afl_stalker.js

function startAFLFollow() {
  Stalker.follow(Process.getCurrentThreadId(), {
    events: {
      call: false,
      ret: false,
      exec: false,
      block: false,
      compile: true
    },

    const cm = new CModule(`
    
      #include <gum/gumstalker.h>
      #include <stdint.h>
      
      static void on_ret (GumCpuContext * cpu_context,
          gpointer user_data);
      
      void
      transform (GumStalkerIterator * iterator, GumStalkerWriter * output,
                 gpointer user_data)
      {
        cs_insn * insn;
        
        gum_stalker_iterator_put_callout (iterator, afl_maybe_log, NULL, NULL);
      
        while (gum_stalker_iterator_next (iterator, &insn))
          gum_stalker_iterator_keep (iterator);
        
      }
      
      static __thread uintptr_t prev_loc;
      
      static void
      afl_maybe_log (GumCpuContext * cpu_context, gpointer user_data)
      {
        uintptr_t cur_loc = cpu_context->pc;
        uint8_t * afl_area_ptr = user_data;
        
        cur_loc  = (cur_loc >> 4) ^ (cur_loc << 8);
        cur_loc &= MAP_SIZE - 1;

        afl_area_ptr[cur_loc ^ prev_loc]++;
        prev_loc = cur_loc >> 1;
      }

    `);

    transform: cm.transform,
    user_data: /* afl_area_ptr allocated with Memory.alloc */

  });
}