44c841ffb1
* Added paging filtering. Reworked address range filtering to fit with new generic code. * Fix: renamed remaining QemuInstrumentationFilter instances. * Renamed sync breakpoint to sync exit. * Split emu in systemmode.rs / usermode.rs for specific code. EmuExitHandler implementation. * sync_backdoor.rs removal. Formatting. * Updated `bindgen` and `which`. Adapting code to work with update. * fix: reconfigure cleanly if prior configure was interrupted abruptly. * Enable sanitizers in QEMU during debug. * Added target-usable files. * Added breakpoint structure. * Adapted other files to work with ExitHandler. * Adapted existing fuzzer to work with new exit handler. * fix: use get to avoid crashes. * Updated README to indicate cargo-make should be installed. * Added QEMU internal exit handler. * Adapted qemu_systemmode example with new exit handler. * Fixed fuzzers to work with new exit handler. * Trying to fix CI (#1739) * test * dummy * dummy * Added new examples. * Forgot to add build scripts. * format * format * clang-format * python emulator adaptation. * fixed python bindings. * clippy fixes. * python bindings. * fix qemu_sugar. * fix fuzzbench. * fixed import issues. * misc fixes. * renamed crate. * Updated x86_64 stub bindings. * Fixed static naming. * binding fmt * clippy * clippy * Removed useless return statement. * removed advice to install cargo-make in individual repositories. * symcc_update (#1749) * Remove unused create_anymap_for_trait macro (fixes #1719) (#1752) * Fix `as_object` UB discussed in #1748 (#1751) * Fix as_object UB discussed in #1748 * More cleanup, more less UB * Fix fixes * Added uninit_on_shmem api * clippy * fmt * trying to fix fuzzers, libfuzzer wrapper * Add OwnedRefMit::owned constructor, libfuzzer fix * Some more fixes * Add BacktaceObserver::owned fn * fmt * more fmt * Ignore SigPipe by default (#1741) * Ignore SigPipe by default * Fix no_std * fmt * Fix incorrect imports (#1758) * Fix incorrect imports https://doc.rust-lang.org/core/simd/trait.SimdOrd.html * Fix * Try fix ci * Documentation fixes (#1761) * Documentation fixes * Fix InProcessExecutor url * Update all urls to latest * Miri ignores for M1 regex (#1762) * Enabling DrCov on Windows (#1765) * Enabling DrCov for Windows * Dedup common code in scheduler (#1702) * dedup common code in scheduler * del eco * fixing * fix * replace `Emulator::new_empty` by `Emulator::get` calls outside of `emu.rs` for safety. (#1763) * Add mute_inprocess_target fn, SimpleFdLogger::set_logger, and more (#1754) * Add mute_inprocess_target fn, SimpleFdLogger::set_logger, set_error_print_panic_hook * Trying to fix #1753 * typo * More fix * Fix test? * more testcase fixes * Fix: renamed remaining QemuInstrumentationFilter instances. * Split emu in systemmode.rs / usermode.rs for specific code. EmuExitHandler implementation. * format * format * format * Replace sync_exit with sync_backdoor. * Rework command system. * fix bad import. * format. * cargo fmt * disable af-xdp as well to avoid linking errors. * End of merging. * format. * Adaptation for usermode. * format. * injection support. * usermode fixes. format. * clippy * clippy + format * Do not unwrap emu + format. * fix: entry_point breakpoint * inital commit. * clippy * tests * clippy * adapt example * systemmode. * renaming * fmt * fix lints. * more lint fix. * even more lint fixes. * always more lint fixes. * lint fix. * allow unused qualifications for crate when it could be confusing. * Still lint fixes. * Lint fixes on generated code. * Some lint fixes. * merge continue. * renamed modules as well. * fixing merge. * systemmode compiling. * fmt * fix early emulator drop. * fmt * fix cast to c_void of the wrong object. * Added global enum for snapshot managers. Some renaming. * move things around. * WIP: generic inclusion of QEMU Executor in exit handler. * * Moved extern calls to `libafl_qemu_sys` * Replaced old `Emulator` by `Qemu` and only kept C functions wrappers * Now `Emulator` is for higher-level interactions with QEMU. Kept old functions for compatibility calling to `Qemu` functions * A direct side effect of this slit is the removal of the `IsEmuExitHandler` trait dependency added in many parts of the code. * Removed old dirty casting for `QemuExecutor` helpers and used the brand-new access to `QemuExecutorState` instead. * Minor changes to `Qemu` and `Emulator` `get` methods for cleaner getters. * Add missing `Qemu` function. * Updated `qemu_systemmode` example. * Adapted QEMU fuzzers + renaming. * Fixed python. * fix libafl_sugar with new implementation. * fix dangling RefCell. adapt new examples. TODO: merge `libafl_systemmode.*` examples. * clippy. * fix more fuzzers. * clippy. * Implement `HasInstrumentationFilter` generically. Updated `StdInstrumentationFilter` accordingly. * Renamed breakpoint functions for QEMU. `qemu.run()` handling. * Removed OnceCell / RefCell in signature. more explicit `MmapPerms` method names. * minor code refactoring * Emulator::run_handle refactoring * deprecated Emulator functions calling directly to QEMU functions. * IsSnapshotManager -> SnapshotManager * IsEmuExitHandler -> EmuExitHandler + fmt * Generic register when it makes sense. * reverted IsSnapshotManager -> SnapshotManager because of a collision. * fix syntax + clippy * fmt --------- Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com> Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: lazymio <mio@lazym.io> Co-authored-by: Bet4 <0xbet4@gmail.com> Co-authored-by: mkravchik <mkravchik@hotmail.com>
qemu_coverage
This folder contains an example fuzzer which runs each entry in the input corpus and collects the cumuative coverage data in drcov format. This fuzzer also distributes the test cases in the input corupus evenly across the selected cores.
The following architectures are supported:
- arm
- aarch64
- i386
- x86_64
- mips
- ppc
Prerequisites
sudo apt install \
gcc-arm-linux-gnueabi \
g++-arm-linux-gnueabi \
gcc-aarch64-linux-gnu \
g++-aarch64-linux-gnu \
gcc \
g++ \
gcc-mipsel-linux-gnu \
g++-mipsel-linux-gnu \
gcc-powerpc-linux-gnu \
g++-powerpc-linux-gnu
Run
Defaults to x86_64 architecture
cargo make run
cargo make <arch>