Support for AFL_FRIDA_PERSISTENT_RET
MODIFY
frida_mode/GNUmakefile
frida_mode/GNUmakefile
@@ -36,6 +36,10 @@ else
CFLAGS+=-Wno-pointer-arith
endif
+ifdef FRIDA_DEBUG
+CFLAGS += -DFRIDA_DEBUG
+endif
+
FRIDA_BUILD_DIR:=$(BUILD_DIR)frida/
FRIDA_TRACE:=$(BUILD_DIR)afl-frida-trace.so
FRIDA_TRACE_EMBEDDED:=$(BUILD_DIR)afl-frida-trace-embedded
@@ -94,9 +98,6 @@ AFL_COMPILER_RT_OBJ:=$(OBJ_DIR)afl-compiler-rt.o
all: $(FRIDA_TRACE)
-32:
- CFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
-
32:
CFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all

MODIFY
frida_mode/include/persistent.h
frida_mode/include/persistent.h
@@ -18,6 +18,9 @@ extern unsigned char *__afl_fuzz_ptr;
extern guint64 persistent_start;
extern guint64 persistent_count;
+extern guint64 persistent_ret;
+extern guint64 persistent_ret_offset;
+extern gboolean persistent_debug;
extern afl_persistent_hook_fn hook;
void persistent_init(void);
@@ -26,6 +29,7 @@ void persistent_init(void);
gboolean persistent_is_supported(void);
void persistent_prologue(GumStalkerOutput *output);
+void persistent_epilogue(GumStalkerOutput *output);
#endif

MODIFY
frida_mode/src/instrument/instrument.c
frida_mode/src/instrument/instrument.c
@@ -85,6 +85,7 @@ static void instr_basic_block(GumStalkerIterator *iterator,
if (instr->address == entry_start) { entry_prologue(iterator, output); }
if (instr->address == persistent_start) { persistent_prologue(output); }
+ if (instr->address == persistent_ret) { persistent_epilogue(output); }
/*
* Until we reach AFL_ENTRYPOINT (assumed to be main if not specified) or

MODIFY
frida_mode/src/persistent/persistent.c
frida_mode/src/persistent/persistent.c
@@ -12,6 +12,9 @@ int __afl_sharedmem_fuzzing = 0;
afl_persistent_hook_fn hook = NULL;
guint64 persistent_start = 0;
guint64 persistent_count = 0;
+guint64 persistent_ret = 0;
+guint64 persistent_ret_offset = 0;
+gboolean persistent_debug = FALSE;
void persistent_init(void) {
@@ -19,12 +22,36 @@ void persistent_init(void) {
persistent_start = util_read_address("AFL_FRIDA_PERSISTENT_ADDR");
persistent_count = util_read_num("AFL_FRIDA_PERSISTENT_CNT");
+ persistent_ret = util_read_address("AFL_FRIDA_PERSISTENT_RET");
+ persistent_ret_offset =
+ util_read_address("AFL_FRIDA_PERSISTENT_RETADDR_OFFSET");
+
+ if (getenv("AFL_FRIDA_PERSISTENT_DEBUG") != NULL) { persistent_debug = TRUE; }
+
+ if (persistent_count != 0 && persistent_start == 0) {
- if (persistent_count != 0 && persistent_start == 0)
FATAL(
"AFL_FRIDA_PERSISTENT_ADDR must be specified if "
"AFL_FRIDA_PERSISTENT_CNT is");
+ }
+
+ if (persistent_ret != 0 && persistent_start == 0) {
+
+ FATAL(
+ "AFL_FRIDA_PERSISTENT_ADDR must be specified if "
+ "AFL_FRIDA_PERSISTENT_RET is");
+
+ }
+
+ if (persistent_ret_offset != 0 && persistent_ret == 0) {
+
+ FATAL(
+ "AFL_FRIDA_PERSISTENT_RET must be specified if "
+ "AFL_FRIDA_PERSISTENT_RETADDR_OFFSET is");
+
+ }
+
if (persistent_start != 0 && persistent_count == 0) persistent_count = 1000;
if (persistent_count != 0 && persistent_count < 100)
@@ -39,6 +66,11 @@ void persistent_init(void) {
persistent_start == 0 ? ' ' : 'X', persistent_count);
OKF("Instrumentation - hook [%s]", hook_name);
+ OKF("Instrumentation - persistent ret [%c] (0x%016" G_GINT64_MODIFIER "X)",
+ persistent_ret == 0 ? ' ' : 'X', persistent_ret);
+ OKF("Instrumentation - persistent ret offset [%c] (%" G_GINT64_MODIFIER "d)",
+ persistent_ret_offset == 0 ? ' ' : 'X', persistent_ret_offset);
+
if (hook_name != NULL) {
void *hook_obj = dlopen(hook_name, RTLD_NOW);

MODIFY
frida_mode/src/persistent/persistent_arm32.c
frida_mode/src/persistent/persistent_arm32.c
@@ -68,5 +68,12 @@ void persistent_prologue(GumStalkerOutput *output) {
}
+void persistent_epilogue(GumStalkerOutput *output) {
+
+ UNUSED_PARAMETER(output);
+ FATAL("Persistent mode not supported on this architecture");
+
+}
+
#endif

MODIFY
frida_mode/src/persistent/persistent_arm64.c
frida_mode/src/persistent/persistent_arm64.c
@@ -111,5 +111,12 @@ void persistent_prologue(GumStalkerOutput *output) {
}
+void persistent_epilogue(GumStalkerOutput *output) {
+
+ UNUSED_PARAMETER(output);
+ FATAL("Persistent mode not supported on this architecture");
+
+}
+
#endif

MODIFY
frida_mode/src/persistent/persistent_x64.c
frida_mode/src/persistent/persistent_x64.c
#include "frida-gum.h"
#include "config.h"
+#include "debug.h"
#include "instrument.h"
#include "persistent.h"
+#include "util.h"
#if defined(__x86_64__)
@@ -264,7 +266,6 @@ void persistent_prologue(GumStalkerOutput *output) {
GumX86Writer *cw = output->writer.x86;
gconstpointer loop = cw->code + 1;
- // gum_x86_writer_put_breakpoint(cw);
/* Stack must be 16-byte aligned per ABI */
instrument_persitent_save_regs(cw, &saved_regs);
@@ -288,7 +289,9 @@ void persistent_prologue(GumStalkerOutput *output) {
instrument_persitent_restore_regs(cw, &saved_regs);
gconstpointer original = cw->code + 1;
/* call original */
+
gum_x86_writer_put_call_near_label(cw, original);
+
/* jmp loop */
gum_x86_writer_put_jmp_near_label(cw, loop);
@@ -300,9 +303,23 @@ void persistent_prologue(GumStalkerOutput *output) {
/* original: */
gum_x86_writer_put_label(cw, original);
+ if (persistent_debug) { gum_x86_writer_put_breakpoint(cw); }
+
gum_x86_writer_flush(cw);
}
+void persistent_epilogue(GumStalkerOutput *output) {
+
+ GumX86Writer *cw = output->writer.x86;
+
+ if (persistent_debug) { gum_x86_writer_put_breakpoint(cw); }
+
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ persistent_ret_offset);
+ gum_x86_writer_put_ret(cw);
+
+}
+
#endif

MODIFY
frida_mode/src/persistent/persistent_x86.c
frida_mode/src/persistent/persistent_x86.c
@@ -244,9 +244,24 @@ void persistent_prologue(GumStalkerOutput *output) {
/* original: */
gum_x86_writer_put_label(cw, original);
+ if (persistent_debug) { gum_x86_writer_put_breakpoint(cw); }
+
gum_x86_writer_flush(cw);
}
+void persistent_epilogue(GumStalkerOutput *output) {
+
+ GumX86Writer *cw = output->writer.x86;
+
+ if (persistent_debug) { gum_x86_writer_put_breakpoint(cw); }
+
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_ESP, GUM_REG_ESP,
+ persistent_ret_offset);
+
+ gum_x86_writer_put_ret(cw);
+
+}
+
#endif

MODIFY
frida_mode/src/util.c
frida_mode/src/util.c
@@ -10,7 +10,7 @@ guint64 util_read_address(char *key) {
if (!g_str_has_prefix(value_str, "0x")) {
- FATAL("Invalid address should have 0x prefix: %s\n", value_str);
+ FATAL("Invalid address should have 0x prefix: %s=%s\n", key, value_str);
}
@@ -20,8 +20,8 @@ guint64 util_read_address(char *key) {
if (!g_ascii_isxdigit(*c)) {
- FATAL("Invalid address not formed of hex digits: %s ('%c')\n", value_str,
- *c);
+ FATAL("Invalid address not formed of hex digits: %s=%s ('%c')\n", key,
+ value_str, *c);
}
@@ -30,7 +30,7 @@ guint64 util_read_address(char *key) {
guint64 value = g_ascii_strtoull(value_str2, NULL, 16);
if (value == 0) {
- FATAL("Invalid address failed hex conversion: %s\n", value_str2);
+ FATAL("Invalid address failed hex conversion: %s=%s\n", key, value_str2);
}
@@ -48,7 +48,8 @@ guint64 util_read_num(char *key) {
if (!g_ascii_isdigit(*c)) {
- FATAL("Invalid address not formed of decimal digits: %s\n", value_str);
+ FATAL("Invalid address not formed of decimal digits: %s=%s\n", key,
+ value_str);
}
@@ -57,7 +58,7 @@ guint64 util_read_num(char *key) {
guint64 value = g_ascii_strtoull(value_str, NULL, 10);
if (value == 0) {
- FATAL("Invalid address failed numeric conversion: %s\n", value_str);
+ FATAL("Invalid address failed numeric conversion: %s=%s\n", key, value_str);
}

ADD
frida_mode/test/persistent_ret/GNUmakefile
+PWD:=$(shell pwd)/
+ROOT:=$(shell realpath $(PWD)../../..)/
+BUILD_DIR:=$(PWD)build/
+TESTINSTR_DATA_DIR:=$(BUILD_DIR)in/
+TESTINSTR_DATA_FILE:=$(TESTINSTR_DATA_DIR)in
+
+TESTINSTBIN:=$(BUILD_DIR)testinstr
+TESTINSTSRC:=$(PWD)testinstr.c
+
+QEMU_OUT:=$(BUILD_DIR)qemu-out
+FRIDA_OUT:=$(BUILD_DIR)frida-out
+
+ifndef ARCH
+
+ARCH=$(shell uname -m)
+ifeq "$(ARCH)" "aarch64"
+ ARCH:=arm64
+endif
+
+ifeq "$(ARCH)" "i686"
+ ARCH:=x86
+endif
+endif
+
+ARCH=$(shell uname -m)
+ifeq "$(ARCH)" "aarch64"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TESTINSTBIN) -s main -b 0x0000aaaaaaaaa000)
+ AFL_FRIDA_PERSISTENT_RET=$(shell $(PWD)get_symbol_addr.py -f $(TESTINSTBIN) -s slow -b 0x0000aaaaaaaaa000)
+endif
+
+ifeq "$(ARCH)" "x86_64"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TESTINSTBIN) -s main -b 0x0000555555554000)
+ AFL_FRIDA_PERSISTENT_RET=$(shell $(PWD)get_symbol_addr.py -f $(TESTINSTBIN) -s slow -b 0x0000555555554000)
+endif
+
+ifeq "$(ARCH)" "x86"
+ AFL_FRIDA_PERSISTENT_ADDR=$(shell $(PWD)get_symbol_addr.py -f $(TESTINSTBIN) -s main -b 0x56555000)
+ AFL_FRIDA_PERSISTENT_RET=$(shell $(PWD)get_symbol_addr.py -f $(TESTINSTBIN) -s slow -b 0x56555000)
+endif
+
+AFL_FRIDA_PERSISTENT_RETADDR_OFFSET:=0x50
+
+.PHONY: all 32 clean qemu frida
+
+all: $(TESTINSTBIN)
+ make -C $(ROOT)frida_mode/
+
+32:
+ CFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
+
+$(BUILD_DIR):
+ mkdir -p $@
+
+$(TESTINSTR_DATA_DIR): | $(BUILD_DIR)
+ mkdir -p $@
+
+$(TESTINSTR_DATA_FILE): | $(TESTINSTR_DATA_DIR)
+ echo -n "000" > $@
+
+$(TESTINSTBIN): $(TESTINSTSRC) | $(BUILD_DIR)
+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $<
+
+clean:
+ rm -rf $(BUILD_DIR)
+
+frida: $(TESTINSTBIN) $(TESTINSTR_DATA_FILE)
+ AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
+ $(ROOT)afl-fuzz \
+ -D \
+ -O \
+ -i $(TESTINSTR_DATA_DIR) \
+ -o $(FRIDA_OUT) \
+ -- \
+ $(TESTINSTBIN) @@
+
+frida_ret: $(TESTINSTBIN) $(TESTINSTR_DATA_FILE)
+ AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
+ AFL_FRIDA_PERSISTENT_RET=$(AFL_FRIDA_PERSISTENT_RET) \
+ AFL_FRIDA_PERSISTENT_RETADDR_OFFSET=$(AFL_FRIDA_PERSISTENT_RETADDR_OFFSET) \
+ $(ROOT)afl-fuzz \
+ -D \
+ -O \
+ -i $(TESTINSTR_DATA_DIR) \
+ -o $(FRIDA_OUT) \
+ -- \
+ $(TESTINSTBIN) @@
+
+debug: $(TESTINSTR_DATA_FILE)
+ gdb \
+ --ex 'set environment AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR)' \
+ --ex 'set environment AFL_FRIDA_PERSISTENT_RET=$(AFL_FRIDA_PERSISTENT_RET)' \
+ --ex 'set environment AFL_FRIDA_PERSISTENT_RETADDR_OFFSET=$(AFL_FRIDA_PERSISTENT_RETADDR_OFFSET)' \
+ --ex 'set environment AFL_FRIDA_PERSISTENT_DEBUG=1' \
+ --ex 'set environment AFL_DEBUG_CHILD=1' \
+ --ex 'set environment LD_PRELOAD=$(ROOT)afl-frida-trace.so' \
+ --ex 'set disassembly-flavor intel' \
+ --args $(TESTINSTBIN) $(TESTINSTR_DATA_FILE)
+
+run: $(TESTINSTR_DATA_FILE)
+ AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
+ AFL_FRIDA_PERSISTENT_RET=$(AFL_FRIDA_PERSISTENT_RET) \
+ AFL_FRIDA_PERSISTENT_RETADDR_OFFSET=$(AFL_FRIDA_PERSISTENT_RETADDR_OFFSET) \
+ AFL_DEBUG_CHILD=1 \
+ LD_PRELOAD=$(ROOT)afl-frida-trace.so \
+ $(TESTINSTBIN) $(TESTINSTR_DATA_FILE)

ADD
frida_mode/test/persistent_ret/Makefile
+all:
+ @echo trying to use GNU make...
+ @gmake all || echo please install GNUmake
+
+32:
+ @echo trying to use GNU make...
+ @gmake 32 || echo please install GNUmake
+
+clean:
+ @gmake clean
+
+frida:
+ @gmake frida
+
+frida_ret:
+ @gmake frida_ret
+
+debug:
+ @gmake debug
+
+run:
+ @gmake run

ADD
frida_mode/test/persistent_ret/get_symbol_addr.py
+#!/usr/bin/python3
+import argparse
+from elftools.elf.elffile import ELFFile
+
+def process_file(file, symbol, base):
+ with open(file, 'rb') as f:
+ elf = ELFFile(f)
+ symtab = elf.get_section_by_name('.symtab')
+ mains = symtab.get_symbol_by_name(symbol)
+ if len(mains) != 1:
+ print ("Failed to find main")
+ return 1
+
+ main_addr = mains[0]['st_value']
+ main = base + main_addr
+ print ("0x%016x" % main)
+ return 0
+
+def hex_value(x):
+ return int(x, 16)
+
+def main():
+ parser = argparse.ArgumentParser(description='Process some integers.')
+ parser.add_argument('-f', '--file', dest='file', type=str,
+ help='elf file name', required=True)
+ parser.add_argument('-s', '--symbol', dest='symbol', type=str,
+ help='symbol name', required=True)
+ parser.add_argument('-b', '--base', dest='base', type=hex_value,
+ help='elf base address', required=True)
+
+ args = parser.parse_args()
+ return process_file (args.file, args.symbol, args.base)
+
+if __name__ == "__main__":
+ ret = main()
+ exit(ret)

ADD
frida_mode/test/persistent_ret/testinstr.c
+/*
+ american fuzzy lop++ - a trivial program to test the build
+ --------------------------------------------------------
+ Originally written by Michal Zalewski
+ Copyright 2014 Google Inc. All rights reserved.
+ Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at:
+ http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifdef __APPLE__
+ #define TESTINSTR_SECTION
+#else
+ #define TESTINSTR_SECTION __attribute__((section(".testinstr")))
+#endif
+
+void testinstr(char *buf, int len) {
+
+ if (len < 1) return;
+ buf[len] = 0;
+
+ // we support three input cases
+ if (buf[0] == '0')
+ printf("Looks like a zero to me!\n");
+ else if (buf[0] == '1')
+ printf("Pretty sure that is a one!\n");
+ else
+ printf("Neither one or zero? How quaint!\n");
+
+}
+
+void slow() {
+
+ usleep(100000);
+
+}
+
+TESTINSTR_SECTION int main(int argc, char **argv) {
+
+ char * file;
+ int fd = -1;
+ off_t len;
+ char * buf = NULL;
+ size_t n_read;
+ int result = -1;
+
+ if (argc != 2) { return 1; }
+
+ do {
+
+ file = argv[1];
+
+ dprintf(STDERR_FILENO, "Running: %s\n", file);
+
+ fd = open(file, O_RDONLY);
+ if (fd < 0) {
+
+ perror("open");
+ break;
+
+ }
+
+ len = lseek(fd, 0, SEEK_END);
+ if (len < 0) {
+
+ perror("lseek (SEEK_END)");
+ break;
+
+ }
+
+ if (lseek(fd, 0, SEEK_SET) != 0) {
+
+ perror("lseek (SEEK_SET)");
+ break;
+
+ }
+
+ buf = malloc(len);
+ if (buf == NULL) {
+
+ perror("malloc");
+ break;
+
+ }
+
+ n_read = read(fd, buf, len);
+ if (n_read != len) {
+
+ perror("read");
+ break;
+
+ }
+
+ dprintf(STDERR_FILENO, "Running: %s: (%zd bytes)\n", file, n_read);
+
+ testinstr(buf, len);
+ dprintf(STDERR_FILENO, "Done: %s: (%zd bytes)\n", file, n_read);
+
+ slow();
+
+ result = 0;
+
+ } while (false);
+
+ if (buf != NULL) { free(buf); }
+
+ if (fd != -1) { close(fd); }
+
+ return result;
+
+}
+

MODIFY
include/envs.h
include/envs.h
@@ -62,7 +62,10 @@ static char *afl_environment_variables[] = {
"AFL_FRIDA_INST_TRACE",
"AFL_FRIDA_PERSISTENT_ADDR",
"AFL_FRIDA_PERSISTENT_CNT",
+ "AFL_FRIDA_PERSISTENT_DEBUG",
"AFL_FRIDA_PERSISTENT_HOOK",
+ "AFL_FRIDA_PERSISTENT_RET",
+ "AFL_FRIDA_PERSISTENT_RETADDR_OFFSET",
"AFL_FUZZER_ARGS", // oss-fuzz
"AFL_GDB",
"AFL_GCC_ALLOWLIST",

Support for AFL_FRIDA_PERSISTENT_RET (#941)

Co-authored-by: Your Name <you@example.com>