1180 Commits

Author SHA1 Message Date
Aarnav
e6b94f3715
Feature/libafl fuzz misc (#2430)
* libafl-fuzz: add cmplog to CI
libafl-fuzz: add option to specify custom rng sed
libafl-fuzz: add help messages to CLI, add file extension support
libafl-fuzz: adhere to AFL++ cmplog bin path format
libafl-fuzz: avoid races when writing to fuzzer_stats
libafl-fuzz: add time tracking for CalibrationStage, MutationalStage and SyncFromDiskStage

* libafl-fuzz: fix libafl paths

* libafl-fuzz: remove redundant cmplog check

* libafl-fuzz: ingore UnstableMapEntries when using queue scheduler in afl_stats.rs
libafl-fuzz: track max_depth for QueueScheduler
libafl-fuzz: fix custom input file

* libafl-fuzz: fix Makefile

* clippy
2024-07-22 15:43:47 +02:00
Romain Malmain
82f11c22ad
Various CI improvements + fix wrong format check in CI (#2417)
use of LLVM 19 by default
    LLVM version should be much easier to switch from now on
    a lot of code repetition has been deleted
    removed llvm-related github action
    fix format check
    other small things

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2024-07-19 22:32:50 +02:00
Romain Malmain
1205c2144c
Restructure the fuzzers folder (#2409)
* move fuzzers in subfolders

* add readme

* remove redundent fuzzers
2024-07-19 18:24:24 +02:00
Aarnav
c22a62c32a
libafl-fuzz: add IndexesLenMinTimeScheduler back (#2426) 2024-07-18 16:47:00 +02:00
Dongjia "toka" Zhang
78a30c4403
Fix baby fuzzer tui (#2425) 2024-07-18 14:56:21 +02:00
Romain Malmain
c96ea616fe
Qemu helpers & hooks refactoring (#2267)
* Helper is now called Module.

* Emulator now contains hooks state.

* Emulator is managed by QemuExecutor.

* QEMU hooks have been completely refactored on the rust side.

* Generics cleanup.
2024-07-17 11:46:42 +02:00
Aarnav
b9da7dd87f
Introduce Persistent Record for libafl-fuzz (#2411)
* libafl-fuzz: fix PERSISTENT_SIG and DEFERRED_SIG

* libafl-fuzz: add AFL_PERSISTENT_RECORD

* libafl-fuzz: update README
2024-07-17 00:35:06 +02:00
Aarnav
aa21815a97
Introduce libafl-fuzz (#2362)
* Introduce libafl-fuzz

* fix corpus file path

* simplify SeedFeedback

* fix incorrect comment

* add clap::ValueEnum to PowerSchedule as an optional derive if clap is enabled

* UnixShMemProvider replaced with StdShMemProvider for libafl-fuzz

* remove io_error_more feature constraint

* libafl-fuzz: make Ok(()) unreachable in CentralizedLauncher

* libafl-fuzz: make harness_input_stdin to harness_input_type with &'static

* libafl-fuzz: move each feedback to it's own file

* make run_fuzzer_with_stage into a function.
use CachedOnDiskCorpus instead of OnDiskCorpus for Corpora
remove utils file

* remove unecessary clone

* libafl-fuzz: cleanup AFLStatsStage

* move peak_rss_mb to libafl_bolts

* parse envs by hand

* add sensible defaults for map size and broker port

* fix test.sh and corpus_id padding

* add Makefile.toml

* libafl-fuzz update test suite

* libafl-fuzz: clippy

* rename peak_rss_mb to peak_rss_mb_children

* remove minor version constraint for clap

* libafl-fuzz: fix ELF check and instrumentation check in check_binary

* libafl-fuzz: improve Makefile.toml

* simplify fuzzer and cleanup typos

* libafl-fuzz: load corpus entries in a multicore fashion

* libafl-fuzz: create output dir if not exists (non-racey)

* libafl-fuzz: add sequential scheduling support
libafl-fuzz: add cmplog options
libafl-fuzz: add test-cmplog.c to CI

* rename peak_rss_mb_children to peak_rss_mb_child_processes

* fix race condition in SyncFromDiskStage, add interval based checking and support for multiple directories.
libafl-fuzz: add support for syncing with foreign fuzzers

* update README

* implement AflScheduler for QueueScheduler.
Add queue_cycles field to
AflScheduler

* libafl-fuzz: remove dependecy on SchedulerMetadata for AflStatsStage

* clippy

* remove queue_cycles from AflScheduler into int's own trait.
libafl-fuzz: simplify map observer tracking

* clippy

* libafl-fuzz: disable cmplog check in CI for now

* add missing constraints for libafl_qemu executor

* clippy

* libafl-fuzz: improve Makefile
libafl-fuzz: clippy

* libafl-fuzz: misc

* misc typos, beautify

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-07-16 02:10:20 +02:00
Romain Malmain
e8de3591bf
Fix cfg clippy for libafl_qemu (#2397)
* optional final comma

* fix systemmode
2024-07-16 00:37:54 +02:00
Dominik Maier
7feeb00546
Fix docs (follow-up to #2385) (#2388)
* Fix docs (follow-up to #2385)

* More fix

* fix fuzzer

* More docs
2024-07-12 16:13:43 +02:00
Dominik Maier
3c93b96b70
Introduce TuiMonitor builder, clean up monitor docs and names (#2385)
* Introduce TuiMonitor builder

* Some random docs

* More documentation for monitors

* fixed critical whitespace

* Rename all-caps TOML and JSON to Toml and Json in monitors

* actually rename

* more
2024-07-12 15:27:45 +02:00
Dominik Maier
fa4241f4f8
Make atheris load multiple tokens files (#2382) 2024-07-12 12:46:42 +02:00
Dongjia "toka" Zhang
2565fa8bf5
Delete Makefile.toml from Multi machine exmaple (#2379)
* delete

* aa
2024-07-11 14:51:18 +02:00
Dominik Maier
264c2f021e
Update all which dependencies (#2375) 2024-07-10 15:38:56 +02:00
Dominik Maier
2b43d86296
Update clap across the repo (#2374) 2024-07-10 15:35:25 +02:00
Dominik Maier
721fd3b14e
Make tokens more token-y (less dictionary-y) (#2371) 2024-07-09 17:37:37 +02:00
0e5bf879e4 fix try_force_new_branches 2024-07-04 12:49:09 +02:00
Nereuxofficial
ed3bd003a4
fix: Added corpus for dynamic_analysis fuzzer (#2360)
* doc: fixed instruction in CONTRIBUTING.md

* Added note for windows users

* fix: Added corpus for dynamic_analysis fuzzer

* fix for calling the clippy script on windows

* Fixed path oversight in previous commit
2024-07-03 11:51:52 +02:00
d569df29a3 build fixes 2024-07-02 09:34:56 +02:00
47724ad1c3 stg try_force_new_branches 2024-07-02 09:34:35 +02:00
810ec36115 refactor 2024-07-01 13:28:38 +02:00
Nereuxofficial
d564656f1c
Improved documentation for fuzzers/cargo_fuzz and dynamic_analysis (#2350)
* Improved documentation for fuzzers/cargo_fuzz and dynamic_analysis

* revert line breaks in markdown files
2024-06-30 14:31:34 +02:00
77799f77a9 move cli parsing, use multibyteinput 2024-06-28 14:38:25 +02:00
Dominik Maier
ea6e440762
Re-Rename Retrying Restart Helper (#2340) 2024-06-26 23:49:22 +02:00
Dongjia "toka" Zhang
2d1e429482
baby_fuzzer_wasm fix (#2336)
* fixer

* a
2024-06-24 17:31:25 +02:00
Dongjia "toka" Zhang
e3dd7cf0dc
Don't restart in deterministic stages. Don't restart where there's no restart safety. Make stage names unique (#2331)
* push

* fuck

* add

* add

* api

* api

* add multi machine to workspace

* doc

* api

* api

* add

* more

* fix

* stats

* rev

* fix

* fix

* real fix

* add

* fmt

* add

* add

* fix

* a

* add

* revert workflow

---------

Co-authored-by: Your Name <you@example.com>
2024-06-20 17:38:15 +02:00
Dominik Maier
042840dba1
Call all Ids id, not idx (#2319)
* All Ids should be id not idx

* More

* fix

* win?

* win?

* win?

* fix

* more fix

* desyscall?

* more

* fmt

* std

* make id less id-y

* fmt

* fix

* cleanup

* fixes all around

* fix

* Fix the broken stuff from refactoring

* remove unused

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-06-20 14:46:47 +01:00
acf9b04e70 remove unused code 2024-06-20 13:25:21 +02:00
6cb2be4408 add TimeProbMassScheduler 2024-06-20 10:15:01 +02:00
3a7c0da037 fast snapshots by default 2024-06-19 14:22:12 +02:00
5fad373199 update to 0.13.0 API 2024-06-19 13:30:36 +02:00
Romain Malmain
fa17f47115
Tree-shaped multi-machine fuzzing (#2302)
* tree-shaped multi-machine fuzzing

* forgot main file

* aaa

* moving things around

* fix

* working?

* remove debug panic

* aaa

* aaa

* fmt

* normal centralized adapted

* removed old useless code

* cleanup

* llmp hooks

* working multi machine apparently?

* aaa

* cleanup (#2305)

* added old message dispatch.
thread safety stuff

* testing things around

* opti opti opti

* :)

* fuzz

* limit the amound received at once to avoid congestion

* remove useless corpus
mv to sqlite
less warnings

* aaa

* ;

* big opti

* adding cfgs

* fix

* fixer

* fix

* s

* clippy and reduce generics

* debugging

* fix

* more robust disconnection

* aaa

* aaa

* aaa

* nostd

* more nostd

* clippy

* not in ci

* unused

* aaa

* doc

* clippy

* clippy

* clippy

* no crash in libpng

* aaa

* aaa

* aaa

* aaa

* graph generator

* fix

* fix

* windows fix all

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-06-17 23:23:01 +02:00
df7333b764 WIP: merge 2024-06-17 14:17:06 +02:00
a7becb403e update helper scripts 2024-06-17 10:31:48 +02:00
5e29f4b909 always dump error case during fuzzing 2024-06-14 14:00:09 +02:00
1146c2c1e5 two-way isr edges, graceful parsing error handling 2024-06-14 13:56:36 +02:00
Dongjia "toka" Zhang
c415b4d5f6
0.13.0 (#2253)
* 0.13

* z3

* capstone

* fixer

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-06-13 23:35:35 +02:00
Dongjia "toka" Zhang
0ed295842b
Use filename for MmapShMemProvider (#2303)
* fixer

* comment

* a

* bb

* apple
2024-06-11 20:15:11 +02:00
Dominik Maier
93085782d6
Rename string stages to unicode stages for consistency (#2293) 2024-06-08 16:59:49 +01:00
Dominik Maier
ba84170777
Fix docs on crates.io for LibAFL_Frida, introduce auto-download feature (#2270)
* Fix docs on crates.io for LibAFL_Frida, introduce auto-download feature

* remove it more

* more testing

* more features

* more CI

* CI?

* CI?

* More fix?

* nicer

* More fix?

* test?

* more try?

* why?

* more more
2024-06-08 13:02:59 +01:00
Romain Malmain
14263b9c69
Rusty LibAFL fmt (#2271) 2024-06-07 23:41:50 +02:00
69d0c6f9bb build fix 2024-06-06 14:50:02 +02:00
b9e388d9d5 timeshift variable, handle nested isr+api, bump max_interrupts 2024-06-06 14:39:45 +02:00
Romain Malmain
399fbccea2
Closure builder for inner managers of centralized. (#2279)
* generic inner manager for centralized, with builder closures.

* moved options inside the function

* removed useless bound

* unused import

* remove useless clone bound.

* make clearer what is secondary node

* same inner manager for main and secondary

* fix example
2024-06-05 19:12:21 +02:00
Dominik Maier
58c39680c9
Move Nautilus to LibAFL, remove AGPL dependencies (#2265)
* Copy choose method for unbounded iterators

* Add choose method for unbounded iterators

* Copy&paste in nautilus grammartec

* cargo

* fmt

* Initial Nautilus in LibAFL

* missing link

* clippy

* clippy

* more clippy

* docs

* docs

* more docs

* remove nautilus default

* fix doctest

* fmt

* less vec

* test

* less flakey

* clippy

* clippy
2024-06-03 14:18:52 +02:00
c7bf1be8b1 target_symbols.csv++ 2024-06-03 08:31:57 +02:00
Romain Malmain
1102ea0fe7
Better RW errors for QEMU (#2260)
* better error for rw in qemu.

* fix python

* clippy

* Fix error in fuzzers

* Fix error in fuzzers

* fix systemmode error

* import
2024-05-30 15:14:17 +02:00
2cbd9de2eb change interrupt mutation 2024-05-29 15:49:52 +02:00
4c8a435cfd fix corpuscase dump 2024-05-29 12:32:34 +02:00
Mrmaxmeier
b96b9be674
tutorial fuzzer: switch lain fork to AFLplusplus/lain (#2257) 2024-05-28 20:45:18 +02:00