libtokencap update proposal
bcmp interception.
FreeBSD using default argument to get current pid for the mapping
data gathering, getpid seems to cause some issues under certain
conditions (getenv call).
MODIFY
libtokencap/libtokencap.so.c
libtokencap/libtokencap.so.c
@@ -115,7 +115,7 @@ static void __tokencap_load_mappings(void) {
#elif defined __FreeBSD__ || defined __OpenBSD__ || defined __NetBSD__
#if defined __FreeBSD__
- int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, getpid()};
+ int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, -1};
#elif defined __OpenBSD__
int mib[] = {CTL_KERN, KERN_PROC_VMMAP, getpid()};
#elif defined __NetBSD__
@@ -134,9 +134,7 @@ static void __tokencap_load_mappings(void) {
#endif
buf = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
- if (!buf) {
- return;
- }
+ if (buf == MAP_FAILED) return;
if (sysctl(mib, miblen, buf, &len, NULL, 0) == -1) {
@@ -354,6 +352,28 @@ int memcmp(const void* mem1, const void* mem2, size_t len) {
}
+#undef bcmp
+
+int bcmp(const void* mem1, const void* mem2, size_t len) {
+
+ if (__tokencap_is_ro(mem1)) __tokencap_dump(mem1, len, 0);
+ if (__tokencap_is_ro(mem2)) __tokencap_dump(mem2, len, 0);
+
+ const char *strmem1 = (const char *)mem1;
+ const char *strmem2 = (const char *)mem2;
+
+ while (len--) {
+
+ int diff = *strmem1 ^ *strmem2;
+ if (diff != 0) return 1;
+ strmem1++;
+ strmem2++;
+
+ }
+
+ return 0;
+}
+
#undef strstr
char* strstr(const char* haystack, const char* needle) {

MODIFY
llvm_mode/afl-clang-fast.c
llvm_mode/afl-clang-fast.c
@@ -273,6 +273,9 @@ static void edit_params(u32 argc, char** argv) {
cc_params[cc_par_cnt++] = "-fno-builtin-strcasecmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strncasecmp";
cc_params[cc_par_cnt++] = "-fno-builtin-memcmp";
+ cc_params[cc_par_cnt++] = "-fno-builtin-bcmp";
+ cc_params[cc_par_cnt++] = "-fno-builtin-strstr";
+ cc_params[cc_par_cnt++] = "-fno-builtin-strcasestr";
}

MODIFY
src/afl-gcc.c
src/afl-gcc.c
@@ -320,6 +320,7 @@ static void edit_params(u32 argc, char** argv) {
cc_params[cc_par_cnt++] = "-fno-builtin-strcasecmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strncasecmp";
cc_params[cc_par_cnt++] = "-fno-builtin-memcmp";
+ cc_params[cc_par_cnt++] = "-fno-builtin-bcmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strstr";
cc_params[cc_par_cnt++] = "-fno-builtin-strcasestr";

libtokencap update proposal

- bcmp interception.
- FreeBSD using default argument to get current pid for the mapping
data gathering, getpid seems to cause some issues under certain
conditions (getenv call).