Fixes for x64
MODIFY
frida_mode/GNUmakefile
frida_mode/GNUmakefile
@@ -58,7 +58,9 @@ CFLAGS+=-Werror \
-Wall \
-Wextra \
-Wpointer-arith \
- -Wno-unknown-pragmas
+ -Wno-unknown-pragmas \
+ -Wno-pointer-to-int-cast \
+ -Wno-int-to-pointer-cast
else
CFLAGS+=-Wno-pointer-arith
endif
@@ -207,7 +209,7 @@ $(FRIDA_MAKEFILE): | $(BUILD_DIR)
.PHONY: $(GUM_DEVIT_LIBRARY)
$(GUM_DEVIT_LIBRARY): $(FRIDA_MAKEFILE)
- cd $(FRIDA_DIR) && make gum-$(OS)$(GUM_ARCH)
+ cd $(FRIDA_DIR) && make gum-$(OS)$(GUM_ARCH) FRIDA_V8=disabled
$(GUM_DEVIT_HEADER): $(FRIDA_MAKEFILE) | $(FRIDA_BUILD_DIR)
echo "#include <stdio.h>" > $@
@@ -246,40 +248,40 @@ TRACE_LDFLAGS+=$(FRIDA_DIR)build/frida-$(OS)-$(ARCH)/lib/libfrida-gum-1.0.a \
else ifeq "$(ARCH)" "arm64"
-CFLAGS+=-I $(FRIDA_DIR)build/frida_thin-$(OS)-$(ARCH)/include/frida-1.0 \
- -I $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/include/glib-2.0/ \
- -I $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/glib-2.0/include/ \
- -I $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/include/capstone/ \
- -I $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/include/json-glib-1.0/ \
+CFLAGS+=-I $(FRIDA_DIR)build/$(OS)-$(ARCH)/include/frida-1.0 \
+ -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/glib-2.0/ \
+ -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/glib-2.0/include/ \
+ -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/capstone/ \
+ -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/json-glib-1.0/ \
ifeq "$(OS)" "android"
CFLAGS += -static-libstdc++
endif
else
-CFLAGS+=-I $(FRIDA_DIR)build/frida_thin-$(OS)-$(ARCH)/include/frida-1.0 \
- -I $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/include/glib-2.0/ \
- -I $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/glib-2.0/include/ \
- -I $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/include/capstone/ \
- -I $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/include/json-glib-1.0/ \
+CFLAGS+=-I $(FRIDA_DIR)build/$(OS)-$(ARCH)/include/frida-1.0 \
+ -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/glib-2.0/ \
+ -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/glib-2.0/include/ \
+ -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/capstone/ \
+ -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/json-glib-1.0/ \
endif
TRACE_LDFLAGS+=$(FRIDA_DIR)build/frida-$(OS)-$(ARCH)/lib/libfrida-gum-1.0.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libsoup-2.4.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libsqlite3.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libtcc.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libjson-glib-1.0.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libquickjs.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libcapstone.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libunwind.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libffi.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libdwarf.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libelf.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libgio-2.0.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libgobject-2.0.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libglib-2.0.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/liblzma.a \
- $(FRIDA_DIR)build/frida_thin-sdk-$(OS)-$(ARCH)/lib/libz.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libsoup-2.4.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libsqlite3.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libtcc.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libjson-glib-1.0.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libquickjs.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libcapstone.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libunwind.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libffi.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libdwarf.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libelf.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libgio-2.0.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libgobject-2.0.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libglib-2.0.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/liblzma.a \
+ $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libz.a \
CFLAGS+=-I $(FRIDA_DIR)build/frida-$(OS)-$(ARCH)/include/frida-1.0 \
-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/glib-2.0/ \

MODIFY
frida_mode/hook/frida_hook.c
frida_mode/hook/frida_hook.c
@@ -54,10 +54,12 @@ __attribute__((visibility("default"))) void afl_persistent_hook(
__attribute__((visibility("default"))) void afl_persistent_hook(
GumCpuContext *regs, uint8_t *input_buf, uint32_t input_buf_len) {
+
// do a length check matching the target!
memcpy((void *)regs->r[0], input_buf, input_buf_len);
regs->r[1] = input_buf_len;
+
}
#else

MODIFY
frida_mode/src/instrument/instrument_arm32.c
frida_mode/src/instrument/instrument_arm32.c
@@ -136,22 +136,27 @@ gboolean instrument_is_coverage_optimize_supported(void) {
static void instrument_coverage_switch(GumStalkerObserver *self,
gpointer from_address,
- gpointer start_address,
- void *from_insn,
+ gpointer start_address, void *from_insn,
gpointer *target) {
+
UNUSED_PARAMETER(self);
UNUSED_PARAMETER(from_address);
UNUSED_PARAMETER(start_address);
UNUSED_PARAMETER(from_insn);
if (!g_hash_table_contains(coverage_blocks, GSIZE_TO_POINTER(*target))) {
+
return;
+
}
- *target = (guint8 *)*target + G_STRUCT_OFFSET(afl_log_code_asm_t, str_r0_sp_rz);
+ *target =
+ (guint8 *)*target + G_STRUCT_OFFSET(afl_log_code_asm_t, str_r0_sp_rz);
+
}
static void instrument_coverage_suppress_init(void) {
+
static gboolean initialized = false;
if (initialized) { return; }
initialized = true;
@@ -162,17 +167,22 @@ static void instrument_coverage_suppress_init(void) {
coverage_blocks = g_hash_table_new(g_direct_hash, g_direct_equal);
if (coverage_blocks == NULL) {
+
FATAL("Failed to g_hash_table_new, errno: %d", errno);
+
}
+
}
static void patch_t3_insn(uint32_t *insn, uint16_t val) {
+
uint32_t orig = GUINT32_FROM_LE(*insn);
uint32_t imm12 = (val & 0xfff);
uint32_t imm4 = (val >> 12);
orig |= imm12;
orig |= (imm4 << 16);
*insn = GUINT32_TO_LE(orig);
+
}
void instrument_coverage_optimize(const cs_insn *instr,
@@ -190,7 +200,9 @@ void instrument_coverage_optimize(const cs_insn *instr,
block_start = GSIZE_TO_POINTER(GUM_ADDRESS(cw->code));
if (!g_hash_table_add(coverage_blocks, block_start)) {
+
FATAL("Failed - g_hash_table_add");
+
}
code.code = template;

MODIFY
frida_mode/src/instrument/instrument_arm64.c
frida_mode/src/instrument/instrument_arm64.c
@@ -156,9 +156,8 @@ static gboolean instrument_is_deterministic(const cs_insn *from_insn) {
}
-cs_insn *
-instrument_disassemble (gconstpointer address)
-{
+cs_insn *instrument_disassemble(gconstpointer address) {
+
csh capstone;
cs_insn *insn = NULL;
@@ -170,12 +169,12 @@ instrument_disassemble (gconstpointer address)
cs_close(&capstone);
return insn;
+
}
static void instrument_coverage_switch(GumStalkerObserver *self,
gpointer from_address,
- gpointer start_address,
- void *from_insn,
+ gpointer start_address, void *from_insn,
gpointer *target) {
UNUSED_PARAMETER(self);
@@ -187,7 +186,8 @@ static void instrument_coverage_switch(GumStalkerObserver *self,
gsize fixup_offset;
if (!g_hash_table_contains(coverage_blocks, GSIZE_TO_POINTER(*target)) &&
- !g_hash_table_contains(coverage_blocks, GSIZE_TO_POINTER((guint8 *)*target + 4))) {
+ !g_hash_table_contains(coverage_blocks,
+ GSIZE_TO_POINTER((guint8 *)*target + 4))) {
return;

MODIFY
frida_mode/src/instrument/instrument_x64.c
frida_mode/src/instrument/instrument_x64.c
@@ -171,7 +171,7 @@ void instrument_coverage_optimize_init(void) {
}
-static void instrument_coverage_switch(GumStalkerObserver *self,
+static void instrument_coverage_switch_insn(GumStalkerObserver *self,
gpointer from_address,
gpointer start_address,
const cs_insn *from_insn,
@@ -224,6 +224,35 @@ static void instrument_coverage_switch(GumStalkerObserver *self,
}
+cs_insn *instrument_disassemble(gconstpointer address) {
+
+ csh capstone;
+ cs_insn *insn = NULL;
+
+ cs_open(CS_ARCH_X86, GUM_CPU_MODE, &capstone);
+ cs_option(capstone, CS_OPT_DETAIL, CS_OPT_ON);
+
+ cs_disasm(capstone, address, 16, GPOINTER_TO_SIZE(address), 1, &insn);
+
+ cs_close(&capstone);
+
+ return insn;
+
+}
+
+static void instrument_coverage_switch(GumStalkerObserver *self,
+ gpointer from_address,
+ gpointer start_address, void *from_insn,
+ gpointer *target) {
+
+ if (from_insn == NULL) { return; }
+ cs_insn *insn = instrument_disassemble(from_insn);
+ instrument_coverage_switch_insn(self, from_address, start_address, insn,
+ target);
+ cs_free(insn, 1);
+
+}
+
static void instrument_coverage_suppress_init(void) {
static gboolean initialized = false;

MODIFY
frida_mode/src/instrument/instrument_x86.c
frida_mode/src/instrument/instrument_x86.c
@@ -83,7 +83,7 @@ gboolean instrument_is_coverage_optimize_supported(void) {
}
-static void instrument_coverage_switch(GumStalkerObserver *self,
+static void instrument_coverage_switch_insn(GumStalkerObserver *self,
gpointer from_address,
gpointer start_address,
const cs_insn *from_insn,
@@ -130,6 +130,35 @@ static void instrument_coverage_switch(GumStalkerObserver *self,
}
+cs_insn *instrument_disassemble(gconstpointer address) {
+
+ csh capstone;
+ cs_insn *insn = NULL;
+
+ cs_open(CS_ARCH_X86, GUM_CPU_MODE, &capstone);
+ cs_option(capstone, CS_OPT_DETAIL, CS_OPT_ON);
+
+ cs_disasm(capstone, address, 16, GPOINTER_TO_SIZE(address), 1, &insn);
+
+ cs_close(&capstone);
+
+ return insn;
+
+}
+
+static void instrument_coverage_switch(GumStalkerObserver *self,
+ gpointer from_address,
+ gpointer start_address, void *from_insn,
+ gpointer *target) {
+
+ if (from_insn == NULL) { return; }
+ cs_insn *insn = instrument_disassemble(from_insn);
+ instrument_coverage_switch_insn(self, from_address, start_address, insn,
+ target);
+ cs_free(insn, 1);
+
+}
+
static void instrument_coverage_suppress_init(void) {
static gboolean initialized = false;

MODIFY
frida_mode/src/js/js.c
frida_mode/src/js/js.c
@@ -19,9 +19,11 @@ static GMainContext *context;
static GMainLoop *main_loop;
static void js_msg(const gchar *message, GBytes *data, gpointer user_data) {
+
UNUSED_PARAMETER(data);
UNUSED_PARAMETER(user_data);
FOKF("%s", message);
+
}
void js_config(void) {

Fixes for x64