28 Commits

Author SHA1 Message Date
Andrea Fioraldi
cc1ebb29f7
Add CmpLog routines to LibAFL QEMU and various fixes (#1664)
* Add CmpLog routines to LibAFL QEMU and various fixes

* format

* fix

* fix read_function_argument

* fix

* multithread

* fix qemu fork

* fix

* clippy

* fix systemmode

* unused imports
2023-11-17 16:59:50 +01:00
Andrea Fioraldi
4c0e01c4aa
Fix memopidx bug in libafl_qemu r/w hooks and update QEMU (#1500) 2023-09-05 16:28:52 +02:00
Ivan Fratric
829b5049e6
Hexagon support (#1323)
* Hexagon support

* Fix format

* Fix needless bool

* Address comments

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-07-04 11:08:36 +02:00
WorksButNotTested
747a636f4f
Add sample fuzzer which collects DrCov coverage for various architect… (#1300)
* Add sample fuzzer which collects DrCov coverage for various architectures using QEMU instrumentation

* Fix clippy

* Rename NullCorpus to NopCorpus

* Added support for verbose output

* Attempt to fix clippy again

* Fix remaining defaults to use x86_64 when no arch specified and be more robust handling partial builds

* Make build even more robust against partial re-builds

* Added missing dependencies to workflow, updated README

* Add missing dependencies for i386

* Another dependency

* More dependencies

* Disable tests on OSX

* Add tmate

* Add missing dependencies and symlink header directory

* Tidy up after test so we don't hog all the disk space

---------

Co-authored-by: Your Name <you@example.com>
2023-06-06 11:50:38 +02:00
Andrea Fioraldi
50708f4d9c
Fast device+mem QEMU snapshots (#930)
* Simple fast root snapshots

* clippy

* epd

* mips
2022-12-12 10:49:44 +01:00
Andrea Fioraldi
71dd58396c
libafl_qemu_sys and libafl_qemu_build to have bindgen with QEMU (#915)
* build and sys qemu crates

* working libafl_qemu_build

* libafl_qemu_sys

* switch libafl_qemu to use libafl_qemu_sys

* fix

* use sys

* fmt

* mmu lookup

* fix

* autofix

* clippy

* fix

* allow

* cl

* docker

* docker

* fix

* mem access info in mem hooks

* fmt

* fix

* kill libafl_page_size

* fix

* clippy

* default bindings for docs.rs

* macos

* fix arm build

* fix

* plugins

* fix

* fix fuzzer

* Correct PC on breakpoint

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2022-12-02 17:01:28 +01:00
Andrea Fioraldi
c2776e117a
emu::current_cpu() is now the CPU that hitted the breakpoint in fullsystem (#910)
* emu::current_cpu() is now kept after vm stop and it is the CPU that hitted the breakpoint

* clippy

* uninit

* clippy

* clippy

* clippy

* clippy

* nightly override in CI

* nightly override in CI

* components

* components

* targets

* targets

* clippy

* clippy

* clippy

* clippy

* clippy (again)

* MaybeUninit

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-11-25 11:57:08 +01:00
Andrea Fioraldi
3f627aaf0b
Save and restore CPU state in libafl_qemu (#907)
* libafl_qemu: fix systemmode with slirp dependency

libslirp will be dropped from future QEMU releases (see https://wiki.qemu.org/ChangeLog/7.0).
This change adds the "slirp" feature,
which links with the host-systems libslirp.

* libafl_qemu: enable systemmode snapshots, vm_start

Re-enable snapshot functions.
Start the VM before qemu_main_loop.

* libafl_qemu: allow synchronous snapshotting

Add a flag to take snapshots synchronosly.
This should be used to take or load snapshots while the emulator is not
running.

* libafl_qemu: fallback cpu for read-/write_mem

In systemmode, current_cpu may not be set.
In such cases use the first cpus memory access methods.

* fuzzers: add example for libafl_qemu in systemmode

* libafl_qemu: update libafl-qemu-bridge revision

* libafl_qemu: add memory access by physcial address

* fix liabfl_qemu example

Use GuestAddr and physical memory access

* ci: install libslirp-dev for libafl_qemu

* fuzzers/qemu_systemmode: clean up example

* libafl_qemu: remove obsolete functions

emu::libafl_cpu_thread_fn
emu::libafl_start_vcpu
emu::start

* fuzzers/qemu_systemmode: simplify example

* improve build_linux.rs

* Update qemu_systemmode fuzzer

* upd

* clippy

* Save and restore CPU state in libafl_qemu

* clippy

* Clone

* upd

* upd

Co-authored-by: Alwin Berger <alwin.berger@tu-dortmund.de>
2022-11-22 16:29:43 +01:00
Alwin Berger
b33839708e
Fix QEMU systemmode fuzzing (#883)
* libafl_qemu: fix systemmode with slirp dependency

libslirp will be dropped from future QEMU releases (see https://wiki.qemu.org/ChangeLog/7.0).
This change adds the "slirp" feature,
which links with the host-systems libslirp.

* libafl_qemu: enable systemmode snapshots, vm_start

Re-enable snapshot functions.
Start the VM before qemu_main_loop.

* libafl_qemu: allow synchronous snapshotting

Add a flag to take snapshots synchronosly.
This should be used to take or load snapshots while the emulator is not
running.

* libafl_qemu: fallback cpu for read-/write_mem

In systemmode, current_cpu may not be set.
In such cases use the first cpus memory access methods.

* fuzzers: add example for libafl_qemu in systemmode

* libafl_qemu: update libafl-qemu-bridge revision

* libafl_qemu: add memory access by physcial address

* fix liabfl_qemu example

Use GuestAddr and physical memory access

* ci: install libslirp-dev for libafl_qemu

* fuzzers/qemu_systemmode: clean up example

* libafl_qemu: remove obsolete functions

emu::libafl_cpu_thread_fn
emu::libafl_start_vcpu
emu::start

* fuzzers/qemu_systemmode: simplify example

* improve build_linux.rs

* Update qemu_systemmode fuzzer

* upd

* clippy

Co-authored-by: Alwin Berger <alwin.berger@tu-dortmund.de>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2022-11-21 17:57:06 +01:00
Andrea Fioraldi
31077765de
Fix CI (#862)
* Autofix with new clippy

* Clippy
2022-10-26 09:41:08 +02:00
Patrick Gersch
cf9c4188c0
Disabling qemu dependecies for qemu fullsystem (#737)
* Disabling qemu dependecies by default

* Adding full emulation_mode support

* Removing usermode from libafl_qemu default features

* Fixing refactoring

* Fixing typo in systemmode

* Fixing clippy:needless-borrow

* Mark libafl_load/save_qemu_snapshot as unused + cpu_reset

* Fixing clippy::needless-borrow

* Fixing needless-borrow yet again

* reset_cpu -> cpu_reset

* Fixing github workflow yet again

* Fixing clippy::uninlined-format-args

* Adding current libafl_qemu_bridge

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2022-10-25 14:16:11 +02:00
Andrea Fioraldi
5571a03641
Implement thread-safe AsanGiovese in Rust with snapshots support (#851)
* Purge C impl of asan-giovese

* Compiling

* reset asan

* Restore asan state in qemu

* clippy

* upd

* Asan snapshots

* fuzzbench_qemu

* fix snap mmap limit

* fix

* compiles again

* clippy

* update meminterval

* autofix

* fix 32 bit targets

* try to clean intermediate builds

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-10-25 09:48:59 +02:00
Andrea Fioraldi
4ccd85f568
Refactor QEMU snapshot helper and add mmap memory limit (#844)
* waiting for an interval tree...

* Rework QEMU user memory snapshots

* Fix pcrel to 1

* clippy

* clippy
2022-10-19 18:46:37 +02:00
Andrea Fioraldi
fbff363842
Update qemu (#835) 2022-10-13 21:16:07 +02:00
Dominik Maier
94f0c7f56e
Moving to named parameters in format strings (#827)
* autofix

* you're just asking for a clamping

* autofmt on linux

* fix nits

* change back nit

* unfixing as u64 for GuestAddr

* fix

* ignoring clippy for GuestAddress
2022-10-11 13:45:01 +02:00
WorksButNotTested
60a6c3f68b
Add support for ARMBE8 (#768)
* Changes to build QEMU out-of-tree so that we don't need to clone the repo for each feature combination we build

* Add be support to libafl_qemu

* More config tweaks

Co-authored-by: Your Name <you@example.com>
2022-09-15 20:25:56 +02:00
Dominik Maier
28194ac746
New Clippy fixes for QEMU (#757) 2022-09-02 18:49:41 +02:00
Patrick Gersch
b2a1e03703
Qemu arm launcher (#708)
* Adding qemu_arm_launcher crate

* Trying to fix qemu arm usermode

* Cargo fmt

* Adding CROSS_CC env

* Remove hardcoded arm-linux-gnueabi-gcc and replace by CROSS_CC

* Adding arm-linux-gnueabi-gcc to github workflows for ubuntu

* Fixing typo in apt install package

* Resetting LR after each fuzzing emulation

* Cargo fmt after merge conflict

* Using GuestAddr

* Compiling, running and running with artificial crash detection

* Adding dependencies for github workflow to cross compile for arm

* Fixing github workflow for ubuntu fuzzer

* arm-linux-binutils for mac in github workflows

* Qemu does not work for mac, no need to compile qemu_arm_launcher harness for it
2022-08-02 11:46:24 +02:00
Andrea Fioraldi
1682ce6862
Fix SIGILL handling in libafl_qemu (#711) 2022-07-26 17:31:18 +02:00
Andrea Fioraldi
90f0f06ef5
Raw API for full-system libafl_qemu (#692)
* full system build

* start supporting more cpus

* first proto working

* more Emulator methods

* fix

* fix

* backdoor

* fix

* libvduse.a

* hash

* clippy

* debug

* working usermode

* Fix userspace arm

* clippy

* clippy

* clippy
2022-07-25 17:50:09 +02:00
Dongjia Zhang
405a1919b8
Still fixing ci (#683)
* fix

* fix

* more

* cargo fixed??

* fixed??

* clp

* fix
2022-06-28 16:56:28 +09:00
Dongjia Zhang
5fd63c0076
Fix QAsan (#677)
* fix

* more
2022-06-23 17:54:50 +02:00
Andrea Fioraldi
7147170240
New hooks for libafl_qemu (#673)
* new block and edge hooks

* Wrking new hooks

* no Pin, just box

* working call tracing

* invalidate_block flag

* working call stack tracking helper

* callstack push

* fixes

* py

* fixes

* clippy

* clippy

* gdb api

* kill introspection

* fix

* upd qemu

* upd qemu
2022-06-16 11:09:07 +02:00
Andrea Fioraldi
93048f6270
Add custom GDB commands to libafl_qemu (#671)
* Add custom GDB commands

* clippy

* statically linked QEMU

* fix Calibrate

* clippy
2022-06-14 11:45:14 +02:00
Andrea Fioraldi
bb773a74d1
Update QEMU version (fix #575) (#619) 2022-05-05 13:24:44 +02:00
Andrea Fioraldi
bf9d2b4c57
Fix snapshots in libafl_qemu (#556)
* afl_exec_sec feature, disabled by default

* Fix snapshots in libafl_qemu

* working memory snapshots
2022-02-28 21:23:20 +01:00
Andrea Fioraldi
95d3de0f4b
Closure hooks and on thread create hook (#542)
* Closure hooks and on thread create hook

* on thread once hook

* clippy

* fix

* fix
2022-02-21 18:30:02 +01:00
Evan Richter
7150ffc5e6
[libafl_qemu] EasyElf::resolve_symbol return GuestAddr (#540)
Also enforce Linux support at the crate level instead of item by item
2022-02-16 21:34:56 +01:00