1180 Commits

Author SHA1 Message Date
03fbe41dbb WIP: port fret 2023-12-22 12:54:16 +01:00
Romain Malmain
830faec95f
QEMU filtering rework + paging filtering (#1705)
* Added paging filtering.
Reworked address range filtering to fit with new generic code.

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Fix: clippy + format

* Updated qemu-libafl-bridge

* Fix QEMU userspace crash handler (#1706)

* Fix QEMU userspace crash handler

* no_std

* libafl_cc custom llvm_config lookup for solaris/illumos (#1708)

* fix simd (#1709)

* Updated qemu

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: David CARLIER <devnexen@gmail.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-12-21 15:51:14 +01:00
Dongjia "toka" Zhang
a98805b4ca
Another attemp to fix CI (#1744)
* fixing?

* more

* delete macos build_and_run fuzzers as its runtime exceeds 360minutes and can't fix it
2023-12-21 04:43:01 +09:00
Dongjia "toka" Zhang
57a64e805f
Trying to fix CI (#1739)
* test

* dummy

* dummy
2023-12-20 16:48:02 +09:00
Dongjia "toka" Zhang
78060ea308
0.11.2 (#1735) 2023-12-18 14:33:14 +01:00
van Hauser
63e1523358
small fixes and enhancements (#1731)
* nits

* first steps

* different approach

* fixes

* remove temps

* remove temp

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-12-17 20:19:15 +09:00
Dongjia "toka" Zhang
7894efe728
Last cleanup after decapstone (#1727)
* Last clenup

* more

* more
2023-12-16 19:51:42 +09:00
Dongjia "toka" Zhang
a0a4dd60bb
Remove capstone from frida [x86_64] (#1720)
* init

* more

* just fixing stuff
2023-12-16 02:39:11 +09:00
Andrea Fioraldi
f1aee3c376
Refactor QEMU hooks (#1690)
* Rewrite QEMU Asan

* fake sys

* New hooks

* edge cov helper

* opaque raw hook

* new hooks

* EMulator::get

* new asan

* fix fuzzers

* fix types

* fix

* fix

* fix

* merge fix

* fix
2023-11-23 18:57:15 +01:00
Dongjia "toka" Zhang
9a1173d4a6
scalability monitor 2nd (#1685)
* tekito

* monitor

* fix

* all

* ci

* ci
2023-11-21 23:54:19 +01:00
Dongjia "toka" Zhang
379e2ae89b
Scalability introspector + State refactor (#1674)
* check

* clippy fmt fixing all the stuff

* restore Cargo.toml

* a

* ci

* ci

* a

* a

* workging?

* work

* ?

* why it worksgit add -u

* ci

* ci

* TMATE

* ci

* ci

* ci

* remove tmate

* less

* fuck; let's try with introspection first

* fucking macro

* another windows shit

* stop it

* i'm harassed by how shit windows is

* fixing

* ci

* ziopera

* fix from main

* ci

* ci
2023-11-21 14:38:48 +01:00
Addison Crump
281524dbf9
Unicode-preserving mutators (#1542)
* create the string classification stage

* modify API to pre-group

* preserving mutator

* more meaningful test

* subproperty mutators + some fixes

* document, finalise, integrate with libafl_libfuzzer

* add example, fix for weird range select

* fix for introspection

* fix fuzzer build

* speed optimisation: allow, but do not require, stacking

* property => category

* token replacement

* fixup: rare case where rust does not agree on valid character

* fix CI again

* again again

* take two: dynamic unicode discovery

* oops

* fix: last byte is never selected

* opt: bias to smaller unicode categories

* fix test

* opt: precompute regions and fix tests

* cache and allow stacking

* document and update libafl_libfuzzer

* oops, use reverse

* fix bolts clippy error

* fixup part 2

* clippy

* part 2

* clippy warning allow

* clippy complaint

* use alloc not std

---------

Co-authored-by: toka <tokazerkje@outlook.com>
2023-11-21 00:41:16 +01:00
s1341
57296a6750
Use Compound configurations in libpng launcher fuzzer (#1676) 2023-11-19 11:11:52 +01:00
Dongjia "toka" Zhang
d53503b73e
Fix stb image on windows (#1657)
* fix

* fix

* HOW DO I ADD FROM:FROM????

* ok
2023-11-08 15:20:35 +01:00
Dongjia "toka" Zhang
02cd260af0
Update LibAFL concolic (#1634)
* concolic upd

* more

* working

* clippy

* rev

* fix

* remove cur_input

* rev

* gitignore
2023-10-22 13:44:01 +02:00
Andrea Fioraldi
35e387773c
Format C code (#1621)
* Add iter() to owned slice

* Format C
2023-10-11 14:19:14 +02:00
Andrea Fioraldi
47cd4dfea6
Break on timeout in QEMU system mode (#1619)
* Break on timeout in QEMU system mode

* fix

* fix

* fix
2023-10-11 14:01:18 +02:00
Dongjia "toka" Zhang
bc91436ef4
Refactor cmplog observers (#1603)
* refactor

* Rename Everything

* fmt

* chg

* test

* aa

* doc fix

* fix?

* doc
2023-10-06 15:22:11 +02:00
Dongjia "toka" Zhang
fc16b70a65
Format C (#1602) 2023-10-03 13:40:19 +02:00
Dongjia "toka" Zhang
5b0e3dd3bc
Make fuzzbench debugging easier (#1574)
* to make debugging easier

* debug
2023-09-29 18:32:09 +02:00
WorksButNotTested
d3a4b726d8
Added qemu_cmin (#1572)
Co-authored-by: Your Name <you@example.com>
2023-09-29 08:59:41 -04:00
WorksButNotTested
9755d189dd
Write coverage for QEMU into separate files (#1571)
Co-authored-by: Your Name <you@example.com>
2023-09-28 15:57:34 -04:00
WorksButNotTested
9c3f8f4511
Qemu features3 (#1538)
* Fix issue with libafl_qemu being repeatedly rebuilt

* Changes to make qemu_launcher a production ready fuzzer

* Remove _get prefix

* Don't collect DrCov data during the campaign

* Fix poor performance

* Better validation for core selection

* Changes to print debug when running in verbose mode

* Autofix

* Remove afl++-clang

* Fix build error on 32-bit

* Fix some clippy

* Fix OSX

* Set default version of clang/clang++

* Review changes

* Fix issue with fd sharing between processes

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-09-28 14:31:15 +02:00
Dongjia "toka" Zhang
b3483ddd42
Give proper name to some crates and exclude them 2 (#1562)
* fix

* comma
2023-09-27 13:29:24 +02:00
Dongjia "toka" Zhang
324db072a2
Fix CI (#1558)
* endif

* just fix every profile

* WHY YOU DONT JUST USE THE SAME NAME FOR DIR

* fix

* Some fuzzer want release

* WHY I ALWAYS FORGET COMMA

* NO MORE SPACE

* rename

* stb doesn't like debug build

* just use release

* another just use release
2023-09-27 09:59:55 +02:00
Dongjia "toka" Zhang
c1006c4d38
Fix CI (#1553)
* export PROFILE

* install aflplusplusw

* no dot

* a
2023-09-25 20:51:40 +02:00
Dongjia "toka" Zhang
c1eef33b5d
Remove --release from Makefile.toml (#1522)
* rem release

* Revert "rem release"

This reverts commit 13aaf13e412818629880348188c3e1b4137b9ed8.

* toggle it with envvar

* fm
2023-09-25 14:22:10 +02:00
Dominik Maier
aa7993de10
Some AFL UI example fuzzer cleanup (#1529)
* Some afl ui cleanup

* more info

* Fix CI (#1549)

* Change profiles for the fuzzbench fuzzers.

* just foreground

* Revert "just foreground"

This reverts commit abd4fbec40fd1a7f3bcca1190ce11816fc868c53.

* fix Makefile.toml

* Tmate debug

* fix?

* fix?

* Can't fix this

* remove reset

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-09-24 14:54:14 +02:00
Dongjia "toka" Zhang
c103444396
Change profiles for the fuzzbench fuzzers. 2023-09-22 23:51:06 +02:00
Fabian Freyer
7f0a4f1d7e
libafl_frida: Add FridaInstrumentationHelperBuilder, don't rely on Clap options (#1523)
* impr(frida): Don't keep FuzzerOptions in Helper

Instead, keep the actual values that are needed. This allows us to make
a builder for FridaInstrumentationBuilder in a subsequent commit.

* refactor(frida): Move workaround to separate method

This is just code movement.

* refactor(frida): move transformer initialization

Mostly code movement here, sets up replacing `new` with a builder. The
one exception is the introduction of a lifetime bound on RT, which needs
to outlive the transformer. This could be generic, but there's probably
no reason to introduce an additional lifetime.

However, because of this lifetime introduction, this is _technically_ a
breaking change.

* impr(frida): Pass module map to runtimes

Instead of passing a slice of modules to instrument, and re-building the
modulemap, pass a Ref-counted module map directly to the initialization.

* feat(frida): Builder for InstrumentationHelper

Co-authored-by: Dominik Maier <domenukk@gmail.com>

* impr(frida/alloc): optional options in allocator

Move all the initialization into Default::default with sensible defaults
and override parameters set from options in new.

* impr(frida): remove options from AsanError

The only option AsanError uses is whether to continue on error. Instead
of keeping a whole clone of the options around, just store that single
boolean value.

* impr(frida/asan): Use less FuzzerOptions

* Implement Default::default to get a good default AsanRuntime

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-09-20 11:08:59 +02:00
ToSeven
defe9084ae
Add an example fuzzer with AFL-Style UI (#1501)
* Add an example fuzzer with AFL-Style UI

* fix CI errors

* fix CI and improve the UI

---------

Co-authored-by: toseven <Byone.heng@gmail.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-09-12 10:17:31 +02:00
Evan
9645dca274
Fixed libafl_atheris Makefile and flag read (#1499) 2023-09-05 01:31:31 +02:00
Dominik Maier
f27107c5e4
Fix docs build for libafl_qemu (#1495)
* Fix docs build for libafl_qemu

* turn around

* does this work?

* build all-features in CI

* fixes

* fix ci
2023-09-02 21:56:01 +02:00
Andrea Fioraldi
00033426e7
Bump to 0.11.1 (#1491) 2023-08-31 15:07:31 +02:00
Andrea Fioraldi
7dd7c1a485
Bump to 0.11.0 (#1469)
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-08-28 15:36:43 +02:00
Rowan Hart
8d8fcdd8db
Add generic cmp observer metadata, rename cmp observers, fix cmplogmap reset (#1461)
* Make cmp metadata generic, rename ForkserverCmpObservers with more accurate names

* Fix zeroed assignment in cmplogmap

* Dont use prelude in libafl_targets

* Make _mut functions actually return mut references

* Fix fuzzbench forkserver build

* Add type alias for easier construction of the standard cmp observer and add aux data accessors
2023-08-26 09:54:31 +02:00
Dominik Maier
6df415438d
Update frida_gdiplus readme (#1464)
Thanks to Nuja from Awesome Fuzzing Discord
2023-08-25 14:49:57 +02:00
Addison Crump
9aa40c0734
Document libafl_libfuzzer (#1457)
* prep for publishing libafl_libfuzzer

* learn to use linkers

* document-features

* special handling for fuzzbench builds

* Update cmplog.c

* drop dep for llvm-tools; add testcase for memcmp sanity

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-08-24 20:24:38 +02:00
Addison Crump
862de53cf6
Full libfuzzer shimming (for cargo-fuzz libfuzzer alternative and other use cases) (#981)
* squash libfuzzer edits

* fixup: compat with custom mutators

* use tui flag

* add introspection support

* use libfuzzer dep now that we've merged

* force input loading

* some fixes

* begin docs, impl shrink

* make whole-archive conditional and not default

* make more copies of counters maps

* lol, remember to add the observer

* make size edge map observer an observer

* fixup: make def of run driver conditional

* add sanity checks for insertion

* revert silencing of forks

* add experimental tmin support; add default asan flags

* use default options instead of specifying our own

* implement lockless mode

* fix merge

* fixup lockless corpus

* fixup for generalisation

* remove erroneous drop_in_place

* improve error logging in the case of corpus loading failure

* ok, use lock files 😔

* fix tmin

* implement merge (again); fix rare cases with maps being too small

* implement a scheduler for removing excess

* implement a walking strategy for corpus loading for large corpora

* revert filename parameter; rename and remove duplicates

* various cleanup and clippy satisfaction

* fix no_std tests

* clang-format

* expand and satisfy the clippy gods

* fix sanitizer_ifaces bindgen for no_std

* fix wasm fuzzer

* fixup clippy script

* rename and provide a small amount of explanation for sanitizer_interfaces

* fixup: HasLastReportTime

* fix clippy oddities

* restrict clippy checks to linux-only for libafl_libfuzzer_runtime

* name the mutators

* format

* fix clippy warning

* hope docker is fixed

* fix cmin lint

* clippy pass

* more docs

* more clippy

* fix remaining clippy complaints

* fix import

* miri fixes (no constructors executed)

* exclude libafl_libfuzzer from cargo-hack

* fix clippy check for sanitizer_interfaces

* fmt

* fix CI (?)

* deduplicate sancov 8bit for improved perf on ASAN

* merge 8bit coverage regions + comment out insane deduplication

* no erroring out on free hooks

* fixup for non-forking merge

* skip the corpus dir if we use it

* fixup: recent libafl changes and feature flags

* libafl_libfuzzer: use rust-lld for whole-archive feature

* clarify cause of failure

* mark unsafe

* clippy :cursed_cowboy:

* attempt to fix wasm

* spooky unknowable bug 👻

* more clippy lints

* clippy fix for merge

* use the version pin

* add unsafe to ::register

* Serdeany autoreg fix

* make type assert actionable

* miri fixes

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dominik Maier <dmnk@google.com>
Co-authored-by: Mrmaxmeier <Mrmaxmeier@gmail.com>
2023-08-24 13:30:23 +02:00
Dominik Maier
e89e8dbaab
Remove dependencies, add doc.rs metadata (#1450)
* Remove dependency, add doc.rs metadata

* remove lazy_static

* even less lazy_static

* serial_test no default
2023-08-24 11:34:38 +02:00
Andrea Fioraldi
0b43711dc9
Fix LLMP p2p + restart bug with CentralizedEventManager (#1389)
This commit rewrites the centralized manager to use a secondary broker, as p2p communication is unreliable during frequent restarts. A centralized launcher is introduced too.
2023-08-22 15:57:50 +02:00
Dominik Maier
6e5d102673
Clippy fixes for frida_executable_libpng fuzzer (#1438) 2023-08-21 19:41:03 +02:00
Dominik Maier
c31ca2c9f7
Fix Frida CI for Windows, Clippy (#1430)
* Fix Frida for Windows

* more fix

* clippy in pthreads
2023-08-20 13:30:21 +02:00
Dominik Maier
1d746b4074
Fixes for frida, qemu_sugar (#1427)
* Fixes for frida, qemu_sugar

* tiny clippy

* clippy

* fix thread_id

* Attempted fix for qemu
2023-08-20 12:00:41 +02:00
Dominik Maier
35fa881ff0
Update frida (#1408)
* Update frida

* fix build

* aarch64

* fix aarch64 buid

* Fix CI

* move to git version of frida

* fix

* Frida frida frida
2023-08-17 17:49:12 +02:00
Dominik Maier
b0179b4498
Update some deps, clippy (#1422)
* More less default

* More clippy

* updated rangemap

* Clean up depencdencies

* Undo accidental remove

* Fix

* trying to fix qemu build

* hexagon be gone
2023-08-17 17:15:03 +02:00
Dominik Maier
5dd5b1efa8
More fuzzer fixes for Bolts (#1397)
* more fixes

* more docker fix
2023-08-03 11:45:18 +02:00
Dominik Maier
febb154e49
Fix merge fail for baby_fuzzer / bolts (#1394)
* Fix merge for bolts

* warning fix

* warning fix
2023-08-03 01:58:09 +02:00
Dominik Maier
e9e9c457d6
Move Bolts to libafl_bolts (#1335)
* sort memebers

* Building bolts

* fixing python, feature flags

* Cleanup bolts Cargo.toml

* Fix tests

* cleanup libafl

* removed duplicate examples

* Info text

* reenable agpl CI

* fix impl_serdeany

* new fmt

* Moved bolts

* fix some builds

* fix

* fix more fixes

* serdeany

* no_std

* Dependency cleanup

* Fix docs

* Docker

* add python bolts bindings

* no_std test fix

* merge fail

* typo fix

* add bolts dependency to fuzzers

* tiny fixes

* merge fun

* clippy

* link no longer exists

* make sure python gets rebuilt

* fix pybind

* doc fix

* remove bolts ref

* LibAFL bolts

* More info

* deprecation notice for launcher

* fix python

* cargo fmt

* fix concolic

* fix

* clippy

* fix libafl_cc

* fix tutorial, clippy

* fix concolic fuzzer

* fix push_stage_harness fuzzer

* prelude

* fix testcase post-merge

* mute clippy
2023-08-02 17:36:26 +02:00
Dominik Maier
006dcac00c
Named Mutators and MultiMutator API change (#1387)
* Mutators need names (alternative to #1379)

* Signature of MultiMutator shouldn't be the same as the normal mutator

* Named for python, remove mutator for multi_mutator

* fmt

* clippy edition warning

* clippy

* mac_count doc fix, return cleanup
2023-08-01 16:58:40 +02:00