Add support for option to disable backpatch
MODIFY
frida_mode/README.md
frida_mode/README.md
@@ -174,6 +174,8 @@ file.
* `AFL_FRIDA_INST_NO_OPTIMIZE` - Don't use optimized inline assembly coverage
instrumentation (the default where available). Required to use
`AFL_FRIDA_INST_TRACE`.
+* `AFL_FRIDA_INST_NO_BACKPATCH` - Disable backpatching. At the end of executing
+each block, control will return to FRIDA to identify the next block to execute.
* `AFL_FRIDA_INST_NO_PREFETCH` - Disable prefetching. By default the child will
report instrumented blocks back to the parent so that it can also instrument
them and they be inherited by the next child on fork, implies

MODIFY
frida_mode/frida.map
frida_mode/frida.map
js_api_add_include_range;
js_api_done;
js_api_error;
+ js_api_set_backpatch_disable;
js_api_set_debug_maps;
js_api_set_entrypoint;
js_api_set_instrument_coverage_file;

MODIFY
frida_mode/include/stalker.h
frida_mode/include/stalker.h
#include "frida-gumjs.h"
extern guint stalker_ic_entries;
+extern gboolean backpatch_enable;
void stalker_config(void);
void stalker_init(void);

MODIFY
frida_mode/src/js/api.js
frida_mode/src/js/api.js
@@ -62,6 +62,12 @@ class Afl {
const buf = Memory.allocUtf8String(log);
Afl.jsApiWrite(STDOUT_FILENO, buf, log.length);
}
+ /**
+ * See `AFL_FRIDA_INST_NO_BACKPATCH`.
+ */
+ static setBackpatchDisable() {
+ Afl.jsApiSetBackpatchDisable();
+ }
/**
* See `AFL_FRIDA_DEBUG_MAPS`.
*/
@@ -267,6 +273,7 @@ Afl.jsApiAddIncludeRange = Afl.jsApiGetFunction("js_api_add_include_range", "voi
Afl.jsApiAflSharedMemFuzzing = Afl.jsApiGetSymbol("__afl_sharedmem_fuzzing");
Afl.jsApiDone = Afl.jsApiGetFunction("js_api_done", "void", []);
Afl.jsApiError = Afl.jsApiGetFunction("js_api_error", "void", ["pointer"]);
+Afl.jsApiSetBackpatchDisable = Afl.jsApiGetFunction("js_api_set_backpatch_disable", "void", []);
Afl.jsApiSetDebugMaps = Afl.jsApiGetFunction("js_api_set_debug_maps", "void", []);
Afl.jsApiSetEntryPoint = Afl.jsApiGetFunction("js_api_set_entrypoint", "void", ["pointer"]);
Afl.jsApiSetInstrumentCoverageFile = Afl.jsApiGetFunction("js_api_set_instrument_coverage_file", "void", ["pointer"]);

MODIFY
frida_mode/src/js/js_api.c
frida_mode/src/js/js_api.c
@@ -237,3 +237,9 @@ __attribute__((visibility("default"))) void js_api_set_traceable(void) {
}
+__attribute__((visibility("default"))) void js_api_set_backpatch_disable(void) {
+
+ backpatch_enable = FALSE;
+
+}
+

MODIFY
frida_mode/src/stalker.c
frida_mode/src/stalker.c
#include "util.h"
guint stalker_ic_entries = 0;
+gboolean backpatch_enable = TRUE;
static GumStalker *stalker = NULL;
@@ -58,6 +59,8 @@ void stalker_config(void) {
if (!gum_stalker_is_supported()) { FATAL("Failed to initialize embedded"); }
+ backpatch_enable = (getenv("AFL_FRIDA_INST_NO_BACKPATCH") == NULL);
+
stalker_ic_entries = util_read_num("AFL_FRIDA_STALKER_IC_ENTRIES");
observer = g_object_new(GUM_TYPE_AFL_STALKER_OBSERVER, NULL);
@@ -87,6 +90,8 @@ static gboolean stalker_exclude_self(const GumRangeDetails *details,
void stalker_init(void) {
+ OKF("Instrumentation - backpatch [%c]", backpatch_enable ? 'X' : ' ');
+
OKF("Stalker - ic_entries [%u]", stalker_ic_entries);
#if !(defined(__x86_64__) || defined(__i386__))
@@ -134,7 +139,7 @@ void stalker_start(void) {
void stalker_trust(void) {
- gum_stalker_set_trust_threshold(stalker, 0);
+ if (backpatch_enable) { gum_stalker_set_trust_threshold(stalker, 0); }
}

MODIFY
frida_mode/ts/lib/afl.ts
frida_mode/ts/lib/afl.ts
@@ -77,6 +77,13 @@ class Afl {
Afl.jsApiWrite(STDOUT_FILENO, buf, log.length);
}
+ /**
+ * See `AFL_FRIDA_INST_NO_BACKPATCH`.
+ */
+ public static setBackpatchDisable(): void {
+ Afl.jsApiSetBackpatchDisable();
+ }
+
/**
* See `AFL_FRIDA_DEBUG_MAPS`.
*/
@@ -313,6 +320,11 @@ class Afl {
"void",
["pointer"]);
+ private static readonly jsApiSetBackpatchDisable = Afl.jsApiGetFunction(
+ "js_api_set_backpatch_disable",
+ "void",
+ []);
+
private static readonly jsApiSetDebugMaps = Afl.jsApiGetFunction(
"js_api_set_debug_maps",
"void",

MODIFY
include/envs.h
include/envs.h
@@ -59,6 +59,7 @@ static char *afl_environment_variables[] = {
"AFL_FRIDA_INST_COVERAGE_FILE",
"AFL_FRIDA_INST_DEBUG_FILE",
"AFL_FRIDA_INST_JIT",
+ "AFL_FRIDA_INST_NO_BACKPATCH",
"AFL_FRIDA_INST_NO_OPTIMIZE",
"AFL_FRIDA_INST_NO_PREFETCH",
"AFL_FRIDA_INST_NO_PREFETCH_BACKPATCH",

Add support for option to disable backpatch