frida: complog -> cmplog
MODIFY
frida_mode/README.md
frida_mode/README.md
@@ -18,8 +18,8 @@ perhaps leverage some of its design and implementation.
| -------------------------|:----------:|:---------------------------------------:|
| NeverZero | x | |
| Persistent Mode | x | (x64 only)(Only on function boundaries) |
- | LAF-Intel / CompCov | - | (Superseded by CmpLog) |
- | CmpLog | x | (x64 only) |
+ | LAF-Intel / CompCov | - | (CMPLOG is better 90% of the time) |
+ | CMPLOG | x | (x64 only) |
| Selective Instrumentation| x | |
| Non-Colliding Coverage | - | |
| Ngram prev_loc Coverage | - | |
@@ -112,9 +112,9 @@ to push and pop the full register context. Note that since this instrumentation
is used on every basic block to generate coverage, it has a large impact on
performance.
-CmpLog support also adds code to the assembly, however, at present this code
+CMPLOG support also adds code to the assembly, however, at present this code
makes use of a basic C function and is yet to be optimized. Since not all
-instances run CmpLog mode and instrumentation of the binary is less frequent
+instances run CMPLOG mode and instrumentation of the binary is less frequent
(only on CMP, SUB and CALL instructions) performance is not quite so critical.
# Advanced configuration options

DELETE
frida_mode/include/complog.h
-#ifndef _COMPLOG_H
-#define _COMPLOG_H
-
-extern struct cmp_map *__afl_cmp_map;
-
-void complog_init(void);
-
-/* Functions to be implemented by the different architectures */
-void complog_instrument(const cs_insn *instr, GumStalkerIterator *iterator);
-
-gboolean complog_is_readable(void *addr, size_t size);
-
-#endif
-

ADD
frida_mode/include/frida_cmplog.h
+#ifndef _CMPLOG_H
+#define _CMPLOG_H
+
+extern struct cmp_map *__afl_cmp_map;
+
+void cmplog_init(void);
+
+/* Functions to be implemented by the different architectures */
+void cmplog_instrument(const cs_insn *instr, GumStalkerIterator *iterator);
+
+gboolean cmplog_is_readable(void *addr, size_t size);
+
+#endif
+

ADD
frida_mode/src/cmplog/cmplog.c
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "util.h"
+
+extern struct cmp_map *__afl_cmp_map;
+
+static GArray *cmplog_ranges = NULL;
+
+static gboolean cmplog_range(const GumRangeDetails *details,
+ gpointer user_data) {
+
+ UNUSED_PARAMETER(user_data);
+ GumMemoryRange range = *details->range;
+ g_array_append_val(cmplog_ranges, range);
+ return TRUE;
+
+}
+
+static gint cmplog_sort(gconstpointer a, gconstpointer b) {
+
+ return ((GumMemoryRange *)b)->base_address -
+ ((GumMemoryRange *)a)->base_address;
+
+}
+
+void cmplog_init(void) {
+
+ if (__afl_cmp_map != NULL) { OKF("CMPLOG mode enabled"); }
+
+ cmplog_ranges = g_array_sized_new(false, false, sizeof(GumMemoryRange), 100);
+ gum_process_enumerate_ranges(GUM_PAGE_READ, cmplog_range, NULL);
+ g_array_sort(cmplog_ranges, cmplog_sort);
+
+ for (guint i = 0; i < cmplog_ranges->len; i++) {
+
+ GumMemoryRange *range = &g_array_index(cmplog_ranges, GumMemoryRange, i);
+ OKF("CMPLOG Range - 0x%016" G_GINT64_MODIFIER "X - 0x%016" G_GINT64_MODIFIER
+ "X",
+ range->base_address, range->base_address + range->size);
+
+ }
+
+}
+
+static gboolean cmplog_contains(GumAddress inner_base, GumAddress inner_limit,
+ GumAddress outer_base, GumAddress outer_limit) {
+
+ return (inner_base >= outer_base && inner_limit <= outer_limit);
+
+}
+
+gboolean cmplog_is_readable(void *addr, size_t size) {
+
+ if (cmplog_ranges == NULL) FATAL("CMPLOG not initialized");
+
+ GumAddress inner_base = GUM_ADDRESS(addr);
+ GumAddress inner_limit = inner_base + size;
+
+ for (guint i = 0; i < cmplog_ranges->len; i++) {
+
+ GumMemoryRange *range = &g_array_index(cmplog_ranges, GumMemoryRange, i);
+ GumAddress outer_base = range->base_address;
+ GumAddress outer_limit = outer_base + range->size;
+
+ if (cmplog_contains(inner_base, inner_limit, outer_base, outer_limit))
+ return true;
+
+ }
+
+ return false;
+
+}
+

RENAME
frida_mode/src/complog/complog_arm.c
frida_mode/src/cmplog/cmplog_arm.c
#include "debug.h"
-#include "complog.h"
+#include "frida_cmplog.h"
#include "util.h"
#if defined(__arm__)
-void complog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
+void cmplog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
UNUSED_PARAMETER(instr);
UNUSED_PARAMETER(iterator);
if (__afl_cmp_map == NULL) { return; }
- FATAL("Complog mode not supported on this architecture");
+ FATAL("CMPLOG mode not supported on this architecture");
}

RENAME
frida_mode/src/complog/complog_arm64.c
frida_mode/src/cmplog/cmplog_arm64.c
#include "debug.h"
-#include "complog.h"
+#include "frida_cmplog.h"
#include "util.h"
#if defined(__aarch64__)
-void complog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
+void cmplog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
UNUSED_PARAMETER(instr);
UNUSED_PARAMETER(iterator);
if (__afl_cmp_map == NULL) { return; }
- FATAL("Complog mode not supported on this architecture");
+ FATAL("CMPLOG mode not supported on this architecture");
}

RENAME
frida_mode/src/complog/complog_x64.c
frida_mode/src/cmplog/cmplog_x64.c
#include "debug.h"
#include "cmplog.h"
-#include "complog.h"
+#include "frida_cmplog.h"
#include "util.h"
#if defined(__x86_64__)
@@ -56,16 +56,16 @@ typedef struct {
};
-} complog_ctx_t;
+} cmplog_ctx_t;
typedef struct {
- complog_ctx_t operand1;
- complog_ctx_t operand2;
+ cmplog_ctx_t operand1;
+ cmplog_ctx_t operand2;
-} complog_pair_ctx_t;
+} cmplog_pair_ctx_t;
-static guint64 complog_read_reg(GumX64CpuContext *ctx, x86_reg reg) {
+static guint64 cmplog_read_reg(GumX64CpuContext *ctx, x86_reg reg) {
switch (reg) {
@@ -134,15 +134,15 @@ static guint64 complog_read_reg(GumX64CpuContext *ctx, x86_reg reg) {
}
-static guint64 complog_read_mem(GumX64CpuContext *ctx, x86_op_mem *mem) {
+static guint64 cmplog_read_mem(GumX64CpuContext *ctx, x86_op_mem *mem) {
guint64 base = 0;
guint64 index = 0;
guint64 address;
- if (mem->base != X86_REG_INVALID) base = complog_read_reg(ctx, mem->base);
+ if (mem->base != X86_REG_INVALID) base = cmplog_read_reg(ctx, mem->base);
- if (mem->index != X86_REG_INVALID) index = complog_read_reg(ctx, mem->index);
+ if (mem->index != X86_REG_INVALID) index = cmplog_read_reg(ctx, mem->index);
address = base + (index * mem->scale) + mem->disp;
return address;
@@ -150,16 +150,16 @@ static guint64 complog_read_mem(GumX64CpuContext *ctx, x86_op_mem *mem) {
}
static guint64 cmplog_get_operand_value(GumCpuContext *context,
- complog_ctx_t *ctx) {
+ cmplog_ctx_t * ctx) {
switch (ctx->type) {
case X86_OP_REG:
- return complog_read_reg(context, ctx->reg);
+ return cmplog_read_reg(context, ctx->reg);
case X86_OP_IMM:
return ctx->imm;
case X86_OP_MEM:
- return complog_read_mem(context, &ctx->mem);
+ return cmplog_read_mem(context, &ctx->mem);
default:
FATAL("Invalid operand type: %d\n", ctx->type);
@@ -167,18 +167,18 @@ static guint64 cmplog_get_operand_value(GumCpuContext *context,
}
-static void complog_call_callout(GumCpuContext *context, gpointer user_data) {
+static void cmplog_call_callout(GumCpuContext *context, gpointer user_data) {
UNUSED_PARAMETER(user_data);
- guint64 address = complog_read_reg(context, X86_REG_RIP);
- guint64 rdi = complog_read_reg(context, X86_REG_RDI);
- guint64 rsi = complog_read_reg(context, X86_REG_RSI);
+ guint64 address = cmplog_read_reg(context, X86_REG_RIP);
+ guint64 rdi = cmplog_read_reg(context, X86_REG_RDI);
+ guint64 rsi = cmplog_read_reg(context, X86_REG_RSI);
void *ptr1 = GSIZE_TO_POINTER(rdi);
void *ptr2 = GSIZE_TO_POINTER(rsi);
- if (!complog_is_readable(ptr1, 32) || !complog_is_readable(ptr2, 32)) return;
+ if (!cmplog_is_readable(ptr1, 32) || !cmplog_is_readable(ptr2, 32)) return;
uintptr_t k = address;
@@ -200,7 +200,7 @@ static void complog_call_callout(GumCpuContext *context, gpointer user_data) {
}
-static void complog_instrument_put_operand(complog_ctx_t *ctx,
+static void cmplog_instrument_put_operand(cmplog_ctx_t *ctx,
cs_x86_op * operand) {
ctx->type = operand->type;
@@ -223,19 +223,19 @@ static void complog_instrument_put_operand(complog_ctx_t *ctx,
}
-static void complog_instrument_call_put_callout(GumStalkerIterator *iterator,
+static void cmplog_instrument_call_put_callout(GumStalkerIterator *iterator,
cs_x86_op * operand) {
- complog_ctx_t *ctx = g_malloc(sizeof(complog_ctx_t));
+ cmplog_ctx_t *ctx = g_malloc(sizeof(cmplog_ctx_t));
if (ctx == NULL) return;
- complog_instrument_put_operand(ctx, operand);
+ cmplog_instrument_put_operand(ctx, operand);
- gum_stalker_iterator_put_callout(iterator, complog_call_callout, ctx, g_free);
+ gum_stalker_iterator_put_callout(iterator, cmplog_call_callout, ctx, g_free);
}
-static void complog_instrument_call(const cs_insn * instr,
+static void cmplog_instrument_call(const cs_insn * instr,
GumStalkerIterator *iterator) {
cs_x86 x86 = instr->detail->x86;
@@ -251,14 +251,14 @@ static void complog_instrument_call(const cs_insn * instr,
if (operand->type == X86_OP_MEM && operand->mem.segment != X86_REG_INVALID)
return;
- complog_instrument_call_put_callout(iterator, operand);
+ cmplog_instrument_call_put_callout(iterator, operand);
}
-static void complog_handle_cmp_sub(GumCpuContext *context, guint64 operand1,
+static void cmplog_handle_cmp_sub(GumCpuContext *context, guint64 operand1,
guint64 operand2, uint8_t size) {
- guint64 address = complog_read_reg(context, X86_REG_RIP);
+ guint64 address = cmplog_read_reg(context, X86_REG_RIP);
register uintptr_t k = (uintptr_t)address;
@@ -278,36 +278,35 @@ static void complog_handle_cmp_sub(GumCpuContext *context, guint64 operand1,
}
-static void complog_cmp_sub_callout(GumCpuContext *context,
- gpointer user_data) {
+static void cmplog_cmp_sub_callout(GumCpuContext *context, gpointer user_data) {
- complog_pair_ctx_t *ctx = (complog_pair_ctx_t *)user_data;
+ cmplog_pair_ctx_t *ctx = (cmplog_pair_ctx_t *)user_data;
if (ctx->operand1.size != ctx->operand2.size) FATAL("Operand size mismatch");
guint64 operand1 = cmplog_get_operand_value(context, &ctx->operand1);
guint64 operand2 = cmplog_get_operand_value(context, &ctx->operand2);
- complog_handle_cmp_sub(context, operand1, operand2, ctx->operand1.size);
+ cmplog_handle_cmp_sub(context, operand1, operand2, ctx->operand1.size);
}
-static void complog_instrument_cmp_sub_put_callout(GumStalkerIterator *iterator,
+static void cmplog_instrument_cmp_sub_put_callout(GumStalkerIterator *iterator,
cs_x86_op * operand1,
cs_x86_op *operand2) {
- complog_pair_ctx_t *ctx = g_malloc(sizeof(complog_pair_ctx_t));
+ cmplog_pair_ctx_t *ctx = g_malloc(sizeof(cmplog_pair_ctx_t));
if (ctx == NULL) return;
- complog_instrument_put_operand(&ctx->operand1, operand1);
- complog_instrument_put_operand(&ctx->operand2, operand2);
+ cmplog_instrument_put_operand(&ctx->operand1, operand1);
+ cmplog_instrument_put_operand(&ctx->operand2, operand2);
- gum_stalker_iterator_put_callout(iterator, complog_cmp_sub_callout, ctx,
+ gum_stalker_iterator_put_callout(iterator, cmplog_cmp_sub_callout, ctx,
g_free);
}
-static void complog_instrument_cmp_sub(const cs_insn * instr,
+static void cmplog_instrument_cmp_sub(const cs_insn * instr,
GumStalkerIterator *iterator) {
cs_x86 x86 = instr->detail->x86;
@@ -340,16 +339,16 @@ static void complog_instrument_cmp_sub(const cs_insn * instr,
(operand2->mem.segment != X86_REG_INVALID))
return;
- complog_instrument_cmp_sub_put_callout(iterator, operand1, operand2);
+ cmplog_instrument_cmp_sub_put_callout(iterator, operand1, operand2);
}
-void complog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
+void cmplog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
if (__afl_cmp_map == NULL) return;
- complog_instrument_call(instr, iterator);
- complog_instrument_cmp_sub(instr, iterator);
+ cmplog_instrument_call(instr, iterator);
+ cmplog_instrument_cmp_sub(instr, iterator);
}

RENAME
frida_mode/src/complog/complog_x86.c
frida_mode/src/cmplog/cmplog_x86.c
#include "debug.h"
-#include "complog.h"
+#include "frida_cmplog.h"
#include "util.h"
#if defined(__i386__)
-void complog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
+void cmplog_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {
UNUSED_PARAMETER(instr);
UNUSED_PARAMETER(iterator);
if (__afl_cmp_map == NULL) { return; }
- FATAL("Complog mode not supported on this architecture");
+ FATAL("CMPLOG mode not supported on this architecture");
}

DELETE
frida_mode/src/complog/complog.c
-#include "frida-gum.h"
-
-#include "debug.h"
-#include "cmplog.h"
-#include "util.h"
-
-extern struct cmp_map *__afl_cmp_map;
-
-static GArray *complog_ranges = NULL;
-
-static gboolean complog_range(const GumRangeDetails *details,
- gpointer user_data) {
-
- UNUSED_PARAMETER(user_data);
- GumMemoryRange range = *details->range;
- g_array_append_val(complog_ranges, range);
- return TRUE;
-
-}
-
-static gint complog_sort(gconstpointer a, gconstpointer b) {
-
- return ((GumMemoryRange *)b)->base_address -
- ((GumMemoryRange *)a)->base_address;
-
-}
-
-void complog_init(void) {
-
- if (__afl_cmp_map != NULL) { OKF("CompLog mode enabled"); }
-
- complog_ranges = g_array_sized_new(false, false, sizeof(GumMemoryRange), 100);
- gum_process_enumerate_ranges(GUM_PAGE_READ, complog_range, NULL);
- g_array_sort(complog_ranges, complog_sort);
-
- for (guint i = 0; i < complog_ranges->len; i++) {
-
- GumMemoryRange *range = &g_array_index(complog_ranges, GumMemoryRange, i);
- OKF("CompLog Range - 0x%016" G_GINT64_MODIFIER
- "X - 0x%016" G_GINT64_MODIFIER "X",
- range->base_address, range->base_address + range->size);
-
- }
-
-}
-
-static gboolean complog_contains(GumAddress inner_base, GumAddress inner_limit,
- GumAddress outer_base,
- GumAddress outer_limit) {
-
- return (inner_base >= outer_base && inner_limit <= outer_limit);
-
-}
-
-gboolean complog_is_readable(void *addr, size_t size) {
-
- if (complog_ranges == NULL) FATAL("CompLog not initialized");
-
- GumAddress inner_base = GUM_ADDRESS(addr);
- GumAddress inner_limit = inner_base + size;
-
- for (guint i = 0; i < complog_ranges->len; i++) {
-
- GumMemoryRange *range = &g_array_index(complog_ranges, GumMemoryRange, i);
- GumAddress outer_base = range->base_address;
- GumAddress outer_limit = outer_base + range->size;
-
- if (complog_contains(inner_base, inner_limit, outer_base, outer_limit))
- return true;
-
- }
-
- return false;
-
-}
-

MODIFY
frida_mode/src/instrument/instrument.c
frida_mode/src/instrument/instrument.c
#include "config.h"
#include "debug.h"
-#include "complog.h"
+#include "frida_cmplog.h"
#include "instrument.h"
#include "persistent.h"
#include "prefetch.h"
@@ -105,7 +105,7 @@ static void instr_basic_block(GumStalkerIterator *iterator,
if (!range_is_excluded((void *)instr->address)) {
- complog_instrument(instr, iterator);
+ cmplog_instrument(instr, iterator);
}
@@ -140,7 +140,7 @@ void instrument_init(void) {
transformer =
gum_stalker_transformer_make_from_callback(instr_basic_block, NULL, NULL);
- complog_init();
+ cmplog_init();
}

DELETE
frida_mode/src/lib/lib
frida_mode/src/lib/lib
Binary files a/frida_mode/src/lib/lib and /dev/null differ

DELETE
frida_mode/test/fuzzbench/fuzzer
frida_mode/test/fuzzbench/fuzzer
Binary files a/frida_mode/test/fuzzbench/fuzzer and /dev/null differ

DELETE
frida_mode/test/libxml/xml
frida_mode/test/libxml/xml
Binary files a/frida_mode/test/libxml/xml and /dev/null differ

frida: complog -> cmplog