36 Commits

Author SHA1 Message Date
Valentin Huber
7fe0c576db
Make CommandExecutor Generic on the specific Input (#2129) 2024-05-02 15:39:06 -04:00
Gregory Petrosyan
b49ab999e3
libafl_bolts: rands super mega ultra giga house cleaning of doom (#2123)
* rands: simpler rand_trait code, remove useless test

* rands: provide and use proper random_seed()

* rands: add missing golden tests

* Don't use current_nanos() for seeding

* rands: remove RandomSeed trait
2024-04-29 11:00:44 -04:00
Dongjia "toka" Zhang
176659821a
Add TypeRefCreator trait (#2065)
* poc

* ai suggestion

* rename this

* aaaa

* fmt

* simplify

* delete blob

* ignore

* fixup?

* some progress on cow-ification

* some more

* clippy fixes, finalise tests

* whoops, missed a spot

* no std compat

* api change: Named now requires alloc feature

* doc fix

* missed a spot

* additional fixes

* libfuzzer fixes

* fix tutorial

* fix

* add

* aa

* fix tutorial

* fix

* Rename

* fix

* aa

* fmt

* aa

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-04-23 19:03:30 +02:00
Addison Crump
3d702f403b
Implement CanTrack tracking enforcement through rust types (#1886)
* sample implementation of tracking enforcement (incomplete)

* helpful compiler output

* make it look like a real compiler output

* ensure that the macro may be used outside of libafl

* separate index/novelty tracking funcs

* default const generic values so that we don't need to change this everywhere

* fix tests

* rollback unnecessary specification of stdmapobserver

* register metadata in doc tests

* doc fixes

* doc cleanup

* doc cleanup 2

* reduce implementor overhead to zero

* renaming/docs fixes

* asref isn't reflexive??

* generalization stage updates

* add better documentation about require_{indices,novelties}_tracking

* remaining generic updates

* round one CI pass (knowingly introduces breaking changes)

* typo

* round 2 clippy

* rollback: libafl_frida changes

* fmt

* moar porting

* fix remaining fuzzers

* fix windows build, maybe

* fixup libafl_libfuzzer

* fmt nighlty all the things

* attempt to fix some broken additions

* fix fmt

* oops

* fix new invocation

* minimizer scheduler fixes

* fix accounting

* rename

* fix

* Fix build

* Sort generics

* Move more generics into the right place

* Rename A -> C

* Fix test

* Fix test some more

* Fix doc some more

* critical formatting

* More A->C

* CanTrack harder

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
2024-04-12 18:33:52 +02:00
Dongjia "toka" Zhang
90c627a7e7
revert large map (#2004) 2024-04-05 17:06:47 +02:00
Dongjia "toka" Zhang
1dcfe8ef56
Make the map size larger for some of the example fuzzers (#1879) 2024-02-23 17:19:00 +01:00
Dongjia "toka" Zhang
2ac154d473
Refactor InProcessExecutor, merge timeout executors (#1789)
* move windows, inprocess fork to a different file, try new hook mechanism for the executor

* fix

* even more

* more

* more

* fix

* fix

* macosgit add -ugit add -u

* windows!

* windows!

* aa

* aa

* macos

* std

* wtf unresolved?

* Copy, Clone

* why you just don't have the same API!

* inproc

* next; inprocess

* windows?

* ci

* ci

* ci

* unused

* ci

* unused

* no_std

* windows no std

* fix

* inprocess

* fix

* windows

* fuzzers

* macos , book

* fix

* aa

* allow

* fix

* stop suggesting wrong lint AAAAAAAAAAAAAAAAA!!!

* stop suggesting wrong lint AAAAAAAAAAAAAAAAA!!!

* win

* fix

* wip

* wip2

* windows done?

* remove TimeoutExecutor

* ci

* ci

* miri

* fixfi

* compile on windows

* a

* clp

* no_std stuff

* windows no_std

* mac stuff

* m

* a

* ci

* ci

* deleting timeoutexecutor, gradually

* fucking macos

* ci

* test

* ci

* ci

* batch mode constructor

* fix

* ci

* aa

* miri

* aaa

* tmate again

* fix windows stuff

* final fix

* another win fix

* add

* let's add the new fix later

* more

* fi

* parse

* win clippy

* win no std

* safety

* fix

* DEFAULT

* final fix

* libafl_libfuzzer

* comments

* fix

* fix fuzzres

* fixxxxx

* fixxxxx

* last fix

* change name
2024-01-23 22:35:14 +01:00
Dominik Maier
c93291ab57
Fix as_object UB discussed in #1748 (#1751)
* Fix as_object UB discussed in #1748

* More cleanup, more less UB

* Fix fixes

* Added uninit_on_shmem api

* clippy

* fmt

* trying to fix fuzzers, libfuzzer wrapper

* Add OwnedRefMit::owned constructor, libfuzzer fix

* Some more fixes

* Add BacktaceObserver::owned fn

* fmt

* more fmt
2023-12-22 16:49:01 +01:00
Dominik Maier
e9e9c457d6
Move Bolts to libafl_bolts (#1335)
* sort memebers

* Building bolts

* fixing python, feature flags

* Cleanup bolts Cargo.toml

* Fix tests

* cleanup libafl

* removed duplicate examples

* Info text

* reenable agpl CI

* fix impl_serdeany

* new fmt

* Moved bolts

* fix some builds

* fix

* fix more fixes

* serdeany

* no_std

* Dependency cleanup

* Fix docs

* Docker

* add python bolts bindings

* no_std test fix

* merge fail

* typo fix

* add bolts dependency to fuzzers

* tiny fixes

* merge fun

* clippy

* link no longer exists

* make sure python gets rebuilt

* fix pybind

* doc fix

* remove bolts ref

* LibAFL bolts

* More info

* deprecation notice for launcher

* fix python

* cargo fmt

* fix concolic

* fix

* clippy

* fix libafl_cc

* fix tutorial, clippy

* fix concolic fuzzer

* fix push_stage_harness fuzzer

* prelude

* fix testcase post-merge

* mute clippy
2023-08-02 17:36:26 +02:00
Dongjia "toka" Zhang
109755208e
Revert "Make harness function take mut ref (#1338)" (#1358)
This reverts commit fe6daecf0bb178cd19970ae81c797443fd8cd88f.
2023-07-10 17:33:26 +02:00
Rowan Hart
fe6daecf0b
Make harness function take mut ref (#1338)
* Change executor trait to allow \&mut Input

* Add mut inprocess executor

* Add mut inprocess executor

* Format and fix clippy errors

* Fix more clippy errors

* Revert accidental refactoring of InMemoryCorpus

* Add mut versions of all executors that can support it

* Do not persist possible testcase mutation in stages, shadow/differential executors, or corpus minimization

* Fix missing imports

* Fix executor type for missed qemu items

* Add re-exports for mut executors

* Use InProcessForkExecutorMut in QemuForkExecutorMut

* Update BytesInput harnesses to take mutable references

* Update other-input-type-taking harnesses to take mut references

* Clippy fixes

* Feature gate TryFromIntError import

* Fix missed harness input type in baby_fuzzer

* Fix additional clippy issues

* Fix unnecessary hashes on string literal

* Even MORE clippy fixes

* Fix one more clippy issue

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-07-10 13:06:38 +02:00
Dongjia "toka" Zhang
aa6d331110
Fix CI (#1292) 2023-05-23 18:07:54 +02:00
Arpan Kapoor
6d2284d8b9
Allow configuring timeout for CommandExecutor (#1269)
* Allow configuring timeout for CommandExecutor

* import Duration on windows as well

* fix example fuzzers
2023-05-15 12:59:06 +02:00
Dominik Maier
c881dc996d
Example fuzzers with less UB (#1212)
* Example fuzzers with even less UB

* more less ub, fixes

* unused dep
2023-04-16 14:29:41 +02:00
Andrey Fedotov
1bd21509af
CASR deduplication for StacktraceObservers (#1184)
* Implement CasrAsanBacktraceObserver for dedupe crashes using libCASR and ASAN reports.

* Use casr observer with forkserver executor

* Add casr deduplication for AsanBacktraceObserver

* Add casr deduplication for BacktraceObserver

* Add Stacktrace filtering

* Move init_ignored_frames to constructors

* Add go ignore regexps for BacktraceObservers

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-04-04 19:03:11 +02:00
Dominik Maier
bbe4e85768
Removed new_ from constructors that don't need it (API consistency) (#1159)
* Removed new_ from constructors that don't need it (API consistency)

* un-change python bindings
2023-03-17 17:02:21 +01:00
Dongjia "toka" Zhang
30b51bb810
Remove unused dependencies (#1069) 2023-02-14 09:02:18 +01:00
R. Elliott Childre
5d76707ede
Bump deps and fix Clippy warns in example fuzzers (#1043)
* Mostly addressing changing the `uninlined_format_args` lint which was
  changed to warn-by-default in rust clippy 1.67

* Bump dependencies:
  bindgen:  0.61 -> 0.63
  cc:       1.0 -> 1.0.42 (Exclue versions w/incompat rayon dependency)
  clap:     3.x -> 4.0
  rangemap: 0.1 -> 1
  xz -> xz2:  move to updated version

* Add fallthrough default return to `LLVMFuzzerTestOneInput` in
  **/fuzz.c to prevent Clang's -Wreturn-type

* libafl_atheris: Improve POSIX compatibility and reduce warnings
  * Check for .dylib and .so libraries
  * `source` -> `.` for POSIX shells
  * install wheel into the venv to support newer Python packaging
    standards
  * `LDPRELOAD` -> `LD_PRELOAD`
2023-02-05 21:53:45 +01:00
Dominik Maier
75f12bd0eb
Remodelling Observers/Examples that rely on UB, API cleanups (#950)
* Tackling UB

* PtrMut -> MutPtr, moved mapobservers to non-UB

* QEMU fixes

* test fixes

* qemu

* Change all interfaces, fix all fuzzers

* fixes

* fix more fixes

* fmt

* fix qemu sugar

* fix some qemus

* atheris

* fmt

* more fmt

* most fmt

* more fix

* nyx fyx

* fix qemu

* clippy, fixes

* more fixes

* no unfix, only fix

* fix

* fix

* more clippy

* fixes

* ListObserver

* fmt, clippy

* fix qemu on arm

* update zlib target

* fix?

* fix

* added migration guide

* ignore doc

* fix symcc

* fix new win fuzzer

* Fixes, rename PTR_SIZE to PTR_NUM

* Try fix linking on win

* Trying to fix win linking

* more cov

* trying to fix win some more

* trying to fix mac

* trying to fix mac

* Fix tests

* Fix tests

* trying to fix win

* more mac

* giving up for windows

* fmt

* python3

* mac?

* undo windows tests
2022-12-24 14:20:44 +01:00
Dominik Maier
663a33168e
Associated types for Corpus, State (#767)
* Associated types for Corpus, State

* cleanup

* fix no_std

* drop unused clauses

* Corpus

* cleanup

* adding things

* fixed fuzzer

* remove phantom data

* python

* progress?

* more more

* oof

* wow it builds?

* python fixes, tests

* fix python fun

* black fmt for python

* clippy, added Nop things

* fixes

* fix merge

* make it compile (#836)

* doc-test fixes, prelude-b-gone for cargo-hack compat

* fixes for windows, concolic

* really fix windows, maybe

* imagine using windows

* ...

* elide I generic when used with S: State

* Elide many, many generics, but at what cost?

* progress on push

* Constraint HasCorpus, HasSolutions at trait definition

* remove unused feature

* remove unstable usage since we constrained HasCorpus at definition

* compiled, but still no type inference for MaxMapFeedback

* cleanup inprocess

* resolve some std conflicts

* simplify map

* undo unnecessary cfg specification

* fix breaking test case for CI on no-std

* fix concolic build failures

* fix macos build

* fixes for windows build

* timeout fixes for windows build

* fix pybindings issues

* fixup qemu

* fix outstanding local build issues

* maybe fix windows inprocess

* doc fixes

* unbridled fury

* de-associate State from Feedback, replace with generic as AT inference is not sufficient to derive specialisation for MapFeedback

* merge update

* refactor + speed up fuzzer builds by sharing build work

* cleanup lingering compiler errors

* lol missed one

* revert QEMU-Nyx change, not sure how I did that

* move HasInput to inputs

* HasInput => KnowsInput

* update bounds to enforce via associated types

* disentangle observers with fuzzer

* revert --target; update some fuzzers to match new API

* resolve outstanding fuzzer build blockers (that I can run on my system)

* fixes for non-linux unixes

* fix for windows

* Knows => Uses, final fixes for windows

* <guttural screaming>

* fixes for concolic

* loosen bound for frida executor so windows builds correctly

* cleanup generics for eventmanager/eventprocessor to drop observers requirement

* improve inference over fuzz_one and friends

* update migration notes

* fixes for python bindings

* fixes for generic counts in event managers

* finish migration notes

* post-merge fix

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2022-10-24 03:22:26 +02:00
Dominik Maier
9695ce0029
Refactor Output Observers (#856)
* Refactor Output Observers

* Delete .gitmodules

* modules

* Drop need for OutputObserving list
2022-10-24 02:50:00 +02:00
Alessandro Mantovani
0307dadcd1
Allow two different observers for DiffExecutor (#843)
* DifferentialExecutor for CommandExecutor along with StdIO observer

* format

* fix CI issues

* fix format and unit test

* fix documentation

* allow three structs and doc only for linux

* resolve documentation test failure

* minor

* running fmt_all.sh

* into_executor() takes 4 params, not just 1

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2022-10-23 01:59:40 +02:00
syheliel
2504b6dae3
Add rustfmt.toml (#722)
* add `rustfmt.toml`

* format fix

Co-authored-by: syheliel <syheliel@gmail.com>
2022-08-12 02:28:32 +02:00
Dominik Maier
5a8bdae26f
Update requirements (#714)
* Update requirements

* more updates

* nits

* more updates

* update nix for fuzzers

* use any regex 1 instead of 1.6
2022-07-29 09:54:16 +02:00
Mrmaxmeier
321bcfeba1
Cleanup duplicate package warnings (#702)
* cleanup duplicate package warnings

* libmozjpeg fuzzer: disable png reading support

libmozjpeg's libpng support is not used by the fuzzing harness,
and the mozjpeg-4.0.3 release has a build system issue with
newish libpng versions.
2022-07-17 14:17:49 +02:00
Dominik Maier
bfe69aea09
Format C/Cpp code in ./scripts/fmt_all.sh (#653)
* format all (clang format 13)

* added clang-format check

* re-add missing newline

* cargo doc was missing

* more brackets

* fixed fmt workflow

* clang format

* shellcheck

* install clang-format-13

* update ubuntu for maximum clang-formattability

* yml whitespaces

* fmt

* shellcheck only for .sh

* oops path

* ignored shellcheck warning
2022-05-29 03:23:02 +02:00
Andrea Fioraldi
da537aae83
FeedbackState as metadata (#627)
* SerdeAny MapFeedbackState

* Fix macro syntax

* alloc

* fix

* Metadata calibrate and map feedback

* metadata feedback states

* compile

* fmt

* Register common generic types

* tests

* sugar

* no_std

* fix book

* alloc

* fix fuzzers

* fix

* fmt

* disable python bindings for libafl

* clippy

* fmt

* fixes

* fmt

* fix

* fix

* fix

* fix

* fix

* release autofix

* fix

* fix

* fix

* fmt

* fix

* fix

* name

* fix

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-05-24 16:05:22 +02:00
WilliamParks
92196cc9be
Fixes forkersever_simple issue on Macs (#623)
* Fixes forkersever_simple issue on Macs

* fixes formatting issue

* Fixes formatting issue
2022-05-08 11:17:55 +09:00
Dongjia Zhang
2ba32c0173
Update Clap dependency (#621) 2022-05-06 01:12:25 +02:00
Andrea Fioraldi
8eab7d6063
Fix fuzzers (#563)
* fix libfuzzer_libpng_ctx

* fix

* fix

* Fix stb

* fix

* fix
2022-03-07 08:59:01 +01:00
Andrea Fioraldi
a56f4af7da
CorpusScheduler -> Scheduler and move them to the schedulers folder (#560)
* CorpusScheduler -> Scheduler

* fix book

* update fuzzers

* fix tests

* fix sugar

* fix

* fix tutorial

* fix tutorial

* fmt

* fix

* fmt

* fmt
2022-03-03 14:27:37 +01:00
Dongjia Zhang
d676363c64
Fix Forkserver Example (#533)
* fix

* fix

* fix

* update

* change
2022-02-11 10:41:07 +01:00
Dongjia Zhang
53bc6e2318
test_all_fuzzers.sh fix (#531)
* fix

* fix

* fix
2022-02-11 10:04:04 +01:00
Andrea Fioraldi
eb668384bb
Fix hardcoded BacktraceObserver (#530)
* refactor BacktraceObserver and InProcessForkExecutor

* cleanup

* fix improcess

* fix

* mormanti

* win fix

* clippy

* fix backtrace_baby_fuzzers/command_executor

* win fix

* clippy
2022-02-10 21:45:20 +01:00
Dominik Maier
6810e6085b
Builder for CommandExecutor & Tokens Refactoring (#508)
* builder for CommandExecutor

* tokens api cleanup, clippy

* fix doctest

* cleanup

* added testcase, remodelled

* command executor builder fix

* fix fuzzer(?)

* implemented From for configurator

* nits

* clippy

* unused

* autotokens

* cleanup

* nits

* Err instead of empty tokens

* fix tokens fn

* fix err

* more error fixing

* tokens remodelling

* typo

* recoverable fail on missing autotokens

* clippy, nostd

* asslice, into_iter, etc. for tokens

* adapt fuzzers

* iter

* fixes, clippy

* fix

* more clippy

* no_std

* more fix

* fixed typo

* cmd_executor builds again

* bring back ASAN stuff to Command Executor

* forkserver speedup

* no need to static

* back to earlier
2022-02-01 10:10:47 +01:00
Youssef
e307dfb16f
Implement backtrace observers for crash dedupe (#379)
* create stacktrace observer

* create stacktrace feedback

* post-merge fixes

* address comments

* update Cargo.toml

* fix CI issue + dynamic naming

* duplicate baby_fizzer

* update stacktrace baby_fuzzer

* force unwinding tables

* ignore test dumps

* fix stacktrace baby_fuzzer logic

* upgrade Backtrace version

* trigger observers.post_exec in crash_handler

* implement NewHashFeedbackState and update logic

* digest symbols pointers

* cleanup

* minimal output

* fix backdated EventFirer generic param

* add baby_fuzzer example with a fork executor

* duplicate baby_fuzzer_stacktrace with forkexecutor

* backtrace collection implemented

* add c app fuzzer example with a fork executor

* group backtrace baby fuzzers

* added c code baby fuzzer with inprocess executor

* remove need for static COLLECT_BACKTRACE

* moved code to stacktrace.rs + fixed bug

* add comment

* add command executor fuzzer example

* post merge cleanup

* add missing doc

* address comment

* fix nit

* clean duplicate variable in timeout handler

* fix command executor bt collection

* clean code and use StdShMem

* cleanup

* add ObserverWithHashField + rename StacktraceObserver

* rename + refactor some code

* add CommandBacktraceObserver

* update command executor

* update baby fuzzers

* simplify BacktraceSharedMemoryWrapper

* use better names + static methods

* use std feature macro on BacktraceObserver + fix bug

* use Box in HashValueWrapper to minimize variants size diff

* use copy_from_slice

* std conditional backtrace collection

* fix std import

* fix comment

* add exit_kind to observer.post_exec

* added hash trait to Input

* collect backtrace in post_exec

* add crash handlers to InProcessForkExecutor

* fix panic message

* duplicate forkserver fuzzer example

minimal example

update

* proto bt collection working

* rename CommandBacktraceExecutor to ASANBacktraceExecutor

* refactor ASANBacktraceObserver

* support for forkserver working

* update fuzzer example

* less verbosity

* Post merge fixes

* implement hash for GeneralizedInput

* update forkserver example after merge

* clippy fixes

* fix inproc test

* fixes for cargo hack --feature-powerset

* fix baby_no_std

* implement Hash for NautilusInput

* update fork executor baby fuzzer

* fix doc

* implement Hash for PacketData

* fix windows build

* fix windows no_std

* fix backtrace baby fuzzers README

* add comments

* move setup_bt_panic to constructor

* pre/post child exec hooks in Observer

* setup_child_panic_hook

* fix ObserversOwnedMap on nightly

* add backtrace fuzzers to CI checks

* fix typo

* fix relative paths in test_all_fuzzers.sh

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2022-01-31 15:58:15 +01:00