format code for demo-so.c and template.cpp
MODIFY
qbdi_mode/demo-so.c
qbdi_mode/demo-so.c
#include <stdio.h>
// gcc -shared -o libdemo.so demo-so.c -w
-int target_func(char *buf, int size)
-{
+int target_func(char *buf, int size) {
+
printf("buffer:%p, size:%p\n", buf, size);
- switch (buf[0])
- {
+ switch (buf[0]) {
+
case 1:
puts("222");
- if (buf[1] == '\x44')
- {
+ if (buf[1] == '\x44') {
+
puts("null ptr deference");
*(char *)(0) = 1;
+
}
+
break;
case 0xff:
- if (buf[2] == '\xff')
- {
- if (buf[1] == '\x44')
- {
+ if (buf[2] == '\xff') {
+
+ if (buf[1] == '\x44') {
+
puts("crash....");
*(char *)(0xdeadbeef) = 1;
+
}
+
}
+
break;
- default:
- puts("default action");
- break;
+ default: puts("default action"); break;
+
}
return 1;
+
}
+

MODIFY
qbdi_mode/template.cpp
qbdi_mode/template.cpp
@@ -37,78 +37,74 @@ unsigned long afl_prev_loc = 0;
/* Set up SHM region and initialize other stuff. */
-int afl_setup(void)
-{
+int afl_setup(void) {
+
char *id_str = getenv(SHM_ENV_VAR);
int shm_id;
- if (id_str)
- {
+ if (id_str) {
+
shm_id = atoi(id_str);
afl_area_ptr = (unsigned char *)shmat(shm_id, NULL, 0);
- if (afl_area_ptr == (void *)-1)
- return 0;
+ if (afl_area_ptr == (void *)-1) return 0;
memset(afl_area_ptr, 0, MAP_SIZE);
+
}
+
return 1;
+
}
/* Fork server logic, invoked once we hit _start. */
-static void afl_forkserver()
-{
+static void afl_forkserver() {
static unsigned char tmp[4];
pid_t child_pid;
- if (write(FORKSRV_FD + 1, tmp, 4) != 4)
- return;
+ if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
- while (1)
- {
+ while (1) {
int status;
u32 was_killed;
// wait for afl-fuzz
- if (read(FORKSRV_FD, &was_killed, 4) != 4)
- exit(2);
+ if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(2);
child_pid = fork();
- if (child_pid < 0)
- exit(4);
+ if (child_pid < 0) exit(4);
+
+ if (!child_pid) {
- if (!child_pid)
- {
// child return to execute code
close(FORKSRV_FD);
close(FORKSRV_FD + 1);
return;
+
}
// write child pid to afl-fuzz
- if (write(FORKSRV_FD + 1, &child_pid, 4) != 4)
- exit(5);
+ if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(5);
// wait child stop
- if (waitpid(child_pid, &status, 0) < 0)
- exit(6);
+ if (waitpid(child_pid, &status, 0) < 0) exit(6);
// send child stop status to afl-fuzz
- if (write(FORKSRV_FD + 1, &status, 4) != 4)
- exit(7);
- }
+ if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7);
+
}
-void afl_maybe_log(unsigned long cur_loc)
-{
- if (afl_area_ptr == NULL)
- {
- return;
}
+
+void afl_maybe_log(unsigned long cur_loc) {
+
+ if (afl_area_ptr == NULL) { return; }
unsigned long afl_idx = cur_loc ^ afl_prev_loc;
afl_area_ptr[afl_idx % MAP_SIZE]++;
afl_prev_loc = cur_loc >> 1;
+
}
-char *read_file(char *path, unsigned long *length)
-{
+
+char *read_file(char *path, unsigned long *length) {
+
FILE *pFile = fopen(path, "rb");
char *pBuf;
fseek(pFile, 0, SEEK_END);
@@ -119,17 +115,14 @@ char *read_file(char *path, unsigned long *length)
fclose(pFile);
*length = len;
return pBuf;
+
}
char FPATH[200];
-QBDI_NOINLINE int fuzz_func()
-{
+QBDI_NOINLINE int fuzz_func() {
- if (afl_setup())
- {
- afl_forkserver();
- }
+ if (afl_setup()) { afl_forkserver(); }
unsigned long len = 0;
char * data = read_file(FPATH, &len);
@@ -137,10 +130,14 @@ QBDI_NOINLINE int fuzz_func()
printf("In fuzz_func\n");
p_target_func(data, len);
return 1;
+
}
-static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm, const QBDI::VMState *state, QBDI::GPRState *gprState, QBDI::FPRState *fprState, void *data)
-{
+static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm,
+ const QBDI::VMState *state,
+ QBDI::GPRState * gprState,
+ QBDI::FPRState *fprState, void *data) {
+
// errno = SAVED_ERRNO;
#ifdef __x86_64__
@@ -152,22 +149,25 @@ static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm, const QBDI::VMState *st
#endif
// just log the module path
- if (pc >= module_base && pc <= module_end)
- {
+ if (pc >= module_base && pc <= module_end) {
+
unsigned long offset = pc - module_base;
printf("\toffset:%p\n", offset);
afl_maybe_log(offset);
+
}
+
return QBDI::VMAction::CONTINUE;
+
}
-int main(int argc, char **argv)
-{
+int main(int argc, char **argv) {
+
+ if (argc < 3) {
- if (argc < 3)
- {
puts("usage: ./loader library_path input_file_path");
exit(0);
+
}
const char *lib_path;
@@ -176,33 +176,38 @@ int main(int argc, char **argv)
strcpy(FPATH, argv[2]);
void *handle = dlopen(lib_path, RTLD_LAZY);
- if (handle == nullptr)
- {
+ if (handle == nullptr) {
+
perror("Cannot load library");
exit(EXIT_FAILURE);
+
}
const char *lib_name = lib_path;
- if (strrchr(lib_name, '/') != nullptr)
- lib_name = strrchr(lib_name, '/') + 1;
+ if (strrchr(lib_name, '/') != nullptr) lib_name = strrchr(lib_name, '/') + 1;
// printf("library name:%s\n", lib_name);
// load library module address for log path
- for (MemoryMap &map : getCurrentProcessMaps())
- {
+ for (MemoryMap &map : getCurrentProcessMaps()) {
+
// printf("module:%s\n", map.name.c_str());
- if ((map.permission & PF_EXEC) && strstr(map.name.c_str(), lib_name) != NULL)
- {
+ if ((map.permission & PF_EXEC) &&
+ strstr(map.name.c_str(), lib_name) != NULL) {
+
module_base = map.range.start;
module_end = map.range.end;
+
}
+
}
- if (module_base == 0)
- {
+ if (module_base == 0) {
+
std::cerr << "Fail to find base address" << std::endl;
return -1;
+
}
+
// printf("module base:%p, module end:%p\n", module_base, module_end);
p_target_func = (target_func)dlsym(handle, "target_func");
// p_target_func = (target_func)(module_base + 0x61a);
@@ -225,4 +230,6 @@ int main(int argc, char **argv)
vm.call(&ret, (rword)&fuzz_func, {});
return 0;
+
}
+

format code for demo-so.c and template.cpp