1308 Commits

Author SHA1 Message Date
Dongjia "toka" Zhang
0e4c6722f0
Replay stage (#3003)
* replay stage

* seems to be working

* a

* rever

* rev

* rdy for merge

* fmt

* lol
2025-02-18 19:55:02 +01:00
bbf99eca8b profile woets 2025-02-18 16:27:53 +01:00
64d1151e96 dump intermediate cases 2025-02-18 16:25:57 +01:00
Dongjia "toka" Zhang
70eb8158e5
Refactor stages (#3002)
* refactor

* miss

* lol

* revivet tests

* aa

* ?

* a

* fuck

* fuck

* a

* m

* fuck
2025-02-18 14:25:21 +01:00
Romain Malmain
a682c36c84
Fix build for libfuzzer_libpng in ubuntu 24 (#2987)
* fix justfile for ubuntu libpng
2025-02-18 11:58:31 +01:00
107ccf03a8 config updates 2025-02-17 18:35:02 +01:00
Marco C.
47f7978b91
Bump Libipt 0.3, add HW breakpoint support (#2984)
* Decode with callback

* WIP restore intelpt module

* Fix build_target if target_dir doesn't exist

* WIP itelpt qemu/kvm example: bootloader

* qemu config refactoring

* Fix intel_pt_command_executor target dir

* * QEMU error refactoring*
* back to one QEMU init function
* other small things

* update test

* Bump libipt

* waitpid_filtered to ignore SIGWINCH

* Fix warnings unused manifest key: *.version

* Add export_raw feature to libafl_intelpt

* derive Debug for IntelPTHook

* Clippy

* Light refactor of EmulatorModules

* qemu is now a parameter to EmulatorModule callbacks and most function hooks.
* EmulatorModules is initialized before QEMU is initialized.

* Update target program ELF offsets

* fmt

* * asan fixed size accesses working with generics
* continue to propagate qemu argument as hook first parameter
* use pre_syscall* and post_syscall* everywhere
* fix some clippy stuff

* fmt

* Add comment to KVM pt_mode check

* refactor

* Add intel_pt_export_raw feature in libafl

* fix fuzzers

* * refactor asan and asanguest modules to avoid custom init of QEMU and use the module interface instead.
* adapt qemu_launcher example to fully work with emulator, since qemu must now be initialized by emulator.

* fmt

* clippy

* fix qemu_coverage

* fmt

* forgot qemu args in launcher

* map_error instead of unwrap

* use correct args

* Update to new libafl_qemu

* adapt api

* borrow checker friendly join_split_trace

and copy trace before deocde to prevent decoding failures

* testing stuff

* Set ip_filters (also) with builder

* Move trace to file

* Store a pt_builder in module

enable the setting of filters and other pt settings

* baby_bootloader target

* Best bootloader ever

* new builder?

* use closure for qemu config from emulator builder.

* better format

* clippy + fmt

* Fix build target

Create target directory if doesn't exist

* Remove filter on speculatively exec blocks

since also committed blocks can have this flag

* Add current ip_filters getter

* Fix possibile infinite loop in trace decode

* HW breakpoint + snapshot

* add snapshot and exit at first objective

* prefer raw pointers to slice_from_raw_parts_mut

since the latter is highly unsafe and allows more potentially dangerous reordering

* Add cpu option to QEMU config

* Add cpu option and minor improvements

* fix cargo run causing recompile

* no default devices

* windows clippy fix

* Exclude intel_pt feature from CI as all systemmode feats

* Add qemu_intel_pt_bootloader to CI

* Fix NopPageFilter

* Fix qemu_config

* Restore HW breakpoints

* Lints

* return Result for hw bp set/remove

* mark join_split_trace as unsafe

* Put the qcow2 in a tmpfs ramdisk

10x exec/sec

* Post merge fixes

* Try out libipt 0.3 alpha

* Try out libipt 0.3 alpha also in hook

* Clippy

* New libipt

* Post merge fixes

* Bump libipt

* Drive cache None

* Post merge fixes

* Use SectionInfo from libipt

* No slice::from_raw_parts_mut, just use raw pointer

* Cache the decoder builder

* Update qemu-bridge

* Add qemu -append param

* Move linux specific code to a mod, less #[cfg]s

* Add qemu initrd config

* Add qemu monitor tcp

* Add not enough ip filters message

* Fix wrong must_use

* Prevent possible infinite loop in block decoding in debug mode

* Clippy

* fix CI?

* Revert, keep libipt 0.3 and hw bp

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
Co-authored-by: Marco Cavenati <marco@lenovo300e>
2025-02-17 14:50:07 +01:00
henri2h
9a2a42ccca
Fix libafl_unicorn CI (#2991)
* fix: clippy

* fix: allow specifying thumb mode or not

* fix: timeout for testcase
2025-02-17 10:45:07 +01:00
Dominik Maier
53004f93d6
Improvements for QEMU_Launcher (#2983)
* Improvements for QEMU_Launcher

* fix
2025-02-17 02:45:02 +01:00
henri2h
0aba2c4520
Add support for Unicorn engine (#1054)
* feat: unicorn support

* feat: update

* fix: remove unused files

* fix: clean

* fix: remove undeeded parameters

* fix: typo

* moved to justfile

* use log::debug!

* fix cargo and created justfile

* feat: add CI

* add runs on

* fix: CI

* fix: CI

* fix: don't use fork executor

* not needed anymore

* fix: CI

* fix: CI

* remove extra space
2025-02-15 04:15:16 +01:00
mkravchik
b3fe744e57
Pr/fasan multithreading fixes upstream (#2955)
* Fixing the test_harness library name

* Fasan works, but testing of all features is pending

* Tests pass, before fixing clippy and fmt

* CLippy+fmt

* CLippy+fmt+tests running on linux

* Clippy

* Not stalkering the fuzzer. In the correct way

* Removing the instrumentation upon crash. Proper hooking of UnmapViewOfFile

* Fixes after the merge from the upstream (before 0.15.0). Still need to add the observer, clippy, fmt, and at least linux compilation

* Adding the helper observer and using it in the test

* Removing the observer from the wrong location

* Adapting to the new helper ownership model

* Adding an observer to shut down instrumentation upon crash

* Clippy + fmt

* Using mimalloc everywhere

* Deactivating before activating with the harness. Otherwise, gets stuck on Linux.

* Fixing imports for windows

* Using the new way of passing the handler

* Using frida_helper_shutdown_observer

* Clippy+fmt

* no-std, clippy

* Fmt

* Stable thread_id

* Clippy 18

* More clippy

* Formatting toml

* Fixing apples

* Fixing apples 2

* Fixing apples 3

* Upping to 0.16.7 (necessary for Windows)

* Clippy+fmt

* Enabling the allocator test after the fix and clarifying the importantce of the static runtime linking.

* Moving has_tls to bolts

* Proper handling of no-std, hopefully

* Another attempt to fix win no-std

* Not mine clippy complaint...

* Not mine clippy complaint #2...

* Dlmalloc not used, removing from dependencies

* Restoring target in config.toml (otherwise fails CI on Linux)

* lots of digging around, pray for us

* fixup?

* Revert "lots of digging around, pray for us"

This reverts commit 706c27201918e906e3401cd0d9e76546f889d1f5.

* Revert "fixup?"

This reverts commit 1d7c5d4fb5b1bd31f5e0c07492aa8ed64c6822f3.

* Revert artifact

* Revert fixups

* Removing unused

* Reverting to upstream/main

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-14 13:45:38 +01:00
7d1e4fd171 plotting + minia fix 2025-02-13 16:38:29 +01:00
Dongjia "toka" Zhang
7202e2a26e
Replace "cargo make" to "just" in md files (#2979)
* justify

* justify
2025-02-13 14:35:38 +01:00
Romain Malmain
cb471a9282
Move to just (binary_only / full_system) (#2949)
* just port for binary only / systemmode fuzzers

* introduce just libraries, with pre-initialized variables and common recipes

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-13 12:42:38 +01:00
Dominik Maier
bdcc0c56e4
Remove outdated comment in QEMU_Launcher (#2975) 2025-02-13 02:23:08 +01:00
4d29735354 hash notify value, config fixes 2025-02-12 17:24:16 +01:00
558b464c1a all new benchmark scripts 2025-02-12 17:03:30 +01:00
Dongjia "toka" Zhang
cb3abf27a3
Add a functionality to see the current qemu mappings. (#2971)
* add

* a

* take qemu

* fix for fuzzers
2025-02-12 16:56:36 +01:00
WorksButNotTested
739156cb23
Add SnapshotModule to qemu_launcher (#2887)
* Add SnapshotModule to qemu_launcher

---------

Co-authored-by: Your Name <you@example.com>
2025-02-11 18:42:20 +01:00
WorksButNotTested
4cb4b6df77
Change qemu_cmin to use snapshots (#2939)
* Change qemu_cmin to use snapshots

* Use features to support both fork and snapshot modes

---------

Co-authored-by: Your Name <you@example.com>
2025-02-11 18:36:17 +01:00
Dominik Maier
b7fcfdd192
Change combine_monitors macro to be tuple_list of Monitors (#2963)
* Make Monitors tuple_list

* fix

* no_std

* unused

* more
2025-02-11 02:40:53 +01:00
Dongjia "toka" Zhang
2c741c8f38
Move to Just (#2952)
* move to just

* fuzzbench

* shell check

* version

* rme

* fixer

* fixing

* libpng friends

* pwd

* ps

* ps

* no fail fast.. for now

* windows

* l

* no powershell

* a

* fk

* fixer

* a

* Revert "fixer"

This reverts commit 76ae72d68686ead01ef914b658c5d8dac5aaee32.

* plzplz

* aaaa

* aa

* aa

* use absolute path, use LIBAFL_CC and LIBAFL_CXX

* why tabs????

* this job is not fun

* aa

* tmate debug

* disable cacheing

* del

* deldelg

* rename

* aaaa

* lol

* aaa

* lol

* lol

* 2nd tmate ...

* a

* lol

* lll

* shell ck

* please i'm about to cry

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2025-02-09 18:44:50 +01:00
Dongjia "toka" Zhang
89e470250f
Properly use in_handler (#2957)
* properly use it

* a

* a

* typo
2025-02-09 15:08:09 +01:00
EvianZhang
abe955137f
Remove base-pattern for Monitor (#2953)
* Remove base-pattern for Monitor

* Fix runtime parameter for log_record

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-08 14:08:00 +01:00
Dongjia "toka" Zhang
c03dfd9daf
Revert "Move to just (#2924)" (#2951)
This reverts commit 00582d849478ed4c2cd5ba5c7c9f46359555bd08.
2025-02-07 15:29:02 +01:00
809f3b0d6a config changes 2025-02-07 12:43:42 +01:00
Dongjia "toka" Zhang
00582d8494
Move to just (#2924)
* move to just

* fuzzbench

* shell check

* version

* rme

* fixer

* fixing

* libpng friends

* pwd

* ps

* ps

* no fail fast.. for now

* windows

* l

* no powershell

* a

* fk

* fixer

* a

* Revert "fixer"

This reverts commit 76ae72d68686ead01ef914b658c5d8dac5aaee32.

* plzplz

---------

Co-authored-by: Your Name <you@example.com>
2025-02-07 11:26:33 +01:00
Romain Malmain
8398f8f99a
Qemu signal refactoring (#2920)
* qemu signal refactoring

* udpate qemu

* clippy, moving things around

* update bindings

* nostd

* cfg

* fmt

* nostd

* clippy

* fmt

* aaa

* windowsssssss

* systemmode

* reimport fix

* remove llmp from replay mode

* lol

* fixer

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-04 14:43:26 +01:00
Dongjia "toka" Zhang
defb475d28
Fix EdgeCoverageModuleBuilder (#2931) 2025-02-04 14:34:11 +01:00
Dhanvith Nayak
72986fc129
Deduplicate OnDisk Corpus (#2827)
* testcase name logic

* implement locking

* implement logic for removing testcase

* minor modifications

* minor modifications to remove_testcase()

* extract generate_name() from trait Input (broken)

* Revert "extract generate_name() from trait Input (broken)"

This reverts commit 9e217be2810a8c33970846cdd380f542975cc05b.

* fix ci errors

* remove CorpusId from generate_name() calls

* toml formatting

* write from file instead of fs

* fmt and clippy

* fix windows clippy

* handle renaming of testcase

* fix failing cmplog test

* overwrite lockfile on remove testcase

* format

* bring back corpus id in generate_name

* missed windows executors hook

* fix failing tests

* some more errors

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-04 07:41:00 +01:00
Dominik Maier
84702d12a8
Make sure EM and Z remain consistent in InProcessExecutor (#2873)
* Make sure EM and Z remain consistent in InProcessExecutor

* first make them compile

* a

* hah

* fix intel pt

* decouple fuzzer from em

* lol

* 3

* fix tcp

* fix

* fix

* fix

* fixer

* std

* fixer

* plz

* plzplzplz

* plzplzplzplz

* mm

* more

* symbol

* a

* a

* mm

* mmm

* mmmm

* mmmmm

* ff

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2025-02-01 08:23:40 +01:00
Dongjia "toka" Zhang
6cd97e7105
Decouple fuzzer functions from event manager (#2915)
* decouple fuzzer from em

* lol

* 3

* fix tcp

* fix

* fix

* fix

* fixer

* std

* fixer

* plz

* plzplzplz

* plzplzplzplz

* mm

* more

* symbol

* a

* a

* mm

* mmm

* mmmm

* mmmmm

* ff
2025-02-01 07:52:42 +01:00
Dongjia "toka" Zhang
ace2a76ece
Update rand_core (#2919)
* a

* upd lain
2025-01-31 19:26:32 +01:00
Romain Malmain
75feedd1a0
Add builder and tests for QASAN (#2898)
* Add tests for QASAN from aflplusplus

* refactor asan module to use the builder pattern

* move injection tests to the new tests directory
2025-01-31 15:43:50 +01:00
Dongjia "toka" Zhang
37fc43f53c
0.15.1 (#2917)
* 0.16.0

* 0.15.1
2025-01-30 18:53:00 +01:00
Dongjia "toka" Zhang
d8df9b4910
Fix Clippy (#2913)
* clp

* lol

* this is false positive

* a

* clippy all

* aa
2025-01-30 11:17:01 +01:00
149dd4b36a copter 20ms minar 2025-01-29 16:55:29 +01:00
s1341
7c84a7903a
Frida updates and FASAN fixes (#2838)
* Frida updates and FASAN fixes

* fmt

* Fixes

* clippy

* fmt

* Clippy

* Update to frida 0.16.2

* fix windows hooks

* Fix

* Fmt

* windows fix

* Bump frida version to 0.16.3

* Get rid of call to LLVMFuzzerInitialize

* bump version 0.16.5; use find_global_export_by_name

* allow unused_macro_rules

* Don't do stdout_file on windows

* fmt

* Add tmate to debug

* fix windows frida_libpng

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-01-28 11:48:52 +02:00
Romain Malmain
b320a8dbab
Add PC to QEMU's read / write callbacks + logger module (#2896)
* Logger module (only read/write for now)

* add pc to rw callbacks

* regen bindings
2025-01-27 15:01:20 +01:00
f7e61665be refactoring 2025-01-27 13:56:43 +01:00
Dongjia "toka" Zhang
133a0ffe7a
Merge LlmpEventManager and LlmpRestartingEventManager (#2891)
* add

* add 2

* feature

* fix nyx launcher

* a bit of doc

* addressing comments
2025-01-26 13:43:04 +01:00
Romain Malmain
4083f0ba73
Fix drcov path parsing (#2884)
* fix drcov path parsing

* refactoring of drcov tool

* add the possibility to sort addresses in drcov tools

* more aggressive clippy. it now catches more warnings as errors than before

* reduce the number of unfixable warnings displayed.
2025-01-24 18:21:51 +01:00
WorksButNotTested
c5b7c7c235
Add SnapshotModule to qemu_coverage tool (#2885)
Co-authored-by: Your Name <you@example.com>
2025-01-23 11:23:37 +01:00
Romain Malmain
e84429012b
Add a qemu_coverage test in ci (#2883)
* add a qemu_coverage test in ci

* update CI path for changes in qemu-related code
2025-01-22 16:59:46 +01:00
Romain Malmain
2cc2298e98
Fix qemu_coverage v2 (#2882) 2025-01-22 16:00:20 +01:00
Romain Malmain
d9e8b59cb6
Fix qemu cov (#2875)
* fix drcov module hooks setup
2025-01-22 14:05:25 +01:00
Dominik Maier
7e18887a32
Remove shmem associated type (#2870)
* reduce shm trait bound

* Rename to SendExiting

* alpha beta gamam

* alphabet

* work

* std only

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2025-01-20 20:28:19 +01:00
Dongjia "toka" Zhang
72adb483b5
0.15.0 (#2848)
* libafl pre-release edition

* oops

* aaa
2025-01-20 17:44:55 +01:00
Dongjia "toka" Zhang
6ee26a8afa
Decouple address_filters() from EmulatorModuleTuple into HasAddressFilters (#2869)
* 1

* fixe
2025-01-20 17:44:44 +01:00
Romain Malmain
8089b18d34
Remove ShMemProvider bound from struct definitions (#2861)
* No more ShMemProvider bound constraint in struct definition whenever possible

* Introduce StdShMem

* Update CONTRIBUTING.md
2025-01-20 17:25:55 +01:00