LibAFL_Frida: add scripting support #2506

WorksButNotTested · 2024-09-05T05:45:15Z

No description provided.

s1341 · 2024-09-05T05:46:41Z

libafl_frida/build.rs

+    xz2::read::XzDecoder,
+};
+
+fn extract() -> Result<()> {


Should this not be done in frida-rust?

Yeah. Mostly likely. Seems there is only support for the gum devkit right now, we would need to replace it (probably a crate config option) with gumjs. Since one is a superset of the other.

s1341 · 2024-09-05T05:46:53Z

libafl_frida/build.rs

+                        entry.unpack(full_name.as_path())?;
+                        found_header = true;
+                    }
+                    "libfrida-gumjs.a" => {


This doesn't take into account windows.

Nope. Nor all of the other architectures.

s1341 · 2024-09-05T05:47:36Z

libafl_frida/src/helper.rs

@@ -429,6 +439,7 @@ where
            .map(PathBuf::from)
            .collect::<Vec<_>>();
        FridaInstrumentationHelper::builder()
+            .load_script("/tmp/script.js")


This really needs to be an option.

Of course, it needs to come from the command line or similar.

s1341 · 2024-09-05T05:48:42Z

libafl_frida/src/script.rs

+    /// Create a new Script
+    pub fn load<P: AsRef<Path>>(path: P) -> Result<()> {
+        unsafe {
+            gum_init_embedded();


You should use frida-gum::Gum::obtain()

In general, all of these calls should be abstracted away by frida-rust objects.

Agreed. I didn't want to mix the two.

s1341 · 2024-09-05T05:50:06Z

libafl_frida/src/script.rs

+
+/// Callback function which can be called from the script
+#[no_mangle]
+pub extern "C" fn test_function(message: *const gchar) {


Maybe move this into the fuzzer example (or even create a new fuzzer which uses this functionality).

The idea of this was to demonstrate that the library can export a function which in turn is accessible to the user through scripting. In AFL++ frida scripting support JS can be used to configure the fuzzer too. e.g. by setting the ranges to be included/excluded in coverage, enabling ASAN etc. See here.

s1341 · 2024-09-05T05:50:21Z

libafl_frida/src/script.js

@@ -0,0 +1,13 @@
+"use strict";


Maybe move this into the fuzzer example (or even create a new fuzzer which uses this functionality).

This relates to the above. The idea is to add a namespace and API to the JS layer which the user can call to interact with libafl_frida itself. e.g. the functions exported would not be target specific.

WorksButNotTested · 2024-09-05T06:13:36Z

The addition of the -rdynamic flag to the fuzzer is a bit ugly too. But without it rust seems to drop any exported functions from crates linked as dependencies. Perhaps adding the dependency as a dynamic lib may help, but that isn't pretty either.

domenukk · 2024-09-05T17:43:06Z

libafl_frida/Cargo.toml

@@ -44,7 +44,13 @@ track_hit_feedbacks = ["libafl/track_hit_feedbacks"]
 auto-download = ["frida-gum-sys/auto-download", "frida-gum/auto-download"]

 [build-dependencies]
+anyhow = "1.0"


I think we should stick to our libafl_bolts::Error struct in LibAFL (and potentially implement more .into() cases)

domenukk · 2024-09-05T17:44:35Z

Cool stuff!

domenukk · 2024-10-16T09:58:41Z

The changes in frida-rust have landed right?

WorksButNotTested · 2024-10-16T11:37:44Z

The changes in frida-rust have landed right?

Yup. Just need to get some free time and I'll integrate them. Happy if someone else wants to do it, if people are waiting on it. The heavy lifting is done.

domenukk · 2024-10-16T12:43:51Z

No rush :)

WorksButNotTested · 2024-10-17T15:34:09Z

Running the command...

LIBAFL_DEBUG_OUTPUT=1 
./target/release/frida_fuzzer 
  -F LLVMFuzzerTestOneInput
  -H ./libpng-harness.so 
  -l ./libpng-harness.so 
  --backend quick-js 
  --script /tmp/script.js

Loading the script...

LibAfl.testFunction("TEST FUNCTION");
const bytes = new Uint8Array([0x11, 0x22, 0x33, 0x44, 0x55]);
send("SENDING", bytes);
console.log("LOGGING");

Results in the output...

LibAfl.testFunction("TEST FUNCTION");
const bytes = new Uint8Array([0x11, 0x22, 0x33, 0x44, 0x55]);
send("SENDING", bytes);
console.log("LOGGING");

domenukk · 2024-10-23T08:51:16Z

If nobody really has the time to test this atm (I don't) - should we just merge this and fix things later if they come up? cc @s1341

WorksButNotTested · 2024-10-23T13:36:55Z

Sounds good to me if you're happy.

Fine

WorksButNotTested · 2024-10-25T19:34:38Z

Thanks for the merge.

domenukk · 2024-10-25T21:04:32Z

Thanks for the scripting support ;)

Co-authored-by: Your Name <you@example.com>

s1341 previously requested changes Sep 5, 2024

View reviewed changes

domenukk reviewed Sep 5, 2024

View reviewed changes

Frida scripting support

eeb4d5f

WorksButNotTested force-pushed the script branch from ca8ba26 to eeb4d5f Compare October 17, 2024 15:31

domenukk changed the title ~~WIP - Initial scripting support~~ LibAFL_Frida: add scripting support Oct 23, 2024

domenukk enabled auto-merge (squash) October 24, 2024 12:09

domenukk merged commit 03af6aa into AFLplusplus:main Oct 25, 2024
89 of 98 checks passed

riesentoaster pushed a commit to riesentoaster/LibAFL that referenced this pull request Dec 11, 2024

Frida scripting support (AFLplusplus#2506)

b235e43

Co-authored-by: Your Name <you@example.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

LibAFL_Frida: add scripting support #2506

LibAFL_Frida: add scripting support #2506

WorksButNotTested commented Sep 5, 2024

s1341 Sep 5, 2024

WorksButNotTested Sep 5, 2024

s1341 Sep 5, 2024

WorksButNotTested Sep 5, 2024

s1341 Sep 5, 2024

WorksButNotTested Sep 5, 2024

s1341 Sep 5, 2024

s1341 Sep 5, 2024

WorksButNotTested Sep 5, 2024

s1341 Sep 5, 2024

WorksButNotTested Sep 5, 2024 •

edited

Loading

s1341 Sep 5, 2024

WorksButNotTested Sep 5, 2024

WorksButNotTested commented Sep 5, 2024

domenukk Sep 5, 2024

domenukk commented Sep 5, 2024

domenukk commented Oct 16, 2024

WorksButNotTested commented Oct 16, 2024 •

edited

Loading

domenukk commented Oct 16, 2024

WorksButNotTested commented Oct 17, 2024

domenukk commented Oct 23, 2024

WorksButNotTested commented Oct 23, 2024

WorksButNotTested commented Oct 25, 2024

domenukk commented Oct 25, 2024

LibAFL_Frida: add scripting support #2506

LibAFL_Frida: add scripting support #2506

Conversation

WorksButNotTested commented Sep 5, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

WorksButNotTested Sep 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

WorksButNotTested commented Sep 5, 2024

Choose a reason for hiding this comment

domenukk commented Sep 5, 2024

domenukk commented Oct 16, 2024

WorksButNotTested commented Oct 16, 2024 • edited Loading

domenukk commented Oct 16, 2024

WorksButNotTested commented Oct 17, 2024

domenukk commented Oct 23, 2024

WorksButNotTested commented Oct 23, 2024

WorksButNotTested commented Oct 25, 2024

domenukk commented Oct 25, 2024

WorksButNotTested Sep 5, 2024 •

edited

Loading

WorksButNotTested commented Oct 16, 2024 •

edited

Loading