add ghidra script and workaround ghidra/linux/ida weirdness
MODIFY
examples/afl_untracer/README.md
examples/afl_untracer/README.md
@@ -10,6 +10,10 @@ or cmplog.
Read and modify afl-untracer.c then `make` and use it as the afl-fuzz target
(or even remote via afl-network-proxy).
+To generate the `patches.txt` file for your target library use the
+`ida_get_patchpoints.py` script for IDA Pro or
+`ghidra_get_patchpoints.java` for Ghidra.
+
This idea is based on [UnTracer](https://github.com/FoRTE-Research/UnTracer-AFL)
and modified by [Trapfuzz](https://github.com/googleprojectzero/p0tools/tree/master/TrapFuzz).
This implementation is slower because the traps are not patched out with each

MODIFY
examples/afl_untracer/afl-untracer.c
examples/afl_untracer/afl-untracer.c
@@ -506,18 +506,6 @@ void setup_trap_instrumentation() {
// It's an offset, parse it and do the patching.
unsigned long offset = strtoul(line, NULL, 16);
- // I dont know what it is. /proc/<pid>/maps shows the right start address
- // and the offsets generated by the python scripts are fine as well.
- // And loading the library into gdb also shows the offsets generated
- // by the script are correct. However when loaded via dlopen the first
- // 0x1000 are skipped ...
-#if defined(__linux__)
- if (offset >= 0x1000)
- offset -= 0x1000;
- else
- fprintf(stderr, "Warning: offset is < 0x1000: %x\n", offset);
-#endif
-
if (offset > lib_size)
FATAL("Invalid offset: 0x%lx. Current library is 0x%zx bytes large",
offset, lib_size);
@@ -526,10 +514,12 @@ void setup_trap_instrumentation() {
FATAL("Too many basic blocks to instrument");
uint32_t *shadow = SHADOW(lib_addr + offset);
- if (*shadow != 0) FATAL("Duplicate patch entry: 0x%lx", offset);
+ if (*shadow != 0) continue; // skip duplicates
// Make lookup entry in shadow memory.
+
#if ((defined(__APPLE__) && defined(__LP64__)) || defined(__x86_64__))
+
// this is for Intel x64
uint8_t orig_byte = lib_addr[offset];

ADD
examples/afl_untracer/ghidra_get_patchpoints.java
+/* ###
+ * IP: GHIDRA
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Find patch points for untracer tools (e.g. afl++ examples/afl_untracer)
+//
+// Copy to ..../Ghidra/Features/Search/ghidra_scripts/
+// Writes the results to ~/Desktop/patches.txt
+//
+// This is my very first Ghidra script. I am sure this could be done better.
+//
+//@category Search
+
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.*;
+import ghidra.program.model.block.*;
+import ghidra.program.model.listing.*;
+import ghidra.program.model.symbol.*;
+import ghidra.program.model.mem.*;
+
+import java.io.*;
+
+public class ghidra_get_patchpoints extends GhidraScript {
+
+ @Override
+ public void run() throws Exception {
+
+ long segment_start = 0;
+ Memory memory = currentProgram.getMemory();
+ MultEntSubModel model = new MultEntSubModel(currentProgram);
+ CodeBlockIterator subIter = model.getCodeBlocks(monitor);
+ BufferedWriter out = new BufferedWriter(new FileWriter(System.getProperty("user.home") + File.separator + "Desktop" + File.separator + "patches.txt"));
+
+ while (subIter.hasNext()) {
+
+ CodeBlock multiEntryBlock = subIter.next();
+ SimpleBlockModel basicBlockModel = new SimpleBlockModel(currentProgram);
+ CodeBlockIterator bbIter = basicBlockModel.getCodeBlocksContaining(multiEntryBlock, monitor);
+
+ while (bbIter.hasNext()) {
+
+ CodeBlock basicBlock = bbIter.next();
+
+ if (segment_start == 0) {
+
+ Address firstAddr = basicBlock.getFirstStartAddress();
+ long firstBlockAddr = firstAddr.getAddressableWordOffset();
+ MemoryBlock mb = memory.getBlock(firstAddr);
+ Address startAddr = mb.getStart();
+ Address endAddr = mb.getEnd();
+ segment_start = startAddr.getAddressableWordOffset();
+ if ((firstBlockAddr - segment_start) >= 0x1000)
+ segment_start += 0x1000;
+ long segment_end = endAddr.getAddressableWordOffset();
+ long segment_size = segment_end - segment_start;
+ if ((segment_size % 0x1000) > 0)
+ segment_size = (((segment_size / 0x1000) + 1) * 0x1000);
+ out.write(currentProgram.getName() + ":0x" + Long.toHexString(segment_size) + "\n");
+ //println("Start: " + Long.toHexString(segment_start));
+ //println("End: " + Long.toHexString(segment_end));
+
+ }
+
+ if (basicBlock.getFirstStartAddress().getAddressableWordOffset() - segment_start > 0)
+ out.write("0x" + Long.toHexString(basicBlock.getFirstStartAddress().getAddressableWordOffset() - segment_start) + "\n");
+
+ }
+ }
+
+ out.close();
+
+ }
+}

MODIFY
examples/afl_untracer/ida_get_patchpoints.py
examples/afl_untracer/ida_get_patchpoints.py
@@ -24,6 +24,8 @@ for seg_ea in idautils.Segments():
start = idc.get_segm_start(seg_ea)
end = idc.get_segm_end(seg_ea)
+ first = 0
+ subtract_addr = 0
#print("Start: " + hex(start) + " End: " + hex(end))
for func_ea in idautils.Functions(start, end):
f = idaapi.get_func(func_ea)
@@ -31,8 +33,13 @@ for seg_ea in idautils.Segments():
continue
for block in idaapi.FlowChart(f):
if start <= block.start_ea < end:
+ if first == 0:
+ if block.start_ea >= 0x1000:
+ subtract_addr = 0x1000
+ first = 1
+
max_offset = max(max_offset, block.start_ea)
- patchpoints.add(block.start_ea)
+ patchpoints.add(block.start_ea - subtract_addr)
#else:
# print("Warning: broken CFG?")

add ghidra script and workaround ghidra/linux/ida weirdness