elif defined(i386)
163 unsigned long pc = gprState->eip;
164 #elif defined(__arm__)
165 unsigned long pc = gprState->pc;
166 #endif
167
168 // just log the module path
169 if (pc >= module_base && pc <= module_end) {
170
171 unsigned long offset = pc - module_base;
172 printf("\toffset:%p\n", offset);
173 afl_maybe_log(offset);
174
175 }
176
177 return QBDI::VMAction::CONTINUE;
178
179 }
180
main(int argc,char ** argv)181 int main(int argc, char **argv) {
182
183 if (argc < 3) {
184
185 puts("usage: ./loader library_path input_file_path");
186 exit(0);
187
188 }
189
190 const char *lib_path;
191 lib_path = argv[1];
192 strcpy(input_pathname, argv[2]);
193 void *handle = dlopen(lib_path, RTLD_LAZY);
194
195 if (handle == nullptr) {
196
197 perror("Cannot load library");
198 exit(EXIT_FAILURE);
199
200 }
201
202 const char *lib_name = lib_path;
203 if (strrchr(lib_name, '/') != nullptr) lib_name = strrchr(lib_name, '/') + 1;
204
205 // printf("library name:%s\n", lib_name);
206 // load library module address for log path
207 for (MemoryMap &map : getCurrentProcessMaps()) {
208
209 // printf("module:%s\n", map.name.c_str());
210 if ((map.permission & PF_EXEC) &&
211 strstr(map.name.c_str(), lib_name) != NULL) {
212
213 module_base = map.range.start;
214 module_end = map.range.end;
215
216 }
217
218 }
219
220 if (module_base == 0) {
221
222 std::cerr << "Fail to find base address" << std::endl;
223 return -1;
224
225 }
226
227 // printf("module base:%p, module end:%p\n", module_base, module_end);
228 p_target_func = (target_func)dlsym(handle, "target_func");
229 // p_target_func = (target_func)(module_base + 0x61a);
230 printf("p_target_func:%p\n", p_target_func);
231
232 VM vm;
233 uint8_t *fakestack = nullptr;
234
235 GPRState *state = vm.getGPRState();
236 allocateVirtualStack(state, STACK_SIZE, &fakestack);
237 vm.addInstrumentedModuleFromAddr(module_base);
238 vm.addInstrumentedModuleFromAddr((rword)&main);
239
240 vm.addVMEventCB(BASIC_BLOCK_ENTRY, bbcallback, nullptr);
241
242 // QBDI::simulateCall(state, FAKE_RET_ADDR);
243 // vm.run((rword)&fuzz_func, (rword)FAKE_RET_ADDR);
244
245 rword ret;
246 vm.call(&ret, (rword)&fuzz_func, {});
247
248 return 0;
249
250 }
251
252