699 Commits

Author SHA1 Message Date
Andrea Fioraldi
f25862cb90 fix baby fuzzer 2021-04-26 09:41:35 +02:00
Andrea Fioraldi
b7de33e922 feedbacks in libfuzzer_libmozjpeg 2021-04-25 16:13:15 +02:00
Andrea Fioraldi
2f7bb8d532 baby fuzzer 2021-04-21 14:51:51 +02:00
Andrea Fioraldi
0732028190 remove qemufuzzer 2021-04-21 09:58:11 +02:00
s1341
655d30519b
Convert ShMem into a state-full ShMemProvider and otherwise refactor shmem/llmp (#54)
* shmeme/llmp refactor to convert ShMem into a stateful ShMemProvider
factory.

At the moment we use parking_lot::ReentrantMutex. That may not be
necessary.

* fix merge issue

* formatting

* Fix fuzzer examples for new ShMemProvider

* Fix clippy warnings

* Fix build and clippy for x86_64

* Resolve review comments

* Remove ReentrantMutex and RefCell - they are not needed

* Hopefully fix win32 build

* Fix tests, windows build

* Rename ShMemProvider to ShMem

* Revert "Rename ShMemProvider to ShMem"

This reverts commit eca07c8d7bb3d5e829fecf3f7213c763470a41e9.

* Rename ShMemMapping to ShMem; Test fixes

* Add missing trait to scope

* Fix from_int

* Fix try_into

* Move to alloc::sync::Arc and spin::Mutex to support nostd

* Fix tests

* nostd fixes; Make new() a part of the ShMemProvider trait

* Fix errant ?

* Fix windows

* Fix missing trait

* nostd remove dbg!

* Add Default and Clone to ShMemProvider

* Formatting

* Fix windows

* Get rid of ArcMutex in favor of RefCell

* Rc RefCell

* moved to refs

* SHP->SP

* Use alloc::rc::Rc instead of std::rc::Rc

* Format

* Add setup_restarting_mgr_std which selects the right ShMemProvider; changed fuzzers to use it

* Get rid of unnecessary clone

* Fix clippy error on windows

* Fix nostd

* Fix formatting

* Make StdShmemProvider include ServedShMemProvider

* Get rid of lifetime specifiers now that we are using Rc

* Get rid of unneccesary spin

* Rename ShMemProvider::Mapping to ShMemProvider::Mem

* Formatting

* fix Windows

* Rename DefaultUnixShmem* to CommonUnixShmem*

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-04-16 11:26:06 +02:00
Dominik Maier
022c12568b QoL improvements 2021-04-12 12:16:45 +02:00
Dominik Maier
e505e7689c fixed merge fails 2021-04-12 11:30:44 +02:00
Grant Hernandez
24a033de31
Add tool detection to build.rs, improve README (#43)
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-04-10 11:16:35 +02:00
s1341
c8bfe76c43
Fix android and optimize frida (#44)
* fix_android_and_optimize_frida: Fix build and run for android; optimize frida maybe_log functions

* fix_android_and_optimize_frida: Get rid of the HasFd trait; cleanup warnings

* fix_android_and_optimize_frida: fmt
2021-04-01 14:39:11 +02:00
Andrea Fioraldi
d889c8c826 libfuzzer_stb_image readme 2021-03-29 16:13:46 +02:00
Andrea Fioraldi
bd9aa89753 libfuzzer_libmozjpeg readme 2021-03-29 16:07:56 +02:00
Andrea Fioraldi
0c2a267075 remove libfuzzer_runtime and use cc wrapper for mozjpeg 2021-03-29 15:56:54 +02:00
Andrea Fioraldi
1f7be63031 value profile in libafl_targets 2021-03-26 17:53:47 +01:00
andreafioraldi
2cd046e1e8 catch assertion errors on win32 2021-03-26 11:42:26 +01:00
andreafioraldi
9c1f836ff2 fix libfuzzer_stb_image 2021-03-26 10:55:23 +01:00
andreafioraldi
7564ce1e87 libfuzzer_stb_image with build.rs and win32 fixes 2021-03-26 10:39:02 +01:00
andreafioraldi
40fe286cf9 run on win32 using the clang wrapper 2021-03-25 20:04:52 +01:00
root
a0550b3154 compile libfuzzer_libpng on windows 2021-03-25 18:50:40 +01:00
Toka
82f5dad784
Add mutator stats method (#40)
* add LogMutation trait

* change &self to &mut self

* move self.scheduler out of StdFuzzer

* reorder generics?, implement post_exec

* append metadata to the corresponding testcase in the corpus

* turn mutations into Mutators

* impl Named for mutations

* add LoggerScheduledMutator, add fn get_name() to MutatorTuple

* Fix BytesDeleteMutator, and format

* remove TupleList bound on Tail

* turn TokenInsert, TokenReplace into Mutator, fill havoc_mutations

* libfuzzer_libpng

* libfuzzer_libpng_cmpalloc

* libfuzzer_libmozjpeg

* fix tests

* fix libfuzzer_libmozjpeg

* fix tests

* fix LoggerScheduledMutator::mutate

* use vec<u8> instead of String

* fix post_exec and get_name

* fmt

* NamedTuple and HasNameIdTuple

* always clear mutations log

* fix tests

* format

* remove libafl_targets default features

* use vec<string> instead of vec<vec<u8>>

* add alloc::string::String

* format

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2021-03-25 13:04:18 +01:00
Andrea Fioraldi
21b790060d readme 2021-03-24 16:24:37 +01:00
Andrea Fioraldi
79dbdf8251 readme 2021-03-24 16:23:08 +01:00
Andrea Fioraldi
9c0fdee007 complete libfuzzer_libpng example with compiler wrapper 2021-03-24 16:15:07 +01:00
Andrea Fioraldi
8d2713c4d9 libfuzzer_libpng wrappers 2021-03-24 15:28:58 +01:00
Andrea Fioraldi
1c8cdc76a8 create libafl_targets and start new structure for libfuzzer_libpng 2021-03-23 20:39:23 +01:00
Dominik Maier
7f72d70977
Windows Fuzzing Example (#41)
* windows fuzzer target and minor changes - breaks android support and maybe linux build

* adapted windows example

* removed warnings from build.rs

* fixed build on unix

* fixed no_std

* build fix, silenced warnings

* no_std warning silenced

* clippy fixes

* fmt

* windows fuzzer target and minor changes - breaks android support and maybe linux build

* adapted windows example

* removed warnings from build.rs

* fixed build on unix

* fixed no_std

* build fix, silenced warnings

* no_std warning silenced

* clippy fixes

* fmt

* clippy

* trying to add clang support

* debugging win build

* debugging win build more

* debuggin..

* debuggin....

* more debugging

* giving up

Co-authored-by: richinseattle <richinseattle@gmail.com>
2021-03-23 13:50:22 +01:00
Dominik Maier
5f74a08316 fix frida wrapper 2021-03-22 17:02:14 +01:00
Dominik Maier
92dd0bfcb2 added main.rs wrapper for frida 2021-03-22 16:58:53 +01:00
Dominik Maier
556141e9a3 ignored frida on windows 2021-03-22 16:54:31 +01:00
Dominik Maier
11686b1667 fixed libfuzzer_libmozjpeg build 2021-03-22 15:04:56 +01:00
Dominik Maier
013dc85328 download to out_dir 2021-03-22 14:04:34 +01:00
s1341
a02cc39bba
Frida Executor Example (#27)
* inprocess: Allow InProcessExecutor to take a function pointer or a closure

* frida: initial working (but slow + buggy) frida helper

Issues:
- it's slow as ****
- there is an Llmp exception after the 227th corpus entry is found
- Cargo.toml lines currently import from a local ../frida-rust dir, as frida-rust is still under development

* inprocess: let the InProcessExecutor take a closure or a function pointer

* frida: working FridaHelper with InProcessExecutor

* frida: Apply suggestions; Move to RefCell; Cleanup warnings

* frida: link libstdc++_static.a on android

* take an FnMut in InProcessExecutor

* adapt libfuzzer_libpng to FnMut in InProcessExecutor

* create FridaInProcessExecutor and FridaEdgeCoverageHelper

* fix frida build.rs

* frida: move gum to main, get rid of lazy_static; use PageProtection enum

* stalker exclude

* frida: implement inline map-update for x86_64

* inprocess: add harness/harness_mut accessors

* format

* remove get_module_size from FridaEdgeCoverageHelper

* frida: implement aarch64 inline map update

* frida: add missing IndexMode

* add timeouts for executors

* move timeouts to observer

* add with_timeout constructor for Observer

* cast to i64 later in pre_exec

* add cfg(unix) guards

* add TimeoutExecutor

* add TimeoutFeedback and send ExitKind::Timeout from the handler

* pass Duration and move timeout stuff to post_exec

* format

* add timeouts to libpng_libfuzzer

* 10 sec timeout

* timeout executor file

* fix timeout executor no_std

* format

* todos

* Win32ShMem

* win32 exceptions

* fixes

* fix win32 build.rs

* fix win32 build.rs

* fixes fro win32

* fixes for win32

* fixes for win32

* fixes for win32

* fixes for win32

* fixes for win32

* fixes for win32

* fixes for win32

* fixes for win32

* fixes for win32

* fixes for win32

* inprocess::windows_exception_handler

* inprocess::windows_exception_handler fixes

* windows_exception_handler in InProcessExecutor

* inprocess::windows_exception_handler fix

* fix windows exceptions mapping

* format

* format

* inprocess: Allow InProcessExecutor to take a function pointer or a closure

* frida: initial working (but slow + buggy) frida helper

Issues:
- it's slow as ****
- there is an Llmp exception after the 227th corpus entry is found
- Cargo.toml lines currently import from a local ../frida-rust dir, as frida-rust is still under development

* inprocess: let the InProcessExecutor take a closure or a function pointer

* frida: Apply suggestions; Move to RefCell; Cleanup warnings

* take an FnMut in InProcessExecutor

* adapt libfuzzer_libpng to FnMut in InProcessExecutor

* reenabled ci for prs

* frida: update to frida-rust 0.3.2

* frida: fix buid errors

* frida: fix build_and_test.yml

* frida: uses crates.io for frida-gum and frida-gum-sys

* fix merge errors

* fix typo

* frida: x86_64 now working

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: toka <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-03-22 12:45:38 +01:00
Andrea Fioraldi
8a3e4301fb format 2021-03-17 17:19:33 +01:00
Andrea Fioraldi
cd7030443e timeout executor file 2021-03-17 17:08:17 +01:00
Andrea Fioraldi
5d92871b27
Merge pull request #31 from AFLplusplus/timeout_executors
add timeouts for executors
2021-03-17 16:49:07 +01:00
Andrea Fioraldi
774dbc82d1 10 sec timeout 2021-03-17 16:46:29 +01:00
Andrea Fioraldi
46c69aeee8 add timeouts to libpng_libfuzzer 2021-03-17 15:36:56 +01:00
toka
b321675aa9 add TimeoutFeedback and send ExitKind::Timeout from the handler 2021-03-16 18:48:40 +09:00
toka
ab3d070f1a add TimeoutExecutor 2021-03-16 18:13:18 +09:00
Andrea Fioraldi
eaa5b15304 readmes 2021-03-11 10:15:53 +01:00
Andrea Fioraldi
93d484bb58 posix_memalign in calloc 2021-03-11 10:11:22 +01:00
Andrea Fioraldi
3752821ab4 create libfuzzer_libpng_cmpalloc 2021-03-11 10:09:42 +01:00
Dominik Maier
f7db29d213 workaround for recursive malloc in release mode 2021-03-10 19:40:39 +01:00
Andrea Fioraldi
add3cf9665 rewrite alloc size tracking in rt.c 2021-03-09 15:23:40 +01:00
Andrea Fioraldi
dbe935b078 time feedback in libfuzzer example 2021-03-09 15:18:50 +01:00
s1341
b048ddf470
Better Unix Signal Handling Abstractions (#22)
* WIP: unix_signal_handling

* WIP: unix_signal_handling, another try

* only emit a single illegal instruction

* unix_signal_handling: Now working

* unix_signal_handling: squash warnings

* unix_signal_handling: formatting

* fix spelling

* unix_signal_handling: add missing file

* unix_signal_handling: port LlmpBroker

* unix_signal_handling: fix missing import

* moving towards no_std compatibility

* unix_signal_handling: get rid of HashMap, Mutex and lazy-static

* unix_signal_handling: formatting

* readme

* no_std fixes

* fixed windows build

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2021-03-05 15:36:44 +01:00
Dominik Maier
bb54d551ac included more clippy suggestions 2021-03-04 19:11:36 +01:00
Andrea Fioraldi
22100d8446 fix rt.c 2021-03-03 17:42:27 +01:00
Dominik Maier
eaa3dc786b
Fork (#20)
* wip forking

* fixed build

* fixed build

* import cleanup

* more fork

* added windows ci

* fmt

* no_std fixes

* windows

* unix build fixed

* ignoring tests on windows

* fixed windows tests
2021-03-03 17:06:17 +01:00
Andrea Fioraldi
8238d65cac libfuzzer runtime for malloc maximization 2021-03-03 17:00:42 +01:00
s1341
fde48be53e
unix_domain_sockets/ashmem: Add ability to connect over unix domain sockets instead of just TCP; Add ashmem support for android (#19)
* unix_domain_sockets: Added Listener abstraction

Tested and TCP is still working

* unix_domain_sockets: turn off the unstable feature except on android

* unix_domain_sockets: more turn off the unstable feature except on android

* unix_domain_sockets: always import UnixListener

* unix_domain_sockets: Finished implementation. Tested working on android when both sides are root

* unix_domain_sockets: adjust conditional compilation

* unix_domain_sockets: formatting

* unix_domain_sockets/android: implement ashmem hooks

* unix_domain_sockets/android: formatting

* unix_domain_sockets: make Listener abstraction public

* unix_domain_sockets: add cfg(std) to Listener

* unix_domain_sockets: add cfg(std) to imports

* unix_domain_sockets: formatting

* unix_domain_sockets: Handle SIGTERM, SIGQUIT and SIGINT gracefully and cleanup the unix socket

* unix_domain_sockets: formatting

* unix_domain_sockets: fix conditional compilation

* unix_domain_sockets: use String::default instead of a literal

* unix_domain_sockets: socket_name should be an Option<>

* fixed build

* fmt

* fixed warnings

* using volatile reads and writes for shutdown flag

* reordered compiler fence on write

* moved the signal handler method to its own function

* readme

* moved to HasShmId

* unix_domain_sockets: fix warnings

* renamed HasShmId to HasFd

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-03-03 12:31:29 +01:00