unicorn compcov for x86
MODIFY
.gitignore
.gitignore
@@ -21,3 +21,4 @@ qemu_mode/qemu-3.1.0
qemu_mode/qemu-3.1.0.tar.xz
unicorn_mode/unicorn
unicorn_mode/unicorn-*
+unicorn_mode/*.tar.gz

MODIFY
unicorn_mode/build_unicorn_support.sh
unicorn_mode/build_unicorn_support.sh
@@ -127,12 +127,13 @@ tar xzf "$ARCHIVE" -C ./unicorn --strip-components=1 || exit 1
echo "[+] Unpacking successful."
-rm -rf "$ARCHIVE" || exit 1
+#rm -rf "$ARCHIVE" || exit 1
echo "[*] Applying patches..."
-cp patches/afl-unicorn-cpu-inl.h unicorn || exit 1
+cp patches/*.h unicorn || exit 1
patch -p1 --directory unicorn < patches/patches.diff || exit 1
+patch -p1 --directory unicorn < patches/compcov.diff || exit 1
echo "[+] Patching done."

MODIFY
unicorn_mode/patches/afl-unicorn-cpu-inl.h
unicorn_mode/patches/afl-unicorn-cpu-inl.h
#define AFL_UNICORN_CPU_SNIPPET2 do { \
if(unlikely(afl_first_instr == 0)) { \
- afl_setup(); \
+ afl_setup(env->uc); \
afl_forkserver(env); \
afl_first_instr = 1; \
} \
- afl_maybe_log(tb->pc); \
+ afl_maybe_log(env->uc, tb->pc); \
} while (0)
/* We use one additional file descriptor to relay "needs translation"
#define TSL_FD (FORKSRV_FD - 1)
-/* This is equivalent to afl-as.h: */
-
-static unsigned char *afl_area_ptr;
-
/* Set in the child process in forkserver mode: */
static unsigned char afl_fork_child;
static unsigned int afl_forksrv_pid;
-/* Instrumentation ratio: */
-
-static unsigned int afl_inst_rms = MAP_SIZE;
-
/* Function declarations. */
-static void afl_setup(void);
+static void afl_setup(struct uc_struct* uc);
static void afl_forkserver(CPUArchState*);
-static inline void afl_maybe_log(unsigned long);
+static inline void afl_maybe_log(struct uc_struct* uc, unsigned long);
static void afl_wait_tsl(CPUArchState*, int);
static void afl_request_tsl(target_ulong, target_ulong, uint64_t);
@@ -105,7 +97,7 @@ struct afl_tsl {
/* Set up SHM region and initialize other stuff. */
-static void afl_setup(void) {
+static void afl_setup(struct uc_struct* uc) {
char *id_str = getenv(SHM_ENV_VAR),
*inst_r = getenv("AFL_INST_RATIO");
@@ -121,21 +113,35 @@ static void afl_setup(void) {
if (r > 100) r = 100;
if (!r) r = 1;
- afl_inst_rms = MAP_SIZE * r / 100;
+ uc->afl_inst_rms = MAP_SIZE * r / 100;
+
+ } else {
+
+ uc->afl_inst_rms = MAP_SIZE;
}
if (id_str) {
shm_id = atoi(id_str);
- afl_area_ptr = shmat(shm_id, NULL, 0);
+ uc->afl_area_ptr = shmat(shm_id, NULL, 0);
- if (afl_area_ptr == (void*)-1) exit(1);
+ if (uc->afl_area_ptr == (void*)-1) exit(1);
/* With AFL_INST_RATIO set to a low value, we want to touch the bitmap
so that the parent doesn't give up on us. */
- if (inst_r) afl_area_ptr[0] = 1;
+ if (inst_r) uc->afl_area_ptr[0] = 1;
+ }
+
+ /* Maintain for compatibility */
+ if (getenv("AFL_QEMU_COMPCOV")) {
+
+ uc->afl_compcov_level = 1;
+ }
+ if (getenv("AFL_COMPCOV_LEVEL")) {
+
+ uc->afl_compcov_level = atoi(getenv("AFL_COMPCOV_LEVEL"));
}
}
@@ -145,7 +151,7 @@ static void afl_forkserver(CPUArchState *env) {
static unsigned char tmp[4];
- if (!afl_area_ptr) return;
+ if (!env->uc->afl_area_ptr) return;
/* Tell the parent that we're alive. If the parent doesn't want
to talk, assume that we're not running in forkserver mode. */
@@ -208,7 +214,7 @@ static void afl_forkserver(CPUArchState *env) {
/* The equivalent of the tuple logging routine from afl-as.h. */
-static inline void afl_maybe_log(unsigned long cur_loc) {
+static inline void afl_maybe_log(struct uc_struct* uc, unsigned long cur_loc) {
static __thread unsigned long prev_loc;
@@ -217,7 +223,7 @@ static inline void afl_maybe_log(unsigned long cur_loc) {
// MODIFIED FOR UNICORN MODE -> We want to log all addresses,
// so the checks for 'start < addr < end' are removed
- if(!afl_area_ptr)
+ if(!uc->afl_area_ptr)
return;
// DEBUG
@@ -236,7 +242,7 @@ static inline void afl_maybe_log(unsigned long cur_loc) {
// DEBUG
//printf("afl_inst_rms = 0x%lx\n", afl_inst_rms);
- if (cur_loc >= afl_inst_rms) return;
+ if (cur_loc >= uc->afl_inst_rms) return;
// DEBUG
//printf("cur_loc = 0x%lx\n", cur_loc);
@@ -249,11 +255,11 @@ static inline void afl_maybe_log(unsigned long cur_loc) {
"seto %%al\n"
"addb %%al, (%0, %1, 1)\n"
: /* no out */
- : "r" (afl_area_ptr), "r" (afl_idx)
+ : "r" (uc->afl_area_ptr), "r" (afl_idx)
: "memory", "eax"
);
#else
- afl_area_ptr[afl_idx]++;
+ uc->afl_area_ptr[afl_idx]++;
#endif
prev_loc = cur_loc >> 1;

ADD
unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h
+/*
+ american fuzzy lop - high-performance binary-only instrumentation
+ -----------------------------------------------------------------
+
+ Written by Andrew Griffiths <agriffiths@google.com> and
+ Michal Zalewski <lcamtuf@google.com>
+
+ TCG instrumentation and block chaining support by Andrea Biondo
+ <andrea.biondo965@gmail.com>
+ Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co>
+
+ Idea & design very much by Andrew Griffiths.
+
+ Copyright 2015, 2016 Google Inc. All rights reserved.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at:
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ This code is a shim patched into the separately-distributed source
+ code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality
+ to implement AFL-style instrumentation and to take care of the remaining
+ parts of the AFL fork server logic.
+
+ The resulting QEMU binary is essentially a standalone instrumentation
+ tool; for an example of how to leverage it for other purposes, you can
+ have a look at afl-showmap.c.
+
+ */
+
+#include "../../config.h"
+
+static void afl_gen_compcov(TCGContext *s, uint64_t cur_loc, TCGv_i64 arg1,
+ TCGv_i64 arg2, TCGMemOp ot, int is_imm) {
+
+ if (!s->uc->afl_compcov_level || !s->uc->afl_area_ptr)
+ return;
+
+ if (!is_imm && s->uc->afl_compcov_level < 2)
+ return;
+
+ cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
+ cur_loc &= MAP_SIZE - 1;
+
+ if (cur_loc >= s->uc->afl_inst_rms) return;
+
+ switch (ot) {
+ case MO_64:
+ gen_afl_compcov_log_64(s, cur_loc, arg1, arg2);
+ break;
+ case MO_32:
+ gen_afl_compcov_log_32(s, cur_loc, arg1, arg2);
+ break;
+ case MO_16:
+ gen_afl_compcov_log_16(s, cur_loc, arg1, arg2);
+ break;
+ default:
+ return;
+ }
+}

ADD
unicorn_mode/patches/afl-unicorn-tcg-op-inl.h
+/*
+ american fuzzy lop - high-performance binary-only instrumentation
+ -----------------------------------------------------------------
+
+ Written by Andrew Griffiths <agriffiths@google.com> and
+ Michal Zalewski <lcamtuf@google.com>
+
+ TCG instrumentation and block chaining support by Andrea Biondo
+ <andrea.biondo965@gmail.com>
+ Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co>
+
+ Idea & design very much by Andrew Griffiths.
+
+ Copyright 2015, 2016 Google Inc. All rights reserved.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at:
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ This code is a shim patched into the separately-distributed source
+ code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality
+ to implement AFL-style instrumentation and to take care of the remaining
+ parts of the AFL fork server logic.
+
+ The resulting QEMU binary is essentially a standalone instrumentation
+ tool; for an example of how to leverage it for other purposes, you can
+ have a look at afl-showmap.c.
+
+ */
+
+static inline void gen_afl_compcov_log_16(TCGContext *tcg_ctx, uint64_t cur_loc,
+ TCGv_i64 arg1, TCGv_i64 arg2)
+{
+ TCGv_ptr tuc = tcg_const_ptr(tcg_ctx, tcg_ctx->uc);
+ TCGv_i64 tcur_loc = tcg_const_i64(tcg_ctx, cur_loc);
+ gen_helper_afl_compcov_log_16(tcg_ctx, tuc, tcur_loc, arg1, arg2);
+}
+
+static inline void gen_afl_compcov_log_32(TCGContext *tcg_ctx, uint64_t cur_loc,
+ TCGv_i64 arg1, TCGv_i64 arg2)
+{
+ TCGv_ptr tuc = tcg_const_ptr(tcg_ctx, tcg_ctx->uc);
+ TCGv_i64 tcur_loc = tcg_const_i64(tcg_ctx, cur_loc);
+ gen_helper_afl_compcov_log_32(tcg_ctx, tuc, tcur_loc, arg1, arg2);
+}
+
+static inline void gen_afl_compcov_log_64(TCGContext *tcg_ctx, uint64_t cur_loc,
+ TCGv_i64 arg1, TCGv_i64 arg2)
+{
+ TCGv_ptr tuc = tcg_const_ptr(tcg_ctx, tcg_ctx->uc);
+ TCGv_i64 tcur_loc = tcg_const_i64(tcg_ctx, cur_loc);
+ gen_helper_afl_compcov_log_64(tcg_ctx, tuc, tcur_loc, arg1, arg2);
+}
+

ADD
unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h
+/*
+ american fuzzy lop - high-performance binary-only instrumentation
+ -----------------------------------------------------------------
+
+ Written by Andrew Griffiths <agriffiths@google.com> and
+ Michal Zalewski <lcamtuf@google.com>
+
+ TCG instrumentation and block chaining support by Andrea Biondo
+ <andrea.biondo965@gmail.com>
+ Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co>
+
+ Idea & design very much by Andrew Griffiths.
+
+ Copyright 2015, 2016 Google Inc. All rights reserved.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at:
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ This code is a shim patched into the separately-distributed source
+ code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality
+ to implement AFL-style instrumentation and to take care of the remaining
+ parts of the AFL fork server logic.
+
+ The resulting QEMU binary is essentially a standalone instrumentation
+ tool; for an example of how to leverage it for other purposes, you can
+ have a look at afl-showmap.c.
+
+ */
+
+#include "uc_priv.h"
+
+void HELPER(afl_compcov_log_16)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
+ uint64_t arg2) {
+
+ struct uc_struct* uc = uc_ptr;
+
+ if ((arg1 & 0xff) == (arg2 & 0xff)) {
+ uc->afl_area_ptr[cur_loc]++;
+ }
+}
+
+void HELPER(afl_compcov_log_32)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
+ uint64_t arg2) {
+
+ struct uc_struct* uc = uc_ptr;
+
+ if ((arg1 & 0xff) == (arg2 & 0xff)) {
+ uc->afl_area_ptr[cur_loc]++;
+ if ((arg1 & 0xffff) == (arg2 & 0xffff)) {
+ uc->afl_area_ptr[cur_loc +1]++;
+ if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) {
+ uc->afl_area_ptr[cur_loc +2]++;
+ }
+ }
+ }
+}
+
+void HELPER(afl_compcov_log_64)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
+ uint64_t arg2) {
+
+ struct uc_struct* uc = uc_ptr;
+
+ if ((arg1 & 0xff) == (arg2 & 0xff)) {
+ uc->afl_area_ptr[cur_loc]++;
+ if ((arg1 & 0xffff) == (arg2 & 0xffff)) {
+ uc->afl_area_ptr[cur_loc +1]++;
+ if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) {
+ uc->afl_area_ptr[cur_loc +2]++;
+ if ((arg1 & 0xffffffff) == (arg2 & 0xffffffff)) {
+ uc->afl_area_ptr[cur_loc +3]++;
+ if ((arg1 & 0xffffffffff) == (arg2 & 0xffffffffff)) {
+ uc->afl_area_ptr[cur_loc +4]++;
+ if ((arg1 & 0xffffffffffff) == (arg2 & 0xffffffffffff)) {
+ uc->afl_area_ptr[cur_loc +5]++;
+ if ((arg1 & 0xffffffffffffff) == (arg2 & 0xffffffffffffff)) {
+ uc->afl_area_ptr[cur_loc +6]++;
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+}
+

ADD
unicorn_mode/patches/compcov.diff
+diff --git a/include/uc_priv.h b/include/uc_priv.h
+index 22f494e..1aa7b3a 100644
+--- a/include/uc_priv.h
++++ b/include/uc_priv.h
+@@ -245,6 +245,12 @@ struct uc_struct {
+ uint32_t target_page_align;
+ uint64_t next_pc; // save next PC for some special cases
+ bool hook_insert; // insert new hook at begin of the hook list (append by default)
++
++#ifdef UNICORN_AFL
++ unsigned char *afl_area_ptr;
++ int afl_compcov_level;
++ unsigned int afl_inst_rms;
++#endif
+ };
+
+ // Metadata stub for the variable-size cpu context used with uc_context_*()
+diff --git a/qemu/target-i386/translate.c b/qemu/target-i386/translate.c
+index 36fae09..196d346 100644
+--- a/qemu/target-i386/translate.c
++++ b/qemu/target-i386/translate.c
+@@ -33,6 +33,12 @@
+
+ #include "uc_priv.h"
+
++#if defined(UNICORN_AFL)
++#include "../../afl-unicorn-cpu-translate-inl.h"
++#else
++#define afl_gen_compcov(a,b,c,d,e,f) do {} while (0)
++#endif
++
+ #define PREFIX_REPZ 0x01
+ #define PREFIX_REPNZ 0x02
+ #define PREFIX_LOCK 0x04
+@@ -1555,6 +1561,7 @@ static void gen_op(DisasContext *s, int op, TCGMemOp ot, int d)
+ case OP_SUBL:
+ tcg_gen_mov_tl(tcg_ctx, cpu_cc_srcT, *cpu_T[0]);
+ tcg_gen_sub_tl(tcg_ctx, *cpu_T[0], *cpu_T[0], *cpu_T[1]);
++ afl_gen_compcov(tcg_ctx, s->pc, *cpu_T[0], *cpu_T[1], ot, d == OR_EAX);
+ gen_op_st_rm_T0_A0(s, ot, d);
+ gen_op_update2_cc(tcg_ctx);
+ set_cc_op(s, CC_OP_SUBB + ot);
+@@ -1582,6 +1589,7 @@ static void gen_op(DisasContext *s, int op, TCGMemOp ot, int d)
+ tcg_gen_mov_tl(tcg_ctx, cpu_cc_src, *cpu_T[1]);
+ tcg_gen_mov_tl(tcg_ctx, cpu_cc_srcT, *cpu_T[0]);
+ tcg_gen_sub_tl(tcg_ctx, cpu_cc_dst, *cpu_T[0], *cpu_T[1]);
++ afl_gen_compcov(tcg_ctx, s->pc, *cpu_T[0], *cpu_T[1], ot, d == OR_EAX);
+ set_cc_op(s, CC_OP_SUBB + ot);
+ break;
+ }
+diff --git a/qemu/tcg-runtime.c b/qemu/tcg-runtime.c
+index 21b022a..14d7891 100644
+--- a/qemu/tcg-runtime.c
++++ b/qemu/tcg-runtime.c
+@@ -31,9 +31,14 @@
+
+ #define DEF_HELPER_FLAGS_2(name, flags, ret, t1, t2) \
+ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2));
++#define DEF_HELPER_FLAGS_4(name, flags, ret, t1, t2, t3, t4) \
++ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), dh_ctype(t4));
+
+ #include "tcg-runtime.h"
+
++#ifdef UNICORN_AFL
++#include "../afl-unicorn-tcg-runtime-inl.h"
++#endif
+
+ /* 32-bit helpers */
+
+diff --git a/qemu/tcg/tcg-op.h b/qemu/tcg/tcg-op.h
+index 38b7dd9..c5a9af9 100644
+--- a/qemu/tcg/tcg-op.h
++++ b/qemu/tcg/tcg-op.h
+@@ -27,6 +27,10 @@
+
+ int gen_new_label(TCGContext *);
+
++#ifdef UNICORN_AFL
++#include "../../afl-unicorn-tcg-op-inl.h"
++#endif
++
+ static inline void gen_uc_tracecode(TCGContext *tcg_ctx, int32_t size, int32_t type, void *uc, uint64_t pc)
+ {
+ TCGv_i32 tsize = tcg_const_i32(tcg_ctx, size);
+diff --git a/qemu/tcg/tcg-runtime.h b/qemu/tcg/tcg-runtime.h
+index 23a0c37..90b993c 100644
+--- a/qemu/tcg/tcg-runtime.h
++++ b/qemu/tcg/tcg-runtime.h
+@@ -14,3 +14,9 @@ DEF_HELPER_FLAGS_2(sar_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
+
+ DEF_HELPER_FLAGS_2(mulsh_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
+ DEF_HELPER_FLAGS_2(muluh_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
++
++#ifdef UNICORN_AFL
++DEF_HELPER_FLAGS_4(afl_compcov_log_16, 0, void, ptr, i64, i64, i64)
++DEF_HELPER_FLAGS_4(afl_compcov_log_32, 0, void, ptr, i64, i64, i64)
++DEF_HELPER_FLAGS_4(afl_compcov_log_64, 0, void, ptr, i64, i64, i64)
++#endif
+diff --git a/qemu/unicorn_common.h b/qemu/unicorn_common.h
+index 8dcbb3e..11e18b4 100644
+--- a/qemu/unicorn_common.h
++++ b/qemu/unicorn_common.h
+@@ -84,6 +84,10 @@ static inline void uc_common_init(struct uc_struct* uc)
+
+ if (!uc->release)
+ uc->release = release_common;
++
++#ifdef UNICORN_AFL
++ uc->afl_area_ptr = 0;
++#endif
+ }
+
+ #endif

ADD
unicorn_mode/samples/compcov_x64/COMPILE.md
+Compiling compcov_target.c
+==========================
+
+compcov_target.c was compiled without optimization, position-independent,
+and without standard libraries using the following command line:
+
+```
+gcc -o compcov_target.elf compcov_target.c -fPIC -O0 -nostdlib
+```
+
+The .text section from the resulting ELF binary was then extracted to create
+the raw binary blob that is loaded and emulated by compcov_test_harness.py:
+
+```
+objcopy -O binary --only-section=.text compcov_target.elf compcov_target.bin
+```
+
+Note that the output of this is padded with nulls for 16-byte alignment. This is
+important when emulating it, as NOPs will be added after the return of main()
+as necessary.

ADD
unicorn_mode/samples/compcov_x64/compcov_target.bin
unicorn_mode/samples/compcov_x64/compcov_target.bin
Binary files /dev/null and b/unicorn_mode/samples/compcov_x64/compcov_target.bin differ

ADD
unicorn_mode/samples/compcov_x64/compcov_target.c
+/*
+ * Sample target file to test afl-unicorn fuzzing capabilities.
+ * This is a very trivial example that will crash pretty easily
+ * in several different exciting ways.
+ *
+ * Input is assumed to come from a buffer located at DATA_ADDRESS
+ * (0x00300000), so make sure that your Unicorn emulation of this
+ * puts user data there.
+ *
+ * Written by Nathan Voss <njvoss99@gmail.com>
+ */
+
+// Magic address where mutated data will be placed
+#define DATA_ADDRESS 0x00300000
+
+int main(void) {
+ unsigned int *data_buf = (unsigned int *) DATA_ADDRESS;
+
+ if (data_buf[0] == 0xabadcafe) {
+ // Cause an 'invalid read' crash if data[0..3] == '\x01\x02\x03\x04'
+ unsigned char invalid_read = *(unsigned char *) 0x00000000;
+ } else if (data_buf[1] == data_buf[2] + 0x4141) {
+ // Cause an 'invalid read' crash if (0x10 < data[0] < 0x20) and data[1] > data[2]
+ unsigned char invalid_read = *(unsigned char *) 0x00000000;
+ }
+
+ return 0;
+}

ADD
unicorn_mode/samples/compcov_x64/compcov_target.elf
unicorn_mode/samples/compcov_x64/compcov_target.elf
Binary files /dev/null and b/unicorn_mode/samples/compcov_x64/compcov_target.elf differ

ADD
unicorn_mode/samples/compcov_x64/compcov_test_harness.py
+"""
+ Simple test harness for AFL's Unicorn Mode.
+
+ This loads the compcov_target.bin binary (precompiled as MIPS code) into
+ Unicorn's memory map for emulation, places the specified input into
+ compcov_target's buffer (hardcoded to be at 0x300000), and executes 'main()'.
+ If any crashes occur during emulation, this script throws a matching signal
+ to tell AFL that a crash occurred.
+
+ Run under AFL as follows:
+
+ $ cd <afl_path>/unicorn_mode/samples/simple/
+ $ ../../../afl-fuzz -U -m none -i ./sample_inputs -o ./output -- python compcov_test_harness.py @@
+"""
+
+import argparse
+import os
+import signal
+
+from unicorn import *
+from unicorn.x86_const import *
+
+# Path to the file containing the binary to emulate
+BINARY_FILE = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'compcov_target.bin')
+
+# Memory map for the code to be tested
+CODE_ADDRESS = 0x00100000 # Arbitrary address where code to test will be loaded
+CODE_SIZE_MAX = 0x00010000 # Max size for the code (64kb)
+STACK_ADDRESS = 0x00200000 # Address of the stack (arbitrarily chosen)
+STACK_SIZE = 0x00010000 # Size of the stack (arbitrarily chosen)
+DATA_ADDRESS = 0x00300000 # Address where mutated data will be placed
+DATA_SIZE_MAX = 0x00010000 # Maximum allowable size of mutated data
+
+try:
+ # If Capstone is installed then we'll dump disassembly, otherwise just dump the binary.
+ from capstone import *
+ cs = Cs(CS_ARCH_X86, CS_MODE_64)
+ def unicorn_debug_instruction(uc, address, size, user_data):
+ mem = uc.mem_read(address, size)
+ for (cs_address, cs_size, cs_mnemonic, cs_opstr) in cs.disasm_lite(bytes(mem), size):
+ print(" Instr: {:#016x}:\t{}\t{}".format(address, cs_mnemonic, cs_opstr))
+except ImportError:
+ def unicorn_debug_instruction(uc, address, size, user_data):
+ print(" Instr: addr=0x{0:016x}, size=0x{1:016x}".format(address, size))
+
+def unicorn_debug_block(uc, address, size, user_data):
+ print("Basic Block: addr=0x{0:016x}, size=0x{1:016x}".format(address, size))
+
+def unicorn_debug_mem_access(uc, access, address, size, value, user_data):
+ if access == UC_MEM_WRITE:
+ print(" >>> Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(address, size, value))
+ else:
+ print(" >>> Read: addr=0x{0:016x} size={1}".format(address, size))
+
+def unicorn_debug_mem_invalid_access(uc, access, address, size, value, user_data):
+ if access == UC_MEM_WRITE_UNMAPPED:
+ print(" >>> INVALID Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(address, size, value))
+ else:
+ print(" >>> INVALID Read: addr=0x{0:016x} size={1}".format(address, size))
+
+def force_crash(uc_error):
+ # This function should be called to indicate to AFL that a crash occurred during emulation.
+ # Pass in the exception received from Uc.emu_start()
+ mem_errors = [
+ UC_ERR_READ_UNMAPPED, UC_ERR_READ_PROT, UC_ERR_READ_UNALIGNED,
+ UC_ERR_WRITE_UNMAPPED, UC_ERR_WRITE_PROT, UC_ERR_WRITE_UNALIGNED,
+ UC_ERR_FETCH_UNMAPPED, UC_ERR_FETCH_PROT, UC_ERR_FETCH_UNALIGNED,
+ ]
+ if uc_error.errno in mem_errors:
+ # Memory error - throw SIGSEGV
+ os.kill(os.getpid(), signal.SIGSEGV)
+ elif uc_error.errno == UC_ERR_INSN_INVALID:
+ # Invalid instruction - throw SIGILL
+ os.kill(os.getpid(), signal.SIGILL)
+ else:
+ # Not sure what happened - throw SIGABRT
+ os.kill(os.getpid(), signal.SIGABRT)
+
+def main():
+
+ parser = argparse.ArgumentParser(description="Test harness for compcov_target.bin")
+ parser.add_argument('input_file', type=str, help="Path to the file containing the mutated input to load")
+ parser.add_argument('-d', '--debug', default=False, action="store_true", help="Enables debug tracing")
+ args = parser.parse_args()
+
+ # Instantiate a MIPS32 big endian Unicorn Engine instance
+ uc = Uc(UC_ARCH_X86, UC_MODE_64)
+
+ if args.debug:
+ uc.hook_add(UC_HOOK_BLOCK, unicorn_debug_block)
+ uc.hook_add(UC_HOOK_CODE, unicorn_debug_instruction)
+ uc.hook_add(UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, unicorn_debug_mem_access)
+ uc.hook_add(UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_READ_INVALID, unicorn_debug_mem_invalid_access)
+
+ #---------------------------------------------------
+ # Load the binary to emulate and map it into memory
+
+ print("Loading data input from {}".format(args.input_file))
+ binary_file = open(BINARY_FILE, 'rb')
+ binary_code = binary_file.read()
+ binary_file.close()
+
+ # Apply constraints to the mutated input
+ if len(binary_code) > CODE_SIZE_MAX:
+ print("Binary code is too large (> {} bytes)".format(CODE_SIZE_MAX))
+ return
+
+ # Write the mutated command into the data buffer
+ uc.mem_map(CODE_ADDRESS, CODE_SIZE_MAX)
+ uc.mem_write(CODE_ADDRESS, binary_code)
+
+ # Set the program counter to the start of the code
+ start_address = CODE_ADDRESS # Address of entry point of main()
+ end_address = CODE_ADDRESS + 0x55 # Address of last instruction in main()
+ uc.reg_write(UC_X86_REG_RIP, start_address)
+
+ #-----------------
+ # Setup the stack
+
+ uc.mem_map(STACK_ADDRESS, STACK_SIZE)
+ uc.reg_write(UC_X86_REG_RSP, STACK_ADDRESS + STACK_SIZE)
+
+ #-----------------------------------------------------
+ # Emulate 1 instruction to kick off AFL's fork server
+ # THIS MUST BE DONE BEFORE LOADING USER DATA!
+ # If this isn't done every single run, the AFL fork server
+ # will not be started appropriately and you'll get erratic results!
+ # It doesn't matter what this returns with, it just has to execute at
+ # least one instruction in order to get the fork server started.
+
+ # Execute 1 instruction just to startup the forkserver
+ print("Starting the AFL forkserver by executing 1 instruction")
+ try:
+ uc.emu_start(uc.reg_read(UC_X86_REG_RIP), 0, 0, count=1)
+ except UcError as e:
+ print("ERROR: Failed to execute a single instruction (error: {})!".format(e))
+ return
+
+ #-----------------------------------------------
+ # Load the mutated input and map it into memory
+
+ # Load the mutated input from disk
+ print("Loading data input from {}".format(args.input_file))
+ input_file = open(args.input_file, 'rb')
+ input = input_file.read()
+ input_file.close()
+
+ # Apply constraints to the mutated input
+ if len(input) > DATA_SIZE_MAX:
+ print("Test input is too long (> {} bytes)".format(DATA_SIZE_MAX))
+ return
+
+ # Write the mutated command into the data buffer
+ uc.mem_map(DATA_ADDRESS, DATA_SIZE_MAX)
+ uc.mem_write(DATA_ADDRESS, input)
+
+ #------------------------------------------------------------
+ # Emulate the code, allowing it to process the mutated input
+
+ print("Executing until a crash or execution reaches 0x{0:016x}".format(end_address))
+ try:
+ result = uc.emu_start(uc.reg_read(UC_X86_REG_RIP), end_address, timeout=0, count=0)
+ except UcError as e:
+ print("Execution failed with error: {}".format(e))
+ force_crash(e)
+
+ print("Done.")
+
+if __name__ == "__main__":
+ main()

ADD
unicorn_mode/samples/compcov_x64/sample_inputs/sample1.bin
+00000000000000000000000000000000
\ No newline at end of file

unicorn compcov for x86