* remove libafl_tests
* fmt
* fix
* fix
* fix
* first
* width
* start working on runtime side
* experimental c code for generate_shadow_check_function
* generate shadow_check_blob
* add
* debuggin
* fix
* passes assert tests
* cargo fmt
* generate_shadow_check_blob, untested
* save flags
* add
* make registers numbers a const
* register frames?
* comment
* debugging memcpy
* fix a bug, more to come
* finally error removed
* finally working function hooking & clean up
* fix for arm & update stub
* fix
* blob
* blob_check_mem works? (at least no errors) & fmt
* add an link to show how the asm code are generated
* put probe code for aarch64 back & clippy
* fmt
* still blob emitting errors
* fmt
* now that blob works?
* stack alignment
* testing speed with hook_function only
* comment some printlns out
* small fix: ignore rep, jmp to current_report_impl iff blob_check_mems are emitted
* make rip accessible by pc()
* Program counter accessors for both arch
* fmt
* fix
* fix offset
* retrieve accessed memory addr, r/w rip
* inspect the fault triggering instruction
* AsanError Classification
* clippy fixes
* pass basereg/indexreg/disp to AsanErros
* update asanerrors for amd64
* clippy
* fmt
* use frida/frida-rust
* just use 44
* fix debug build
* fix
* fix
* crate.io
* change
* fmt
* Fix incorrect encoding of and imm: use a register for now
* Fix assumption regarding length of ashmem clients list
* Make harness less chatty
* Fix refcounting in the ashmem server
* Always work around the frida allocate-near bug, not just when doing asan.
* Add support for ashmem on devices which have a boot secret, but don't use it
* Formatting
* frida_asan: Implemented initial asan runtime library
* frida_asan: Switch to hashbrown
* Implemented GOT-based hooking to isolate the hooking of the memory functions. Implemented initial ASAN instrumentation
* WIP: Shadowing all used memory. Currently tracking pages using a BTreeSet. Slow AF!
* Add SigTrap to unix_signals and inprocess
* Working frida-asan, almost no speed degradation.
Currently the shadow check is reversed, so it checks only that the shadow is not 0.
We need to implement sub-8-byte checking.
* Format
* Cleanup and formatting
* Sub-qword and 16-byte checks implemented; Fixed unaligned access to QWORD
* Pass the ucontext_t to signal handlers. Initial regdump on crash
* Fix typo
* Make the context argument a mut ref
* Add missing files; Implement initial reporting
* Refactor out gothook; Move safety checkers to dynasm
* Get rid of const assembly blobs no longer needed
* Move to a handler function instead of using SIGTRAP.
This bloats the transformed code, but doesn't seem to have a major impact on performance.
Also, implemented pretty backtraces and assembly output.
* Formatting
* Get rid of all the pinning crap I wasted my day on, We don't need it
* windows fixes
* ashmem
* ashmem_service: server side ready
* ashmem_service: client side ready. Ready for integration
* ashmem_service: changes to UnixShMem to make it 'threadable'
* ashmem_service: format
* ashmem_service: Undo changes to UnixShMem, make the thread own the AshmemService instead; Fix protocol bug
* ashmem_service: working ashmem service. Fix merge issues
* use the newly released capston e 0.8.0; Fix a nasty bug where the afl_area an pc_pointer were reversed. Changed Vectors to Boxed [u8]
* Implement type detection for reporting; Implement double-free/unallocated free checking
* fmt
* Cleanup code a little
* frida-asan: This is an omnibus commit. Should probably have been a bunch of small commits, but I don't have the time/patience.
- Implemented DrCov support in order to debug a failing harness. This is actually
generic and should be moved out of libafl_frida.
- Implemented LIBAFL_FRIDA_OPTIONS env var to pass options to the frida helper,
to dynamically enable/disable asan and drcov.
- Implemented memory reuse - after each test case the used pages are recycled and
can be reused in the next test case.
- Implemented and tested vectorized instruction instrumentation.
- Implemented not instrumenting atomic load/store instructions. The cost of
trying to emulate their behaviour is too high at the moment.
- Implemented probing of shadow bit to determine the best match for the current
system.
- Implemented shadow memory pre-mapping where it is available. We probe for this
too.
- Implemented ability to specify a list of modules to instrument on the command
line. This allows fine-grained control of which modules are instrumented for
coverage/asan/drcov.
- Implemented unpoisoning of the Input target_bytes in a pre_exec hook.
- Added support for zero-sized allocations. We return 0x10 bytes at the moment.
- Added all known operator new/delete functions to hooks.
- Added workaround for frida_gum_allocate_near bug.
- Cleaned up reporting, added reporting for different error types.
* frida-asan: Implement leak detection
* Fix merge issues
* Rebased on dev to get llmp/shmem changes; Clippy fixes
* Add FridaOptions struct
* Add the Custom ExitKind; Get rid of Clone/PartialEq on ExitKind
* Make it possible to recover from an ASAN error
* Add SIGTRAP to crashing signals
* Add back (conditional) crashing on Asan errors.
* Fix too-large immediates in add instruction
* Implement RcShMemProvider, finally fix the EOP bug
* Clear ASAN_ERRORS before each test
* Fix warnings; Fix review issues
* Cleanup prints
* Add timeout to Frida mode
* Make allocation-/free-site backtraces optional
* CPU Context and backtrace (on android/aarch64 atm) on crash
* Make stalker conditional
* Add metadata to solution, and write metadata files
* Add addresses to backtrace; Add reporting of ASAN stack errors; Fix ASAN reporting bugs
* Remove meaningless backtrace on crash
* Fix the x0, x1 load in report
* use upstream color-backtrace
* use __builtin_thread_pointer instead of custom asm
* Don't unwrap ASAN_ERRORS if it isn't some
* Fix bug where we weren't clearing the drcov basicblocks after each run
* Fix bug where we were dropping an ashmem too soon
* Fix OwnedPtr instead of CPtr
* Fix gettls for all archs
* cfg guards for target arch, disabling Frida-ASAN/-DrCov if not on aarch64
* Cargo fmt
* Only panic in options when asan/drcov are turned on; Merge fixes
* gothook only supported on unix
* Fix gettls on msvc
* Another attempt to fix MSVC gettls
* Fix backtrace use
* nostd fixes; warning fixes
* formatting
* Migrate FridaEdgeCoverageHelper into libafl_frida, and rename to FridaInstrumentationHelper
* Clean up uses
* Move DrCovWriter to libafl_targets
* Refactor DrCovWriter to get a vec of DrCovBasicBlocks; formatting
* Update to newer backtrace which supports android with gimli
* windows fixes
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: andreafioraldi <andreafioraldi@gmail.com>
* inprocess: Allow InProcessExecutor to take a function pointer or a closure
* frida: initial working (but slow + buggy) frida helper
Issues:
- it's slow as ****
- there is an Llmp exception after the 227th corpus entry is found
- Cargo.toml lines currently import from a local ../frida-rust dir, as frida-rust is still under development
* inprocess: let the InProcessExecutor take a closure or a function pointer
* frida: working FridaHelper with InProcessExecutor
* frida: Apply suggestions; Move to RefCell; Cleanup warnings
* frida: link libstdc++_static.a on android
* take an FnMut in InProcessExecutor
* adapt libfuzzer_libpng to FnMut in InProcessExecutor
* create FridaInProcessExecutor and FridaEdgeCoverageHelper
* fix frida build.rs
* frida: move gum to main, get rid of lazy_static; use PageProtection enum
* stalker exclude
* frida: implement inline map-update for x86_64
* inprocess: add harness/harness_mut accessors
* format
* remove get_module_size from FridaEdgeCoverageHelper
* frida: implement aarch64 inline map update
* frida: add missing IndexMode
* add timeouts for executors
* move timeouts to observer
* add with_timeout constructor for Observer
* cast to i64 later in pre_exec
* add cfg(unix) guards
* add TimeoutExecutor
* add TimeoutFeedback and send ExitKind::Timeout from the handler
* pass Duration and move timeout stuff to post_exec
* format
* add timeouts to libpng_libfuzzer
* 10 sec timeout
* timeout executor file
* fix timeout executor no_std
* format
* todos
* Win32ShMem
* win32 exceptions
* fixes
* fix win32 build.rs
* fix win32 build.rs
* fixes fro win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* inprocess::windows_exception_handler
* inprocess::windows_exception_handler fixes
* windows_exception_handler in InProcessExecutor
* inprocess::windows_exception_handler fix
* fix windows exceptions mapping
* format
* format
* inprocess: Allow InProcessExecutor to take a function pointer or a closure
* frida: initial working (but slow + buggy) frida helper
Issues:
- it's slow as ****
- there is an Llmp exception after the 227th corpus entry is found
- Cargo.toml lines currently import from a local ../frida-rust dir, as frida-rust is still under development
* inprocess: let the InProcessExecutor take a closure or a function pointer
* frida: Apply suggestions; Move to RefCell; Cleanup warnings
* take an FnMut in InProcessExecutor
* adapt libfuzzer_libpng to FnMut in InProcessExecutor
* reenabled ci for prs
* frida: update to frida-rust 0.3.2
* frida: fix buid errors
* frida: fix build_and_test.yml
* frida: uses crates.io for frida-gum and frida-gum-sys
* fix merge errors
* fix typo
* frida: x86_64 now working
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: toka <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
