-
Notifications
You must be signed in to change notification settings - Fork 34
Open
Description
Referencing this: #23
Current working directory is just the fpicker root.
script goes a bit like this
import { Fuzzer } from "./harness/fuzzer.js"; //relative path
class VMWareFuzzer extends Fuzzer {
constructor() {
// The constructor needs to specify the address of the targeted function and a NativeFunction
// object that can later be called by the fuzzer.
// Usually you would use:
// const proc_fn_addr = Module.getExportByName(null, "proc_fn");
// However, there are cases where the symbol is not an export. We can still find it by enumerating
// all symbols and filtering for the one we're looking for.
const proc_fn_addr = Module.enumerateSymbolsSync("stuff").filter(function(o) {return o.name == "stuff";})[0].address;
//const proc_fn_addr = Module.getExportByName(null, "MKSMM_Calloc");
const proc_fn = new NativeFunction(
proc_fn_addr,
"int64", ["uint", "int64", "int64"], {
});
// The constructor needs:
// - the module name
// - the address of the targeted function
// - the NativeFunction object of the targeted function
super("process", proc_fn_addr, proc_fn);
}
// The pepare function is called once the script is loaded into the target process in case any
// preparation or state setup is required. In this case, no preparation is needed (see the bluetoothd
// example for a preparation function that does something)
prepare() {
// No preparation needed
}
// This function is called by the fuzzer with the first argument being a pointer into memory
// where the payload is stored and the second the length of the input.
fuzz(payload, len) {
this.debug_log(payload, len);
this.target_function(payload, parseInt(len));
}
}
const f = new VMWareFuzzer();
rpc.exports.fuzzer = f;Also a secondary error:
[->] error: {"type":"error","description":"TypeError: cannot read property 'address' of undefined","stack":"TypeError: cannot read property 'address' of undefined\n at VMWareFuzzer (harness.js:12)\n at <anonymous> (harness.js:41)","fileName":"harness.js","lineNumber":12,"columnNumber":1}
The module does have symbols but is they're not visual via nm. So how would I go about calling those?
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels