alephsecurity/research

Transplant afl++ qemu-mode to Android emulator

Opened this issue · 0 comments

thx for your sharing about how to transplant afl++ qemu-mode to Android aarch64,

I am trying to transplant it to Android x86_64 emulator ,at last when i exeute ./build_qemu_support.sh to build afl-qemu-trace ,it seems something went wrong:
983/989] Compiling C object libqemu-x86_64-linux-user.fa.p/target_i386_tcg_translate.c.o
[984/989] Linking target qemu-x86_64
FAILED: qemu-x86_64
/home/git/dev/AndroidSdk/ndk/23.1.7779620/toolchains/llvm/prebuilt/linux-x86_64/bin/x86_64-linux-android30-clang++ -o qemu-x86_64 libcommon.fa.p/cpus-common.c.o libcommon.fa.p/hw_core_cpu.c.o libcommon.fa.p/accel_accel-user.c.o libcommon.fa.p/disas_capstone.c.o libcommon.fa.p/disas_i386.c.o libqemu-x86_64-linux-user.fa.p/linux-user_x86_64_signal.c.o libqemu-x86_64-linux-user.fa.p/linux-user_x86_64_cpu_loop.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_smm_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_cc_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_kvm_kvm-stub.c.o libqemu-x86_64-linux-user.fa.p/target_i386_gdbstub.c.o libqemu-x86_64-linux-user.fa.p/target_i386_sev-stub.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_mpx_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_xsave_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_cpu-dump.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_translate.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_excp_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_fpu_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_cpu.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_misc_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_tcg-cpu.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_seg_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_mem_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_int_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_svm_helper.c.o libqemu-x86_64-linux-user.fa.p/target_i386_tcg_bpt_helper.c.o libqemu-x86_64-linux-user.fa.p/accel_tcg_cpu-exec-common.c.o libqemu-x86_64-linux-user.fa.p/accel_accel-common.c.o libqemu-x86_64-linux-user.fa.p/accel_tcg_tcg-runtime-gvec.c.o libqemu-x86_64-linux-user.fa.p/linux-user_main.c.o libqemu-x86_64-linux-user.fa.p/gdbstub.c.o libqemu-x86_64-linux-user.fa.p/accel_tcg_tcg-all.c.o libqemu-x86_64-linux-user.fa.p/thunk.c.o libqemu-x86_64-linux-user.fa.p/linux-user_exit.c.o libqemu-x86_64-linux-user.fa.p/accel_tcg_user-exec-stub.c.o libqemu-x86_64-linux-user.fa.p/accel_stubs_hax-stub.c.o libqemu-x86_64-linux-user.fa.p/accel_tcg_cpu-exec.c.o libqemu-x86_64-linux-user.fa.p/accel_tcg_user-exec.c.o libqemu-x86_64-linux-user.fa.p/accel_stubs_xen-stub.c.o libqemu-x86_64-linux-user.fa.p/tcg_tcg-op.c.o libqemu-x86_64-linux-user.fa.p/trace_control-target.c.o libqemu-x86_64-linux-user.fa.p/linux-user_strace.c.o libqemu-x86_64-linux-user.fa.p/tcg_tcg.c.o libqemu-x86_64-linux-user.fa.p/disas.c.o libqemu-x86_64-linux-user.fa.p/accel_tcg_translator.c.o libqemu-x86_64-linux-user.fa.p/linux-user_uname.c.o libqemu-x86_64-linux-user.fa.p/exec-vary.c.o libqemu-x86_64-linux-user.fa.p/linux-user_elfload.c.o libqemu-x86_64-linux-user.fa.p/tcg_tcg-op-gvec.c.o libqemu-x86_64-linux-user.fa.p/accel_tcg_tcg-runtime.c.o libqemu-x86_64-linux-user.fa.p/accel_stubs_kvm-stub.c.o libqemu-x86_64-linux-user.fa.p/linux-user_safe-syscall.S.o libqemu-x86_64-linux-user.fa.p/cpu.c.o libqemu-x86_64-linux-user.fa.p/linux-user_signal.c.o libqemu-x86_64-linux-user.fa.p/tcg_tcg-op-vec.c.o libqemu-x86_64-linux-user.fa.p/linux-user_linuxload.c.o libqemu-x86_64-linux-user.fa.p/tcg_optimize.c.o libqemu-x86_64-linux-user.fa.p/linux-user_uaccess.c.o libqemu-x86_64-linux-user.fa.p/fpu_softfloat.c.o libqemu-x86_64-linux-user.fa.p/accel_tcg_translate-all.c.o libqemu-x86_64-linux-user.fa.p/linux-user_fd-trans.c.o libqemu-x86_64-linux-user.fa.p/tcg_tcg-common.c.o libqemu-x86_64-linux-user.fa.p/linux-user_mmap.c.o libqemu-x86_64-linux-user.fa.p/linux-user_syscall.c.o libqemu-x86_64-linux-user.fa.p/meson-generated_..x86_64-linux-user-gdbstub-xml.c.o libqemu-x86_64-linux-user.fa.p/meson-generated..trace_generated-helpers.c.o -Wl,--as-needed -Wl,--no-undefined -pie -Wl,--whole-archive libqom.fa libhwcore.fa -Wl,--no-whole-archive -Wl,-z,relro -Wl,-z,now -m64 -Wl,--start-group -ldl libcapstone.a libqemuutil.a libqom.fa libhwcore.fa -pthread -lm -L/home/k/git/android-12.0.0_r16-modify/AFLplusplus/qemu_mode/build_android/lib -lgthread-2.0 -lglib-2.0 -lintl '-Wl,-rpath,$ORIGIN/' -Wl,-rpath-link,/home/git/android-12.0.0_r16-modify/AFLplusplus/qemu_mode/qemuafl/build/ -lstdc++ -Wl,--end-group
ld: error: undefined symbol: arch_prctl
/>>> referenced by tcg.c
/>>> libqemu-x86_64-linux-user.fa.p/tcg_tcg.c.o:(tcg_prologue_init)
clang-12: error: linker command failed with exit code 1 (use -v to see invocation)
[985/989] Compiling C object tests/fp/fp-test.p/berkeley-testfloat-3_source_slowfloat.c.o
[986/989] Compiling C object tests/fp/fp-test.p/..
..fpu_softfloat.c.o
[987/989] Compiling C object tests/fp/fp-bench.p/..
.._fpu_softfloat.c.o
ninja: build stopped: subcommand failed.
make[1]: *** [Makefile:152: run-ninja] Error 1
make[1]: Leaving directory '/home/git/android-12.0.0_r16-modify/AFLplusplus/qemu_mode/qemuafl/build'
make: *** [GNUmakefile:11: all] Error 2

could you help me solve this issuse? it seems that arch_prctl system call need to be fixed