afl_fuzz unmapping
MODIFY
unicorn_mode/samples/compcov_x64/compcov_test_harness.py
unicorn_mode/samples/compcov_x64/compcov_test_harness.py
@@ -59,35 +59,17 @@ def unicorn_debug_mem_invalid_access(uc, access, address, size, value, user_data
else:
print(" >>> INVALID Read: addr=0x{0:016x} size={1}".format(address, size))
-def force_crash(uc_error):
- # This function should be called to indicate to AFL that a crash occurred during emulation.
- # Pass in the exception received from Uc.emu_start()
- mem_errors = [
- UC_ERR_READ_UNMAPPED, UC_ERR_READ_PROT, UC_ERR_READ_UNALIGNED,
- UC_ERR_WRITE_UNMAPPED, UC_ERR_WRITE_PROT, UC_ERR_WRITE_UNALIGNED,
- UC_ERR_FETCH_UNMAPPED, UC_ERR_FETCH_PROT, UC_ERR_FETCH_UNALIGNED,
- ]
- if uc_error.errno in mem_errors:
- # Memory error - throw SIGSEGV
- os.kill(os.getpid(), signal.SIGSEGV)
- elif uc_error.errno == UC_ERR_INSN_INVALID:
- # Invalid instruction - throw SIGILL
- os.kill(os.getpid(), signal.SIGILL)
- else:
- # Not sure what happened - throw SIGABRT
- os.kill(os.getpid(), signal.SIGABRT)
-
def main():
parser = argparse.ArgumentParser(description="Test harness for compcov_target.bin")
parser.add_argument('input_file', type=str, help="Path to the file containing the mutated input to load")
- parser.add_argument('-d', '--debug', default=False, action="store_true", help="Enables debug tracing")
+ parser.add_argument('-t', '--trace', default=False, action="store_true", help="Enables debug tracing")
args = parser.parse_args()
# Instantiate a MIPS32 big endian Unicorn Engine instance
uc = Uc(UC_ARCH_X86, UC_MODE_64)
- if args.debug:
+ if args.trace:
uc.hook_add(UC_HOOK_BLOCK, unicorn_debug_block)
uc.hook_add(UC_HOOK_CODE, unicorn_debug_instruction)
uc.hook_add(UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, unicorn_debug_mem_access)
@@ -132,11 +114,6 @@ def main():
"""
Callback that loads the mutated input into memory.
"""
- # Load the mutated input from disk
- input_file = open(args.input_file, 'rb')
- input = input_file.read()
- input_file.close()
-
# Apply constraints to the mutated input
if len(input) > DATA_SIZE_MAX:
return

MODIFY
unicorn_mode/samples/simple/simple_test_harness.py
unicorn_mode/samples/simple/simple_test_harness.py
This loads the simple_target.bin binary (precompiled as MIPS code) into
Unicorn's memory map for emulation, places the specified input into
simple_target's buffer (hardcoded to be at 0x300000), and executes 'main()'.
- If any crashes occur during emulation, this script throws a matching signal
- to tell AFL that a crash occurred.
+ If any crashes occur during emulation, unicornafl will
+ tell AFL that a crash occurred.
Run under AFL as follows:
@@ -59,35 +59,17 @@ def unicorn_debug_mem_invalid_access(uc, access, address, size, value, user_data
else:
print(" >>> INVALID Read: addr=0x{0:016x} size={1}".format(address, size))
-def force_crash(uc_error):
- # This function should be called to indicate to AFL that a crash occurred during emulation.
- # Pass in the exception received from Uc.emu_start()
- mem_errors = [
- UC_ERR_READ_UNMAPPED, UC_ERR_READ_PROT, UC_ERR_READ_UNALIGNED,
- UC_ERR_WRITE_UNMAPPED, UC_ERR_WRITE_PROT, UC_ERR_WRITE_UNALIGNED,
- UC_ERR_FETCH_UNMAPPED, UC_ERR_FETCH_PROT, UC_ERR_FETCH_UNALIGNED,
- ]
- if uc_error.errno in mem_errors:
- # Memory error - throw SIGSEGV
- os.kill(os.getpid(), signal.SIGSEGV)
- elif uc_error.errno == UC_ERR_INSN_INVALID:
- # Invalid instruction - throw SIGILL
- os.kill(os.getpid(), signal.SIGILL)
- else:
- # Not sure what happened - throw SIGABRT
- os.kill(os.getpid(), signal.SIGABRT)
-
def main():
parser = argparse.ArgumentParser(description="Test harness for simple_target.bin")
parser.add_argument('input_file', type=str, help="Path to the file containing the mutated input to load")
- parser.add_argument('-d', '--debug', default=False, action="store_true", help="Enables debug tracing")
+ parser.add_argument('-t', '--trace', default=False, action="store_true", help="Enables debug tracing")
args = parser.parse_args()
# Instantiate a MIPS32 big endian Unicorn Engine instance
uc = Uc(UC_ARCH_MIPS, UC_MODE_MIPS32 + UC_MODE_BIG_ENDIAN)
- if args.debug:
+ if args.trace:
uc.hook_add(UC_HOOK_BLOCK, unicorn_debug_block)
uc.hook_add(UC_HOOK_CODE, unicorn_debug_instruction)
uc.hook_add(UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, unicorn_debug_mem_access)
@@ -121,6 +103,8 @@ def main():
uc.mem_map(STACK_ADDRESS, STACK_SIZE)
uc.reg_write(UC_MIPS_REG_SP, STACK_ADDRESS + STACK_SIZE)
+ print(STACK_ADDRESS + STACK_SIZE)
+
# reserve some space for data
uc.mem_map(DATA_ADDRESS, DATA_SIZE_MAX)
@@ -129,11 +113,6 @@ def main():
# We did not pass in any data and don't use persistent mode, so we can ignore these params.
# Be sure to check out the docstrings for the uc.afl_* functions.
def place_input_callback(uc, input, persistent_round, data):
- # Load the mutated input from disk
- input_file = open(args.input_file, 'rb')
- input = input_file.read()
- input_file.close()
-
# Apply constraints to the mutated input
if len(input) > DATA_SIZE_MAX:
#print("Test input is too long (> {} bytes)")

MODIFY
unicorn_mode/unicorn
unicorn_mode/unicorn
-Subproject commit aa5ebf5e16f4f5781cfe94229b41eee7ff93b357
+Subproject commit db248c8d8167e47ee07943961d1ce6244d57602b

afl_fuzz unmapping