113 Commits

Author SHA1 Message Date
Andrea Fioraldi
ce63b76558
Update to v0.15.3 (#3259)
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-05-23 22:50:23 +02:00
Dongjia "toka" Zhang
2c262b0597
UPDATE LOCKFILE (#3267) 2025-05-23 16:35:30 +02:00
jma
871548c366
Allow passing Qemu object to QemuBytesCoverageSugar (#3261)
* attempt to return Qemu object as a parameter to QemuBytesCoverageSugar

* apply clippy suggestions from precommit.sh

* python qemu sugar: add option to enable stdout

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-05-23 10:22:00 +02:00
WorksButNotTested
1355bd5294
Improve CI (#3258)
* Improve CI

* Fix markup errors

* Remove unnecessary matrix parameters

* Rename matrix jobs to tidy up the UI

* Allow the docker cache to be updated

* Fix cache name

* Share some caches

* Rename tools
2025-05-22 16:08:35 +02:00
WorksButNotTested
3a62013c85
LibAFL_QEMU: Add redirect stdout module (#3256)
* Add redirect stdout

* Review changes
2025-05-21 13:26:02 +02:00
Rowan Hart
0b25d723c0
Windows Support for LibAFL-LibFuzzer (#3130)
* Add windows build script and additional changes to support windows for libafl-libfuzzer

* Update build scripts and harness wrapping directives

* Resolve issue with corpus edge count calculation

* Add help message and make fork do nothing on Windows

* Format harness_wrap.cpp

* Clippy happiness pass

* Clippy happiness pass

* Clippy happiness pass

* Correct logic

* Correct logic

* Update help output and make runs argument work

* Add test for libafl_libfuzzer on windows

* Add workflow for libafl_libfuzzer test

* Fix copy without dependent task

* Add libafl_libfuzzer_windows to preflight list

* Format harness

* Explicitly ignore windows fuzzer

* Remove windows-specific copy from unix instructions

* Ensure using nightly

* Fix job name

* Update build to use libFuzzer.lib on Windows to keep consistent with Linux

* Remove nightly requirement

---------

Co-authored-by: Rowan Hart <rowanhart@microsoft.com>
2025-05-21 01:35:48 +02:00
lazymio
f901c2085d
Support capturing stdout/stderr for ForkserverExecutor and code clean (#3216)
* Support capture stdout/stderr for ForkserverExecutor

Reduce code duplication for ForkserverExecutor and CommandExecutor

* use memfd_create from nix for macos and remove debug print

* resolve macos issue

* clippy

* fix macos again

* fix docs

* fix imports

* format code

* fix docs again

* fix sample

* fix another wrong import

* restore cargo.lock

* add an inner for target args

* fix and docs

* fix

* rename to ChildArgs and ChildArgsInner

* revert forkserver_simple

* allow debug child with observers

* fmt

* std marker

* fix

* move implementation to observers

* implement serde

* Add a forkserver_capture_stdout

* renaming

* fix

* fmt

* fix CommandExecutor

* add a test to check capture

* fix imports

* clippy

* fix sample

* update sample to make it closer to real usecase

* also CommandExecutor for sample

* format

* add forkserver_capture_stdout to CI

* fix doc

* accidentally remove

* fix non_std

* fix for windows

* remove useless lint

* remove spurious fuzzer

* fix for windows again

* fix imports

* fix doc sample

* fix docs

* fix sample

* fmt

* clippy

* clippy again

* fix msrv

* have cargo.lock for sample fuzzer

* avoid double read

* fix fsrv and cmd

* fix sample

* fix docs for windows

* fix typo

* clippy again

* fix exec

* typo

* clippy

* update

* fix nyx executor

* cliipy

* fmt again

* last clippy

* clippy
2025-05-13 16:08:27 +02:00
dependabot[bot]
522e00eda0
Bump tokio from 1.44.1 to 1.45.0 in /fuzzers/binary_only/frida_libpng (#3212)
Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.44.1 to 1.45.0.
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.44.1...tokio-1.45.0)

---
updated-dependencies:
- dependency-name: tokio
  dependency-version: 1.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-05-12 15:29:14 +02:00
Dongjia "toka" Zhang
390008e1d5
fix qemu launcher bug (#3206)
* no more shellscript

* metadatas

* clp

* clippo

* fix bug

* taplo

* Merge branch 'qemu_launcher_insane' of github.com:AFLplusplus/LibAFL into qemu_launcher_insane

* fix wrong code
2025-05-12 15:12:20 +02:00
dependabot[bot]
58bdbd293a
Bump tokio in /fuzzers/binary_only/frida_windows_gdiplus (#3204)
Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.44.1 to 1.45.0.
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.44.1...tokio-1.45.0)

---
updated-dependencies:
- dependency-name: tokio
  dependency-version: 1.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-08 14:44:18 +02:00
Dongjia "toka" Zhang
d8f8640982
Always show user monitor in SimpleMonitor (#3202)
* *recursion* is not proper

* user monitor on

* api changer

* no submodule anymore
2025-05-07 18:17:58 +02:00
Dongjia "toka" Zhang
62d9485f10
Use symlink instead to get the corpus (#3177)
* a

* add real symlink

* tmate

* corpus

* detmate

---------

Co-authored-by: Skynet 2 <name@domain.example>
2025-04-28 18:47:10 +02:00
Dongjia "toka" Zhang
3ec8098d76
Remove duplicate corpus folders (#3174)
* remove duplicate pngs

* add tmin corpus back

* fix

* windows?

* space

* exit 0

* oops
2025-04-28 15:39:47 +02:00
forky2
c3475cd577
Qemu tmin (#3118)
* Start on qemu_tmin

* WIP

* qemu_tmin working for single testcase.
Also some comment improvements.

* Add env_logger to baby_fuzzer

* Remove old reference.

* Added comment doc for qemu_tmin.

* Slight reorder for parallelisation

* Finished single-thread qemu_tmin

* Finishing touches to single thread version.

* A pre_commit.sh change I didn't notice.

* Duplicate to attempt multi-threaded version

* Fix taplo whine.
Mark "fork" mode as broken.

* Launcher for parallelisation implemented, but for one core.

* Running in parallel. Now need tidy up.

* Parallel version complete.

* Add comment

* Merged single-core/multi-core qemu_tmin into one crate

* Removed forkexecutor mode.

* Precommit fixes

* Add qemu_tmin to build_and_test.yml

* Clippy fixes

* Change tmin test cores to 0.
2025-04-25 23:08:18 +02:00
Francesco Cirillo
796ce20cd8
ScheduledMutator Fix with_max_stack_pow (#3148)
* ScheduledMutator Fix with_max_stack_pow

* Renamed StdScheduledMutator to HavocScheduledMutator

* Added SingleChoiceScheduledMutator

* Changed HavocScheduledMutator description

* Added rename in migration

* Missed renaming

* cargo fmt fix

* cargo fmt fix 2

* Clippy duplicate code and safer test

* cargo fmt fix 3

* Removed my hallucination
2025-04-12 20:35:31 +02:00
Dominik Maier
6372148149
Update README.md (#3149) 2025-04-10 02:21:17 +02:00
Romain Malmain
4f5ca8f8e2
Fix cmplog for qemu fork executor (#3145)
* update cmplog map ptr

* do not lower it; it's still there so it should be working
2025-04-09 15:25:13 +02:00
Romain Malmain
fb8939eefc
Fix fork bug in libafl qemu (#3109)
* fix fork bug

* lol

* fix

* lower it; we're gonna move from this anyway

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-04-08 19:08:40 +02:00
Dongjia "toka" Zhang
c99371fd20
Fix tiny inst (#3126)
* fix tn inst

* add

* fix more
2025-04-03 16:22:25 +02:00
Dongjia "toka" Zhang
b67bd1792f
update libnyx (#3111)
* apude

* lock
2025-03-27 13:25:58 +01:00
dkoch144
f700aac911
Enable building libpng on CI without using GUI (#3110)
* Fixing windows ci build in justfile. harness.cc modified for cl.exe. Additions to README.

* More precise compiler check for noinline definition.

---------

Co-authored-by: dkoch <dkoch@vigilantsys.com>
2025-03-26 22:16:06 +01:00
Dongjia "toka" Zhang
bd12639f8e
0.15.2 (#3104)
* 0.15.2

* miri

* mistake

* unsafe

* lock file
2025-03-25 13:30:15 +01:00
WorksButNotTested
30946641cd
Add filter to ASAN module in qemu_launcher (#3089)
also add filters to rasan runner.

Co-authored-by: Your Name <you@example.com>
2025-03-19 16:13:45 +01:00
Romain Malmain
d5ddc1359e
Fix qemu snapshot module unmap (#3084)
* fix qemu usermode snapshot unmap

* fix phys addr computation for qemu. some cleanup.
2025-03-18 10:31:16 +01:00
Romain Malmain
d67296f34e
Soft recovery from crashes in libafl qemu usermode (#3073)
* soft recovery from crashes in qemu

* regen bindings for clippy

* configurable crash behaviour
2025-03-14 16:56:03 +01:00
Romain Malmain
85bcafa831
Track lockfiles (#3015)
* rename libafl_fmt into liabfl_repo_tools

* add option to generate lockfiles

* only keep binary lockfiles (update gitignore)
2025-03-13 12:32:09 +01:00
Dongjia "toka" Zhang
ff8a5b3baa
Fix wrong path in Justfile (#3068) 2025-03-11 18:58:53 +01:00
Dongjia "toka" Zhang
226a20e6cf
Fix usage of TracingStage (#3062)
* real fix

* more

* debug

* fix

* fixer

* mmmm

* mm

* mm

* mm

* fix

* fix atheris

* ?
2025-03-11 14:37:19 +01:00
WorksButNotTested
728b1216bb
Librasan (#3023)
* Fixes to main

* Add librasan

* Party like it's 2024

* Fix snapshot module to work with guest asan

* Fix guest_asan module

* Fixes to runner

* Fix linking issues using a REL

* Fix qemu_launcher

* Change modify_mapping to a method

* Fix gasan_test

* Remove debug from Justfile

* Optimize release build of librasan

* Set ulimit for qasan and gasan tests

* Tidy up symbol renaming

* Add missing symbols for PPC

* Change to support rustix 1.0.0

* Canonicalize the CUSTOM_ASAN_PATH

* Review changes

* Restructure backends

* release_max_level_info

* More review changes

* Clippy fixes

* Changes to reduce the burden on the CI

* Fix macos clippy

---------

Co-authored-by: Your Name <you@example.com>
2025-03-10 17:27:55 +01:00
Dongjia "toka" Zhang
620500e295
Remove AdaptiveSerializer, Send off interesting testcase from crash handler, Add clearer error message (#3053)
* clean

* test thread 1

* add some error messages

* mm

* std

* mm

* aa

* pp

* fix

* change fuzzers

* fix

---------

Co-authored-by: Your Name <you@example.com>
2025-03-08 20:12:16 +01:00
Dominik Maier
ce5fd435ea
Move all unnecessary std uses to core,alloc (#3027)
* Move all unnecessary std uses to core,alloc

* More

* more fix

* more

* more

* Remove libafl-fuzz grimoire

* more

* more

* more cleanup

* remove bins

* fix

* more fix
2025-02-27 14:32:37 +01:00
Dominik Maier
e5ba51aae4
More LibAFL_QEMU Launcher things (#3000)
* More LibAFL_QEMU Launcher things

* Fix CI

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-24 16:12:37 +01:00
Celian G.
40c0a8c57c
Improved calling convention support for x86, x86_64, arm and aarch64 for libafl-qemu (#3013)
* Improved calling convention support for x86, x86_64, arm and aarch64

* fix

* fix write_function_arguments

* fix argument_error

* follow clippy advice

* last change?

* fix guestaddr issue

* add code block for cargo-fmt

* default to default convention

* fix mistake

* add pub

* fix

* changes after review

* last change?

---------

Co-authored-by: celian <cglenaz>
2025-02-21 18:04:45 +01:00
Dominik Maier
7c83be2408
Add auto format to settings.json.default, format documentation and macros (#3019)
* Add auto format to settings.json.default

* Add more nightly rustfmt features
2025-02-21 13:31:31 +01:00
Dongjia "toka" Zhang
0e4c6722f0
Replay stage (#3003)
* replay stage

* seems to be working

* a

* rever

* rev

* rdy for merge

* fmt

* lol
2025-02-18 19:55:02 +01:00
Dongjia "toka" Zhang
70eb8158e5
Refactor stages (#3002)
* refactor

* miss

* lol

* revivet tests

* aa

* ?

* a

* fuck

* fuck

* a

* m

* fuck
2025-02-18 14:25:21 +01:00
Marco C.
47f7978b91
Bump Libipt 0.3, add HW breakpoint support (#2984)
* Decode with callback

* WIP restore intelpt module

* Fix build_target if target_dir doesn't exist

* WIP itelpt qemu/kvm example: bootloader

* qemu config refactoring

* Fix intel_pt_command_executor target dir

* * QEMU error refactoring*
* back to one QEMU init function
* other small things

* update test

* Bump libipt

* waitpid_filtered to ignore SIGWINCH

* Fix warnings unused manifest key: *.version

* Add export_raw feature to libafl_intelpt

* derive Debug for IntelPTHook

* Clippy

* Light refactor of EmulatorModules

* qemu is now a parameter to EmulatorModule callbacks and most function hooks.
* EmulatorModules is initialized before QEMU is initialized.

* Update target program ELF offsets

* fmt

* * asan fixed size accesses working with generics
* continue to propagate qemu argument as hook first parameter
* use pre_syscall* and post_syscall* everywhere
* fix some clippy stuff

* fmt

* Add comment to KVM pt_mode check

* refactor

* Add intel_pt_export_raw feature in libafl

* fix fuzzers

* * refactor asan and asanguest modules to avoid custom init of QEMU and use the module interface instead.
* adapt qemu_launcher example to fully work with emulator, since qemu must now be initialized by emulator.

* fmt

* clippy

* fix qemu_coverage

* fmt

* forgot qemu args in launcher

* map_error instead of unwrap

* use correct args

* Update to new libafl_qemu

* adapt api

* borrow checker friendly join_split_trace

and copy trace before deocde to prevent decoding failures

* testing stuff

* Set ip_filters (also) with builder

* Move trace to file

* Store a pt_builder in module

enable the setting of filters and other pt settings

* baby_bootloader target

* Best bootloader ever

* new builder?

* use closure for qemu config from emulator builder.

* better format

* clippy + fmt

* Fix build target

Create target directory if doesn't exist

* Remove filter on speculatively exec blocks

since also committed blocks can have this flag

* Add current ip_filters getter

* Fix possibile infinite loop in trace decode

* HW breakpoint + snapshot

* add snapshot and exit at first objective

* prefer raw pointers to slice_from_raw_parts_mut

since the latter is highly unsafe and allows more potentially dangerous reordering

* Add cpu option to QEMU config

* Add cpu option and minor improvements

* fix cargo run causing recompile

* no default devices

* windows clippy fix

* Exclude intel_pt feature from CI as all systemmode feats

* Add qemu_intel_pt_bootloader to CI

* Fix NopPageFilter

* Fix qemu_config

* Restore HW breakpoints

* Lints

* return Result for hw bp set/remove

* mark join_split_trace as unsafe

* Put the qcow2 in a tmpfs ramdisk

10x exec/sec

* Post merge fixes

* Try out libipt 0.3 alpha

* Try out libipt 0.3 alpha also in hook

* Clippy

* New libipt

* Post merge fixes

* Bump libipt

* Drive cache None

* Post merge fixes

* Use SectionInfo from libipt

* No slice::from_raw_parts_mut, just use raw pointer

* Cache the decoder builder

* Update qemu-bridge

* Add qemu -append param

* Move linux specific code to a mod, less #[cfg]s

* Add qemu initrd config

* Add qemu monitor tcp

* Add not enough ip filters message

* Fix wrong must_use

* Prevent possible infinite loop in block decoding in debug mode

* Clippy

* fix CI?

* Revert, keep libipt 0.3 and hw bp

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
Co-authored-by: Marco Cavenati <marco@lenovo300e>
2025-02-17 14:50:07 +01:00
Dominik Maier
53004f93d6
Improvements for QEMU_Launcher (#2983)
* Improvements for QEMU_Launcher

* fix
2025-02-17 02:45:02 +01:00
mkravchik
b3fe744e57
Pr/fasan multithreading fixes upstream (#2955)
* Fixing the test_harness library name

* Fasan works, but testing of all features is pending

* Tests pass, before fixing clippy and fmt

* CLippy+fmt

* CLippy+fmt+tests running on linux

* Clippy

* Not stalkering the fuzzer. In the correct way

* Removing the instrumentation upon crash. Proper hooking of UnmapViewOfFile

* Fixes after the merge from the upstream (before 0.15.0). Still need to add the observer, clippy, fmt, and at least linux compilation

* Adding the helper observer and using it in the test

* Removing the observer from the wrong location

* Adapting to the new helper ownership model

* Adding an observer to shut down instrumentation upon crash

* Clippy + fmt

* Using mimalloc everywhere

* Deactivating before activating with the harness. Otherwise, gets stuck on Linux.

* Fixing imports for windows

* Using the new way of passing the handler

* Using frida_helper_shutdown_observer

* Clippy+fmt

* no-std, clippy

* Fmt

* Stable thread_id

* Clippy 18

* More clippy

* Formatting toml

* Fixing apples

* Fixing apples 2

* Fixing apples 3

* Upping to 0.16.7 (necessary for Windows)

* Clippy+fmt

* Enabling the allocator test after the fix and clarifying the importantce of the static runtime linking.

* Moving has_tls to bolts

* Proper handling of no-std, hopefully

* Another attempt to fix win no-std

* Not mine clippy complaint...

* Not mine clippy complaint #2...

* Dlmalloc not used, removing from dependencies

* Restoring target in config.toml (otherwise fails CI on Linux)

* lots of digging around, pray for us

* fixup?

* Revert "lots of digging around, pray for us"

This reverts commit 706c27201918e906e3401cd0d9e76546f889d1f5.

* Revert "fixup?"

This reverts commit 1d7c5d4fb5b1bd31f5e0c07492aa8ed64c6822f3.

* Revert artifact

* Revert fixups

* Removing unused

* Reverting to upstream/main

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-14 13:45:38 +01:00
Dongjia "toka" Zhang
7202e2a26e
Replace "cargo make" to "just" in md files (#2979)
* justify

* justify
2025-02-13 14:35:38 +01:00
Romain Malmain
cb471a9282
Move to just (binary_only / full_system) (#2949)
* just port for binary only / systemmode fuzzers

* introduce just libraries, with pre-initialized variables and common recipes

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-13 12:42:38 +01:00
Dominik Maier
bdcc0c56e4
Remove outdated comment in QEMU_Launcher (#2975) 2025-02-13 02:23:08 +01:00
Dongjia "toka" Zhang
cb3abf27a3
Add a functionality to see the current qemu mappings. (#2971)
* add

* a

* take qemu

* fix for fuzzers
2025-02-12 16:56:36 +01:00
WorksButNotTested
739156cb23
Add SnapshotModule to qemu_launcher (#2887)
* Add SnapshotModule to qemu_launcher

---------

Co-authored-by: Your Name <you@example.com>
2025-02-11 18:42:20 +01:00
WorksButNotTested
4cb4b6df77
Change qemu_cmin to use snapshots (#2939)
* Change qemu_cmin to use snapshots

* Use features to support both fork and snapshot modes

---------

Co-authored-by: Your Name <you@example.com>
2025-02-11 18:36:17 +01:00
Dongjia "toka" Zhang
89e470250f
Properly use in_handler (#2957)
* properly use it

* a

* a

* typo
2025-02-09 15:08:09 +01:00
Romain Malmain
8398f8f99a
Qemu signal refactoring (#2920)
* qemu signal refactoring

* udpate qemu

* clippy, moving things around

* update bindings

* nostd

* cfg

* fmt

* nostd

* clippy

* fmt

* aaa

* windowsssssss

* systemmode

* reimport fix

* remove llmp from replay mode

* lol

* fixer

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-04 14:43:26 +01:00
Dongjia "toka" Zhang
defb475d28
Fix EdgeCoverageModuleBuilder (#2931) 2025-02-04 14:34:11 +01:00
Dominik Maier
84702d12a8
Make sure EM and Z remain consistent in InProcessExecutor (#2873)
* Make sure EM and Z remain consistent in InProcessExecutor

* first make them compile

* a

* hah

* fix intel pt

* decouple fuzzer from em

* lol

* 3

* fix tcp

* fix

* fix

* fix

* fixer

* std

* fixer

* plz

* plzplzplz

* plzplzplzplz

* mm

* more

* symbol

* a

* a

* mm

* mmm

* mmmm

* mmmmm

* ff

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2025-02-01 08:23:40 +01:00
Romain Malmain
75feedd1a0
Add builder and tests for QASAN (#2898)
* Add tests for QASAN from aflplusplus

* refactor asan module to use the builder pattern

* move injection tests to the new tests directory
2025-01-31 15:43:50 +01:00