2803 Commits

Author SHA1 Message Date
Romain Malmain
47120834dc
libafl_qemu: do not test slirp in ci for usermode (#2644) 2024-10-30 17:47:37 +01:00
Romain Malmain
9da113e7a8
Fix RISC-V port issues (#2642)
fix riscv{32,64} stuff
2024-10-30 14:10:50 +01:00
s1341
af06d75d3e
frida: bump version (#2640)
* frida: bump version

* frida_windows: fix
2024-10-30 12:31:40 +01:00
saibotk
83c87acd5b
libafl_qemu: Add RISCV support (#2367)
* libafl_qemu: Add RISCV support

Adds the following targets (as features):
- riscv32
- riscv64

Added `RISCVCPU` and `CPURISCVState` to the bindings allow list.

Added riscv.rs to the arch module, with all necessary functions and
registers implemented and mapped.
The registers are the same as the ones found in qemus gdbstub xml found
after a build.

Additionally we added all syscall numbers for riscv 64 bit (already
supported by the `syscall_numbers` crate) and also added the missing
ones for riscv 32 bit. We compared both lists and their differences /
equalities with a simple python script and generated a list of the
missing ones, to be complete.
We might PR those to the `syscall_numbers` crate later on.

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-10-30 10:33:03 +01:00
Dominik Maier
6eb2dafd34
Feature: Make executors and feedbacks easier to use outside of the fuzzing loop (extends #2511) (#2637)
* feat(libafl_core): make executors and feedbacks more cleanly usable outside of LibAFLs Fuzzer loop

* cargo +nightly fmt

* updated type constraints

* reformatted and final type constraint fixes

* made unicode extraction stage useful separately

* fix libafl_cc error message

* fix state type constraint to be constrained on the method

* removed unnecessary observer constraint

* renamed unused variables

* fix unnecessary error wrapping in helper functions

* converted unicode conversion stage into associated function and fixed nautilus changes

* more update

* Remove extra I

* more fmt

* bounds?

* less bounds

* more less bounds

* different trait bounds again

* more less generics

* fix unicode

* fix list

* remove unneeded bound

---------

Co-authored-by: Lukas Dresel <Lukas-Dresel@users.noreply.github.com>
Co-authored-by: Toka <tokazerkje@outlook.com>
2024-10-29 18:35:17 +01:00
Aarnav
0f744a3abb
Add Python Grammar Loader for Nautilus (#2635)
* add python grammar loader for Nautilus

* fmt

* fmt toml

* add python to macos CI deps

* install python

* fmt

* ci

* clippy

* fix workflow

* fmt

* fix baby nautilus

* fix nautilus sync

* fmt

* fmt

* clippy

* typo

* fix miri

* remove pyo3 from workspace to packages which need it and make it optional

* go back to AsRef<Path> for nautilus grammar loading

* replace hardcoded python flags for macos build

* typo

* taplo fmt

* revert formatting of libafl_qemu_arch

* ci

* typo

* remove expects in NautilusContext::from_file and make them Results

* remove not(miri) clause in test

* try and fix python build fir ios and android

* again

* android

* tmate

* fix android build

* document load_python_grammar

* log if python or json when loading nautilus grammar

* make nautilus optional

* add nautilus as feature to forkserver_simple_nautilus
2024-10-29 11:32:59 +01:00
Aarnav
58fad2befd
libafl-fuzz: separate frida build + cmplog debug (#2591)
* libafl-fuzz: separate frida build

* cmplog debug

* update

* merge AflStatsStage
move time_tracker stage to LibAFL

* mandate track_hit_feedbacks feature for AflStatsStage

* afl_stats do not hardcode TimeoutFeedback and CrashFeedback names

* typo

* typo

* fix generics order

* add verify timeouts stage

* libafl: introduce set_timeout func to dynamically set timeouts for executor
libafl-fuzz: add verify_timeout stage

* add missing set_timeout implementations

* libafl-fuzz: move set_timeout and timeout from Executor to HasTimeout

* libafl-fuzz: add removed gitignore

* remove timeout from libafl_nyx::Executor and move it to NyxHelper

* clippy

* fix HasTimeout for QemuExecutor

* libafl-fuzz: remove observer handle usage in verify_timeouts
misc: remove prelude imports

* libafl-fuzz: fix foreign_sync_dirs option

* fmt && clippy

* clippy && fmt

* missing doc

* clippy

* bruh

* damned doc build

* trait fix

* impl HasTimeout for InProcessExecutor only if std

* clippy

* fix typo

* fix nostd build

* clippy

* remove most HasTimeout implementations for now

* typo

* remove redundant import

* misc

* fmt

* simplify trait bounds

* add old AflStatsStage back and rename it to StatsStage

* fix ci

* make set_timeout and timeout of HasTimeout inline

* fmt

* add gitignore

* serde_any fix

* tmate

* misc

* remove tmate

* test

* coordinate between capture_timeout and verify_timeout

* makefile

* fix

* fix

* fmt

* increase cmplog timeout

* semantic

* debug

* debug

* remove dbeug

* only test libafl-fuzz on CI for now

* better seed for cmplog?

* remove preflight check for now

* set Input type in forkserver

* debug

* tmate

* fix capture_timeout

* revert workflow

* run only libafl-fuzz

* remove pre-flight

* re-enable fuzzers on CI

* move capture_timeouts and verify_timeouts to main lib

* run fmt

* add note for verify timeouts

* add note in verify timeouts stage

* typo

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-10-28 11:40:04 +01:00
Dominik Maier
42b306a39f
Fix LibAFL-fuzz build (#2634) 2024-10-26 02:03:22 +02:00
WorksButNotTested
03af6aaf0c
Frida scripting support (#2506)
Co-authored-by: Your Name <you@example.com>
2024-10-25 17:18:25 +02:00
Marco C.
053d125254
fix clippy redundant field names in struct initialization (#2633) 2024-10-25 16:07:34 +02:00
Marco C.
b9e6363826
Avoid using feature flags and env variable to set the same parameter pt.1 emulation_mode (#2512)
* Remove emulation_mode env variable and custom cfg

* Using only the feature flag simplifies things a bit and allow the usage of optional dependencies

* Do not use --all-features on libafl_qemu

* Add missing target_os = "linux"
2024-10-25 15:16:55 +02:00
Dominik Maier
e27ec269ce
Add TargetBytesConverter to allow Nautilus for ForkserverExecutor (#2630)
* Add TargetBytesConverter to allow Nautilus for ForkserverExecutor

* ci

* ci

* More

* fmt
2024-10-24 14:10:26 +02:00
Reverier Xu
261b6b5a52
minor: fix mutable reference warning in examples (#2631) 2024-10-24 12:25:39 +02:00
Langston Barrett
dfd5609c10
bolts: Simplify definition of nonzero! macro (#2624)
* bolts: Simplify definition of `nonzero!` macro

* Non-Usize NonZero

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-10-24 00:28:47 +02:00
Romain Malmain
d96d833760
Support on_crash & on_timeout callbacks for libafl_qemu modules (#2620)
* support (unsafe) on_crash / on_timeout callbacks for modules

* use libc types in bindgen
2024-10-21 17:59:04 +02:00
Dongjia "toka" Zhang
f0da4d15da
Fix Generator (#2627)
* no min but max

* import

* large stack arrays ?
2024-10-21 16:27:25 +02:00
Dongjia "toka" Zhang
fda1596ee2
Use nonzero! macro (#2589)
* nonzero_lit

* nonzero

* std instead of core

* a

* l

* test

* import

* api

* api

* aaaaa

* apiapi

* api

* api

* api

* mm

* api

* non zero

* FMT

* pls

* nnnaaasdfadsfafdsa

* pls

* MM

* fix

* a

* sat add

* aa

* mistake

* unreachable

* no generic

* api change

* a
2024-10-18 23:33:03 +02:00
Romain Malmain
3b31b4d796
libafl_qemu: unset thumb bit for breakpoints (#2619)
* unset thumb bit for breakpoints
2024-10-17 09:42:56 +02:00
Romain Malmain
23e966c702
Fix CI apt-get install (#2618) 2024-10-16 13:17:34 +02:00
Romain Malmain
31e31b662d
Adapt qemu linux fuzzers to latest LibAFL version (#2616) 2024-10-16 10:41:37 +02:00
Dominik Maier
4710915b61
Revert "Revert "Fix pipe I/O in forkserver"" (#2614)
* Revert "Revert "Fix pipe I/O in forkserver (#2602)" (#2612)"

This reverts commit 888c608e5e56e2df55271dab262bb0eac400a416.

* More expressive errors

* fix testcase
2024-10-15 16:31:25 +02:00
Romain Malmain
d48a7d508d
Centralize clippy lints in workspace (#2606)
* centralize clippy definition

* fmt

* add update bindings script

* add a checked and unchecked version of memory read to qemu stuff

also, a lot of clippy thing

* update binding position

* rm old script, new one is a bit better

* update doc

* macos clippy

* adapt fuzzers

* windows clippy

* fix fuzzer

* windows clippy

* remove old allowed clippy

* remove some allowed clippy

* use default features for serde_json in gramatron

* better error handler for failed rw to memory
2024-10-15 13:31:01 +02:00
Dongjia "toka" Zhang
453d733a35
Use .vscode/settings.json.default (#2615)
* .gitignore .vscode

* vscode

* vscode

* ignore
2024-10-14 15:45:17 +02:00
Dongjia "toka" Zhang
888c608e5e
Revert "Fix pipe I/O in forkserver (#2602)" (#2612)
This reverts commit ea4a281d535cce1b522ed0fb328f02b016a4b4ea.
2024-10-14 14:17:40 +02:00
Henry Chu
ea4a281d53
Fix pipe I/O in forkserver (#2602)
* Fix read_st_size in forkserver

* fixed read_st, read_st_size, and write_ctl

with read_exact and write_all

* Cleanup redundant return values in forkserver pipe I/O

* Forkserver: avoid using read_exact/write_all for reading/writing integers

* Forkserver: avoid initializing the vec twice when reading a chunk of bytes

* Fix code formatting
2024-10-14 11:49:06 +02:00
Dominik Maier
da8f17f29e
Add AFLStats to QEMU_Launcher TUI (#2611)
* Remove prelude from qemu_launcher

* QEMU_Launcher: Add stats to TUI

* More tui
2024-10-14 11:06:21 +02:00
Dominik Maier
1ad64e7ae7
Remove prelude from qemu_launcher (#2610) 2024-10-14 10:53:02 +02:00
Dominik Maier
d29b657bf4
Add LibAFL_Jumper util (#2594)
* Add jumper

* Hex Hex

* Fix hex decoding

* Cleanup readme

* Build with musl

* add mips delay slot back

* Added linker script

* More jump

* clippy

* taplo
2024-10-12 13:16:33 +02:00
Dominik Maier
cad9e2717e
Remove prelude from default features (#2608)
* Remove prelude from default features

* Prelude

* something
2024-10-12 13:16:22 +02:00
Romain Malmain
18fb6a4197
[libafl-qemu-bridge] fix rpath regex for Ubuntu (#2609) 2024-10-11 18:56:51 +02:00
Dominik Maier
66a8682c9e
Add DrCov &.rerun options to QEMU_Launcher (#2607)
* Move all target-specific code to harness.rs

* Add IfModule to LibAFL_Qemu

* More more

* Added DrCov tracing

* Add DrCov rerun to launcher

* fixes
2024-10-11 16:02:01 +02:00
Dominik Maier
2bfed2d488
Move all target-specific code to harness.rs (#2605) 2024-10-11 12:41:42 +02:00
Dominik Maier
830941ce3a
Rename LibAFL_GdiPlus to _Windows_ (#2604)
* Rename LibAFL_GdiPlus to _Windows_

* Readme more
2024-10-11 10:52:39 +02:00
Dongjia "toka" Zhang
19ccb0807c
Don't do generalization on larger inptus (#2603) 2024-10-10 16:13:08 +02:00
Henry Chu
a69cd98432
Make ASAN log dumping optional (#2600) 2024-10-10 09:44:26 +02:00
jejuisland87654
efa99ee3c9
Fix error[E0308]: mismatched types for libafl_qemu_init (#2593) 2024-10-09 17:17:51 +02:00
Romain Malmain
c03653f7be
Remove useless allocation in colorization stage (#2598)
* do not allocate here

* clippy
2024-10-09 17:16:53 +02:00
cube0x8
1e4d38d744
Fix file sync timing and prevent crash on missing SyncFromDiskMetadata (#2595)
* max_time is the current_time(); SyncFromDiskMetadata might not be in state

* using metadata_or_insert_with
2024-10-09 17:16:32 +02:00
cube0x8
2b05e0a1fd
Do not start another logger in prometheus (#2599) 2024-10-09 17:15:56 +02:00
Romain Malmain
c1ddcb2eed
Update frida to 0.14.0 (#2596)
* update frida crate to the latest version

* adapt libafl_frida to the latest version of frida
2024-10-09 11:13:43 +02:00
Dongjia "toka" Zhang
c12c6f31e2
Change fuzzbench_qemu fuzzer (#2520)
* change fuzzbench_qemu

* real test

* fix qemu crash hook

* update bindings

* fix fork executor, reduce trait bound overhead

* make EdgeModule depend on observer to get ptrs.

* do not make EdgeCoverageModule::new public

* map observer as builder call

* adapt examples with new edge coverage module builder.

* TMP: everyone is a variable length map observer

* reuse profile path script

* fix absolute paths

* remove some dependencies to make pipeline faster

* compile-time builder initialization check

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-10-08 15:18:13 +02:00
Romain Malmain
7344fdf059
Re-add drcov for both usermode and systemmode. (#2573)
* re-add drcov for both usermode and systemmode.
2024-10-07 14:20:11 +02:00
Dominik Maier
27677a6461
LibAFL_QEMU: Don't require extra_tokens. (#2576)
Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-10-07 13:39:55 +02:00
Romain Malmain
1fbb18cb99
Versioning unification, dependencies update, logging optimization (#2560)
* versioning unification: use x.y.z format everywhere

* do not compile low-level logs (< info level) by default in fuzzers

* update dependencies to the latest versions

* add members to workspace.

* use workspace for common dependencies

* add vscode native support

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2024-10-07 12:03:29 +02:00
Dominik Maier
4fc136cd1c
Rand below should take a NonZero parameter (#2519)
* Rand below should take a NonZero parameter

* More

* more

* More

* fix build

* bit of clippy

* more clippy

* more clippy

* More clippy

* More more

* more nonzero

* fix multipart

* Cleanup, more unsafe

* fix

* fix unicode

* clippy, fmt

* more

* More safer and more better

* MaxStackPow

* fix merge fails

* make random_slize_size faster

* fix

* more

* fix
2024-10-04 02:16:10 +02:00
Romain Malmain
15157e0b72
Discard no tc mm (follow-up) (#2584)
* forgot to set the flags
2024-10-03 20:26:28 +02:00
Romain Malmain
9a50868058
Discard non-new testcase events for multi-machine messages (#2583)
* discard non-new testcase events

* clippy
2024-10-03 18:46:26 +02:00
Romain Malmain
9ceb9917a5
Do not embed client exec count in testcase and objective (#2582)
* do not include exec count in testcase

* remove exec count from objective as well

* fmt
2024-10-03 16:42:11 +02:00
Marco C.
9b0eccf73b
Do not require Sized for OwnedRefMut as_ref/as_mut (#2581) 2024-10-03 13:35:00 +02:00
Romain Malmain
76d52bcf49
Addr filter update helper functions (#2575)
* add filter update helpers

* fmt
2024-10-02 14:26:46 +02:00