1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
#define TARGET_MIPS
#include "../../qemu_mode/qemuafl/qemuafl/api.h"
#include <stdio.h>
#include <string.h>
#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
#define h2g(x) ((uint64_t)(x) - guest_base)
void afl_persistent_hook(struct mips_regs *regs, uint64_t guest_base,
uint8_t *input_buf, uint32_t input_buf_len) {
// In this example the register $a0 is pointing to the memory location
// of the target buffer, and the length of the input is in $a1.
// This can be seen with a debugger, e.g. gdb (and "disass main")
printf("Placing input into 0x%lx\n", regs->a0);
if (input_buf_len > 1024) input_buf_len = 1024;
memcpy(g2h(regs->a0), input_buf, input_buf_len);
regs->a1 = input_buf_len;
}
#undef g2h
#undef h2g
int afl_persistent_hook_init(void) {
// 1 for shared memory input (faster), 0 for normal input (you have to use
// read(), input_buf will be NULL)
return 1;
}
|
