Changes to default CMOV instrumentation to off
MODIFY
frida_mode/README.md
frida_mode/README.md
@@ -170,11 +170,11 @@ instances run CMPLOG mode and instrumentation of the binary is less frequent
***
```
+* `AFL_FRIDA_INST_INSN` - Generate instrumentation for conditional
+ instructions (e.g. `CMOV` instructions on x64).
* `AFL_FRIDA_INST_JIT` - Enable the instrumentation of Just-In-Time compiled
code. Code is considered to be JIT if the executable segment is not backed by
a file.
-* `AFL_FRIDA_INST_NO_INSN` - Don't generate instrumentation for conditional
- instructions (e.g. `CMOV` instructions on x64).
* `AFL_FRIDA_INST_NO_OPTIMIZE` - Don't use optimized inline assembly coverage
instrumentation (the default where available). Required to use
`AFL_FRIDA_INST_TRACE`.

MODIFY
frida_mode/frida.map
frida_mode/frida.map
js_api_set_instrument_debug_file;
js_api_set_instrument_jit;
js_api_set_instrument_libraries;
- js_api_set_instrument_no_instructions;
+ js_api_set_instrument_instructions;
js_api_set_instrument_no_optimize;
js_api_set_instrument_seed;
js_api_set_instrument_trace;

MODIFY
frida_mode/src/instrument/instrument.c
frida_mode/src/instrument/instrument.c
@@ -276,7 +276,7 @@ void instrument_config(void) {
instrument_fixed_seed = util_read_num("AFL_FRIDA_INST_SEED", 0);
instrument_coverage_unstable_filename =
(getenv("AFL_FRIDA_INST_UNSTABLE_COVERAGE_FILE"));
- instrument_coverage_insn = (getenv("AFL_FRIDA_INST_NO_INSN") == NULL);
+ instrument_coverage_insn = (getenv("AFL_FRIDA_INST_INSN") != NULL);
instrument_debug_config();
instrument_coverage_config();
@@ -302,6 +302,8 @@ void instrument_init(void) {
instrument_coverage_unstable_filename == NULL
? " "
: instrument_coverage_unstable_filename);
+ FOKF(cBLU "Instrumentation" cRST " - " cGRN "instructions:" cYEL " [%c]",
+ instrument_coverage_insn ? 'X' : ' ');
if (instrument_tracing && instrument_optimize) {

MODIFY
frida_mode/src/js/api.js
frida_mode/src/js/api.js
@@ -113,6 +113,12 @@ class Afl {
static setInstrumentEnableTracing() {
Afl.jsApiSetInstrumentTrace();
}
+ /**
+ * See `AFL_FRIDA_INST_INSN`
+ */
+ static setInstrumentInstructions() {
+ Afl.jsApiSetInstrumentInstructions();
+ }
/**
* See `AFL_FRIDA_INST_JIT`.
*/
@@ -125,12 +131,6 @@ class Afl {
static setInstrumentLibraries() {
Afl.jsApiSetInstrumentLibraries();
}
- /**
- * See `AFL_FRIDA_INST_NO_INSN`
- */
- static setInstrumentNoInstructions() {
- Afl.jsApiSetInstrumentNoInstructions();
- }
/**
* See `AFL_FRIDA_INST_NO_OPTIMIZE`
*/
@@ -303,9 +303,9 @@ Afl.jsApiSetDebugMaps = Afl.jsApiGetFunction("js_api_set_debug_maps", "void", []
Afl.jsApiSetEntryPoint = Afl.jsApiGetFunction("js_api_set_entrypoint", "void", ["pointer"]);
Afl.jsApiSetInstrumentCoverageFile = Afl.jsApiGetFunction("js_api_set_instrument_coverage_file", "void", ["pointer"]);
Afl.jsApiSetInstrumentDebugFile = Afl.jsApiGetFunction("js_api_set_instrument_debug_file", "void", ["pointer"]);
+Afl.jsApiSetInstrumentInstructions = Afl.jsApiGetFunction("js_api_set_instrument_instructions", "void", []);
Afl.jsApiSetInstrumentJit = Afl.jsApiGetFunction("js_api_set_instrument_jit", "void", []);
Afl.jsApiSetInstrumentLibraries = Afl.jsApiGetFunction("js_api_set_instrument_libraries", "void", []);
-Afl.jsApiSetInstrumentNoInstructions = Afl.jsApiGetFunction("js_api_set_instrument_no_instructions", "void", []);
Afl.jsApiSetInstrumentNoOptimize = Afl.jsApiGetFunction("js_api_set_instrument_no_optimize", "void", []);
Afl.jsApiSetInstrumentSeed = Afl.jsApiGetFunction("js_api_set_instrument_seed", "void", ["uint64"]);
Afl.jsApiSetInstrumentTrace = Afl.jsApiGetFunction("js_api_set_instrument_trace", "void", []);

MODIFY
frida_mode/src/js/js_api.c
frida_mode/src/js/js_api.c
@@ -142,10 +142,10 @@ js_api_set_prefetch_backpatch_disable(void) {
}
-__attribute__((visibility("default"))) void
-js_api_set_instrument_no_instructions(void) {
+__attribute__((visibility("default"))) void js_api_set_instrument_instructions(
+ void) {
- instrument_coverage_insn = FALSE;
+ instrument_coverage_insn = TRUE;
}

MODIFY
frida_mode/src/ranges.c
frida_mode/src/ranges.c
@@ -595,8 +595,6 @@ void ranges_init(void) {
ranges_inst_jit ? 'X' : ' ');
FOKF(cBLU "Ranges" cRST " - " cGRN "instrument libraries:" cYEL " [%c]",
ranges_inst_libs ? 'X' : ' ');
- FOKF(cBLU "Ranges" cRST " - " cGRN "instrument libraries:" cYEL " [%c]",
- ranges_inst_libs ? 'X' : ' ');
print_ranges("include", include_ranges);
print_ranges("exclude", exclude_ranges);

MODIFY
frida_mode/test/cmov/GNUmakefile
frida_mode/test/cmov/GNUmakefile
@@ -46,6 +46,7 @@ $(DUMMY_DATA_FILE): | $(BUILD_DIR)
dd if=/dev/zero bs=1048576 count=1 of=$@
frida: $(TEST_CMOV_OBJ) $(CMP_LOG_INPUT) $(DUMMY_DATA_FILE)
+ AFL_FRIDA_INST_INSN=1 \
AFL_FRIDA_PERSISTENT_CNT=1000000 \
AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
@@ -60,7 +61,6 @@ frida: $(TEST_CMOV_OBJ) $(CMP_LOG_INPUT) $(DUMMY_DATA_FILE)
$(TEST_CMOV_OBJ) $(DUMMY_DATA_FILE)
frida_noinst: $(TEST_CMOV_OBJ) $(CMP_LOG_INPUT) $(DUMMY_DATA_FILE)
- AFL_FRIDA_INST_NO_INSN=1 \
AFL_FRIDA_PERSISTENT_CNT=1000000 \
AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \

MODIFY
frida_mode/ts/lib/afl.ts
frida_mode/ts/lib/afl.ts
@@ -135,6 +135,13 @@ class Afl {
Afl.jsApiSetInstrumentTrace();
}
+ /**
+ * See `AFL_FRIDA_INST_INSN`
+ */
+ public static setInstrumentInstructions(): void {
+ Afl.jsApiSetInstrumentInstructions();
+ }
+
/**
* See `AFL_FRIDA_INST_JIT`.
*/
@@ -149,13 +156,6 @@ class Afl {
Afl.jsApiSetInstrumentLibraries();
}
- /**
- * See `AFL_FRIDA_INST_NO_INSN`
- */
- public static setInstrumentNoInstructions(): void {
- Afl.jsApiSetInstrumentNoInstructions();
- }
-
/**
* See `AFL_FRIDA_INST_NO_OPTIMIZE`
*/
@@ -374,6 +374,11 @@ class Afl {
"void",
["pointer"]);
+ private static readonly jsApiSetInstrumentInstructions = Afl.jsApiGetFunction(
+ "js_api_set_instrument_instructions",
+ "void",
+ []);
+
private static readonly jsApiSetInstrumentJit = Afl.jsApiGetFunction(
"js_api_set_instrument_jit",
"void",
@@ -384,11 +389,6 @@ class Afl {
"void",
[]);
- private static readonly jsApiSetInstrumentNoInstructions = Afl.jsApiGetFunction(
- "js_api_set_instrument_no_instructions",
- "void",
- []);
-
private static readonly jsApiSetInstrumentNoOptimize = Afl.jsApiGetFunction(
"js_api_set_instrument_no_optimize",
"void",

MODIFY
include/envs.h
include/envs.h
@@ -59,8 +59,8 @@ static char *afl_environment_variables[] = {
"AFL_FRIDA_EXCLUDE_RANGES",
"AFL_FRIDA_INST_COVERAGE_FILE",
"AFL_FRIDA_INST_DEBUG_FILE",
+ "AFL_FRIDA_INST_INSN",
"AFL_FRIDA_INST_JIT",
- "AFL_FRIDA_INST_NO_INSN",
"AFL_FRIDA_INST_NO_OPTIMIZE",
"AFL_FRIDA_INST_NO_PREFETCH",
"AFL_FRIDA_INST_NO_PREFETCH_BACKPATCH",

Changes to default CMOV instrumentation to off