636 Commits

Author SHA1 Message Date
Andrea Fioraldi
1faadec106
Move win32 libs in libafl_cc and improve static lib linking (#176)
* Move win32 libs in libafl_cc and improve static lib linking

* fmt
2021-06-16 14:21:13 +02:00
Gal Tashma
8202548648
dont send was_killed to forkserver more than once (#175)
Co-authored-by: galtashma <gal.tashma@swg.local>
2021-06-15 21:58:05 +02:00
Dominik Maier
c2feddbe7c
Implemented rand::Rng for libafl::Rand as feature flag (#174)
* implemented rand::Rng for libafl::Rand as feature flag

* fixed build

* renamed macro
2021-06-15 09:30:32 +02:00
Gal Tashma
1b1060b35a
fix introspection for mutational stage (#172) 2021-06-14 14:40:36 +02:00
Toka
ad80df5bbb
compression fix (#170)
* compression fix

* use miniz_oxide

* fix Error::Compression
2021-06-14 11:06:53 +02:00
Andrea Fioraldi
2b0976132a
Generic Inmemory Fuzzer (#166)
* generic inmemory fuzzer

* Link whole archive

* fmt
2021-06-14 10:26:10 +02:00
Dominik Maier
c123872b11 more informative error message for forkserver 2021-06-10 22:19:44 +02:00
Dominik Maier
c4dd0b25b8 fmt, clippy fixes 2021-06-10 13:39:44 +02:00
Dominik Maier
0c353daee6
Single-threaded Restartable Mgr (#129) (#159)
* initial single-threaded restartable mgr

* starting rework

* created SimpleRestartingManager

* fixed win build

* moved cpu to boplts

* bringing back cpu

* no_std fixes

* no_std fixes

* removed unused variable
2021-06-10 12:43:00 +02:00
Dominik Maier
6b235472e0
Added load_initial_inputs_forced to add all inputs to a corpus (fixes #123) (#158)
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2021-06-09 14:51:48 +02:00
Andrea Fioraldi
8fa654dd61 fix generics for ShadowExecutor 2021-06-09 14:34:38 +02:00
Andrea Fioraldi
2328ac252b Merge branch 'main' of github.com:AFLplusplus/LibAFL into main 2021-06-09 14:17:54 +02:00
Andrea Fioraldi
2b16e92461 introduce ShadowTracingStage 2021-06-09 14:17:43 +02:00
OB
7abd7c8162
Cmplog instrumentation for Frida (#99)
* libafl_targets: refactor sancov trace-pc

* cmp observer

* libaf_targets: new structure to isolate sancov

* fix C warning

* combined executor

* cmp observer and feedback

* I2SRandReplace mutator

* impl CmpMap for CmpLogMap in libafl_targets

* cmplog observer

* clippy

* TracingStage

* working random cmplog mutations

* enable cmplog for libfuzzer_stb_image

* re-enable new testcase stats print

* fix update stats display

* bump 0.3.1

* clippy

* clippy

* no clippy for fuzzers/

* fix

* add cmplog runtime instrumentation

* test cmplog against value profile feature

* fix compile error

* add target arch aarch64 for is_interesting_cmplog_instruction

* add cfg target aarch64 on cmplog related code within stalker loop

* revert changes in cargo.toml

* align code with 'main' branch

* revert accidently changed Cargo.toml file

* update cmplog runtime code to work with the cmplog backend implementation

* change magic to 8 bytes

* cmplog runs with observer- no crashes

* clippy fixes

* add cmplog_runtime as feature

* set cmplog command-line argument to false by default

* setup cmplog observer and mutator correctly

* decrease emitted code opcode count

* add cmplog testing to the harness

* get rid of irrelevant changes and unused code, add comments, change
feature name to "cmplog"

* get rid of some unessecery whitespaces and new lines

* fix clippy errors

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Omree <you@example.com>
2021-06-09 14:11:43 +02:00
Andrea Fioraldi
9e9425c622 introduce ShadowExecutor 2021-06-09 12:15:08 +02:00
Dominik Maier
24beae99f7
launchers without brokers (fixes #128) (#157) 2021-06-08 15:40:32 +02:00
s1341
4271790cb5
Add unique_name() to Input. Use it to generate filename in OnDiskCorpus (#152)
* Add unique_name() to Input. Use unique_name to generate filename in OnDiskCorpus

* updated duplicate ahash

* nostd fixes

* fmt

* rename unique_name to generate_name

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-06-08 09:54:38 +02:00
Dominik Maier
36b823548a
nightly clippy fixes (#155)
* nightly clippy fixes

* more niglty clippy fixes

* added Safety section

* no_std fixes

* final fixes
2021-06-07 12:30:56 +02:00
Dominik Maier
35e655ca04
LLMP Changes (#130)
* llmp_changes

* fixed send

* no_std fixes
2021-06-07 02:15:31 +02:00
Dominik Maier
392ffd33f7
Fix client_id for outgoing messages (#154)
* attaching client_id to outgoing messages

* fixed forwarding, example
2021-06-07 01:48:52 +02:00
Dominik Maier
3b2ee4bb70
Added MacOS CI (#131)
* added macos ci

* running tests on macos

* some macos fixes

* fmt

* some must_use infos

* trying' to fix MacOs testcases

* no main in test

* fixed MacOS testcases

* tried to fix build errors

* unified shmem_limits

* Revert "unified shmem_limits"

This reverts commit 8c6bb8d6a2cec71d72bb181b5b491737a771298e.

* hopefully fixed macos testcase

* removed unneeded values
2021-06-07 01:24:41 +02:00
Douman
11771c3323
Bump xxhash-rust minimal version to fixed one (#153)
* Bump minimal xxhash_rust version to 0.8.2

Note that 0.8.1 bug doesn't affect current usage, but still do it just in case

* Do not use const xxh3 not in cosnt context
2021-06-06 23:54:16 +02:00
s1341
636194de0e
Frida switch from walk-proc-maps to frida-gum based extraction of ranges (#149)
* Bump frida-gum version

* Move from walk of /proc/pid/maps to frida based range/module locatoin
2021-06-06 10:40:07 +02:00
Gal Tashma
156ed08905
Eager and Fast FeedbackTuple Implementations (#144)
* Introduce eager and fast feedback_or! implementations (issue #135)

* rename FeedbackTuple to CombinedFeedback (as it is a struct not tuple) and add fast/eager AND
2021-06-04 14:07:02 +02:00
Andrea Fioraldi
42997dbde9 Fix #147 2021-06-04 14:03:31 +02:00
Mrmaxmeier
de933fee63
check each feature in CI and fix introspection on no_std (#143)
* ci: check every feature with cargo-hack

* fix introspection on no_std

* ci: the dev branch is not a thing anymore

* ci: run tests with --all-features
2021-06-01 18:03:26 +02:00
Gal Tashma
ad9a2faaea
don't panick on time subtraction failure (#141)
On some machines, the system clock can be faulty and start_time maybe
actually be after the end time. This causes a panic, instead gracefully
just put a None time in `self.last_runtime`
2021-06-01 18:02:27 +02:00
Mrmaxmeier
1b755036ad
remove unnecessary generics on RandGenerators (#142) 2021-06-01 17:26:36 +02:00
Toka
c90604f123
TimeoutForkserverExecutor fix (#140)
* fix the call to kill

* fix
2021-05-31 19:31:32 +02:00
Toka
e4b3cc542a
Forkserver_simple uses TimeoutForkserverExecutor (#139)
* forkserver_simple uses TimeoutforkserverExecutor

* fmt

* from_millis
2021-05-31 15:44:56 +02:00
Toka
e68eaf8244
Timeout forkserver (#136)
* barebones for TimeoutForkserverExecutor

* TimeoutForkserverExecutor

* update pid in forkserverexecutor

* clppy and other small fixes

* doc

* fix

* no unwrap

* read_exact and error handling

* fix

* semicolon
2021-05-30 23:11:10 +02:00
David CARLIER
e61f80584e
FreeBSD build fix proposal. (#137)
rlim_t is signed in this platform.
2021-05-29 00:31:04 +02:00
Dominik Maier
81ccf7f7d8 some macos fixes 2021-05-26 13:58:12 +02:00
Toka
5d44846c27
Improve TimeoutExecutor (#126)
* improve TimeoutExecutor

* fix for windows build
2021-05-25 22:20:52 +02:00
Andrea Fioraldi
a0804fd24d
Decouple llmp broker from manager (#125)
* decouple broker from manager

* fix no_std

* fix win build
2021-05-25 18:00:27 +02:00
Andrea Fioraldi
46716e8090
Remove executor hooks (#124)
* remove HasExecHooks from Executor

* adapt the frida executor

* adapt frida and avoid recursive type infearence

* fix win build
2021-05-25 15:19:10 +02:00
s1341
3a21ad59a4
Hook using frida gum interceptor instead of gothook (#112)
* Move from gothook to frida-based hooks

* Force link against libc++

* Clippy + cleanup prints

* exclude ranges

* Add back guard pages; Implement libc hooks

* Bump frida-rust version

* Add hooks for mmap/munmap, as per issue #105

* Refactor to get rid of global allocator singleton

* Cleanup imports; Fix free out-of-range; Move to fixed addresses for asan allocatoins

* use frida-rust from crates.io now that it has caught up

* cargo fmt

* Clippy fixes

* Better clippy fix

* More clippy fix

* Formatting

* Review changes
2021-05-25 13:45:06 +02:00
Toka
d4410c072a
ForkserverExecutor (#111)
* add Forkserver, Pipe Outfile struct

* add forkserver executor struct, and shmem init

* close pipes in the destructor of Forkserver

* fill pre_exec to write out the inputs

* fix

* read_st, write_ctl

* more handshakes

* wrap Pipe in Arc, fill post_exec

* add Forkserver, Pipe Outfile struct

* add forkserver executor struct, and shmem init

* close pipes in the destructor of Forkserver

* fill pre_exec to write out the inputs

* fix

* read_st, write_ctl

* more handshakes

* wrap Pipe in Arc, fill post_exec

* fix for the lastest HasExecHooks trait

* use Dominik's pipe, remove Arc and temporarily pass RawFd to setstdin but trying to figure out other solutions

* add libafl_tests, put a very simple vulnerable program

* fix

* added forkserver_simple (mostly copy-pasted from babyfuzzer)

* fix test

* handle crash in post_exec

* add README.md

* check exec time to see why it's so slow

* remove double invokation of is_interesting for the obejctive

* make forkserver_simple AFL-like and improve speed

* some debugging help

* do not evaluate feedback if solution

* speedup the things

* working input placement via stdin in Forkserver

* don't call panic! but return errors, rewrite some comments

* use AFLplusplus/afl-cc instead of AFL

* use .cur_input like AFL

* bring the test for forkserver back

* add better README.md message

* failing the initial handshake should return an error

* delete some commented-out code

* format

* format

* ForkserverExecutor needs std and is unix-only for now

* clippy

* OutFile error handling

* fmt

* clippy

* don't build libafl_tests on windows

* fix

* keep test in forkserver.rs simple

* add forkserver_test feature for libafl_tests

* format

* some doc

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2021-05-25 13:40:00 +02:00
Max Ammann
1089c93577
Make load_initial_inputs work for arbitrary inputs (#121) 2021-05-24 14:03:32 +02:00
Max Ammann
9569e24a06
Remove unused HasRand to avoid confusion with libafl::state::HasRand (#120) 2021-05-24 13:54:51 +02:00
Evan Richter
e65a2f9550
new Rand method: choose. fixes #117 (#118)
The choose method takes an ExactSizeIterator and returns a randomly
chosen item from it. Using this method prevents chosing items with an
incorrect upper_bound on the index.

Various macros help with defining and implementing repetitive mutation
strategies.
2021-05-22 11:51:24 +02:00
Andrea Fioraldi
cbec59bea8 fuzzers: re-enable LTO on release build for missing fuzzers 2021-05-21 17:52:23 +02:00
Andrea Fioraldi
3809a85df3 libafl: MultiStats UI padding 2021-05-21 17:47:48 +02:00
Andrea Fioraldi
349cc7b886 libafl: make clippy happy 2021-05-21 16:22:38 +02:00
Andrea Fioraldi
35181ec95b format 2021-05-21 16:00:06 +02:00
Andrea Fioraldi
dd6f6fa03a libafl: asserts in MapFeedback::is_interesting to hint the compiler 2021-05-21 15:42:28 +02:00
Andrea Fioraldi
f506b3722e libafl: Introduce ConstMapObserver using const generics 2021-05-21 15:39:32 +02:00
s1341
533a93ddd6
Various frida/ashmem fixes (#116)
* Fix incorrect encoding of and imm: use a register for now

* Fix assumption regarding length of ashmem clients list

* Make harness less chatty

* Fix refcounting in the ashmem server

* Always work around the frida allocate-near bug, not just when doing asan.

* Add support for ashmem on devices which have a boot secret, but don't use it

* Formatting
2021-05-21 13:34:35 +02:00
Max Ammann
bfbaa7ae83
Make InProcessExecutor use a plain Input instead of bytes (#115)
* Make InProcessExecutor use a plain Input instead of bytes

* Use HasTargetBytes and fix CI
2021-05-20 17:57:31 +02:00
Andrea Fioraldi
2f54e9dc01
UserStats (#114)
* MultiStats

* custom event in MapFeedback

* fix introspection

* fix windows

* clippy

* fix nostd

* bump to 0.3.2
2021-05-20 16:49:12 +02:00