172 Commits

Author SHA1 Message Date
omergreen
abfd834e98
Fix FridaInstrumentationHelper bugs caused by moving it after creation (#931)
* move Transformer out of FridaInstrumentationHelper's fields and create it dynamically instead; wrap CoverageRuntime in Pin<Arc<RefCell>>

* Update helper.rs

* run cargo fmt

* switch Arc for Rc
2022-12-06 17:46:59 +01:00
Dominik Maier
68fbfc8914
Fix Clippy (#926)
* Fix clippy

* undo comment fmt

* add unstracked nyx files to gitignore

* fix

* windows, no_std

* fix

* fix

* more

* macos

* remove doctest

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2022-12-06 00:05:42 +09:00
omergreen
c879a0a8d3
Fix frida ASAN incompatibility with mac m1 (#917)
Add MAP_JIT, and extract the writable portion of generate_instrumentation_blobs into AsanRuntime
2022-12-04 18:55:45 +01:00
Andrea Fioraldi
c2776e117a
emu::current_cpu() is now the CPU that hitted the breakpoint in fullsystem (#910)
* emu::current_cpu() is now kept after vm stop and it is the CPU that hitted the breakpoint

* clippy

* uninit

* clippy

* clippy

* clippy

* clippy

* nightly override in CI

* nightly override in CI

* components

* components

* targets

* targets

* clippy

* clippy

* clippy

* clippy

* clippy (again)

* MaybeUninit

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-11-25 11:57:08 +01:00
Langston Barrett
bc85129cd9
libafl_frida: Point to the LibAFL book from API docs (#886)
Help users find the docs!
2022-11-25 01:48:21 +01:00
omergreen
889161e55e
Fix mac m1 incompatibility for cmplog in frida mode (#914)
For some reason, Apple's aarch64 processor throws a SIGILL when encountering LDP x5, x5 (or any other repeating register). STP works, but I changed both for symmetry.
2022-11-25 01:31:22 +01:00
Dominik Maier
2011ed299b
Pthread introspection hook (extends #263) (#891)
* Add pthread_introspection_hook support on macos

See-also: #68

* Remove lazy_static

* all of apple are created equal

Co-authored-by: Fabian Freyer <fabian.freyer@physik.tu-berlin.de>
2022-11-15 18:27:48 +01:00
Dominik Maier
663a33168e
Associated types for Corpus, State (#767)
* Associated types for Corpus, State

* cleanup

* fix no_std

* drop unused clauses

* Corpus

* cleanup

* adding things

* fixed fuzzer

* remove phantom data

* python

* progress?

* more more

* oof

* wow it builds?

* python fixes, tests

* fix python fun

* black fmt for python

* clippy, added Nop things

* fixes

* fix merge

* make it compile (#836)

* doc-test fixes, prelude-b-gone for cargo-hack compat

* fixes for windows, concolic

* really fix windows, maybe

* imagine using windows

* ...

* elide I generic when used with S: State

* Elide many, many generics, but at what cost?

* progress on push

* Constraint HasCorpus, HasSolutions at trait definition

* remove unused feature

* remove unstable usage since we constrained HasCorpus at definition

* compiled, but still no type inference for MaxMapFeedback

* cleanup inprocess

* resolve some std conflicts

* simplify map

* undo unnecessary cfg specification

* fix breaking test case for CI on no-std

* fix concolic build failures

* fix macos build

* fixes for windows build

* timeout fixes for windows build

* fix pybindings issues

* fixup qemu

* fix outstanding local build issues

* maybe fix windows inprocess

* doc fixes

* unbridled fury

* de-associate State from Feedback, replace with generic as AT inference is not sufficient to derive specialisation for MapFeedback

* merge update

* refactor + speed up fuzzer builds by sharing build work

* cleanup lingering compiler errors

* lol missed one

* revert QEMU-Nyx change, not sure how I did that

* move HasInput to inputs

* HasInput => KnowsInput

* update bounds to enforce via associated types

* disentangle observers with fuzzer

* revert --target; update some fuzzers to match new API

* resolve outstanding fuzzer build blockers (that I can run on my system)

* fixes for non-linux unixes

* fix for windows

* Knows => Uses, final fixes for windows

* <guttural screaming>

* fixes for concolic

* loosen bound for frida executor so windows builds correctly

* cleanup generics for eventmanager/eventprocessor to drop observers requirement

* improve inference over fuzz_one and friends

* update migration notes

* fixes for python bindings

* fixes for generic counts in event managers

* finish migration notes

* post-merge fix

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2022-10-24 03:22:26 +02:00
Dominik Maier
e8b3d33bf4
Update dependencies, removed unused deps, CI fixes (#839)
* update clap, remove unused deps

* update grammartek

* update pyo3

* update pyo3

* undid clap update

* not changing nyx

* updated deps

* Update more deps, fixes

* not needed clippy

* fix windows

* try to enable deprecated pyproto for pyo3

* unused

* moving some things to clap4 after all

* initial move to clap 4

* fix clap

* more clap4, removed accidental file

* fixes, fmt

* fix

* all fix no play

* fix
2022-10-18 20:36:43 +02:00
expend20
bb3d6b3688
Frida Windows: calling original UnhandledExceptionFilter in the hook (#832) 2022-10-13 09:06:15 +02:00
Andrea Fioraldi
089bc49d55
Bump to 0.8.2 and update versions script (#828) 2022-10-12 14:57:08 +02:00
Dominik Maier
94f0c7f56e
Moving to named parameters in format strings (#827)
* autofix

* you're just asking for a clamping

* autofmt on linux

* fix nits

* change back nit

* unfixing as u64 for GuestAddr

* fix

* ignoring clippy for GuestAddress
2022-10-11 13:45:01 +02:00
expend20
8fa4bca2d9
Hook IsProcessorFeaturePresent to crash with STATUS_STACK_BUFFER_OVERRUN exception (#804)
* First working attempt

* formatting issues

* Safety comment

* got rid of mutex

* Pass gum as a parameter

* removed debug println

* Review comments

* review: switched back to panic
2022-10-05 22:26:19 +02:00
Dominik Maier
cc0c2f32ae
Additional errors only in test (#809) 2022-09-30 20:28:51 +02:00
Dongjia "toka" Zhang
6dc7cc2f59
bump (#799) 2022-09-25 09:41:01 +02:00
David CARLIER
0fe8192976
Enable memset_patter ASan hooks for Apple on libafl_frida (#763) 2022-09-05 01:39:17 +02:00
David CARLIER
d316591ba1
libafl_frida: ASan hook adding Apple's memset_pattern* api. (#761) 2022-09-04 03:09:05 +02:00
Dongjia Zhang
eac7307c5a
0.8.1 (#732) 2022-08-18 10:23:57 +02:00
syheliel
2504b6dae3
Add rustfmt.toml (#722)
* add `rustfmt.toml`

* format fix

Co-authored-by: syheliel <syheliel@gmail.com>
2022-08-12 02:28:32 +02:00
Dominik Maier
7d7601204f
Fixes for new clippy (#719) 2022-08-05 13:34:27 +02:00
Dongjia Zhang
376e3adfcd
Bump Frida, Capstone versions (#715)
* bump

* fix

* fix

* revert

* fix

* fmt

* fix
2022-08-01 16:53:39 +02:00
Dominik Maier
5a8bdae26f
Update requirements (#714)
* Update requirements

* more updates

* nits

* more updates

* update nix for fuzzers

* use any regex 1 instead of 1.6
2022-07-29 09:54:16 +02:00
Dongjia Zhang
ffe8dbf6af
Bump to 0.8.0 (#696)
* upd

* more
2022-07-11 21:59:11 +02:00
Dominik Maier
3a5118fc02
Moved core_affinity to bolts (#655)
* moved core_affinity to bolts crate

* clippy

* fixes

* ubuntu

* ubuntu++

* moved core_affinity to os

* fixed more imports

* fixed imports

* fixed test

* moved core_affinity out of os

* added affinity

* moved to windows crate

* fmt

* some tiny fixes

* more win

* refactoring

* win?

* win?

* clp

* upd

* more

* copy & paste & fix

* clp

* try

* fix

* more

* fix

Co-authored-by: tokatoka <tokazerkje@outlook.com>
2022-05-30 10:02:46 +02:00
Dominik Maier
bfe69aea09
Format C/Cpp code in ./scripts/fmt_all.sh (#653)
* format all (clang format 13)

* added clang-format check

* re-add missing newline

* cargo doc was missing

* more brackets

* fixed fmt workflow

* clang format

* shellcheck

* install clang-format-13

* update ubuntu for maximum clang-formattability

* yml whitespaces

* fmt

* shellcheck only for .sh

* oops path

* ignored shellcheck warning
2022-05-29 03:23:02 +02:00
Andrea Fioraldi
28edbad618
Refactor libafl Python bindings (#632)
* SerdeAny MapFeedbackState

* Fix macro syntax

* alloc

* fix

* Metadata calibrate and map feedback

* metadata feedback states

* compile

* fmt

* Register common generic types

* tests

* sugar

* no_std

* fix book

* alloc

* fix fuzzers

* fix

* fmt

* disable python bindings for libafl

* clippy

* fmt

* fixes

* fmt

* compiling python bindings

* no uaf in python observer

* working python observer, feedback and executor

* mutators

* fmt

* nits

* added autofix script

* clippy

* clippy

* more clippy

* fix

* ignore clippy for deserialization

* newlines

* nits

* fmt

* feedbacks

* generators

* methods

* feedbacks

* pyerr

* fix

* fix

* fmt

* python bindings in CI

* fix

* fix

* fix

* autofix

* clippy

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-05-25 16:56:06 +02:00
Dominik Maier
fa839bb08d
More docs and less pub types (#646)
* more docs

* nits

* fixes

* win fix

* fmt
2022-05-23 13:42:51 +02:00
Dominik Maier
c404825fb8
More clippy (#641)
* Even more libafl_frida clippy

* Eq

* addr_of_mut cleanup

* fmt
2022-05-22 13:01:55 +02:00
Dominik Maier
828ebcff39
Clippy nits & fixes (#640)
* release autofix

* fix unused backtrace

* clippy fixes

* clippy

* more clippy

* more autofix

* clippy for frida

* more clippy
2022-05-22 02:43:25 +02:00
Dongjia Zhang
5570601fea
Small refactoring of nits in #635 (#636)
* fix

* more

* fmt

* fix

* fix

* fix

* fix

* fmt

* fmt

* fix
2022-05-20 07:26:28 +02:00
Dongjia Zhang
4eba9323c5
Fix overflow in Frida mode (#635) 2022-05-17 15:06:38 +02:00
Dongjia Zhang
e7a06fb30c
Fix unsafe bracket (#594) 2022-04-05 14:24:58 +02:00
Dongjia Zhang
e77e147a74
Update Clap (#591)
* upd

* fix
2022-04-04 17:59:34 +02:00
s1341
f4c4d9044f
Use the new bolts::cli with the frida_libpng sample (#541)
* Use the new bolts::cli with the frida_libpng sample

* Fix comment and add must_use

* Fix windows

* Fix windows more

* Fix windows more, more

* Fix windows more, more, more

* Remove comma

* fmt
2022-03-01 11:25:11 +01:00
Dongjia Zhang
393afa56c8
Github workflows frida build on windows (#536)
* Update build_and_test.yml

* Update build_and_test.yml

* clippy

* clippy

* clippy
2022-02-13 05:10:17 +01:00
Dominik Maier
7dad2153e2
Clippy for Cargo (#532)
* Clippy for Cargo

* clippy fixes

* clippy fixes

* edition

* fix

* wrong self hidden

* fix

* more clippy
2022-02-11 14:34:01 +01:00
Andrea Fioraldi
63d89463a3
Improve libafl_qemu snapshots (#484)
* mprotect

* expose EnumIter

* thread safe mem snapshot

* update qemu hash

* clippy

* child helpers

* fixes

* fix build

* fix dep
2022-02-09 09:40:59 +01:00
Sagittarius-a
2bb60fb756
Fix documentation typos (#514)
* Fix typos in LibAFL doc comments

* Fix doc comment for ProgressReporter trait

* Remove unused comment

* Link ShMem by name in doc comment
2022-02-03 16:31:19 +01:00
Dongjia Zhang
3c4ec38d83
Win Fix (#513)
* win_fix

* fmt

* another fmt
2022-02-02 00:26:10 +01:00
s1341
e41b76fe31
Throw an exception on a failed new in frida ASan, instead of just returning null (#512) 2022-02-01 15:28:44 +01:00
Dongjia Zhang
fb21c4ff82
Frida Runtime Tuples (#457)
* an attempt to make runtimes into tuples

* wip

* wip

* wipp

* getter

* refactor

* fmt

* fix

* compiles

* fuzzer change

* coverage working

* asan & less unwrap() & fixes

* inst size, fmt

* build & coverage works on asan

* amd64 fix
2022-02-01 14:34:53 +01:00
Youssef
e307dfb16f
Implement backtrace observers for crash dedupe (#379)
* create stacktrace observer

* create stacktrace feedback

* post-merge fixes

* address comments

* update Cargo.toml

* fix CI issue + dynamic naming

* duplicate baby_fizzer

* update stacktrace baby_fuzzer

* force unwinding tables

* ignore test dumps

* fix stacktrace baby_fuzzer logic

* upgrade Backtrace version

* trigger observers.post_exec in crash_handler

* implement NewHashFeedbackState and update logic

* digest symbols pointers

* cleanup

* minimal output

* fix backdated EventFirer generic param

* add baby_fuzzer example with a fork executor

* duplicate baby_fuzzer_stacktrace with forkexecutor

* backtrace collection implemented

* add c app fuzzer example with a fork executor

* group backtrace baby fuzzers

* added c code baby fuzzer with inprocess executor

* remove need for static COLLECT_BACKTRACE

* moved code to stacktrace.rs + fixed bug

* add comment

* add command executor fuzzer example

* post merge cleanup

* add missing doc

* address comment

* fix nit

* clean duplicate variable in timeout handler

* fix command executor bt collection

* clean code and use StdShMem

* cleanup

* add ObserverWithHashField + rename StacktraceObserver

* rename + refactor some code

* add CommandBacktraceObserver

* update command executor

* update baby fuzzers

* simplify BacktraceSharedMemoryWrapper

* use better names + static methods

* use std feature macro on BacktraceObserver + fix bug

* use Box in HashValueWrapper to minimize variants size diff

* use copy_from_slice

* std conditional backtrace collection

* fix std import

* fix comment

* add exit_kind to observer.post_exec

* added hash trait to Input

* collect backtrace in post_exec

* add crash handlers to InProcessForkExecutor

* fix panic message

* duplicate forkserver fuzzer example

minimal example

update

* proto bt collection working

* rename CommandBacktraceExecutor to ASANBacktraceExecutor

* refactor ASANBacktraceObserver

* support for forkserver working

* update fuzzer example

* less verbosity

* Post merge fixes

* implement hash for GeneralizedInput

* update forkserver example after merge

* clippy fixes

* fix inproc test

* fixes for cargo hack --feature-powerset

* fix baby_no_std

* implement Hash for NautilusInput

* update fork executor baby fuzzer

* fix doc

* implement Hash for PacketData

* fix windows build

* fix windows no_std

* fix backtrace baby fuzzers README

* add comments

* move setup_bt_panic to constructor

* pre/post child exec hooks in Observer

* setup_child_panic_hook

* fix ObserversOwnedMap on nightly

* add backtrace fuzzers to CI checks

* fix typo

* fix relative paths in test_all_fuzzers.sh

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2022-01-31 15:58:15 +01:00
Dongjia Zhang
efb5e25411
Fix shadow bit for libafl_frida on Linux (#502) 2022-01-28 09:26:24 +01:00
Dongjia Zhang
2730515c46
Asan Fix (#490)
* fix

* fmt
2022-01-24 09:17:19 +01:00
Dongjia Zhang
03c020f4bd
Asan fix (#485) 2022-01-21 09:08:21 +01:00
Dongjia Zhang
5e1c0b96ea
Various Fixes (windows timeout race & frida options) (#482)
* race fix

* oops

* no backtrace
2022-01-20 01:32:04 +01:00
Dominik Maier
77e5965e97
Add AsSlice, AsMutSlice traits, refactor MapObservers to be iterable, and have associated types (#477)
* from warning

* fix latest clippy

* clippy fixes++

* renamed shmem parameters

* renamed map to shmem

* make forkserver executor work for any (non-system) shmem

* Mem -> ShMem

* rework windows

* fix nit

* fix symbolic

* refacctor map observers

* iterator for map observers

* removed unused ownedptr, added asslice trait to most functions

* make map entry type an associated type

* fix fuzzers

* fix docs

* typo fix

* fix windows, add try_from_slice to shmid

* missing import

* fix fuzzbench

* cleanup

* fmt

* more asslice

* fmt

* added doc link about token-level fuzzing

* cods
2022-01-19 00:02:33 +01:00
Dominik Maier
b67a7f5b60
[libafl_frida] Enabled ASan for Apple (#478) 2022-01-18 18:37:19 +01:00
Dominik Maier
ac43997950
Fixed additional new clippy lints for libafl_qemu, libafl_frida (#473)
* clippy for qemu

* getrlimit clippy
2022-01-17 16:24:40 +01:00
Dominik Maier
2dd88998bd
Clippy fixes for latest toolchain (#471)
* from warning

* fix latest clippy

* clippy fixes++

* more nits
2022-01-17 11:02:42 +01:00