1180 Commits

Author SHA1 Message Date
Andrea Fioraldi
ac4a0e7330
libafl_qemu snapshot device filter (#1386)
* libafl_qemu snapshot device filter

* Working device list

* regenerate bindings stub
2023-08-01 12:01:10 +02:00
Dominik Maier
003b219826
Make all no_mangle fns extern "C" (#1369) 2023-07-14 17:42:58 +02:00
WorksButNotTested
2002bbca35
Arch independent helpers in libafl_qemu (#1355)
* Add more features to libafl_qemu to remove some of the heavy lifting from the fuzzers

* Refactor qemu_coverage

* Minor tweaks to fix other fuzzers

* Autofix

* Add CallingConvention to write_function_argument

* Replay reverted clippy fixes

---------

Co-authored-by: Your Name <you@example.com>
2023-07-11 10:56:40 +02:00
Dongjia "toka" Zhang
109755208e
Revert "Make harness function take mut ref (#1338)" (#1358)
This reverts commit fe6daecf0bb178cd19970ae81c797443fd8cd88f.
2023-07-10 17:33:26 +02:00
Rowan Hart
fe6daecf0b
Make harness function take mut ref (#1338)
* Change executor trait to allow \&mut Input

* Add mut inprocess executor

* Add mut inprocess executor

* Format and fix clippy errors

* Fix more clippy errors

* Revert accidental refactoring of InMemoryCorpus

* Add mut versions of all executors that can support it

* Do not persist possible testcase mutation in stages, shadow/differential executors, or corpus minimization

* Fix missing imports

* Fix executor type for missed qemu items

* Add re-exports for mut executors

* Use InProcessForkExecutorMut in QemuForkExecutorMut

* Update BytesInput harnesses to take mutable references

* Update other-input-type-taking harnesses to take mut references

* Clippy fixes

* Feature gate TryFromIntError import

* Fix missed harness input type in baby_fuzzer

* Fix additional clippy issues

* Fix unnecessary hashes on string literal

* Even MORE clippy fixes

* Fix one more clippy issue

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-07-10 13:06:38 +02:00
Dongjia "toka" Zhang
8cca87f2bd
Fix #1342 (#1345)
* push

* fmt
2023-07-05 13:03:09 +02:00
Dominik Maier
e5b3e5a677
Fixed Forkserver shmem input length, made it configurable (#1342)
* Fixed Forkserver shmem input length, made it configurable

* fix redqueen clippy

* Clippy

* Clippy

* WHY ARE THERE TWO TIMES THE SAME FN

* More clippy
2023-07-04 14:57:09 +01:00
Dongjia "toka" Zhang
07f4c42ecf
AFL++ redqueen update (#1291)
* up

* dbg

* fix

* fmt

* fix

* refactor

* more

* clp

* upd

* fmt

* fmt

* last

* debugging

* wip

* lastlast

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-07-03 19:27:34 +02:00
Dominik Maier
c0e1236a07
Formatting fuzzers with new fmt (#1340) 2023-07-02 18:19:48 +01:00
WorksButNotTested
c6062889d5
Extend qemu_launcher to support multiple architectures (#1328)
* Change qemu_launcher fuzzer to support multiple architectures and remove qemu_arm_launcher

* Review changes

* Changes to milliseconds

---------

Co-authored-by: Your Name <you@example.com>
2023-06-30 02:18:00 +02:00
s1341
71aa0221a0
Add feature to build variants/configurations automatically, with libtool/cc/cxx shims (#1322)
* Add feature to build variants/configurations automatically, with libtool/cc/cxx shims

* Fixes

* Clippy

* Add brief comment describing usage

* Fix

* Fix fuzzers: add ToolWrapper

* Clippy

* More clippy

* More clippy

* Add Compound configuration

* Clippy

* Fix

* Clippy

* Damn that Clippy

* Change names of Configurations

* Add ar wrapper

* Fix

* Clippy

* Windows build

* Clippy

* Clippy

* Clippy
2023-06-22 16:17:33 +02:00
Dominik Maier
f858e1a247
Add TcpEventManager (#1302)
* Tcp manager, initial commit

* no tokio by default

* Allow Any broker type

* Add tcp_manager example

* fix CI
2023-06-10 06:25:25 +02:00
WorksButNotTested
747a636f4f
Add sample fuzzer which collects DrCov coverage for various architect… (#1300)
* Add sample fuzzer which collects DrCov coverage for various architectures using QEMU instrumentation

* Fix clippy

* Rename NullCorpus to NopCorpus

* Added support for verbose output

* Attempt to fix clippy again

* Fix remaining defaults to use x86_64 when no arch specified and be more robust handling partial builds

* Make build even more robust against partial re-builds

* Added missing dependencies to workflow, updated README

* Add missing dependencies for i386

* Another dependency

* More dependencies

* Disable tests on OSX

* Add tmate

* Add missing dependencies and symlink header directory

* Tidy up after test so we don't hog all the disk space

---------

Co-authored-by: Your Name <you@example.com>
2023-06-06 11:50:38 +02:00
Dongjia "toka" Zhang
aa6d331110
Fix CI (#1292) 2023-05-23 18:07:54 +02:00
Dongjia "toka" Zhang
6f21cb3848
Bump to 0.10.1 (#1280)
* bmp

* remove DEBUG env var
2023-05-22 12:42:36 +02:00
Arpan Kapoor
6d2284d8b9
Allow configuring timeout for CommandExecutor (#1269)
* Allow configuring timeout for CommandExecutor

* import Duration on windows as well

* fix example fuzzers
2023-05-15 12:59:06 +02:00
Dongjia "toka" Zhang
52d557aa8f
Ecofuzz Fix 2 (#1262)
* finally works

* f
2023-05-09 16:45:20 +02:00
Dongjia "toka" Zhang
c8fad7833d
Use InMemoryOnDiskCorpus in fuzzbench fuzzer (#1240)
* in memory

* f

* aaa

* nn
2023-05-02 15:18:17 +02:00
van Hauser
8ff8ae41f1
switch fuzzbench to FAST schedule (#1233) 2023-04-27 11:11:53 +02:00
ToSeven
f248a061ef
add the version information of fuzzers in the UI (#1224)
Co-authored-by: toseven <Byone.heng@gmail.com>
2023-04-26 16:52:21 +02:00
Andrea Fioraldi
8ade809588
Centralized Testcase evaluation EventManager (#1216)
* template

* moar

* merge

* compiles

* fuzzer

* forward event newtestcase

* clippy
2023-04-24 11:38:55 +02:00
Dongjia "toka" Zhang
39c0a2040b
Fix CI (#1225) 2023-04-20 19:04:31 +02:00
Dominik Maier
96e24d1c8b
Move Input loading and dumping APIs from Testcase to Corpus (#1201)
* Less allocatiosn for filenames

* clippy for wasm fuzzer

* Reworked filename and rename APIs

* python, clippy

* fmt

* More cleanup, fixed metadata location

* clippy

* fix fuzzbench_text / cached len, invert parameters (state first)

* clippy

* oops

* Caching for paths

* simplified, fixed

* no_std

* cached_len

* Nider API for input getting
2023-04-18 12:14:49 +02:00
Andrea Fioraldi
fd68c8a81f
Batch mode timeouts (Linux only ATM) (#1193)
* batch mode timeouts for linux

* batch_mode is linux only atm

* fix

* fix

* fix

* imports

* winfix

* more fix

* winfix

* fix

* fix

* fix

* fix

* clippy

* fix macos

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-04-17 18:16:44 +02:00
Dominik Maier
c881dc996d
Example fuzzers with less UB (#1212)
* Example fuzzers with even less UB

* more less ub, fixes

* unused dep
2023-04-16 14:29:41 +02:00
Langston Barrett
aa3f126100
LibAFL_qemu: Return errors from Emulator::new instead of asserting (#1197)
* qemu: Return errors from Emulator::new instead of asserting

Libraries should not `assert!` except in cases of unrecoverable (library)
programmer error. These errors are all potentially recoverable, and aren't
internal errors in `libafl_qemu` itself.

* Respond to review comments
2023-04-09 21:27:27 +02:00
Dominik Maier
f73e2006fc
Removed more new_ (#1200) 2023-04-07 02:34:28 +02:00
Andrea Fioraldi
0f633962ff
Bump to 0.10.0 (#1156)
* Bump to 0.10.0

* fix

* Fix CI

* Fix copyright

* fmt

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-04-05 17:49:53 +02:00
Felipe Baltor
6523341c4d
fix: output directory name; monitor output with println! (#1192) 2023-04-05 11:00:21 +02:00
Andrey Fedotov
1bd21509af
CASR deduplication for StacktraceObservers (#1184)
* Implement CasrAsanBacktraceObserver for dedupe crashes using libCASR and ASAN reports.

* Use casr observer with forkserver executor

* Add casr deduplication for AsanBacktraceObserver

* Add casr deduplication for BacktraceObserver

* Add Stacktrace filtering

* Move init_ignored_frames to constructors

* Add go ignore regexps for BacktraceObservers

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-04-04 19:03:11 +02:00
Dongjia "toka" Zhang
ccd1211cd2
Remove qemu_arm_launcher test from CI (#1179)
* remove qemu arm

* trigger all

* debug

* revert

* api chg

* fix

* try

* debug

* remove qemu

* no_std

* Update build_and_test.yml

* llvm16

* revert z3

* macos

* fix

* remove test

* don't grep on mac

* fix

* ok

* f

* f

* f

* aaa
2023-04-04 14:49:58 +02:00
LiuZhihong
590d3655cd
add readme documentation description about the tui feature (#1198) 2023-04-04 10:34:22 +02:00
ToSeven
ea512f70f8
Fix a build error in baby_fuzzer_minimizing (#1195)
Co-authored-by: toseven <Byone.heng@gmail.com>
2023-04-03 13:38:11 +02:00
Andrea Fioraldi
a01863696e
Implement restarting without serializing the corpus (#1182)
* Restart without serializing state option

* libfuzzer libpng example

* clippy

* libfuzzer_libpng_norestart

* fix
2023-03-30 14:35:58 +02:00
Dongjia "toka" Zhang
0c9933c3e4
Remove libfuzzer_stb_image_sugar for now (#1177)
* a

* better check

* slow
2023-03-24 02:41:15 +09:00
Dominik Maier
620b2861e3
Fix libafl_qemu testcase (#1173)
* Fix libafl_qemu testcase

* stb?

* Undo change for stb
2023-03-23 15:15:54 +01:00
Dominik Maier
66b2867ba2
Fix example fuzzers (#1171)
* Fix example fuzzers

* fmt
2023-03-23 11:02:18 +01:00
Dominik Maier
76e4f6031d
Fmt, no_std fixes (#1167)
* Fmt, no_std fixes

* push-stage fix
2023-03-23 00:10:01 +01:00
v1ce0ye
7c514c3669
ix UB in baby_fuzzer_grimoire (#1166) 2023-03-22 15:37:57 +01:00
Vincent
38ea17b426
libafl_frida for Linux executables (#1117)
* add frida_executable_libpng

* fix makefile

* fix README.md

* remove author from Cargo.toml

* fix fuzzer

* fix fuzzer

* fix Makefile

* fix linter

* fix clang-format-13

* unsupport mac os

* fix build_and_test_fuzzers

* fix cargo fmt

* cargo fmt

* add safer libc_start_main

* fix call rax addr

* fix frida

* fix cargo fmt

* fix metadata() to metadata_map()

* fix toml

* fix maxmapfeedback
2023-03-22 15:18:21 +01:00
Dominik Maier
8f8e74d670
Don't build z3 from source by default (and add static_z3 feature) (#1160)
* Reduce build times by using preinstaled z3

* fix env order

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-03-20 10:04:27 +01:00
Dominik Maier
f4f23de32b
Fix fuzzers after HasTestcase (#1123) (#1162)
* Fix fuzzers after HasTestcase (#1123)

* Make the trait a trait

* Implement HasTestcase for Corpora

* fix

* fix

* a

* a

* fix

* wasm32

* a

* f

* f

* aa

---------

Co-authored-by: tokatoka <tokazerkje@outlook.com>
2023-03-19 11:58:32 +09:00
Dominik Maier
bbe4e85768
Removed new_ from constructors that don't need it (API consistency) (#1159)
* Removed new_ from constructors that don't need it (API consistency)

* un-change python bindings
2023-03-17 17:02:21 +01:00
Dongjia "toka" Zhang
6c98945fc3
Fix fuzzbench_forkserver 2023-03-15 13:32:04 +09:00
Matheus Baptistella
c38405ef83
Shorthand functions to get typed metadata, renamed metatdata -> metadata_map (#1123)
* Created macro to get the metadata form State and Testcase

* Expanded the macros for mutable, or not, State and Testcase metadata

* Created functions on traits HasMetadata and HasNamedMetadatato get, mutable or not, metadata

* Created the functions to get metadata

* Added #[inline] attribute and renamed the functions

* Renamed the functions and added #[inline] attribute

* Temporarily added testcase() function

* Added testcase() function

* Changed Ref import to core::cell:Ref

* Added testcase_mut() and renamed occurences of metadata() and metadata_mut()

* Renamed more occurences

* Renamed the metadata() on impl HasMetadata for NopState

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-03-14 14:24:33 +01:00
Dominik Maier
8dfdee6fce
Fix UB for differential map observer example (#1140)
* Fix UB for differential map observer example

* clippy

* undo submodule foo
2023-03-14 13:50:50 +01:00
Dominik Maier
6894a37ceb
Added Truncate trait (#1141) 2023-03-13 17:34:58 +01:00
Addison Crump
786af9f6a9
resolve zero-sized allocation in swap diff fuzzer (#1139) 2023-03-12 23:24:22 +01:00
Dominik Maier
2ed6583041
CI: Run miri tests (#1130)
* Fixes/ignores for miri support

* linux

* fix doctest for miri

* fix docs

* fix UB in baby_fuzzer

* no custom allocator in miri
2023-03-08 19:21:17 +01:00
Vincent
c8254dbd0e
Check CI result on cargo make test for available fuzzers (#1107)
* fix libfuzzer_libpng_cmin

* fix libfuzzer_libpng_ctx

* revert libfuzzer_libpng_cmin and check ci by grepping broker stdout result instead

* revert libfuzzer_libpng_ctx and check ci by grepping broker stdout result instead

* add check ci for fuzzers

* add check ci for fuzzers

* add check ci

* add fuzzbench test

* add validation for qemu fuzzer

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-03-06 23:21:24 +09:00