Andrea Fioraldi andreafioraldi
andreafioraldi
/ libfuzzer_afl_driver.cpp
Created
March 6, 2020 19:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| //===- afl_driver.cpp - a glue between AFL and libFuzzer --------*- C++ -* ===// | |
| // | |
| // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. | |
| // See https://llvm.org/LICENSE.txt for license information. | |
| // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception | |
| //===----------------------------------------------------------------------===// | |
| /* This file allows to fuzz libFuzzer-style target functions | |
| (LLVMFuzzerTestOneInput) with AFL using AFL's persistent (in-process) mode. |
andreafioraldi
/ peb_defs.h
Last active
February 7, 2020 13:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // ----------------------------------------------------- | |
| // Common definitions outside Ghidra | |
| // ----------------------------------------------------- | |
| typedef unsigned char byte; | |
| typedef long long longlong; | |
| typedef unsigned char uchar; | |
| typedef unsigned int uint; | |
| typedef unsigned long ulong; |
andreafioraldi
/ libxml2_harness.js
Created
December 19, 2019 15:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| var fuzz = require("./frida-fuzzer/fuzz"); | |
| fuzz.target_module = "libxml2.so.2"; | |
| /* Load libdislocator and hook the PLT of the target module. DO NOT hook the | |
| symbols in libc otherwise Frida itself will use the dislocator malloc | |
| and freeze your machine (problably there are memory leaks in the runtime) */ | |
| var subs = ["malloc", "calloc", "realloc", "free", "memalign", "posix_memalign"]; | |
| var disloc = Module.load("/home/andrea/AFLplusplus/libdislocator.so"); |
andreafioraldi
/ asov_cheatshit_singlefile.txt
Last active
February 22, 2024 07:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ___ ____ ______ __ | |
| / | / __ \/ ___/ | / / | |
| / /| |/ / / /\__ \| | / / | |
| / ___ / /_/ /___/ /| |/ / | |
| /_/__||||||_//____/ |___/__ _____ __ _ __ | |
| / ____/ /_ ___ _____/ /_/ ___// /_ (_) /_ | |
| / / / __ \/ _ \/ ___/ __/\__ \/ __ \/ / __/ | |
| / /___/ / / / __/ /__/ /_ ___/ / / / / / /_ | |
| \____/_/ /_/\___/\___/\__//____/_/ /_/_/\__/ |
andreafioraldi
/ a.js
Created
December 10, 2019 22:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| var STALKER_QUEUE_CAP = 100000000; | |
| var STALKER_QUEUE_DRAIN_INT = 1000*1000; | |
| Stalker.trustThreshold = 0; | |
| Stalker.queueCapacity = STALKER_QUEUE_CAP; | |
| Stalker.queueDrainInterval = STALKER_QUEUE_DRAIN_INT; | |
| var TARGET_MODULE = "libnative-lib.so"; | |
| var TARGET_FUNCTION = Module.findExportByName(TARGET_MODULE, "target_func"); |
andreafioraldi
/ afl_frida_gum_test.c
Last active
November 14, 2019 19:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /* | |
| * Compile with: | |
| * | |
| * gcc -static-libgcc -fPIC -shared -m64 -ffunction-sections -fdata-sections -Wall -Os -pipe -g3 afl_frida_gum_test.c -I . -o afl-frida-gum.so -L. -lfrida-gum -lresolv -ldl -lrt -lm -Wl,--gc-sections,-z,noexecstack -pthread | |
| */ | |
| #include "frida-gum.h" | |
| #include <fcntl.h> | |
| #include <unistd.h> |
andreafioraldi
/ afl_stalker.js
Created
November 14, 2019 09:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| function startAFLFollow() { | |
| Stalker.follow(Process.getCurrentThreadId(), { | |
| events: { | |
| call: false, | |
| ret: false, | |
| exec: false, | |
| block: false, | |
| compile: true | |
| }, |
andreafioraldi
/ neg_syscall_feedback.diff
Last active
October 23, 2019 19:07
An example of a domain-specific custom coverage for AFL++ QEMU mode. This patch provide a feedback for the fuzzer when the return value of a syscall is negative (so an error happened)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff --git a/linux-user/i386/cpu_loop.c b/linux-user/i386/cpu_loop.c | |
| index 51cfa006..510e4cbf 100644 | |
| --- a/linux-user/i386/cpu_loop.c | |
| +++ b/linux-user/i386/cpu_loop.c | |
| @@ -80,6 +80,8 @@ static void set_idt(int n, unsigned int dpl) | |
| } | |
| #endif | |
| +#include "../patches/afl-qemu-common.h" | |
| + |
andreafioraldi
/ neg_int_feedback.diff
Last active
October 23, 2019 19:05
An example of a domain-specific custom coverage for AFL++ QEMU mode. This patch hooks functions calls and give feedbacks to the fuzzer if an argument of the function (the first 4 are considered in this naive example) is not a pointer and is a negative integer (can be both a 32 bit negative or a 64 bit negative).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff --git a/accel/tcg/tcg-runtime.c b/accel/tcg/tcg-runtime.c | |
| index d0d44844..d10d51ce 100644 | |
| --- a/accel/tcg/tcg-runtime.c | |
| +++ b/accel/tcg/tcg-runtime.c | |
| @@ -167,3 +167,29 @@ void HELPER(exit_atomic)(CPUArchState *env) | |
| { | |
| cpu_loop_exit_atomic(ENV_GET_CPU(env), GETPC()); | |
| } | |
| + | |
| + |
andreafioraldi
/ dmg2img vfdecrypt command injection
Created
August 27, 2019 08:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| This: | |
| if (*cmd && *inFile) { | |
| sprintf(cmd, | |
| "strings %s | grep '^[0-9a-fA-F]*$' | awk '{ if (length($1) == 72) print; }'", | |
| inFile); | |
| system(cmd); | |
| exit(0); | |
| } |