├── .gitignore ├── README.md ├── afl.js ├── afl.png ├── experimental ├── aflmock.c ├── checkfd.c ├── checkfd.js ├── checkfd.py ├── fridamock.c └── simple.c ├── frida-afl.py └── scripts └── clean.sh /.gitignore: -------------------------------------------------------------------------------- 1 | afl 2 | simple 3 | *.dSYM/ 4 | .vscode/ 5 | frida.rep/ 6 | ghidra.rep/ 7 | ghidra.gpr 8 | ghidra.lock 9 | testcase/ 10 | in/ 11 | out/ 12 | afl.log 13 | fork.log 14 | map.txt 15 | fridamock 16 | checkfd 17 | aflmock 18 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Frida-AFL 2 | 3 | ![AFL Status Screen](afl.png "AFL Status Screen") 4 | 5 | The `frida-afl.py` scripts spawn the target process with ASLR disabled, inject and execute the `afl.js` script and wait for the execution to finish. If you want to use the forkserver implementation you need to pass the `--entrypoint 0xDEADBEEF` option to the `frida-afl.py` script in order for the instrumented code to start the forkserver at the right place. If you dont want to use the forkserver (**which btw currently doesn't work**), just pass `AFL_NO_FORKSRV=1`. 6 | 7 | The env-variable `WHITELIST` should be pass in order to instrument also dynamic libraries used by the target. If none is given only the main module (target binary) will be instrumented. If you use `all` as value, every basic block will be instrumented (no matter which module). 8 | 9 | For example: 10 | ``` 11 | WHITELIST="libplist.3.dylib" AFL_NO_FORKSRV=1 frida --no-pause --runtime=v8 -l afl.js -- /usr/local/bin/plistutil -i Info.plist 12 | ``` 13 | Will only track `libplist` basic blocks. 14 | 15 | > **IMPORTANT:** In order to communicate with the forkserver in the target process AFL uses some pipes, those pipes are exposed via FDs when starting the target. Unfortunately this FDs are not inherited from target because of how frida starts the target (and its helper). To address this I created a pull-request in frida-core that fixes the problem: https://github.com/frida/frida-core/pull/279 16 | 17 | The `experimental` folder contains some helper files/programs to test forkserver. E.g. `aflmock.c` simulate AFL by setting up the shared memory (code-coverage map), by faking the control pipes like AFL does, by running the target binary via `execv` and by creating a readable memory map file once the execution is finished. 18 | 19 | ## References 20 | * [Frida Javascript API References](https://www.frida.re/docs/javascript-api/) 21 | * [Frida CModule explanations](https://www.frida.re/news/2019/09/18/frida-12-7-released/) 22 | * [frida-gum CModule](https://github.com/frida/frida-gum/tree/master/bindings/gumjs/runtime/cmodule) 23 | * [AFL-Dynamorio](https://github.com/vanhauser-thc/afl-dynamorio) by Vanhauser 24 | * [AFL forkserver concept](https://lcamtuf.blogspot.com/2014/10/fuzzing-binaries-without-execve.html) 25 | * [Inside a Mach-O binary](https://adrummond.net/posts/macho) 26 | * [posix_spawn part for Mac OS X](https://github.com/frida/frida-core/blob/5328de88a29222559fb2883be54ccae3b705a8b6/src/darwin/frida-helper-backend-glue.m) 27 | 28 | ## Example Runs 29 | 30 | ### afl-fuzz 31 | ``` 32 | $ AFL_NO_FORKSRV=1 WHITELIST="all" AFL_SKIP_BIN_CHECK=1 afl-fuzz -m 800 -i in_file/ -o out/ -t 2000 -- ./frida-afl.py /usr/bin/file @@ 33 | afl-fuzz 2.56b by 34 | [+] You have 4 CPU cores and 3 runnable tasks (utilization: 75%). 35 | [+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt. 36 | [*] Setting up output directories... 37 | [+] Output directory exists but deemed OK to reuse. 38 | [*] Deleting old session data... 39 | [+] Output dir cleanup successful. 40 | [*] Scanning 'in_file/'... 41 | [+] No auto-generated dictionary tokens to reuse. 42 | [*] Creating hard links for all input files... 43 | [*] Validating target binary... 44 | [*] Attempting dry run with 'id:000000,orig:simple' ... 45 | ``` 46 | 47 | ### afl-showmap 48 | 49 | ``` 50 | $ AFL_NO_FORKSRV=1 WHITELIST="file" AFL_SKIP_BIN_CHECK=1 afl-showmap -o map.txt -- ./frida-afl.py /usr/bin/file in_file/simple 51 | afl-showmap 2.56b by 52 | [*] Executing './frida-afl.py'... 53 | 54 | -- Program output begins -- 55 | __AFL_SHM_ID is 917507 56 | Spawning /usr/bin/file in_file/simple 57 | [*] Found export for getenv! 58 | [*] Prepared native function @ 0x7fff70bcb85f 59 | [*] Shared memory ID: 917507 60 | [*] Forkserver enabled: false 61 | [*] Whitelist: file 62 | [*] getpid() found 63 | [*] trace_bits mapped at 0x100561000 64 | [*] Done stalking threads 65 | in_file/simple: Mach-O 64-bit executable x86_64 66 | [*] Monitored 803 blocks! 67 | [*] Shared memory unmapped! 68 | Exiting! 69 | -- Program output ends -- 70 | [+] Captured 779 tuples in 'map.txt'. 71 | bash-3.2$ head map.txt 72 | 000201:1 73 | 000222:1 74 | 000984:1 75 | 001009:1 76 | 001027:1 77 | 001047:1 78 | 001050:1 79 | 001087:1 80 | 001122:2 81 | ... 82 | ``` 83 | -------------------------------------------------------------------------------- /afl.js: -------------------------------------------------------------------------------- 1 | 2 | const logfile = new File("afl.log", "a+"); 3 | 4 | function debug(msg) { 5 | var args = Array.prototype.slice.call(arguments); 6 | console.log.apply(console, args); 7 | logfile.write(args.join(" ")); 8 | logfile.write("\n"); 9 | logfile.flush(); 10 | } 11 | 12 | var threads = {}; 13 | 14 | var EV_TYPE_BLOCK = 8; 15 | var EV_TYPE_COMPILE = 16; 16 | 17 | var intSize = Process.pointerSize; 18 | var EV_STRUCT_SIZE = 2 * Process.pointerSize + 2 * intSize; 19 | 20 | function parseEvents(blob, callback) { 21 | var len = getLen(blob); 22 | for (var i = 0; i !== len; i++) { 23 | var type = getType(blob, i); 24 | switch (type) { 25 | case EV_TYPE_BLOCK: 26 | callback(parseBlockEvent(blob, i)); 27 | break; 28 | case EV_TYPE_COMPILE: 29 | callback(parseCompileEvent(blob, i)); 30 | break; 31 | default: 32 | debug('Unsupported type ' + type); 33 | break; 34 | } 35 | } 36 | } 37 | 38 | function getType(blob, idx) { 39 | return parseInteger(blob, idx, 0); 40 | } 41 | 42 | function getLen(blob) { 43 | return blob.byteLength / EV_STRUCT_SIZE; 44 | } 45 | 46 | function parseBlockEvent(blob, idx) { 47 | var begin = parsePointer(blob, idx, intSize); 48 | var end = parsePointer(blob, idx, intSize + Process.pointerSize); 49 | var i = begin.add(0); 50 | var code = []; 51 | while (i.compare(end) < 0) { 52 | var instr = Instruction.parse(i); 53 | code.push(i.toString() + ' ' + instr.toString()); 54 | i = instr.next; 55 | } 56 | return { 57 | type: 'block', 58 | begin: begin, 59 | end: end, 60 | code: code.join('\n') 61 | }; 62 | } 63 | 64 | function parseCompileEvent(blob, idx) { 65 | var parsed = parseBlockEvent(blob, idx); 66 | parsed.type = 'compile'; 67 | return parsed; 68 | } 69 | 70 | function parseInteger(blob, idx, offset) { 71 | return new Int32Array(blob, idx * EV_STRUCT_SIZE + offset, 1)[0]; 72 | } 73 | 74 | function parsePointer(blob, idx, offset) { 75 | var view = new Uint8Array(blob, idx * EV_STRUCT_SIZE + offset, Process.pointerSize); 76 | var stringed = []; 77 | for (var i = 0; i < Process.pointerSize; i++) { 78 | var x = view[i]; 79 | var conv = x.toString(16); 80 | if (conv.length === 1) { 81 | conv = '0' + conv; 82 | } 83 | stringed.push(conv); 84 | } 85 | return ptr('0x' + stringed.reverse().join('')); 86 | } 87 | 88 | function reverse(arr) { 89 | var result = []; 90 | for (var i = arr.length - 1; i >= 0; i--) { 91 | result.push(arr[i]); 92 | } 93 | return result; 94 | } 95 | 96 | // Assignments 97 | Stalker.trustThreshold = 0; 98 | // WATCH-OUT: seems like the first module is always the binary main module 99 | var instrument_all = false; 100 | var trace_bits = ptr(0); 101 | var shmat = ptr(0); 102 | var shmdt = ptr(0); 103 | var getpid = ptr(0); 104 | // keep track of previous block id 105 | var prev_id = ptr(0); 106 | var block_monitored = 0; 107 | var entrypoint = ptr(0); 108 | // forkserver 109 | var have_forkserver = 0; 110 | 111 | rpc.exports = { 112 | init: function (entrypoint_address) { 113 | entrypoint = ptr(entrypoint_address); 114 | debug("[*] Entrypoint address set to", entrypoint); 115 | debug("[+] Instrumentation initialized from python launcher!"); 116 | return; 117 | } 118 | }; 119 | 120 | const forkstarted = Memory.alloc(4); 121 | const forkserver_module = new CModule(` 122 | #include 123 | 124 | #define FORKSRV_FD 198 125 | #define F_GETFL 3 /* get file status flags */ 126 | 127 | 128 | extern int fork(void); 129 | extern int read(int fildes, void *buf, unsigned int nbyte); 130 | extern int write(int fildes, const void *buf, unsigned int nbyte); 131 | extern int waitpid(int pid, int *stat_loc, int options); 132 | extern int close(int fildes); 133 | extern int fcntl(int fildes, int cmd, ...); 134 | int getpid(void); 135 | // logging 136 | FILE *fopen(const char * restrict path, const char * restrict mode); 137 | int fclose(FILE *stream); 138 | int fflush(FILE *stream); 139 | extern int errno; 140 | extern volatile int forkstarted; 141 | 142 | void 143 | start (void) 144 | { 145 | FILE *log = fopen("fork.log", "a+"); 146 | unsigned char tmp[4] = {}; 147 | int child_pid = 0; 148 | fprintf(log, "[+] Init forkserver PID %d!\\n", getpid()); 149 | 150 | if (fcntl(FORKSRV_FD, F_GETFL) == -1 || fcntl(FORKSRV_FD + 1, F_GETFL) == -1){ 151 | fprintf(log, "[!] AFL fork server file descriptors are not open, errno %d\\n", errno); 152 | goto getout; 153 | } else { 154 | fprintf(log, "[*] FDs ready!\\n"); 155 | } 156 | 157 | if (write(FORKSRV_FD + 1, tmp, 4) != 4) { 158 | fprintf(log, "[!] Error writing fork server to FD %d, errno %d\\n", FORKSRV_FD + 1, errno); 159 | goto getout; 160 | } else { 161 | fprintf(log, "[*] write (1)!\\n"); 162 | } 163 | 164 | while (1) { 165 | unsigned int was_killed; 166 | int status; 167 | fprintf(log, "[+] Waiting for mother!\\n"); 168 | if (read(FORKSRV_FD, &was_killed, 4) != 4) { 169 | fprintf(log, "[!] Error reading fork server\\n"); 170 | goto getout; 171 | } else { 172 | fprintf(log, "[*] Read!\\n"); 173 | } 174 | 175 | child_pid = fork(); 176 | if (child_pid < 0) { 177 | fprintf(log, "[!] Error fork\\n"); 178 | goto getout; 179 | } else { 180 | fprintf(log, "[*] Forked PID %d!\\n", child_pid); 181 | } 182 | 183 | if (child_pid == 0) { // child 184 | fprintf(log, "[+] forkserver(): this is the child\\n"); 185 | close(FORKSRV_FD); 186 | close(FORKSRV_FD + 1); 187 | forkstarted = 1; 188 | goto getout; 189 | } 190 | 191 | if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) { 192 | fprintf(log, "[!] Error writing child pid to fork server (2)\\n"); 193 | goto getout; 194 | } else { 195 | fprintf(log, "[*] Wrote child pid %d!\\n", child_pid); 196 | } 197 | 198 | fprintf(log, "[+] this is the forkserver(main) waiting for child %d\\n", child_pid); 199 | if (waitpid(child_pid, &status, 0) < 0) { 200 | fprintf(log, "[!] Error waiting for child\\n"); 201 | goto getout; 202 | } else { 203 | fprintf(log, "[*] Waitpid!\\n"); 204 | } 205 | 206 | if (write(FORKSRV_FD + 1, &status, 4) != 4) { 207 | fprintf(log, "[!] Fork server is gone before status submission, terminating\\n"); 208 | goto getout; 209 | } else { 210 | fprintf(log, "[*] wrote status %d!\\n", status); 211 | } 212 | fprintf(log, "[+] forkserver(): child is done\\n"); 213 | fflush(log); 214 | } 215 | getout: 216 | fflush(log); 217 | return; 218 | }`, { forkstarted }); 219 | 220 | /* 221 | // Check if one AFL FD is accessible 222 | var fcntl_export = Module.getExportByName(null, 'fcntl'); 223 | if (fcntl_export) { 224 | const fcntl = new NativeFunction(fcntl_export, 'int', ['int', 'int', '...']); 225 | var res = fcntl(198, 3); 226 | if (res > -1) { 227 | debug('FD 198 is readable'); 228 | } else { 229 | debug('FD 198 is NOT readable'); 230 | } 231 | } else { 232 | debug("Unable to resolve fcntl!"); 233 | } 234 | */ 235 | 236 | 237 | var getenv_export = Module.getExportByName(null, 'getenv'); 238 | if (getenv_export) { 239 | debug("[*] Found export for getenv!"); 240 | const get_env = new NativeFunction(getenv_export, 'pointer', ['pointer']); 241 | debug("[*] Prepared native function @", get_env); 242 | var shm_id = parseInt(Memory.readCString(get_env(Memory.allocUtf8String("__AFL_SHM_ID")))); 243 | debug("[*] Shared memory ID:", shm_id); 244 | 245 | var forkserver_enabled = parseInt(Memory.readCString(get_env(Memory.allocUtf8String("AFL_NO_FORKSRV")))) != 1; 246 | debug("[*] Forkserver enabled:", forkserver_enabled); 247 | 248 | var whitelist_raw = Memory.readCString(get_env(Memory.allocUtf8String("WHITELIST"))); 249 | if (whitelist_raw) { 250 | var whitelist = whitelist_raw.split(",").map(function (item) { 251 | return item.trim(); 252 | }); 253 | debug("[*] Whitelist: ", whitelist); 254 | if (whitelist.indexOf("all") > -1) { 255 | debug("[*] Covering all modules!"); 256 | instrument_all = true 257 | } 258 | } else { 259 | var whitelist = [Process.enumerateModules()[0].name]; 260 | debug("[!] WHITELIST env not available! tracking only main module", whitelist[0]); 261 | } 262 | 263 | 264 | var getpid_export = Module.getExportByName(null, 'getpid'); 265 | if (getpid_export) { 266 | getpid = new NativeFunction(getpid_export, 'int', []); 267 | debug("[*] getpid() found"); 268 | } 269 | 270 | var shmat_export = Module.getExportByName(null, 'shmat'); 271 | var shmdt_export = Module.getExportByName(null, 'shmdt'); 272 | if (shmat_export && shmdt_export) { 273 | shmat = new NativeFunction(shmat_export, 'pointer', ['int', 'pointer', 'int']); 274 | shmdt = new NativeFunction(shmdt_export, 'int', ['pointer']); 275 | if (shm_id > 0) { 276 | trace_bits = shmat(shm_id, ptr(0), 0); 277 | } 278 | debug("[*] trace_bits mapped at", trace_bits); 279 | } else { 280 | debug("[!] Unable to resolve shared memory exports!\n"); 281 | } 282 | 283 | } else { 284 | debug("[!] Unable to find export for getenv!"); 285 | } 286 | 287 | Process.enumerateThreads({ 288 | onMatch: function (thread) { 289 | Stalker.follow(thread.id, { 290 | events: { 291 | compile: true, // block compiled 292 | block: false //block executed 293 | }, 294 | onReceive: function (events) { 295 | parseEvents(events, function (event) { 296 | if (event.type === 'compile' || event.type === 'block') { 297 | var block = event; 298 | var module = Process.findModuleByAddress(block.begin); 299 | 300 | if (forkserver_enabled && forkstarted.readInt() == 0) { 301 | if (block.begin.equals(entrypoint) && have_forkserver == 0) { 302 | debug("[+] Entrypoint reached!"); 303 | var forkserver_start = new NativeFunction(forkserver_module.start, 'void', []); 304 | debug("[+] Forkserver about to start... PID", getpid(), ", flag is ", forkstarted.readInt()); 305 | have_forkserver = 1; 306 | forkserver_start(); 307 | debug("[+] Forkserver started! PID", getpid(), ", flag is ", forkstarted.readInt()); 308 | } 309 | } else { 310 | if (module && (instrument_all || whitelist.indexOf(module.name) > -1)) { 311 | //debug(event.type + ":" + module.name, block.begin); 312 | var base = ptr(module.base); 313 | //debug(block.begin + ' -> ' + block.end, "(", module.name, ":", module.base, "-", base.add(module.size), ")"); 314 | block_monitored += 1; 315 | if (!trace_bits.isNull()) { 316 | var id = block.begin >> 1; 317 | var offset = (prev_id ^ id) & 0xFFFF; 318 | var target = trace_bits.add(offset) 319 | const current_value = target.readU16() 320 | target.writeU16(current_value + 1); 321 | prev_id = id >> 1; 322 | //debug("[*] map_offset:", offset, "id:", id, "prev_id:", prev_id, ", target:", target, ", current:", current_value); 323 | } 324 | } 325 | } 326 | } 327 | }); 328 | } 329 | }); 330 | }, 331 | onComplete: function () { 332 | debug("[*] Done stalking threads"); 333 | } 334 | }); 335 | 336 | Interceptor.attach(Module.getExportByName(null, 'exit'), { 337 | onEnter: function (args) { 338 | debug("[*] Monitored", block_monitored, "blocks!"); 339 | shmdt(trace_bits); 340 | debug("[*] Shared memory unmapped!"); 341 | } 342 | }); -------------------------------------------------------------------------------- /afl.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/geeksonsecurity/frida-afl/370b6213cc31cea823f5934c1f36f1be3147ba2e/afl.png -------------------------------------------------------------------------------- /experimental/aflmock.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | #define MAP_SIZE_POW2 16 11 | #define MAP_SIZE (1 << MAP_SIZE_POW2) 12 | #define FORKSRV_FD 198 13 | 14 | int main(int argc, char *argv[]) 15 | { 16 | if (argc < 2) 17 | { 18 | printf("Usage: %s \n", argv[0]); 19 | return -1; 20 | } 21 | int shm_id = shmget(IPC_PRIVATE, MAP_SIZE, IPC_CREAT | IPC_EXCL | 0600); 22 | if (shm_id < 0) 23 | { 24 | printf("Failed to get memory %d: %s\n", shm_id, strerror(errno)); 25 | return -1; 26 | } 27 | char shm_str[1024]; 28 | sprintf(shm_str, "%d", shm_id); 29 | setenv("__AFL_SHM_ID", shm_str, 1); 30 | unsigned char *trace_bits = shmat(shm_id, NULL, 0); 31 | printf("Set shm %s mapped to %p\n", shm_str, trace_bits); 32 | 33 | if (dup2(1, FORKSRV_FD) < 0) perror("dup2() failed"); 34 | if (dup2(1, FORKSRV_FD + 1) < 0) perror("dup2() failed"); 35 | 36 | char *myargv[argc]; 37 | for (int i = 1; i < argc; i++) 38 | { 39 | myargv[i - 1] = argv[i]; 40 | } 41 | myargv[argc-1]=NULL; 42 | 43 | printf("Running %s...\n", argv[1]); 44 | int res = execv(argv[1], myargv); 45 | //char *myargv[]={"fridamock", "./checkfd"}; 46 | //int res = execv("./fridamock", myargv); 47 | //int res = system("frida --no-pause -l afl.js -- /usr/local/bin/plistutil -i ../..//Repos/recipe/ios/Runner/Info.plist"); 48 | printf("Execution result: %d\n", res); 49 | 50 | if (res != -1) 51 | { 52 | FILE *f = fopen("map.txt", "w"); 53 | for (int i = 0; i < MAP_SIZE; i++) 54 | { 55 | 56 | if (!trace_bits[i]) 57 | continue; 58 | fprintf(f, "%06u:%u\n", i, trace_bits[i]); 59 | } 60 | fclose(f); 61 | } 62 | else 63 | { 64 | printf("Failed to execute target binary!\n"); 65 | } 66 | shmdt(trace_bits); 67 | shmctl(shm_id, IPC_RMID, NULL); 68 | printf("Shared memory cleaned up!\n"); 69 | return res; 70 | } -------------------------------------------------------------------------------- /experimental/checkfd.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | #define FORKSRV_FD 198 5 | 6 | int main(void){ 7 | FILE *f = fopen("/tmp/checkfd.log", "a+"); 8 | //FILE *f = stdout; 9 | if (fcntl(FORKSRV_FD, F_GETFL) == -1 || fcntl(FORKSRV_FD + 1, F_GETFL) == -1) 10 | fprintf(f, "-- [!] AFL fork server file descriptors %d, %d are not open\n", FORKSRV_FD, FORKSRV_FD + 1); 11 | else 12 | fprintf(f, "-- [+] AFL fork server file descriptors ready!\n"); 13 | return 0; 14 | } -------------------------------------------------------------------------------- /experimental/checkfd.js: -------------------------------------------------------------------------------- 1 | const forkserver_module = new CModule(` 2 | #include 3 | 4 | #define FORKSRV_FD 198 5 | #define F_GETFL 3 /* get file status flags */ 6 | 7 | extern int fcntl(int fildes, int cmd, ...); 8 | extern int errno; 9 | 10 | void 11 | start (void) 12 | { 13 | if (fcntl(FORKSRV_FD, F_GETFL) == -1 || fcntl(FORKSRV_FD + 1, F_GETFL) == -1){ 14 | printf("[!] AFL fork server file descriptors are not open, errno %d\\n", errno); 15 | return; 16 | } 17 | printf("AFL descriptors ready!\\n"); 18 | } 19 | `); 20 | 21 | var fcntl_export = Module.getExportByName(null, 'fcntl'); 22 | if (fcntl_export) { 23 | const fcntl = new NativeFunction(fcntl_export, 'int', ['int', 'int', '...']); 24 | var res = fcntl(198, 3); 25 | if(res > -1){ 26 | console.log('FD 198 is readable'); 27 | } else { 28 | console.log('FD 198 is NOT readable'); 29 | } 30 | } else { 31 | console.log("Unable to resolve fcntl!"); 32 | } 33 | 34 | var forkserver_start = new NativeFunction(forkserver_module.start, 'void', []); 35 | forkserver_start(); -------------------------------------------------------------------------------- /experimental/checkfd.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | import fcntl 3 | 4 | FORKSRV_FD = 198 5 | 6 | with open('/tmp/fork.txt', 'a+') as fp: 7 | try: 8 | flags = fcntl.fcntl(FORKSRV_FD, fcntl.F_GETFL) 9 | fp.write('Flags: ' + str(flags) + '\n') 10 | except Exception as e: 11 | fp.write('Exception: ' + str(e) + '\n') -------------------------------------------------------------------------------- /experimental/fridamock.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | #define FORKSRV_FD 198 11 | 12 | #ifndef _POSIX_SPAWN_DISABLE_ASLR 13 | # define _POSIX_SPAWN_DISABLE_ASLR 0x0100 14 | #endif 15 | 16 | extern char **environ; 17 | 18 | int main(int argc, char* argv[]) 19 | { 20 | if(argc < 2){ 21 | printf("Usage: ./%s \n", argv[0]); 22 | return -1; 23 | } 24 | char *myargv[argc-1]; 25 | for(int i = 1; i< argc; i++){ 26 | myargv[i-1] = argv[i]; 27 | printf("- myargv[%1d]: %s\n", i-1, myargv[i-1]); 28 | } 29 | 30 | FILE *f = stdout; 31 | if (fcntl(FORKSRV_FD, F_GETFL) == -1 || fcntl(FORKSRV_FD + 1, F_GETFL) == -1) 32 | fprintf(f, "- [!] AFL fork server file descriptors %d, %d are not open\n", FORKSRV_FD, FORKSRV_FD + 1); 33 | else 34 | fprintf(f, "- [+] AFL fork server file descriptors ready!\n"); 35 | 36 | pid_t pid; 37 | posix_spawn_file_actions_t file_actions; 38 | posix_spawnattr_t attributes; 39 | sigset_t signal_mask_set; 40 | 41 | posix_spawn_file_actions_init (&file_actions); 42 | posix_spawnattr_init (&attributes); 43 | sigemptyset (&signal_mask_set); 44 | posix_spawnattr_setsigmask (&attributes, &signal_mask_set); 45 | short flags = POSIX_SPAWN_SETPGROUP | POSIX_SPAWN_SETSIGMASK | POSIX_SPAWN_START_SUSPENDED; 46 | posix_spawn_file_actions_adddup2 (&file_actions, 0, 0); 47 | posix_spawn_file_actions_adddup2 (&file_actions, 1, 1); 48 | posix_spawn_file_actions_adddup2 (&file_actions, 2, 2); 49 | flags |= _POSIX_SPAWN_DISABLE_ASLR; 50 | posix_spawnattr_setflags (&attributes, flags); 51 | 52 | printf("- posix_spawn --\n"); 53 | int status = posix_spawn(&pid, argv[1], &file_actions, &attributes, myargv, environ); 54 | if (status == 0) { 55 | printf("- Child pid: %i\n", pid); 56 | kill (pid, SIGCONT); 57 | printf("- Child resumed!\n"); 58 | if (waitpid(pid, &status, 0) != -1) { 59 | printf("- Child exited with status %i\n", status); 60 | } else { 61 | perror("waitpid"); 62 | } 63 | } else { 64 | printf("- posix_spawn: %s\n", strerror(status)); 65 | } 66 | 67 | return 0; 68 | } -------------------------------------------------------------------------------- /experimental/simple.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main(int argc, char *argv[]){ 4 | int res = 0; 5 | if(argc > 1){ 6 | res = argc; 7 | if(argc == 2){ 8 | res += 1; 9 | } else { 10 | res += argc; 11 | } 12 | } else { 13 | res = 1; 14 | } 15 | printf("[simple] %d\n", res); 16 | return res; 17 | } -------------------------------------------------------------------------------- /frida-afl.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import frida 4 | import sys 5 | import time 6 | import threading 7 | import os 8 | import fcntl 9 | 10 | FORKSRV_FD = 198 11 | 12 | from optparse import OptionParser 13 | 14 | finished = threading.Event() 15 | 16 | 17 | def on_message(message, data): 18 | print("[{}] => {}".format(message, data)) 19 | 20 | def exiting(): 21 | finished.set() 22 | print("Exiting!") 23 | 24 | def main(target_binary, entrypoint): 25 | shm_var = os.getenv("__AFL_SHM_ID") 26 | print("__AFL_SHM_ID is {}".format(shm_var)) 27 | print("Spawning {} ".format(" ".join(target_binary))) 28 | device = frida.get_local_device() 29 | pid = device.spawn(target_binary, aslr="disable") 30 | session = device.attach(pid) 31 | session.on('detached', exiting) 32 | with open('afl.js', 'r') as file: 33 | data = file.read() 34 | script = session.create_script(data, runtime='v8') 35 | script.on("message", on_message) 36 | script.load() 37 | if entrypoint: 38 | script.exports.init(entrypoint) 39 | device.resume(pid) 40 | finished.wait() 41 | 42 | 43 | if __name__ == "__main__": 44 | if len(sys.argv) < 2: 45 | print("Usage {} target".format(sys.argv[0])) 46 | sys.exit(-1) 47 | else: 48 | parser = OptionParser(usage="usage: %prog [options] target_binary args") 49 | parser.add_option("-e", "--entrypoint", dest="entrypoint", 50 | help="Specify entrypoint") 51 | (options, args) = parser.parse_args() 52 | if not options.entrypoint and not os.getenv("AFL_NO_FORKSRV"): 53 | parser.error("Entrypoint not given") 54 | 55 | main(args, options.entrypoint) 56 | -------------------------------------------------------------------------------- /scripts/clean.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | m=`ipcs -m | cut -d' ' -f2` 4 | echo $m 5 | for i in $m 6 | do 7 | echo removing shm id $i 8 | ipcrm -m $i 9 | done 10 | --------------------------------------------------------------------------------