libdislocator, new option to name an anonymous address range.
For performance matter tough, disabled by default.
MODIFY
unicorn_mode/unicornafl
unicorn_mode/unicornafl
-Subproject commit d4915053d477dd827b3fe4b494173d3fbf9f456e
+Subproject commit a44fa94488d01aba60401ccf81f8bebcce685bf2

MODIFY
utils/libdislocator/Makefile
utils/libdislocator/Makefile
@@ -19,9 +19,10 @@ HELPER_PATH = $(PREFIX)/lib/afl
VERSION = $(shell grep '^\#define VERSION ' ../../config.h | cut -d '"' -f2)
CFLAGS ?= -O3 -funroll-loops -D_FORTIFY_SOURCE=2
-override CFLAGS += -I ../../include/ -Wall -g -Wno-pointer-sign
+CFLAGS += -I ../../include/ -Wall -g -Wno-pointer-sign
CFLAGS_ADD=$(USEHUGEPAGE:1=-DUSEHUGEPAGE)
+CFLAGS_ADD += $(USENAMEDPAGE:1=-DUSENAMEDPAGE)
CFLAGS += $(CFLAGS_ADD)
all: libdislocator.so

MODIFY
utils/libdislocator/README.md
utils/libdislocator/README.md
@@ -29,6 +29,9 @@ heap-related security bugs in several ways:
- Optionally, in platforms supporting it, huge pages can be used by passing
`USEHUGEPAGE=1` to make.
+ - Optionally, in platforms supporting it, `named` pages can be used by passing
+ `USENAMEDPAGE=1` to make.
+
- Size alignment to `max_align_t` can be enforced with `AFL_ALIGNED_ALLOC=1`. In
this case, a tail canary is inserted in the padding bytes at the end of the
allocated zone. This reduce the ability of libdislocator to detect

MODIFY
utils/libdislocator/libdislocator.so.c
utils/libdislocator/libdislocator.so.c
#if (defined(__linux__) && !defined(__ANDROID__)) || defined(__HAIKU__)
#include <unistd.h>
+ #include <sys/prctl.h>
#ifdef __linux__
#include <sys/syscall.h>
#include <malloc.h>
} while (0)
#endif
+ #ifndef PR_SET_VMA
+ #define PR_SET_VMA 0x53564d41
+ #define PR_SET_VMA_ANON_NAME 0
+ #endif
#endif
#include "config.h"
@@ -251,6 +256,19 @@ static void *__dislocator_alloc(size_t len) {
}
+#if defined(USENAMEDPAGE)
+#if defined(__linux__)
+ // in the /proc/<pid>/maps file, the anonymous page appears as
+ // `<start>-<end> ---p 00000000 00:00 0 [anon:libdislocator]`
+ if (prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME,
+ (unsigned long)ret, tlen, (unsigned long)"libdislocator") < 0) {
+
+ DEBUGF("prctl() failed");
+
+ }
+#endif
+#endif
+
/* Set PROT_NONE on the last page. */
if (mprotect(ret + PG_COUNT(rlen + 8) * PAGE_SIZE, PAGE_SIZE, PROT_NONE))

libdislocator, new option to name an anonymous address range.
For performance matter tough, disabled by default.