242 Commits

Author SHA1 Message Date
Dongjia Zhang
4eba9323c5
Fix overflow in Frida mode (#635) 2022-05-17 15:06:38 +02:00
Dongjia Zhang
e7a06fb30c
Fix unsafe bracket (#594) 2022-04-05 14:24:58 +02:00
Dongjia Zhang
e77e147a74
Update Clap (#591)
* upd

* fix
2022-04-04 17:59:34 +02:00
s1341
f4c4d9044f
Use the new bolts::cli with the frida_libpng sample (#541)
* Use the new bolts::cli with the frida_libpng sample

* Fix comment and add must_use

* Fix windows

* Fix windows more

* Fix windows more, more

* Fix windows more, more, more

* Remove comma

* fmt
2022-03-01 11:25:11 +01:00
Dongjia Zhang
393afa56c8
Github workflows frida build on windows (#536)
* Update build_and_test.yml

* Update build_and_test.yml

* clippy

* clippy

* clippy
2022-02-13 05:10:17 +01:00
Dominik Maier
7dad2153e2
Clippy for Cargo (#532)
* Clippy for Cargo

* clippy fixes

* clippy fixes

* edition

* fix

* wrong self hidden

* fix

* more clippy
2022-02-11 14:34:01 +01:00
Andrea Fioraldi
63d89463a3
Improve libafl_qemu snapshots (#484)
* mprotect

* expose EnumIter

* thread safe mem snapshot

* update qemu hash

* clippy

* child helpers

* fixes

* fix build

* fix dep
2022-02-09 09:40:59 +01:00
Sagittarius-a
2bb60fb756
Fix documentation typos (#514)
* Fix typos in LibAFL doc comments

* Fix doc comment for ProgressReporter trait

* Remove unused comment

* Link ShMem by name in doc comment
2022-02-03 16:31:19 +01:00
Dongjia Zhang
3c4ec38d83
Win Fix (#513)
* win_fix

* fmt

* another fmt
2022-02-02 00:26:10 +01:00
s1341
e41b76fe31
Throw an exception on a failed new in frida ASan, instead of just returning null (#512) 2022-02-01 15:28:44 +01:00
Dongjia Zhang
fb21c4ff82
Frida Runtime Tuples (#457)
* an attempt to make runtimes into tuples

* wip

* wip

* wipp

* getter

* refactor

* fmt

* fix

* compiles

* fuzzer change

* coverage working

* asan & less unwrap() & fixes

* inst size, fmt

* build & coverage works on asan

* amd64 fix
2022-02-01 14:34:53 +01:00
Youssef
e307dfb16f
Implement backtrace observers for crash dedupe (#379)
* create stacktrace observer

* create stacktrace feedback

* post-merge fixes

* address comments

* update Cargo.toml

* fix CI issue + dynamic naming

* duplicate baby_fizzer

* update stacktrace baby_fuzzer

* force unwinding tables

* ignore test dumps

* fix stacktrace baby_fuzzer logic

* upgrade Backtrace version

* trigger observers.post_exec in crash_handler

* implement NewHashFeedbackState and update logic

* digest symbols pointers

* cleanup

* minimal output

* fix backdated EventFirer generic param

* add baby_fuzzer example with a fork executor

* duplicate baby_fuzzer_stacktrace with forkexecutor

* backtrace collection implemented

* add c app fuzzer example with a fork executor

* group backtrace baby fuzzers

* added c code baby fuzzer with inprocess executor

* remove need for static COLLECT_BACKTRACE

* moved code to stacktrace.rs + fixed bug

* add comment

* add command executor fuzzer example

* post merge cleanup

* add missing doc

* address comment

* fix nit

* clean duplicate variable in timeout handler

* fix command executor bt collection

* clean code and use StdShMem

* cleanup

* add ObserverWithHashField + rename StacktraceObserver

* rename + refactor some code

* add CommandBacktraceObserver

* update command executor

* update baby fuzzers

* simplify BacktraceSharedMemoryWrapper

* use better names + static methods

* use std feature macro on BacktraceObserver + fix bug

* use Box in HashValueWrapper to minimize variants size diff

* use copy_from_slice

* std conditional backtrace collection

* fix std import

* fix comment

* add exit_kind to observer.post_exec

* added hash trait to Input

* collect backtrace in post_exec

* add crash handlers to InProcessForkExecutor

* fix panic message

* duplicate forkserver fuzzer example

minimal example

update

* proto bt collection working

* rename CommandBacktraceExecutor to ASANBacktraceExecutor

* refactor ASANBacktraceObserver

* support for forkserver working

* update fuzzer example

* less verbosity

* Post merge fixes

* implement hash for GeneralizedInput

* update forkserver example after merge

* clippy fixes

* fix inproc test

* fixes for cargo hack --feature-powerset

* fix baby_no_std

* implement Hash for NautilusInput

* update fork executor baby fuzzer

* fix doc

* implement Hash for PacketData

* fix windows build

* fix windows no_std

* fix backtrace baby fuzzers README

* add comments

* move setup_bt_panic to constructor

* pre/post child exec hooks in Observer

* setup_child_panic_hook

* fix ObserversOwnedMap on nightly

* add backtrace fuzzers to CI checks

* fix typo

* fix relative paths in test_all_fuzzers.sh

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2022-01-31 15:58:15 +01:00
Dongjia Zhang
efb5e25411
Fix shadow bit for libafl_frida on Linux (#502) 2022-01-28 09:26:24 +01:00
Dongjia Zhang
2730515c46
Asan Fix (#490)
* fix

* fmt
2022-01-24 09:17:19 +01:00
Dongjia Zhang
03c020f4bd
Asan fix (#485) 2022-01-21 09:08:21 +01:00
Dongjia Zhang
5e1c0b96ea
Various Fixes (windows timeout race & frida options) (#482)
* race fix

* oops

* no backtrace
2022-01-20 01:32:04 +01:00
Dominik Maier
77e5965e97
Add AsSlice, AsMutSlice traits, refactor MapObservers to be iterable, and have associated types (#477)
* from warning

* fix latest clippy

* clippy fixes++

* renamed shmem parameters

* renamed map to shmem

* make forkserver executor work for any (non-system) shmem

* Mem -> ShMem

* rework windows

* fix nit

* fix symbolic

* refacctor map observers

* iterator for map observers

* removed unused ownedptr, added asslice trait to most functions

* make map entry type an associated type

* fix fuzzers

* fix docs

* typo fix

* fix windows, add try_from_slice to shmid

* missing import

* fix fuzzbench

* cleanup

* fmt

* more asslice

* fmt

* added doc link about token-level fuzzing

* cods
2022-01-19 00:02:33 +01:00
Dominik Maier
b67a7f5b60
[libafl_frida] Enabled ASan for Apple (#478) 2022-01-18 18:37:19 +01:00
Dominik Maier
ac43997950
Fixed additional new clippy lints for libafl_qemu, libafl_frida (#473)
* clippy for qemu

* getrlimit clippy
2022-01-17 16:24:40 +01:00
Dominik Maier
2dd88998bd
Clippy fixes for latest toolchain (#471)
* from warning

* fix latest clippy

* clippy fixes++

* more nits
2022-01-17 11:02:42 +01:00
Andrea Fioraldi
bbd11bc4a7
Bump libafl_frida to 0.7.1 (#467) 2022-01-13 15:48:51 +01:00
Andrea Fioraldi
bca1f392a7
Bump to 0.7.1 (#465)
* bump to 0.7.1

* bump libafl_qemu
2022-01-13 11:32:57 +01:00
Dongjia Zhang
b70833f26b
Libafl_frida ASan shadow bit (#455)
* add

* debugging

* remove debug code

* fmt

* why

* writable or executable ranges

* for

* fmt

* fix
2022-01-13 10:45:15 +01:00
Dongjia Zhang
327ff98ea1
Asan fix (#460)
* fix

* fix

* bump

* fmt
2022-01-09 21:00:04 +01:00
Dongjia Zhang
82194c5fe5
Fix windows build (#462)
* fix

* fmt
2022-01-09 20:57:43 +01:00
Dominik Maier
a1a6d5f478
Disable pita 🥙 compiler in debug mode (#454) 2022-01-04 16:20:52 +01:00
s1341
1608294d0b
Various fixes related to frida mode (#445)
* Fix lint errors

* Fix incorrect address for unfreed allocations when reseting

* Use hash for edge ids

* Fmt
2022-01-03 10:41:52 +01:00
Dominik Maier
af3d321213
Derive debug for all structs in LibAFL (#442)
* documentation, warnings

* fixed docs

* docs

* no_std

* test

* windows

* nautilus docs

* more fixes

* more docs

* nits

* windows clippy

* docs, windows

* nits

* debug all the things

* derive debug for all core library components

* Docu for libafl_targets

* nits

* reordered generics

* add docs to frida, debug

* nits

* fixes

* more docu for frida, nits

* more docu

* more docu

* Sugar docs

* debug for qemu

* more debug

* import debug

* fmt

* debug

* anyap_debug feature no longer needed

* tidy up unused fn

* indicate if we left out values for struct debug

* implement Debug for sugar

* debug allthethings

* ci
2022-01-03 00:47:17 +01:00
Dominik Maier
efc804fe7d
Updated dependencies (#443)
* updated dependencies

* updated info in toml

* Windows fixes

* fixed immport

* u32 -> i32

* ignore i32 overflows in constants

* removed unused double allow
2022-01-02 17:52:44 +01:00
Dominik Maier
d669b063f4 clippy 2021-12-30 18:38:28 +01:00
s1341
b5153cc525
Frida various fixes (#436)
* Make drcov post_exec dependent on whether drcov is enabled

* Fix find_smallest_fit algorithm

* Fix missing ?

* fix warnings

* fix

* todo for non-linux/android shadow, clippy

* typo

* removed unsupposted eq

* cleanup, docu

* libafl::Error

* fixed import

Co-authored-by: tokatoka <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-12-29 18:47:33 +01:00
s1341
eeac0f4f06
Fix strncmp hook to only check the length of the string (#434) 2021-12-28 10:00:44 +01:00
s1341
6384f1da95
Merge pull request #433 from AFLplusplus/frida_asan_max_total_allocation
Implement max total allocation size for frida asan
2021-12-27 11:49:40 +02:00
s1341
2e92a34494 Reset total allocations on reset 2021-12-26 11:17:27 +02:00
s1341
11ae49b7cd Implement max total allocation size for frida asan 2021-12-26 10:44:25 +02:00
tokatoka
97c169fe63 init ranges later 2021-12-24 16:34:53 +09:00
tokatoka
e6434d2ec2 fmt 2021-12-24 15:46:27 +09:00
tokatoka
9cd0d2228c drcov runtime 2021-12-24 15:45:08 +09:00
Dominik Maier
6b5181250c
Drcov remodelling (#415)
* drcov remodelling

* fmt

* fix

Co-authored-by: tokatoka <tokazerkje@outlook.com>
2021-12-23 17:13:18 +01:00
s1341
b0019ae4a9
Fix frida-mode for debug builds, ensure it will continue to work on release builds (#427)
* Fix cfg directives so that we actually build on all combinations of release/debug x86_64/aarch64

* Include fuzzer for stalker purposes

* Get rid of cfg on use
2021-12-21 14:30:47 +01:00
Dongjia Zhang
2aa0ca5ef1
Frida shadow fix (#425)
* map_to_shadow

* fix map_to_shadow

* aarch64 change?

* fix

* fix

* fix

* fix

* fix

* fix

* fix

* use

* revert

* s1341's change

* Fix shadow calculation in instrumented code

* Fix asan error output to be more accurate

Co-authored-by: s1341 <github@shmarya.net>
2021-12-20 10:51:45 +01:00
Dongjia Zhang
6e59e5bdc7
Frida Refactor: Separate Frida other helper functions into each Runtime (#418)
* separate asan

* fmt

* move asan out of helper.rs

* fmt

* move cmplog out of helper.rs

* fmt

* fix

* fix

* fix

* fix

* fix

* fix

* fix

* fix

* fix

* final fix & fmt

* Fix unused imports

* Fmt

* rename files

* fix Makefile

* fmt

* clippy

Co-authored-by: s1341 <github@shmarya.net>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-12-16 14:16:01 +01:00
Dominik Maier
217a7dee1d
Use Structopt instead of yaml for example fuzzers, introduce Cores API (#420)
* reworked generic_inmemory to structopt

* moved core parsing to a struct

* added Cores

* added structopt to libpng_ctx

* improved libafl, added structopt to libpng launcher

* fix deexit ub

* move more to structopt

* improve llvm-config detection

* move construct_automata to structopt

* clippy, fixes, ...

* no_std

* clippy

* frida core parsing

* fixed no-fork cores

* updated clap

* added missing import

* missing borrow

* reworked frida to structopt

* fixed build

* using Cores api for atheris

Co-authored-by: Dominik Maier <d.maier@avm.de>
2021-12-15 03:58:35 +01:00
Dongjia Zhang
fc0881194d
Windows timeout fix with critical sections (#391)
* add

* unix fix

* unsafe positions

* another unsafe!

* ignore

* ignore

* make changes back

* fix

* fix

* fmt

* bug fix

* fmt

* compiler fence

* import

* typo

* add another critical section

* fix

* fix

* exclude windows book test

* typo

* fence

* why

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2021-12-09 13:55:20 +01:00
Andrea Fioraldi
37b8cb0d2f Bump to 0.7 2021-12-01 17:22:09 +01:00
Andrea Fioraldi
2fb1c3520a
More LLVM passes from AFL++ (#394)
* afl coverage pass

* working ctx coverage

* MAYBE_THREAD_LOCAL

* doh

* fix for msvc

* ci

* clippy

* atheris

* thread_local
2021-12-01 13:27:39 +01:00
Toka
6cd2d69bfc
fix (#388) 2021-11-23 17:01:08 +01:00
OB
751330e8ee
Cmplog instrumentation (#382)
* add support for cbz/tbz

* remove unecessary print

* implemented support for tbz

* add support for tbnz

* fix an error in the emitted code for both tbz/tbnz

* add support for cbnz

* fix error in logic

* add special handling to "subs"

* add restoration for X5 for tbz/tbnz

* add "adds" support

* add special handling for different opcodes

* add support for cbz/tbz

* remove unecessary print

* implemented support for tbz

* add support for tbnz

* fix an error in the emitted code for both tbz/tbnz

* add support for cbnz

* fix error in logic

* add special handling to "subs"

* add restoration for X5 for tbz/tbnz

* add "adds" support

* add special handling for different opcodes

* add adcs to cmplog commands

* get rid of irrelevant allocations

* add flag restoration to cmplog instrumentation emitted code

* add restoration for x24

* save and restore all registers
2021-11-17 18:22:37 +01:00
Toka
fd869ba1cd
Frida Refactor: Frida executor (#374)
* frida executor

* add files

* fmt & clippy

* fmt

* fix

* fmt

* fix & fmt
2021-11-17 12:51:39 +01:00
Dominik Maier
ba969108e3
Push stage trait (#380)
* rpush mutational trait

* tiny changes

* started PushStageAdapter

* fmt

* refactoring

* fix docs

* no_std

* formatted more
2021-11-17 12:51:14 +01:00