Persistent mode return address patch not work correctly in ARM Thumb

Question

Persistent mode return address patch not work correctly in ARM Thumb

SimonTheCoder opened this issue 4 years ago · comments

According to the "README.persistent.md", running qemuafl in persistent mode, return address will be patched to AFL_QEMU_PERSISTENT_ADDR after a iteration.
If the CPU is in ARM Thumb mode, this will cause "qemu: uncaught target signal 4 (Illegal instruction) " exception,
because of the jump address must be (address | 0x1) in ARM Thumb mode.
When CPU jump to patched address, it will return to ARM mode but running Thumb code, then cause a illegal ins exception.
It seems AFL_QEMU_TARGET_ARM_SNIPPET in qemuafl/target/arm/translate.c has something to do with this issue.
Sorry for my bad English.

Best wishes.

Andrea Fioraldi · Answer 1 · Mon Feb 01 2021 04:49:08 GMT+0800 (China Standard Time)

Hi, can you checkout the dev branch of AFL++ and try again now?

Andrea Fioraldi · Answer 2 · Mon Feb 01 2021 05:00:00 GMT+0800 (China Standard Time)

(ofc you have to build again qemu mode)

Simon Shi · Answer 3 · Mon Feb 01 2021 09:32:40 GMT+0800 (China Standard Time)

Hi.
It's working great! Thank you very much.