libafl-frida stalker miss many blocks?

[icepng]

I try to fuzz android library based libafl-frida. I write a harness library which uses dlopen to load the target library.

When fuzzing, I use frida to hook one of the functions in target library, and it was hit. However, I print all block addresses in stalker transformer , the addresses in that function are not found.

I try to use javascript interface of stalker based frida-server, and everything seems good. I guessed it's the problem of frida-gum of rust. Anyone encounters the same problem?

[s1341]

Did you specify that the target library be instrumented using the ‘-l’ flag?

[icepng]

I use the -l flag. I found some functions in target library were hit.

[tokatoka]

do you have a minimal PoC so that we can reproduce?

[icepng]

I test it in samsung phone, the target library needed some libs of the samsung phone. And I found it's not the problem of libafl. The problem is the achievement of frida stalker exclude function (frida-gum), I didn't know the reason why the stalker exclude works fail on my target, and i solved it by commenting on it, and this problem also exists in afl++ frida mode.

[tokatoka]

thanks for the info so you mean these lines?

        for range in ranges.gaps(&(0..usize::MAX)) {
            println!("excluding range: {:x}-{:x}", range.start, range.end);
            stalker.exclude(&MemoryRange::new(
                NativePointer(range.start as *mut c_void),
                range.end - range.start,
            ));
        }

[icepng]

thanks for the info so you mean these lines?

        for range in ranges.gaps(&(0..usize::MAX)) {
            println!("excluding range: {:x}-{:x}", range.start, range.end);
            stalker.exclude(&MemoryRange::new(
                NativePointer(range.start as *mut c_void),
                range.end - range.start,
            ));
        }

Sure, I comment stalker.exclude

[tokatoka]

so it's not our issue, then I'll close this

[s1341]

This is the result of leaving out some -l arguments. There must be a clear line of execution from every function you want stalked back to the entry point. This is is because of how frida-stalker works.