111 Commits

Author SHA1 Message Date
WorksButNotTested
374f8735fa
Implement user-space QEMU ASAN (#1806)
* Implement user-space QEMU ASAN

* Fix wrong cfgs

* fmt

* merge conflicts in libafl qemu

* A few more fixes to qemu_launcher

* Change commit of qemu-libafl-bridge

* Fix clippy in qemu_launcher

* Fix commit id again

* Empty commit to trigger CI

* Fix path to fuzzer for test in qemu_launcher?

* Revert location of target binary and show the full error log from qemu_launcher test

* Appease the clippy gods

* Empty

* Fix format

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2024-04-10 01:11:28 +02:00
Dominik Maier
ff938261df
Fix Clippy on MacOS for qemu, accept some clippy::missing_transmute_annotations suggestions (#2009)
* Fix Clippy/CI

* Ignore transmute annotations in pybind

* fix

* more clippy

* more clippy

* fix fixes
2024-04-08 16:24:10 +02:00
Andrea Fioraldi
e29897dd44
Fix GuestMaps in userspace LibAFL QEMU (#2013) 2024-04-08 08:30:23 +02:00
Romain Malmain
44c841ffb1
WIP: QEMU exit handler (#1745)
* Added paging filtering.
Reworked address range filtering to fit with new generic code.

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Renamed sync breakpoint to sync exit.

* Split emu in systemmode.rs / usermode.rs for specific code.
EmuExitHandler implementation.

* sync_backdoor.rs removal.
Formatting.

* Updated `bindgen` and `which`.
Adapting code to work with update.

* fix: reconfigure cleanly if prior configure was interrupted abruptly.

* Enable sanitizers in QEMU during debug.

* Added target-usable files.

* Added breakpoint structure.

* Adapted other files to work with ExitHandler.

* Adapted existing fuzzer to work with new exit handler.

* fix: use get to avoid crashes.

* Updated README to indicate cargo-make should be installed.

* Added QEMU internal exit handler.

* Adapted qemu_systemmode example with new exit handler.

* Fixed fuzzers to work with new exit handler.

* Trying to fix CI (#1739)

* test

* dummy

* dummy

* Added new examples.

* Forgot to add build scripts.

* format

* format

* clang-format

* python emulator adaptation.

* fixed python bindings.

* clippy fixes.

* python bindings.

* fix qemu_sugar.

* fix fuzzbench.

* fixed import issues.

* misc fixes.

* renamed crate.

* Updated x86_64 stub bindings.

* Fixed static naming.

* binding fmt

* clippy

* clippy

* Removed useless return statement.

* removed advice to install cargo-make in individual repositories.

* symcc_update (#1749)

* Remove unused create_anymap_for_trait macro (fixes #1719) (#1752)

* Fix `as_object` UB discussed in #1748 (#1751)

* Fix as_object UB discussed in #1748

* More cleanup, more less UB

* Fix fixes

* Added uninit_on_shmem api

* clippy

* fmt

* trying to fix fuzzers, libfuzzer wrapper

* Add OwnedRefMit::owned constructor, libfuzzer fix

* Some more fixes

* Add BacktaceObserver::owned fn

* fmt

* more fmt

* Ignore SigPipe by default (#1741)

* Ignore SigPipe by default

* Fix no_std

* fmt

* Fix incorrect imports (#1758)

* Fix incorrect imports

https://doc.rust-lang.org/core/simd/trait.SimdOrd.html

* Fix

* Try fix ci

* Documentation fixes (#1761)

* Documentation fixes

* Fix InProcessExecutor url

* Update all urls to latest

* Miri ignores for M1 regex (#1762)

* Enabling DrCov on Windows (#1765)

* Enabling DrCov for Windows

* Dedup common code in scheduler (#1702)

* dedup common code in scheduler

* del eco

* fixing

* fix

* replace `Emulator::new_empty` by `Emulator::get` calls outside of `emu.rs` for safety. (#1763)

* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, and more (#1754)

* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, set_error_print_panic_hook

* Trying to fix #1753

* typo

* More fix

* Fix test?

* more testcase fixes

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Split emu in systemmode.rs / usermode.rs for specific code.
EmuExitHandler implementation.

* format

* format

* format

* Replace sync_exit with sync_backdoor.

* Rework command system.

* fix bad import.

* format.

* cargo fmt

* disable af-xdp as well to avoid linking errors.

* End of merging.

* format.

* Adaptation for usermode.

* format.

* injection support.

* usermode fixes.
format.

* clippy

* clippy + format

* Do not unwrap emu + format.

* fix: entry_point breakpoint

* inital commit.

* clippy

* tests

* clippy

* adapt example

* systemmode.

* renaming

* fmt

* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.

* merge continue.

* renamed modules as well.

* fixing merge.

* systemmode compiling.

* fmt

* fix early emulator drop.

* fmt

* fix cast to c_void of the wrong object.

* Added global enum for snapshot managers.
Some renaming.

* move things around.

* WIP: generic inclusion of QEMU Executor in exit handler.

* * Moved extern calls to `libafl_qemu_sys`
* Replaced old `Emulator` by `Qemu` and only kept C functions wrappers
* Now `Emulator` is for higher-level interactions with QEMU. Kept old functions for compatibility calling to `Qemu` functions
* A direct side effect of this slit is the removal of the `IsEmuExitHandler` trait dependency added in many parts of the code.
* Removed old dirty casting for `QemuExecutor` helpers and used the brand-new access to `QemuExecutorState` instead.
* Minor changes to `Qemu` and `Emulator` `get` methods for cleaner getters.

* Add missing `Qemu` function.

* Updated `qemu_systemmode` example.

* Adapted QEMU fuzzers + renaming.

* Fixed python.

* fix libafl_sugar with new implementation.

* fix dangling RefCell.
adapt new examples.
TODO: merge `libafl_systemmode.*` examples.

* clippy.

* fix more fuzzers.

* clippy.

* Implement `HasInstrumentationFilter` generically.
Updated `StdInstrumentationFilter` accordingly.

* Renamed breakpoint functions for QEMU.
`qemu.run()` handling.

* Removed OnceCell / RefCell in signature.
more explicit `MmapPerms` method names.

* minor code refactoring

* Emulator::run_handle refactoring

* deprecated Emulator functions calling directly to QEMU functions.

* IsSnapshotManager -> SnapshotManager

* IsEmuExitHandler -> EmuExitHandler + fmt

* Generic register when it makes sense.

* reverted IsSnapshotManager -> SnapshotManager because of a collision.

* fix syntax + clippy

* fmt

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: lazymio <mio@lazym.io>
Co-authored-by: Bet4 <0xbet4@gmail.com>
Co-authored-by: mkravchik <mkravchik@hotmail.com>
2024-03-22 18:03:29 +01:00
Stefan Zabka
fbd0d497d4
Refactor(build.rs): extract common code between branches (#1950) 2024-03-17 21:31:30 +01:00
Romain Malmain
b3ddab3bce
fix libafl_qemu_sys unnecessarily rebuilding. (#1938) 2024-03-14 18:25:19 +01:00
Romain Malmain
e745401a39
Update QEMU version. (#1922)
* update QEMU version.

* clippy
2024-03-08 13:15:00 +01:00
Romain Malmain
d96a1426d5
Fix lint errors (#1909)
* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.
2024-03-05 14:16:26 +01:00
Dongjia "toka" Zhang
1a41e65a5b
Sancov based ngram & ctx implementation (#1864)
* ngram

* ctx

* push stuff

* passing cargo check

* save stuf

* add

* no default

* fuzzbench ready

* formatt

* aaaaaaaa

* adaptive map

* add all

* chg

* fix

* deleting stuff

* fmt

* clang18

* fuck

* save space

* fix?

* feature name

* fucking nightly only

* harness

* fix libafl_cc

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-03-01 13:59:13 +01:00
Dominik Maier
578a22a3d9
Revert "Companion patch to qemu-libafl-bridge #46 (#1830)" (#1865)
This reverts commit b999b4aac591818d4342773ff48e98f2896f141e.
2024-02-16 20:50:18 +01:00
cube0x8
b999b4aac5
Companion patch to qemu-libafl-bridge #46 (#1830)
* fixing qemu-libafl-bridge #46

* cargo fmt

* updated QEMU revision

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2024-02-15 16:30:05 +01:00
Romain Malmain
5151f1e35c
fix qemu linking error. (#1846)
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-02-15 00:29:33 +01:00
Andrea Fioraldi
41d24ca375
Fix broken closure hooks in libafl_qemu (#1839)
* Fix broken crash hook

* fix hooks

* clippy

* pin
2024-02-07 15:03:27 +01:00
Romain Malmain
99a70e5771
Update qemu-libafl-bridge with upstream. (#1829)
QEMU update to v8.2.1
2024-02-05 14:24:02 +01:00
Romain Malmain
b8d48013c0
updated QEMU. Adapted emu.rs to fit new interface. (#1774)
* updated QEMU. Adapted emu.rs to fit new interface.

* format
2024-01-03 20:10:20 +01:00
Romain Malmain
830faec95f
QEMU filtering rework + paging filtering (#1705)
* Added paging filtering.
Reworked address range filtering to fit with new generic code.

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Fix: clippy + format

* Updated qemu-libafl-bridge

* Fix QEMU userspace crash handler (#1706)

* Fix QEMU userspace crash handler

* no_std

* libafl_cc custom llvm_config lookup for solaris/illumos (#1708)

* fix simd (#1709)

* Updated qemu

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: David CARLIER <devnexen@gmail.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-12-21 15:51:14 +01:00
Dongjia "toka" Zhang
78060ea308
0.11.2 (#1735) 2023-12-18 14:33:14 +01:00
Andrea Fioraldi
517d6962bd
Fix QEMU userspace crash handler (#1706)
* Fix QEMU userspace crash handler

* no_std
2023-12-01 13:26:10 +01:00
Andrea Fioraldi
5d83c9399a
Fix bp in QEMU thumb mode on arm64 systems (#1701) 2023-11-29 10:37:10 +01:00
Andrea Fioraldi
bc458864f1
Fix libafl_qemu edge hooks src addr (#1700) 2023-11-28 17:16:15 +01:00
Andrea Fioraldi
1545514ed8
JIT fast path for edge cov hooks in libafl_qemu (#1696)
* JIT fast path for edge cov hooks in libafl_qemu

* fix

* fmt

* fix

* unify hooks as opt
2023-11-27 13:20:20 +01:00
Romain Malmain
bd12e060ca
Update qemu-libafl-bridge (#1697)
Update to last version of qemu-libafl-bridge
2023-11-24 20:19:57 +01:00
Andrea Fioraldi
f1aee3c376
Refactor QEMU hooks (#1690)
* Rewrite QEMU Asan

* fake sys

* New hooks

* edge cov helper

* opaque raw hook

* new hooks

* EMulator::get

* new asan

* fix fuzzers

* fix types

* fix

* fix

* fix

* merge fix

* fix
2023-11-23 18:57:15 +01:00
Romain Malmain
43c9100f59
QEMU Synchronous Exit + Syx Snapshot update (#1681)
* Fix: typo in variable name.

* Fix: thread-safe static for emulator initialization.

* Initial support for synchronous exit from QEMU.

* New commands for the sync exit feature.
Supports physical and virtual address requests.
Updated for new SyxSnapshot naming.

* update qemu commit and fix some things

* - Removed lazy_static dependency
- Compiles for usermode
- Format

* Fix warnings

* Fixed sync_exit for missing architectures

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-11-23 17:35:32 +01:00
Andrea Fioraldi
cc1ebb29f7
Add CmpLog routines to LibAFL QEMU and various fixes (#1664)
* Add CmpLog routines to LibAFL QEMU and various fixes

* format

* fix

* fix read_function_argument

* fix

* multithread

* fix qemu fork

* fix

* clippy

* fix systemmode

* unused imports
2023-11-17 16:59:50 +01:00
Andrea Fioraldi
406e77faa9
QEMU Asan backtrace and report (#1628)
* wip

* ExtractFirstRefMutType

* Asan report with backtrace

* Print asan reports and fix backtraces in libafl qemu

* print context

* enlarge redzone

* nopstate

* fix

* reproducer

* clippy

* clippy

* Fix android

* Crash hook
2023-10-25 15:58:32 +02:00
Andrea Fioraldi
31f4669794
Autodetect llvm-config for QEMU bindings generation (#1610)
* Autodetect llvm-config for QEMU bindings generation

* fix ci

* Fix signal handlers without ucontext pointer

* ci
2023-10-10 15:26:32 +02:00
Andrea Fioraldi
cffbf069d2
Call the original QEMU user crash handler in libafl_qemu (#1575)
* Call the original QEMU user crash handler in libafl_qemu

* Return if real crash or not

* merge

* Fix singal handlers in libafl and libafl_qemu

* doc and clippy

* clippy

* clippy

* clippy

* slirp

* fix

* fix system
2023-10-05 15:24:21 +02:00
Dongjia "toka" Zhang
60b3408737
Update dependencies (#1588)
* update

* downgrade some
2023-10-01 07:20:23 -05:00
WorksButNotTested
9c3f8f4511
Qemu features3 (#1538)
* Fix issue with libafl_qemu being repeatedly rebuilt

* Changes to make qemu_launcher a production ready fuzzer

* Remove _get prefix

* Don't collect DrCov data during the campaign

* Fix poor performance

* Better validation for core selection

* Changes to print debug when running in verbose mode

* Autofix

* Remove afl++-clang

* Fix build error on 32-bit

* Fix some clippy

* Fix OSX

* Set default version of clang/clang++

* Review changes

* Fix issue with fd sharing between processes

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-09-28 14:31:15 +02:00
Andrea Fioraldi
4c0e01c4aa
Fix memopidx bug in libafl_qemu r/w hooks and update QEMU (#1500) 2023-09-05 16:28:52 +02:00
Andrea Fioraldi
00033426e7
Bump to 0.11.1 (#1491) 2023-08-31 15:07:31 +02:00
Andrea Fioraldi
7dd7c1a485
Bump to 0.11.0 (#1469)
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-08-28 15:36:43 +02:00
Andrea Fioraldi
04c8d5208b
qemu: Fix cpu page size function for full-system (#1452)
* Revert "qemu: add cpu page_size call (#1433)"

This reverts commit d338b30c080ecfe1a6639185b6505b7a7b8edbeb.

* Reintroduce page_size
2023-08-25 11:42:23 +02:00
Dominik Maier
e89e8dbaab
Remove dependencies, add doc.rs metadata (#1450)
* Remove dependency, add doc.rs metadata

* remove lazy_static

* even less lazy_static

* serial_test no default
2023-08-24 11:34:38 +02:00
David CARLIER
d338b30c08
qemu: add cpu page_size call (#1433)
* qemu handy cpu page size call proposal.

* changes from feedback.
2023-08-23 20:27:58 +02:00
Dominik Maier
b0179b4498
Update some deps, clippy (#1422)
* More less default

* More clippy

* updated rangemap

* Clean up depencdencies

* Undo accidental remove

* Fix

* trying to fix qemu build

* hexagon be gone
2023-08-17 17:15:03 +02:00
Andrea Fioraldi
ac4a0e7330
libafl_qemu snapshot device filter (#1386)
* libafl_qemu snapshot device filter

* Working device list

* regenerate bindings stub
2023-08-01 12:01:10 +02:00
Andrea Fioraldi
37bfead4e5
Fix generic hooks bug in libafl_qemu (#1382) 2023-07-27 17:28:33 +02:00
Andrea Fioraldi
cb24b5dc2d
Extract linker args when building QEMU (#1377)
* Update qemu commit

* Hook the linker and automatically extract linker args

* Comment code
2023-07-26 10:42:15 +02:00
Dominik Maier
36b1d8aea2
Fix status updates for crashing fuzzers (fixes #1367) (#1368)
* Fix status updates for crashing fuzzers (fixes #1367)

* client perf fix

* Add HasLastReportTime trait :/

* ****** prelude

* reoder phantom

* fix tests

* clippy, fixes

* more fixes, traits are maaad

* fmt
2023-07-14 18:50:31 +02:00
Langston Barrett
2885b10f70
libafl_qemu_build: Bump bindgen to 0.66 for syn 2 support (#1349) 2023-07-10 13:12:26 +02:00
Ivan Fratric
829b5049e6
Hexagon support (#1323)
* Hexagon support

* Fix format

* Fix needless bool

* Address comments

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-07-04 11:08:36 +02:00
Andrea Fioraldi
356698c24b
Update to QEMU 8 (#1299)
* Update to QEMU 8

* fix

* fix snapshots

* fix pcrel
2023-06-02 18:24:07 +02:00
WorksButNotTested
53dd6c6be6
Post gen (#1282)
* Add post_gen

* Adopt post_gen hooks in DrCovHelper

* Bump qemu-libafl-bridge revision

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-05-24 16:03:59 +02:00
Dongjia "toka" Zhang
6f21cb3848
Bump to 0.10.1 (#1280)
* bmp

* remove DEBUG env var
2023-05-22 12:42:36 +02:00
WorksButNotTested
4029069640
Disable capstone when building qemu-afl-bridge for user-mode fuzzing (#1281)
Co-authored-by: Your Name <you@example.com>
2023-05-18 00:47:59 +02:00
intrigus-lgtm
91b10f8c40
LibAFL_qemu: Disable Capstone to fix build issues on some distributions (#1263) 2023-05-11 09:52:57 +02:00
Andrea Fioraldi
0f633962ff
Bump to 0.10.0 (#1156)
* Bump to 0.10.0

* fix

* Fix CI

* Fix copyright

* fmt

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-04-05 17:49:53 +02:00
Dominik Maier
0d446bab20
Updated dependencies (#1174)
* Updated deps

* win

* Revert "win"

This reverts commit a6dfd95f1c63a9471659481d92c5cbc480af6360.

* revert win

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-04-04 22:58:00 +02:00