aflpp libfuzzer driver for qemu mode
MODIFY
examples/aflpp_driver/GNUmakefile
examples/aflpp_driver/GNUmakefile
@@ -9,7 +9,7 @@ endif
FLAGS=-O3 -funroll-loops
-all: libAFLDriver.a
+all: libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
aflpp_driver.o: aflpp_driver.cpp
$(LLVM_BINDIR)clang++ $(FLAGS) -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp
@@ -17,5 +17,17 @@ aflpp_driver.o: aflpp_driver.cpp
libAFLDriver.a: aflpp_driver.o
ar ru libAFLDriver.a aflpp_driver.o
+aflpp_qemu_driver.o: aflpp_qemu_driver.c
+ $(LLVM_BINDIR)clang $(FLAGS) -funroll-loops -c aflpp_qemu_driver.c
+
+libAFLQemuDriver.a: aflpp_qemu_driver.o
+ ar ru libAFLQemuDriver.a aflpp_qemu_driver.o
+
+aflpp_qemu_driver_hook.so: aflpp_qemu_driver_hook.o
+ $(LLVM_BINDIR)clang -shared aflpp_qemu_driver_hook.o -o aflpp_qemu_driver_hook.so
+
+aflpp_qemu_driver_hook.o: aflpp_qemu_driver_hook.c
+ $(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
+
clean:
- rm -f *.o libAFLDriver*.a *~ core
+ rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core

ADD
examples/aflpp_driver/aflpp_qemu_driver.c
+#include <stdint.h>
+#include <stdlib.h>
+
+// libFuzzer interface is thin, so we don't include any libFuzzer headers.
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
+__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
+
+int main(int argc, char **argv) {
+ if (LLVMFuzzerInitialize)
+ LLVMFuzzerInitialize(&argc, &argv);
+ // Do any other expensive one-time initialization here.
+
+ uint8_t dummy_input[1] = {0};
+ LLVMFuzzerTestOneInput(dummy_input, 1);
+
+ return 0;
+}

ADD
examples/aflpp_driver/aflpp_qemu_driver_hook.c
+#include <stdint.h>
+#include <string.h>
+
+#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
+
+#define REGS_RDI 7
+#define REGS_RSI 6
+
+void afl_persistent_hook(uint64_t *regs, uint64_t guest_base,
+ uint8_t* input_buf, uint32_t input_len) {
+
+ memcpy(g2h(regs[REGS_RDI]), input_buf, input_len);
+ regs[REGS_RSI] = input_len;
+
+}
+
+int afl_persistent_hook_init(void) {
+
+ return 1;
+
+}

aflpp libfuzzer driver for qemu mode