Add ability for hook and AppCall

[bjchan9an]

1. Hook (or intercept) Function Call

Currently qemuafl supports in-process fuzzing by setting AFL_QEMU_PERSISTENT_ADDR. However, it will be more flexible if we could intercept other function calls (e.g., emulate the socket recv/send). Maybe users should implement this feature by ourselves, similar to AFL's instrumentation?

2. AppCalls

Currently qemuafl supports registers settings with afl_persistent_hook() and afl_persistent_hook_init(void). However, sometimes we need actively call functions of the program under test for initializing or recovering. For example, frida allows AppCalls as follows.

const addr = Module.getExportByName(null, "target_function");
const target_fn = new NativeFunction(addr, "void", ["int", "pointer"]);

Will qemuafl supports this feature?

[andreafioraldi]

Hi, good point in general, but will not invest development time in extensibility features for qemuafl when we are already putting this effort in libafl_qemu.

[andreafioraldi]

However, feel free to contribute with a PR.