alwin.berger/FRET-LibAFL
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
2,327 Commits 19 Branches 28 Tags
Commit Graph

90 Commits

Author SHA1 Message Date
Dongjia Zhang
ba4cca0e15
Delete redundant makefiles (#546) 
We switched to cargo make
 2022-02-20 18:50:29 +01:00
Dongjia Zhang
fc89f2944b
Makefile.toml fix (#545) 2022-02-20 04:21:43 +01:00
Dongjia Zhang
936e2221d1
Cargo-make (#537) 
* timeout utility

* example build.toml

* upd

* ci

* Update build_and_test.yml

* Update build_and_test.yml

* rename, qemu_launcher

* libpngs

* fix

* upd

* del

* do_nothing -> unsupported

* rename

* use command

* non qemu fuzzbench

* script.sh

* mroe

* qemu

* fix

* generic

* fix

* fix

* allow 124

* quotes

* fix

* fix

* fix

* stderr to devnull

* chg
 2022-02-20 03:32:43 +01:00
Andrea Fioraldi
a03d733cf9
libafl_qemu decouple hooks from the executor and QemuForkExecutor (#528) 
* QemuHooks

* option state hooks

* QemuForkExecutor

* enforce no side effects in QemuForkExecutor

* child hooks fixes

* fixes

* qemu_launcher

* examples and fixes

* fix sugar

* clippy

* fmt

* no timeout for fuzzbench_fork_qemu

* Update libafl_qemu/src/hooks.rs

Co-authored-by: Alwin Berger <50980804+alwinber@users.noreply.github.com>

* clippy

Co-authored-by: Alwin Berger <50980804+alwinber@users.noreply.github.com>
 2022-02-15 22:11:24 +01:00
Dominik Maier
6810e6085b
Builder for CommandExecutor & Tokens Refactoring (#508) 
* builder for CommandExecutor

* tokens api cleanup, clippy

* fix doctest

* cleanup

* added testcase, remodelled

* command executor builder fix

* fix fuzzer(?)

* implemented From for configurator

* nits

* clippy

* unused

* autotokens

* cleanup

* nits

* Err instead of empty tokens

* fix tokens fn

* fix err

* more error fixing

* tokens remodelling

* typo

* recoverable fail on missing autotokens

* clippy, nostd

* asslice, into_iter, etc. for tokens

* adapt fuzzers

* iter

* fixes, clippy

* fix

* more clippy

* no_std

* more fix

* fixed typo

* cmd_executor builds again

* bring back ASAN stuff to Command Executor

* forkserver speedup

* no need to static

* back to earlier
 2022-02-01 10:10:47 +01:00
Evan Richter
4a6616bdfe
[libafl_qemu] simplify emu::{read,write}_mem (#496) 
Methods read_mem and write_mem now operate on &[u8], not &[T]

The generic T slice interface was prone to various footguns:
* i32 is the default Rust integer type, but buffers are often expected
  to hold u8. This means the following code writes 16 bytes to the
  guest, not 4:

      let buf = [0; 4];
      emu.write_mem(addr, &buf);

* If a buffer of 16-bit or larger integers (&[u64] for example) is
  needed to read/write, the user will need to consider host/guest
  endianness. The byte array methods in std are a good, explicit
  alternative.

  Perhaps libafl_qemu could expose/define "to/from guest endianness"
  helper functions or extension traits using the established cfg flags,
  so that guest endianness is always right by default.

* emu::read_mem causes insta-UB if a user did something like:

      let mut my_bool = false;
      emu.read_mem(addr, &mut my_bool);

  It's less surprising for users to just operate on plain-ol' bytes,
  which they can explicitly transmute if they wish.
 2022-01-27 09:05:33 +01:00
Dominik Maier
77e5965e97
Add AsSlice, AsMutSlice traits, refactor MapObservers to be iterable, and have associated types (#477) 
* from warning

* fix latest clippy

* clippy fixes++

* renamed shmem parameters

* renamed map to shmem

* make forkserver executor work for any (non-system) shmem

* Mem -> ShMem

* rework windows

* fix nit

* fix symbolic

* refacctor map observers

* iterator for map observers

* removed unused ownedptr, added asslice trait to most functions

* make map entry type an associated type

* fix fuzzers

* fix docs

* typo fix

* fix windows, add try_from_slice to shmid

* missing import

* fix fuzzbench

* cleanup

* fmt

* more asslice

* fmt

* added doc link about token-level fuzzing

* cods
 2022-01-19 00:02:33 +01:00
Andrea Fioraldi
bca1f392a7
Bump to 0.7.1 (#465) 
* bump to 0.7.1

* bump libafl_qemu
 2022-01-13 11:32:57 +01:00
Dominik Maier
6d9763c51f
Move to clap 3.0 (#447) 
* move to clap 3.0

* fix cargo.toml

* update symcc to use clap3
 2022-01-04 23:53:12 +01:00
Dominik Maier
efc804fe7d
Updated dependencies (#443) 
* updated dependencies

* updated info in toml

* Windows fixes

* fixed immport

* u32 -> i32

* ignore i32 overflows in constants

* removed unused double allow
 2022-01-02 17:52:44 +01:00
Andrea Fioraldi
6274ad4594
Refactor libafl_qemu creating the Emulator struct and post syscall hooks (#430) 
* working without asan.rs

* working asan

* update fuzzers

* mremap in snapshot

* sugar

* python

* fix python

* clippy

* fmt

* fuck you loader
 2021-12-23 09:10:13 +01:00
Andrea Fioraldi
0cce1e2b91 Update fuzzbench and fuzzbench_qemu, delete fuzzbench_gsoc 2021-12-21 11:26:04 +01:00
Dominik Maier
304eda724f
Various fixes for CI (#423) 
* Various fixes

* fix try_from for cores

* no_std
 2021-12-15 18:11:40 +01:00
Dominik Maier
217a7dee1d
Use Structopt instead of yaml for example fuzzers, introduce Cores API (#420) 
* reworked generic_inmemory to structopt

* moved core parsing to a struct

* added Cores

* added structopt to libpng_ctx

* improved libafl, added structopt to libpng launcher

* fix deexit ub

* move more to structopt

* improve llvm-config detection

* move construct_automata to structopt

* clippy, fixes, ...

* no_std

* clippy

* frida core parsing

* fixed no-fork cores

* updated clap

* added missing import

* missing borrow

* reworked frida to structopt

* fixed build

* using Cores api for atheris

Co-authored-by: Dominik Maier <d.maier@avm.de>
 2021-12-15 03:58:35 +01:00
Dongjia Zhang
4aa6550bf2
Clap: use help instead of about (#417) 2021-12-10 05:04:32 +01:00
Andrea Fioraldi
37b8cb0d2f Bump to 0.7 2021-12-01 17:22:09 +01:00
Andrea Fioraldi
fd5e793e57
libafl_qemu cpu_target cfg (#383) 
* cpu_target

* report

* track mmap in x64 snapshots
 2021-11-17 12:50:10 +01:00
Andrea Fioraldi
00d38dc535
AddressSanitizer for libafl_qemu (#378) 
* build libqasan

* asan runtime

* working simple asan

* init_with_asan

* fmt

* incomplete instr filter

* harden dealloc

* clippy
 2021-11-16 13:53:28 +01:00
Dominik Maier
62afed61e2
Renamed Stats to Monitors (#373) 
* renamed stats to monitors

* added depreciation notices

* resorted generics alphaabetically

* added monitors

* fmt fuzzers

* added depreciation note for usermonitor

* fmt all fuzzers script

* more fmt

* renamed some monitor things back to stats

* fixed rename
 2021-11-12 11:01:08 +01:00
Jordan McLeod
3d436b7519
Upgrade to Rust 2021 Edition (#340) 
* Enable missing const_xxh3 feature

* Move to Rust 2021 Edition

* Fix clippy complaints

* Remove imports made unecessary in 2021 edition
 2021-11-04 09:59:49 +01:00
julihoh
2e55d24f5a
update deps (#327) 
* experimental update deps

* Reverted to rand-core 0.5.1 for Lain compatibility

* updated nix

* less strict libc dep

* remove deprecated errno conversion

Co-authored-by: Dominik Maier <domenukk@gmail.com>
 2021-10-12 10:32:21 +02:00
Andrea Fioraldi
a420eb0513
Qemu generic hooks (#313) 
* generic hooks

* Fix generic hooks
 2021-10-01 16:27:26 +02:00
Andrea Fioraldi
f2929b8253
Allowlist and denylist for QEMU edges and cmps (#311) 
* fix edges hashtable query bug in hook

* fmt
 2021-10-01 14:28:24 +02:00
Andrea Fioraldi
90928d3d97
Qemu Helpers and basic snapshotting (#310) 
* store executor_ptr

* QemuHelpers

* working hooks and snapshot helper

* walk only the list of dirty pages on restore()

* mem hooks for snpashot

* brk snapshot

* snapshot method

* macos shit

* sugar and clippy
 2021-10-01 12:17:28 +02:00
Andrea Fioraldi
96bbe37cc1 Remove unused files from old libafl_qemu 2021-09-27 14:51:04 +02:00
Andrea Fioraldi
1fde608145
Qemu as lib (#301) 
* linking problems

* use shared lib

* ci

* clippy, ci fixegit pushs

* ingoring distclean result

* clippy

* clippy

Co-authored-by: Dominik Maier <domenukk@gmail.com>
 2021-09-24 13:22:33 +02:00
Andrea Fioraldi
7d249dd306 Update libafl-qemu-bridge commit && libafl_qemu 2021-08-24 16:03:33 +02:00
Andrea Fioraldi
951b6fef36 Bump 0.6.1 2021-08-23 10:01:22 +02:00
julihoh
dcf107a30a
symcc_runtime dependency fix for next libafl version & bump to 0.6.0 (#268) 
* symcc_runtime dependency fix for next libafl version

* bump to 0.6.0

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
 2021-08-18 10:57:55 +02:00
Dominik Maier
bb21ab7a63
Autolaunch ShMemService, add MacOS fuzzers to CI, various fixes (#246) 
* starting to fix macos linker bugs

* mdetailed error prints

* start shmem service manually

* not a doc comment

* Some fixes

* only send exit msg to shmemservice when start was successful

* incorporated shmem service into provider

* removed unused imports

* trying to fix fuzzers

* fixed build

* check if join_handle is_some

* more debug prints

* fixed shmem service autolaunch

* fixed macos linker

* ignoring broken libpng testcase on macos for now (see #252)

* fmt

* try to fix missing llvm_config (see #253)

* empty issue template added

* Mmanually look for llvm-config on MacOS

* fixing CI

* fixed docs

* ignoring libmozjpg for CI, see #254
 2021-08-09 01:10:29 +02:00
Dominik Maier
16c3a07be7
ShMem Server for MacOS (#238) 
* generalized ashmem server

* fixed macos testcases

* added StdShMemService

* no_st

* fmt

* added testcase, fixed some bugs (not all)

* solidified unix shmem

* initial impl for MmapShMem

* Added shmem service start to more testcases

* clippy

* fixed tetcases

* added frida_libpng makefile for easy use

* trying to fix build on ubuntu

* fixed ubuntu build for libpng

* no_std

* fixed testcase
 2021-08-05 17:08:01 +02:00
Andrea Fioraldi
2faf1d24c8
Hook syscalls in QemuBytesCoverageSugar (#233) 
* add x64 syscalls numbers

* syscall hook

* update commit

* read guest mappings

* clippy

* read write hooks

* automerge fix

* type fix

* hooks syscalls in sugar
 2021-07-21 12:29:46 +02:00
Andrea Fioraldi
db820d56a2
Qemu memory hooks (#232) 
* add x64 syscalls numbers

* syscall hook

* update commit

* read guest mappings

* clippy

* read write hooks

* automerge fix

* type fix
 2021-07-21 12:28:06 +02:00
Andrea Fioraldi
8e745f7d90 Remove useless fuzzbench_qemu build deps 2021-07-21 11:18:33 +02:00
Andrea Fioraldi
5cd7339b1a
Qemu read memory mappings (#228) 
* add x64 syscalls numbers

* syscall hook

* update commit

* read guest mappings

* clippy
 2021-07-16 10:38:00 +02:00
Andrea Fioraldi
b09fa4e3f4
Qemu syscalls hook (#226) 
* add x64 syscalls numbers

* syscall hook

* update commit
 2021-07-15 11:12:10 +02:00
Andrea Fioraldi
42b7c6d7e7
Qemu CmpLog (#223) 
* empty libafl_qemu crate

* fuzzbench qemu fuzzer skeleton

* emu.run() works without bp

* working emu loop

* resolve elf symbols

* running Qemu fuzzer without coverage

* qemu fuzzer with edge coverage

* merge into inprocess::GLOBAL_STATE

* create QemuExecutor and remove QemuEmulator

* qemu hooks and persist edges mapping storing them in State

* windows fix

* add libafl_qemu to workspace

* windows fix

* some clippy

* clippy

* fix fuzzbench_qemu

* fix fuzzbench_qemu makefile

* fuck you macos

* resolve PIC symbols

* cmp hooks

* cmplog hooks

* qemu cmplog

* clippy
 2021-07-13 16:02:53 +02:00
Dominik Maier
a0ba0f0251 clippy 2021-07-12 10:30:41 +02:00
Andrea Fioraldi
badf3f0e6e
Resolve symbols in PIC binaries in libafl_qemu (#216) 
* empty libafl_qemu crate

* fuzzbench qemu fuzzer skeleton

* emu.run() works without bp

* working emu loop

* resolve elf symbols

* running Qemu fuzzer without coverage

* qemu fuzzer with edge coverage

* merge into inprocess::GLOBAL_STATE

* create QemuExecutor and remove QemuEmulator

* qemu hooks and persist edges mapping storing them in State

* windows fix

* add libafl_qemu to workspace

* windows fix

* some clippy

* clippy

* fix fuzzbench_qemu

* fix fuzzbench_qemu makefile

* fuck you macos

* resolve PIC symbols
 2021-07-09 15:17:57 +02:00
Andrea Fioraldi
d472a1242a
libafl_qemu (#211) 
* empty libafl_qemu crate

* fuzzbench qemu fuzzer skeleton

* emu.run() works without bp

* working emu loop

* resolve elf symbols

* running Qemu fuzzer without coverage

* qemu fuzzer with edge coverage

* merge into inprocess::GLOBAL_STATE

* create QemuExecutor and remove QemuEmulator

* qemu hooks and persist edges mapping storing them in State

* windows fix

* add libafl_qemu to workspace

* windows fix

* some clippy

* clippy

* fix fuzzbench_qemu

* fix fuzzbench_qemu makefile

* fuck you macos
 2021-07-08 15:21:14 +02:00