264 Commits

Author SHA1 Message Date
Dongjia "toka" Zhang
332ddf4655
Don't fail fast for now (#2843) 2025-01-15 10:40:40 +01:00
Romain Malmain
a45e44764f
Remove UsesInput from libafl qemu (#2832)
* remove UsesInput from libafl_qemu

* Insert I bound instead of ugly Corpus::Input stuff

* Uses a C generic for Commands

* adapt nyx api to new generics

* add qemu linux fuzzers to CI for building.
2025-01-14 10:24:28 +01:00
Marco C.
ca647f0c30
CI check-md-links fix (#2824)
Use ubuntu-22.04 and restore the action instead of the script
2025-01-09 12:04:01 +01:00
Valentin Huber
bdde109867
Make Launcher use ClientDescription instead of CoreId (#2676)
* launcher now uses client_id instead of core_id

* adding overcommit to an example fuzzer

* Replace addr_of with &raw across the codebase (#2669)

* Replace addr_of with &raw across the codebase

* fix fixes

* more fix

* undo clang fmt?

* oops

* fix?

* allocator fix

* more fix

* more more

* more docs

* more fix

* mas mas mas

* hm

* more

* fix Frida

* needed

* more error

* qemu

* Introduce workspace (again) (#2673)

* Trying to redo workspace deps again after #2672

* unused

* clippy

* Replace addr_of with &raw across the codebase (#2669)

* Replace addr_of with &raw across the codebase

* fix fixes

* more fix

* undo clang fmt?

* oops

* fix?

* allocator fix

* more fix

* more more

* more docs

* more fix

* mas mas mas

* hm

* more

* fix Frida

* needed

* more error

* qemu

* Introduce workspace (again) (#2673)

* Trying to redo workspace deps again after #2672

* unused

* clippy

* fixing formatting issues

* cloning values to make borrow checker happy

* simplifying cfg constraints, removing excessive clippy allows

* printing clang version that is used to find inconsistencies between CI and local formatting

* some fixes according to the CI

* Specifying types

* improved logging for formatter

* more attempts at logging for the CI formatting

* fixing setting LLVM version in formatting in CI

* fixing cippy allows

* renaming launcher's ClientID to ClientDescription

* Lower capped RAND generators (#2671)

* Lower capped rand generators

* Updated all references to RAND generators

* Formatting updates

* New RAND bytes generator constructor

* Revert "Updated all references to RAND generators"

This reverts commit 9daad894b25ec3867daf93c4fe67c03abec1d8c6.

* Revert "Formatting updates"

This reverts commit ff2a61a366c48b3f313878f62409e51b1e1ed663.

* cargo nightly format

* Added must_use to with_min_size

* fix error '#' is not followed by a macro parameter (#2678)

* Use version.workspace (#2682)

* LibAFL_QEMU: Don't return a generic Address from Register reads (#2681)

* LibAFL_QEMU: Make ReadReg always return GuestReg type

* Don't return a generic address

* fix fuzzers

* fix mips

* Add DrCovReader to read DrCov files and DrCov dumper and merge utils (#2680)

* Add DrCov Reader

* Removed libafl_jumper deps

* Fix DrCovWriter, add dump_drcov_addrs

* Taplo

* Move frida from usize to u64

* DrCov usize=>u64

* Better error print

* More u64

* ?

* debug

* clippy

* clippy

* Add Merge option to DrCovReader

* Add drcov_merge tool

* Move folder around

* DrCov

* More assert

* fmt

* Move around

* Fix print

* Add option to read multiple files/full folders

* Fix build_all_fuzzers.sh for local runs (#2686)

* Add Intel PT tracing support (#2471)

* WIP: IntelPT qemu systemmode

* use perf-event-open-sys instead of bindgen

* intelPT Add enable and disable tracing, add test

* Use static_assertions crate

* Fix volatiles, finish test

* Add Intel PT availability check

* Use LibAFL errors in Result

* Improve filtering

* Add KVM pt_mode check

* move static_assertions use

* Check for perf_event_open support

* Add (empty) IntelPT module

* Add IntelPTModule POC

* partial ideas to implement intel pt

* forgot smth

* trace decoding draft

* add libipt decoder

* use cpuid instead of reading /proc/cpuinfo

* investigating nondeterministic behaviour

* intel_pt module add thread creation hook

* Fully identify deps versions

Cargo docs: Although it looks like a specific version of the crate, it actually specifies a range of versions and allows SemVer compatible updates

* Move mem image to module, output to file for debug

* fixup! Use static_assertions crate

* Exclude host kernel from traces

* Bump libipt-rs

* Callback to get memory as an alterantive to image

* WIP Add bootloader fuzzer example

* Split availability check: add availability_with_qemu

* Move IntelPT to observer

* Improve test docs

* Clippy happy now

* Taplo happy now

* Add IntelPTObserver boilerplate

* Hook instead of Observer

* Clippy & Taplo

* Add psb_freq setting

* Extremely bad and dirty babyfuzzer stealing

* Use thread local cell instead of mutex

* Try a trace diff based naive feedback

* fix perf aux buffer wrap handling

* Use f64 for feedback score

* Fix clippy for cargo test

* Add config format tests

* WIP intelpt babyfuzzer with fork

* Fix not wrapped tail offset in split buffer

* Baby PT with raw traces diff working

* Cache nr_filters

* Use Lazy_lock for perf_type

* Add baby_fuzzer_intel_pt

* restore baby fuzzer

* baby_fuzzer with block decoder

* instruction decoder instead of block

* Fix after upstream merge

* OwnedRefMut instead of Cow

* Read mem directly instead of going through files

* Fix cache lifetime and tail update

* clippy

* Taplo

* Compile caps only on linux

* clippy

* Fail compilation on unsupported OSes

* Add baby_fuzzer_intel_pt to CI

* Cleanup

* Move intel pt + linux check

* fix baby pt

* rollback forkexecutor

* Remove unused dep

* Cleanup

* Lints

* Compute an edge id instead of using only block ip

* Binary only intelPT POC

* put linux specific code behind target_os=linux

* Clippy & Taplo

* fix CI

* Disable relocation

* No unwrap in decode

* No expect in decode

* Better logging, smaller aux buffer

* add IntelPTBuilder

* some lints

* Add exclude_hv config

* Per CPU tracing and inheritance

* Parametrize buffer size

* Try not to break commandExecutor API pt.1

* Try not to break commandExecutor API pt.2

* Try not to break commandExecutor API pt.3

* fix baby PT

* Support on_crash & on_timeout callbacks for libafl_qemu modules (#2620)

* support (unsafe) on_crash / on_timeout callbacks for modules

* use libc types in bindgen

* Move common code to bolts

* Cleanup

* Revert changes to backtrace_baby_fuzzers/command_executor

* Move intel_pt in one file

* Use workspace deps

* add nr_addr_filter fallback

* Cleaning

* Improve decode

* Clippy

* Improve errors and docs

* Impl from<PtError> for libafl::Error

* Merge hooks

* Docs

* Clean command executor

* fix baby PT

* fix baby PT warnings

* decoder fills the map with no vec alloc

* WIP command executor intel PT

* filter_map() instead of filter().map()

* fix docs

* fix windows?

* Baby lints

* Small cleanings

* Use personality to disable ASLR at runtime

* Fix nix dep

* Use prc-maps in babyfuzzer

* working ET_DYN elf

* Cleanup Cargo.toml

* Clean command executor

* introduce PtraceCommandConfigurator

* Fix clippy & taplo

* input via stdin

* libipt as workspace dep

* Check kernel version

* support Arg input location

* Reorder stuff

* File input

* timeout support for PtraceExec

* Lints

* Move out method not needing self form IntelPT

* unimplemented

* Lints

* Move intel_pt_baby_fuzzer

* Move intel_pt_command_executor

* Document the need for smp_rmb

* Better comment

* Readme and Makefile.toml instead of build.rs

* Move out from libafl_bolts to libafl_intelpt

* Fix hooks

* (Almost) fix intel_pt command exec

* fix intel_pt command exec debug

* Fix baby_fuzzer

* &raw over addr_of!

* cfg(target_os = "linux")

* bolts Cargo.toml leftover

* minimum wage README.md

* extract join_split_trace from decode

* extract decode_block from decode

* add 1 to `previous_block_ip` to avoid that all the recursive basic blocks map to 0

* More generic hook

* fix windows

* Update CI, fmt

* No bitbybit

* Fix docker?

* Fix Apple silicon?

* Use old libipt from crates.io

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
Co-authored-by: Dominik Maier <domenukk@gmail.com>

* libafl-fuzz: introduce nyx_mode (#2503)

* add nyx_mode

* fix frida ci?

* damn clippy

* clippy

* LibAFL: Remove `tui_monitor` from default features (#2685)

* No Usermode default

* no tui

* gg

* try fix CI

* fmt

---------

Co-authored-by: Dominik Maier <dmnk@google.com>

* Actually make ConstMapObserver work, introduce `nonnull_raw_mut` macro (#2687)

* Actually make ConstMapObserver work

* fixes

* does that work?

* mas

* Feature: libafl-fuzzfuzzbench (#2689)

* fuzzbench

* clippy

* fmt

* fix unicorn CI?

* Move bitfields to bitbybit (#2688)

* move to bitbybit

* Restore bitbybit dependent code

* Clippy

* Fix NautilusContext::from_file for python files (#2690)

* Bump to 0.14.0 (#2692)

* Fix versions in libafl and libafl_intelpt for crates.io (#2693)

* Fix versions in libafl and libafl_intelpt for crates

* Add libafl_intelpt to publish

* StdMOptMutator:🆕 remove unused type parameter (#2695)

`I` is unused in `::new` and thus requires callers to explicitly specify
any type as it can't be determined by type inference.

Clippy's `extra_unused_type_parameters` should pick this up, but is
tuned a bit too conservative in order to avoid false positives AFAICT.

* Move test_harness from source directory to OUT_DIR (#2694)

* remove test_harness from source directory

* fmt

* Add package.metadata.docs.rs for libafl_intelpt (#2696)

* libafl-fuzz: fix cmplog running on inputs more than once (#2697)

* libafl-fuzz: fix cmplog running on inputs more than once

* fmt

* fix afl++ cmplog header

* update to latest afl stable commit

* Libafl workspace internal deps in workspace Cargo.toml (#2691)

* Add internal deps to workspace

* libafl: use workspace internal deps

* libafl_bolts: use workspace internal deps

* 0.14.0

* use workspace internal deps

* Fix tui monitor for example fuzzers (#2699)

* Fix tui monitor for example fuzzers

* New clippy lint

* fix

* Update pyo3-build-config requirement from 0.22.3 to 0.23.1 (#2701)

Updates the requirements on [pyo3-build-config](https://github.com/pyo3/pyo3) to permit the latest version.
- [Release notes](https://github.com/pyo3/pyo3/releases)
- [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pyo3/pyo3/compare/v0.22.3...v0.23.1)

---
updated-dependencies:
- dependency-name: pyo3-build-config
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* bolts: fix build for tiers 3 platforms. (#2700)

cater to platforms knowingly support this feature instead.

* Pre init module hooks (#2704)

* differenciate pre qemu init and post qemu init hooks

* api breakage: Emulator::new_with_qemu is not public anymore.

* Fix edge module generators (#2702)

* fix generators

* fix metadata removal for ExecutionCountRestartHelper (#2705)

* Ignore pyo3 update (#2709)

* libafl-fuzz: feature-flag nyx mode (#2712)

* Bump ctor dependency to make nightly compile again (#2713)

* Batched timeout doc (#2716)

* timeout doc

* clp

* FMT

* More batched timeout doc (#2717)

* timeout doc

* clp

* FMT

* more

* fixing an overexited cast

* renaming variables

* removing unnecessary brackets

* fixing imports

* fixing imports

* renaming more variables

* even more variable renaming

* removing duplicate clap short options

* reverting mistaken variable renaming

* comparing the actual cores instead of an enumeration index

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Subhojeet Mukherjee, PhD <57270300+CowBoy4mH3LL@users.noreply.github.com>
Co-authored-by: jejuisland87654 <jejuisland87654@gmail.com>
Co-authored-by: Marco C. <46560192+Marcondiro@users.noreply.github.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Romain Malmain <romain.malmain@pm.me>
Co-authored-by: Aarnav <aarnav@srlabs.de>
Co-authored-by: Dominik Maier <dmnk@google.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: Mrmaxmeier <3913977+Mrmaxmeier@users.noreply.github.com>
Co-authored-by: Sharad Khanna <sharad@mineo333.dev>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: David CARLIER <devnexen@gmail.com>
Co-authored-by: Henry Chu <henrytech@outlook.com>
2024-11-29 19:36:13 +01:00
Dongjia "toka" Zhang
f30cd2a8ab
Run miri test only if it has labels (#2734)
* stuf

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml
2024-11-27 15:35:53 +01:00
Mrmaxmeier
6ce447ee17
Specify minimum supported rust version and check in CI (#2726) 2024-11-26 17:58:01 +01:00
Marco C.
f7f8dff6cd
Add Intel PT tracing support (#2471)
* WIP: IntelPT qemu systemmode

* use perf-event-open-sys instead of bindgen

* intelPT Add enable and disable tracing, add test

* Use static_assertions crate

* Fix volatiles, finish test

* Add Intel PT availability check

* Use LibAFL errors in Result

* Improve filtering

* Add KVM pt_mode check

* move static_assertions use

* Check for perf_event_open support

* Add (empty) IntelPT module

* Add IntelPTModule POC

* partial ideas to implement intel pt

* forgot smth

* trace decoding draft

* add libipt decoder

* use cpuid instead of reading /proc/cpuinfo

* investigating nondeterministic behaviour

* intel_pt module add thread creation hook

* Fully identify deps versions

Cargo docs: Although it looks like a specific version of the crate, it actually specifies a range of versions and allows SemVer compatible updates

* Move mem image to module, output to file for debug

* fixup! Use static_assertions crate

* Exclude host kernel from traces

* Bump libipt-rs

* Callback to get memory as an alterantive to image

* WIP Add bootloader fuzzer example

* Split availability check: add availability_with_qemu

* Move IntelPT to observer

* Improve test docs

* Clippy happy now

* Taplo happy now

* Add IntelPTObserver boilerplate

* Hook instead of Observer

* Clippy & Taplo

* Add psb_freq setting

* Extremely bad and dirty babyfuzzer stealing

* Use thread local cell instead of mutex

* Try a trace diff based naive feedback

* fix perf aux buffer wrap handling

* Use f64 for feedback score

* Fix clippy for cargo test

* Add config format tests

* WIP intelpt babyfuzzer with fork

* Fix not wrapped tail offset in split buffer

* Baby PT with raw traces diff working

* Cache nr_filters

* Use Lazy_lock for perf_type

* Add baby_fuzzer_intel_pt

* restore baby fuzzer

* baby_fuzzer with block decoder

* instruction decoder instead of block

* Fix after upstream merge

* OwnedRefMut instead of Cow

* Read mem directly instead of going through files

* Fix cache lifetime and tail update

* clippy

* Taplo

* Compile caps only on linux

* clippy

* Fail compilation on unsupported OSes

* Add baby_fuzzer_intel_pt to CI

* Cleanup

* Move intel pt + linux check

* fix baby pt

* rollback forkexecutor

* Remove unused dep

* Cleanup

* Lints

* Compute an edge id instead of using only block ip

* Binary only intelPT POC

* put linux specific code behind target_os=linux

* Clippy & Taplo

* fix CI

* Disable relocation

* No unwrap in decode

* No expect in decode

* Better logging, smaller aux buffer

* add IntelPTBuilder

* some lints

* Add exclude_hv config

* Per CPU tracing and inheritance

* Parametrize buffer size

* Try not to break commandExecutor API pt.1

* Try not to break commandExecutor API pt.2

* Try not to break commandExecutor API pt.3

* fix baby PT

* Support on_crash & on_timeout callbacks for libafl_qemu modules (#2620)

* support (unsafe) on_crash / on_timeout callbacks for modules

* use libc types in bindgen

* Move common code to bolts

* Cleanup

* Revert changes to backtrace_baby_fuzzers/command_executor

* Move intel_pt in one file

* Use workspace deps

* add nr_addr_filter fallback

* Cleaning

* Improve decode

* Clippy

* Improve errors and docs

* Impl from<PtError> for libafl::Error

* Merge hooks

* Docs

* Clean command executor

* fix baby PT

* fix baby PT warnings

* decoder fills the map with no vec alloc

* WIP command executor intel PT

* filter_map() instead of filter().map()

* fix docs

* fix windows?

* Baby lints

* Small cleanings

* Use personality to disable ASLR at runtime

* Fix nix dep

* Use prc-maps in babyfuzzer

* working ET_DYN elf

* Cleanup Cargo.toml

* Clean command executor

* introduce PtraceCommandConfigurator

* Fix clippy & taplo

* input via stdin

* libipt as workspace dep

* Check kernel version

* support Arg input location

* Reorder stuff

* File input

* timeout support for PtraceExec

* Lints

* Move out method not needing self form IntelPT

* unimplemented

* Lints

* Move intel_pt_baby_fuzzer

* Move intel_pt_command_executor

* Document the need for smp_rmb

* Better comment

* Readme and Makefile.toml instead of build.rs

* Move out from libafl_bolts to libafl_intelpt

* Fix hooks

* (Almost) fix intel_pt command exec

* fix intel_pt command exec debug

* Fix baby_fuzzer

* &raw over addr_of!

* cfg(target_os = "linux")

* bolts Cargo.toml leftover

* minimum wage README.md

* extract join_split_trace from decode

* extract decode_block from decode

* add 1 to `previous_block_ip` to avoid that all the recursive basic blocks map to 0

* More generic hook

* fix windows

* Update CI, fmt

* No bitbybit

* Fix docker?

* Fix Apple silicon?

* Use old libipt from crates.io

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-11-12 22:34:46 -03:00
Valentin Huber
ae9ab80ad9
Fixing version pinning in CI (#2679) 2024-11-12 00:49:58 +01:00
Valentin Huber
e32b3eae93
Introducing Launcher::overcommit, improving CI formatting (#2670)
* introducing Launcher::overcommit

* removing unnecessary cfg restrictions and clippy allows

* improving warning for wrong clang-format version

* installing black in the format CI

* Enforcing python formatting in CI

* extending formatting using black on all python files

* printing diff on black failure

* preferring python's black over system black

* moving to LLVM 19 for formatting
2024-11-09 19:13:51 +01:00
Dominik Maier
36a24ab418
Custom Executor Example (#2570)
* [WIP] Custom Executor Example

* readme

* src/main.rs

* Finish

* fix warnings

* reame

* CI
2024-11-05 16:49:07 +01:00
Romain Malmain
49ea0b03a6
Compile-time edge module compilation check, native support for ConstMapObserver (#2592)
* compile-time edge module compilation trick

* clippy

* possible since rust 1.79

* split edge module in submodules

* Update frida to 0.14.0 (#2596)

* update frida crate to the latest version

* adapt libafl_frida to the latest version of frida

* tracers and generators private modules

* do not use star export.

* same for drcov

* forgot a file...

* first draft of generic-based edge module for ConstantLengthMapObserver.

* integration of OwnedSizedSlice.

replaced OwnedSlice in ConstMapObserver by the new OwnedSizedSlice.

* fix serde stuff

* no std

* import

* fixed qemu_cmin with new constant map abstraction.

* fix const map

* fix clippy from another pr...

* fix non-null usage

* fix ci?

* new feature stuff

* fixes

* minor fixes

* fmt

* non null

* im stupid

* fmt

* fix fuzzer

* fix fuzzers

* sized slice

* fuzzer fixes

* ptr::NonNull -> NonNull

* shorter trait length

* fmt
2024-11-04 14:34:52 +01:00
Aarnav
0f744a3abb
Add Python Grammar Loader for Nautilus (#2635)
* add python grammar loader for Nautilus

* fmt

* fmt toml

* add python to macos CI deps

* install python

* fmt

* ci

* clippy

* fix workflow

* fmt

* fix baby nautilus

* fix nautilus sync

* fmt

* fmt

* clippy

* typo

* fix miri

* remove pyo3 from workspace to packages which need it and make it optional

* go back to AsRef<Path> for nautilus grammar loading

* replace hardcoded python flags for macos build

* typo

* taplo fmt

* revert formatting of libafl_qemu_arch

* ci

* typo

* remove expects in NautilusContext::from_file and make them Results

* remove not(miri) clause in test

* try and fix python build fir ios and android

* again

* android

* tmate

* fix android build

* document load_python_grammar

* log if python or json when loading nautilus grammar

* make nautilus optional

* add nautilus as feature to forkserver_simple_nautilus
2024-10-29 11:32:59 +01:00
Marco C.
b9e6363826
Avoid using feature flags and env variable to set the same parameter pt.1 emulation_mode (#2512)
* Remove emulation_mode env variable and custom cfg

* Using only the feature flag simplifies things a bit and allow the usage of optional dependencies

* Do not use --all-features on libafl_qemu

* Add missing target_os = "linux"
2024-10-25 15:16:55 +02:00
Dominik Maier
e27ec269ce
Add TargetBytesConverter to allow Nautilus for ForkserverExecutor (#2630)
* Add TargetBytesConverter to allow Nautilus for ForkserverExecutor

* ci

* ci

* More

* fmt
2024-10-24 14:10:26 +02:00
Romain Malmain
23e966c702
Fix CI apt-get install (#2618) 2024-10-16 13:17:34 +02:00
Dominik Maier
830941ce3a
Rename LibAFL_GdiPlus to _Windows_ (#2604)
* Rename LibAFL_GdiPlus to _Windows_

* Readme more
2024-10-11 10:52:39 +02:00
Dongjia "toka" Zhang
c12c6f31e2
Change fuzzbench_qemu fuzzer (#2520)
* change fuzzbench_qemu

* real test

* fix qemu crash hook

* update bindings

* fix fork executor, reduce trait bound overhead

* make EdgeModule depend on observer to get ptrs.

* do not make EdgeCoverageModule::new public

* map observer as builder call

* adapt examples with new edge coverage module builder.

* TMP: everyone is a variable length map observer

* reuse profile path script

* fix absolute paths

* remove some dependencies to make pipeline faster

* compile-time builder initialization check

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-10-08 15:18:13 +02:00
Dongjia "toka" Zhang
a212d66afe
No Uses* for Observers (#2568)
* first

* Round 2

* Round 3

* Round 4

* Round 5

* Round 6

* Round 7

* Round 8

* clp

* from windows

* roll back

* baby building

* doc

* no deref

* frida

* api

* a

* impl HasLen

* libafl-fuzz and fmt

* asan error

* Cargo toml

* who cares abotu freebsd seriously?????

* aaaa

* qemu stuf

* fixing what i can fix

* nyx

* more for qemu stuf

* fixup libfuzzer

* fix baby swap

* AsIterMut

* UsesObservers eliminated

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-10-01 17:51:09 +02:00
Dominik Maier
4b99c69e51
Move fuzzers around some more (#2566)
* Move fuzzers around some more

* back to baby

* this was missing..

* shuffeling shuffeling

* shuffeling

* md

* cleanup

* oops

* Move foldername to underscore

* more doc
2024-09-27 18:14:13 +02:00
Dongjia "toka" Zhang
79b8390214
No Uses* for Corpus, Mutators (#2547)
* wip

* this shit is crazy

* from windows

* fmt

* fuck

* fmt

* aa

* reduce generics for generator

* do stuff for mutators, too

* aa

* a

* fmt

* idk

* getting things compiling

* fix merge

* idk

* fuzzers

* nire

* more

* a

* frida win

* cmin

* mm

* qemu?

* del ubuntu dep

---------

Co-authored-by: Your Name <you@example.com>
2024-09-26 20:03:03 +02:00
Romain Malmain
79cd1afec0
Move linkspector config file out of workflow dir (#2565) 2024-09-26 18:37:38 +02:00
Romain Malmain
42b3199807
Change action for MD link checks (#2563)
* change MD link action checker

* fix md files
2024-09-26 16:29:32 +02:00
Romain Malmain
c944a70056
Linux kernel fuzzing example (#2496)
* linux kernel (x509_cert) and process fuzzing example

* rework filters

* update to latest qemu

* working for process and kernel fuzzing

* new i2s mutator for binary only fuzzers

* refactoring modules with new filtering interface

* add state as parameter of harness

* hide unused global in usermode

* Script for stub bindings generation

* do not try to check whether it is worth generating the bindings, always
  generate when the env variable is on.

* add taplo to fmt_all.sh

* Moved fuzzers (again) in a target-centric way.

* fix rust 2024 warnings.

* new libafl_qemu harness structure.

* rename qemu_systemmode into qemu_baremetal

* fix qemu baremetal makefile

* fix formatter

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2024-09-26 14:29:33 +02:00
Valentin Huber
2c676f0352
Add MappedInputs to allow havoc muations for custom (sub-)inputs (#2422)
* introducing MappingMutator

* extending mapping mutators

* adding example fuzzer

* making crossover mutators more flexible.

* moving example fuzzer

* fixing dependency paths

* formatting

* fixing no std error

* fixing broken docs link

* fixing import paths

* fixing imports

* more format fixing

* adding new example fuzzer to CI

* fixing further imports

* fixing formatting

* formatting fixes

* improving docs for the example fuzzer

* adding documentation and tests to mapping mutators

* make extraction function for mapped crossover mutators more general

* adding MutVecFunctionMappingMutator

* Introducing WrapsReference

* code cleanup for mapping mutators

* adding tests and docs to mapping mutators

* reformatting comments

* fixing merging of mutators in example fuzzer

* formatting

* formatting v2

* cleanup according to PR comments

* adding type constraint to MappedInput helper functions to remove the need to specify types

* matching functions passed to mapped_havoc_mutations

* removing unnecessary constraints

* mapping mutators now contain the name of their inner mutator

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-09-18 23:23:04 +02:00
Romain Malmain
1f55458293
Fix fmt & remaining md links (#2497) 2024-08-22 19:08:44 -05:00
Romain Malmain
8d0ad23856
Check markdown links validity in CI (#2495)
* add markdown link check in ci

* fix broken links when possible.
configuration file for md checker.

* accept code 200...

* more fixes

* more fixes

* more fixes
2024-08-22 18:15:15 -05:00
Dominik Maier
651ea027b9
Speedup CI by moving checkout back (#2457)
* Speedup CI by moving checkout back

* apparently not legal

* better?
2024-07-29 17:48:46 +02:00
Dominik Maier
75af67f1e0
Fix CI after Rust 1.80, update to Ubuntu 24.04 (#2449)
* 0.13.2 (for real this time)

* More 0.13.2

* Make sure this never bites us

* Update ahash

* Fix CI after rust 1.80

* Does 18 work?

* Trying to fix this?

* lol regex

* noble

* works?

* fix llvm-config

* fmt

* Windows?

* more fix?

* more fix

* remove pip

* Add find_python3_version support to libafl_cc

* llvm-config

* more curl

* windows has no apt lol

* more
2024-07-29 15:31:41 +02:00
Dominik Maier
6df1b34375
Add Taplo check to CI (#2451)
* Add Taplo check to CI

* more taplo

* Try to make this easier
2024-07-26 18:38:50 +02:00
Mrmaxmeier
c44d361828
CI: Update actions and fix warnings (#2435)
* CI: update to checkout@v4 action

Not sure why they decided to bump a major version. It seems like this is
unnecessary churn: https://github.com/actions/checkout/pull/1436#issuecomment-1737711301

* CI: replace archived `actions-rs/toolchain`

It's been unmaintained for four years and has been throwing warnings in
CI:

> The `set-output` command is deprecated and will be disabled soon.

* CI: Bump `cargo-install` action.

This should fix the remaining warnings in CI?

* CI: mdbook-linkcheck: workaround for build error
2024-07-23 12:44:34 +02:00
Romain Malmain
82f11c22ad
Various CI improvements + fix wrong format check in CI (#2417)
use of LLVM 19 by default
    LLVM version should be much easier to switch from now on
    a lot of code repetition has been deleted
    removed llvm-related github action
    fix format check
    other small things

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2024-07-19 22:32:50 +02:00
Romain Malmain
1205c2144c
Restructure the fuzzers folder (#2409)
* move fuzzers in subfolders

* add readme

* remove redundent fuzzers
2024-07-19 18:24:24 +02:00
Dongjia "toka" Zhang
f00470ddaa
Corpus pruning stage (#2399)
* push

* upd

* add last found time

* add common as prerequisite

* clp

* aa

* more clp

* fix how to get corpus id

* pruning

* aa

* no std

* fix
2024-07-16 18:04:23 +02:00
Aarnav
aa21815a97
Introduce libafl-fuzz (#2362)
* Introduce libafl-fuzz

* fix corpus file path

* simplify SeedFeedback

* fix incorrect comment

* add clap::ValueEnum to PowerSchedule as an optional derive if clap is enabled

* UnixShMemProvider replaced with StdShMemProvider for libafl-fuzz

* remove io_error_more feature constraint

* libafl-fuzz: make Ok(()) unreachable in CentralizedLauncher

* libafl-fuzz: make harness_input_stdin to harness_input_type with &'static

* libafl-fuzz: move each feedback to it's own file

* make run_fuzzer_with_stage into a function.
use CachedOnDiskCorpus instead of OnDiskCorpus for Corpora
remove utils file

* remove unecessary clone

* libafl-fuzz: cleanup AFLStatsStage

* move peak_rss_mb to libafl_bolts

* parse envs by hand

* add sensible defaults for map size and broker port

* fix test.sh and corpus_id padding

* add Makefile.toml

* libafl-fuzz update test suite

* libafl-fuzz: clippy

* rename peak_rss_mb to peak_rss_mb_children

* remove minor version constraint for clap

* libafl-fuzz: fix ELF check and instrumentation check in check_binary

* libafl-fuzz: improve Makefile.toml

* simplify fuzzer and cleanup typos

* libafl-fuzz: load corpus entries in a multicore fashion

* libafl-fuzz: create output dir if not exists (non-racey)

* libafl-fuzz: add sequential scheduling support
libafl-fuzz: add cmplog options
libafl-fuzz: add test-cmplog.c to CI

* rename peak_rss_mb_children to peak_rss_mb_child_processes

* fix race condition in SyncFromDiskStage, add interval based checking and support for multiple directories.
libafl-fuzz: add support for syncing with foreign fuzzers

* update README

* implement AflScheduler for QueueScheduler.
Add queue_cycles field to
AflScheduler

* libafl-fuzz: remove dependecy on SchedulerMetadata for AflStatsStage

* clippy

* remove queue_cycles from AflScheduler into int's own trait.
libafl-fuzz: simplify map observer tracking

* clippy

* libafl-fuzz: disable cmplog check in CI for now

* add missing constraints for libafl_qemu executor

* clippy

* libafl-fuzz: improve Makefile
libafl-fuzz: clippy

* libafl-fuzz: misc

* misc typos, beautify

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-07-16 02:10:20 +02:00
Dongjia "toka" Zhang
8919024e83
New clippy script (#2400)
* claude.ai

* aaa

* ps1

* set -e

* nightly

* nightly default

* components?
2024-07-15 19:17:21 +02:00
Romain Malmain
539ac91ce0
fix qemu ci not running aggressively enough (#2395) 2024-07-15 13:55:35 +02:00
Dongjia "toka" Zhang
e3dd7cf0dc
Don't restart in deterministic stages. Don't restart where there's no restart safety. Make stage names unique (#2331)
* push

* fuck

* add

* add

* api

* api

* add multi machine to workspace

* doc

* api

* api

* add

* more

* fix

* stats

* rev

* fix

* fix

* real fix

* add

* fmt

* add

* add

* fix

* a

* add

* revert workflow

---------

Co-authored-by: Your Name <you@example.com>
2024-06-20 17:38:15 +02:00
Romain Malmain
fa17f47115
Tree-shaped multi-machine fuzzing (#2302)
* tree-shaped multi-machine fuzzing

* forgot main file

* aaa

* moving things around

* fix

* working?

* remove debug panic

* aaa

* aaa

* fmt

* normal centralized adapted

* removed old useless code

* cleanup

* llmp hooks

* working multi machine apparently?

* aaa

* cleanup (#2305)

* added old message dispatch.
thread safety stuff

* testing things around

* opti opti opti

* :)

* fuzz

* limit the amound received at once to avoid congestion

* remove useless corpus
mv to sqlite
less warnings

* aaa

* ;

* big opti

* adding cfgs

* fix

* fixer

* fix

* s

* clippy and reduce generics

* debugging

* fix

* more robust disconnection

* aaa

* aaa

* aaa

* nostd

* more nostd

* clippy

* not in ci

* unused

* aaa

* doc

* clippy

* clippy

* clippy

* no crash in libpng

* aaa

* aaa

* aaa

* aaa

* graph generator

* fix

* fix

* windows fix all

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-06-17 23:23:01 +02:00
mkravchik
03d8d2eb08
Fixing Frida ASAN tests on Windows (#2299)
* libafl_frida unit tests passing with ASAN

* Clippy+fmt

* Clippy

* Setup VS environment before building
2024-06-11 13:22:46 +02:00
Dongjia "toka" Zhang
454176427b
Windows clippy (#2295)
* add

* real one

* fuck

* abc

* def

* ghi

* jkl

* fix

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-06-08 20:32:40 +02:00
Dongjia "toka" Zhang
30ae963c45
Fix CI (#2292)
* p

* a

* p

* a

* delete transfered

* b

* bring back transferred

* ??

* xx

* conditional

* ?

* debug

* a

* 🤬🤬🤬🤬🤬🤬🤬

* a

* a

* comment
2024-06-08 16:25:49 +01:00
Dongjia "toka" Zhang
e99fcad326
Run ./scripts/fmt_all.sh in CI (#2290)
* pppp

* fix

* xx

* add clang18

* fix

* chg

* purge existing clang..

* tmate

* trigger

* bruh

* finally..

* Don't fmt when not in cargo-fmt

* fix

* aaaaaa

* fuck
2024-06-08 01:41:39 +02:00
Dominik Maier
58c39680c9
Move Nautilus to LibAFL, remove AGPL dependencies (#2265)
* Copy choose method for unbounded iterators

* Add choose method for unbounded iterators

* Copy&paste in nautilus grammartec

* cargo

* fmt

* Initial Nautilus in LibAFL

* missing link

* clippy

* clippy

* more clippy

* docs

* docs

* more docs

* remove nautilus default

* fix doctest

* fmt

* less vec

* test

* less flakey

* clippy

* clippy
2024-06-03 14:18:52 +02:00
Romain Malmain
65af5a7f78
Fix libnyx, library upgrades (#2254)
* try this thing

* this?

* use new mmap signature in nix.

* fix import

* fix to work with addr2line v0.23.

* remove unused flag

* update strum also for dependency...

* clippy

* clippy

* update lain git hash

* bump many outdated crates

* fix hash
2024-05-28 17:15:08 +02:00
Dongjia "toka" Zhang
e6eb6c48d2
LibAFL Dynamic Analysis (#2208)
* aa

* push

* push

* push

* claude ai

* push

* add

* add stuff

* upd

* rdm

* fix

* ci

* fix

* fix

* fixing

* feature

* revert

* no submodules

* ci
2024-05-24 14:43:27 +02:00
cube0x8
47d15ade81
Instrumentation filters remove generic bound (#2053)
* Removed S: UsesInput bound for HasInstrumentationFilter

* cargo fmt

* Removed S generic leftovers

* cargo fmt

* fix systemmode

* unused imports

* more verbose error.

* clippy

* debug test

* still debugging

* debug ci

* sudo

* debug

* debug

* debug

* add g++

* build-essential

* more deps...

* restore to sane state.

* remove useless comment.

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-05-22 12:58:10 +02:00
Dominik Maier
117741e1b1
Run Clippy on macOS (#2222)
* macos clippy

* Fix clippy on macOS
2024-05-20 02:58:42 +02:00
Dongjia "toka" Zhang
22d8e92b08
Ci fix (#2212)
* bbb

* ccc
2024-05-18 13:42:03 +02:00
Dongjia "toka" Zhang
f8f9da2a15
Trying to fix CI (#2211)
* test

* aaa

* 4.38

* 4.37
2024-05-18 00:13:11 +02:00
Dongjia "toka" Zhang
d4ff7b86b1
Add windows test & ci & fix (#2144)
* fix

* ignore

* fmt

* a
2024-05-05 14:53:27 +02:00