persistent qemu retaddr offset
MODIFY
qemu_mode/patches/afl-qemu-common.h
qemu_mode/patches/afl-qemu-common.h
@@ -61,6 +61,7 @@ extern target_long persistent_stack_offset;
extern unsigned char persistent_first_pass;
extern unsigned char persistent_save_gpr;
extern target_ulong persistent_saved_gpr[CPU_NB_REGS];
+extern int persisent_retaddr_offset;
extern __thread abi_ulong afl_prev_loc;

MODIFY
qemu_mode/patches/afl-qemu-cpu-inl.h
qemu_mode/patches/afl-qemu-cpu-inl.h
@@ -90,6 +90,7 @@ target_long persistent_stack_offset;
unsigned char persistent_first_pass;
unsigned char persistent_save_gpr;
target_ulong persistent_saved_gpr[CPU_NB_REGS];
+int persisent_retaddr_offset;
/* Instrumentation ratio: */
@@ -219,6 +220,9 @@ static void afl_setup(void) {
if (getenv("AFL_QEMU_PERSISTENT_GPR"))
persistent_save_gpr = 1;
+ if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"))
+ persisent_retaddr_offset = strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 16);
+
if (getenv("AFL_QEMU_PERSISTENT_CNT"))
afl_persistent_cnt = strtoll(getenv("AFL_QEMU_PERSISTENT_CNT"), NULL, 16);
else

MODIFY
qemu_mode/patches/afl-qemu-cpu-translate-inl.h
qemu_mode/patches/afl-qemu-cpu-translate-inl.h
@@ -195,7 +195,7 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2,
if (afl_persistent_ret_addr == 0) { \
\
TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr); \
- tcg_gen_st_tl(paddr, cpu_regs[R_ESP], 0); \
+ tcg_gen_st_tl(paddr, cpu_regs[R_ESP], persisent_retaddr_offset); \
\
} \
tcg_gen_afl_call0(&afl_persistent_loop); \

persistent qemu retaddr offset