1400 Commits

Author SHA1 Message Date
bernhl
fb0848e174
Remove unecessary HasTargetBytes constraint (#3117) 2025-04-01 20:39:01 +02:00
Romain Malmain
9dff7a438d
Add client stats to Events (#3116)
* add stats alongside Event over the wire
2025-04-01 16:51:52 +02:00
Dongjia "toka" Zhang
bd12639f8e
0.15.2 (#3104)
* 0.15.2

* miri

* mistake

* unsafe

* lock file
2025-03-25 13:30:15 +01:00
Romain Malmain
c863c8bd6c
Fix clippy (#3102)
* fix clippy

* libafl_frida/

* lol

* lol

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2025-03-24 15:03:04 +01:00
WorksButNotTested
d317725170
Add total execs to TUI (#3078)
* Add total execs to TUI

* Pretty print large numbers

---------

Co-authored-by: Your Name <you@example.com>
2025-03-14 20:47:51 +01:00
Dongjia "toka" Zhang
d4a86cdeeb
Hide Forkserver constructor API (#3076) 2025-03-14 14:30:54 +01:00
Dongjia "toka" Zhang
f3da9da7bf
Fix metadata addition when solution is found (#3069)
* fix

* fixer
2025-03-12 13:57:06 +01:00
Dongjia "toka" Zhang
63e82d898e
Bring back #3029 (#3067)
* rerevert

* add comments
2025-03-11 19:52:24 +01:00
Dongjia "toka" Zhang
226a20e6cf
Fix usage of TracingStage (#3062)
* real fix

* more

* debug

* fix

* fixer

* mmmm

* mm

* mm

* mm

* fix

* fix atheris

* ?
2025-03-11 14:37:19 +01:00
Dongjia "toka" Zhang
f4cb9a827d
Partially Revert #3029 and #3053 (#3063)
* revert begins

* fixer

* e?

* fixer

* how you didn't report that at the same time though???

* i'm tired of you
2025-03-11 12:53:27 +01:00
Dominik Maier
115672904e
Auto-implement Rand for (normal, rusty rng) CoreRng types, fixes #3060 (#3064)
* Auto-implement Rand for (normal, rusty rng) CoreRng types, fixes #3060

* clippy

* cleanup

* clip

* doc

* more doc
2025-03-11 11:51:31 +01:00
Dongjia "toka" Zhang
15da05f8e8
Cleanup for #3035 (#3059) 2025-03-10 14:09:54 +01:00
Dongjia "toka" Zhang
620500e295
Remove AdaptiveSerializer, Send off interesting testcase from crash handler, Add clearer error message (#3053)
* clean

* test thread 1

* add some error messages

* mm

* std

* mm

* aa

* pp

* fix

* change fuzzers

* fix

---------

Co-authored-by: Your Name <you@example.com>
2025-03-08 20:12:16 +01:00
Dhanvith Nayak
41f16890b8
convert share_objectives into a runtime option (#3033)
* add share_objectives field to StdFuzzer

* uhhh maybe add field to StdState instead

* trivial

* implement to handle_in_client()

* fmt

* revert changes to state

* no gating on receiving objectives

* add query method to hasobjectives

* make input field of Event::Objective optional

* fmt and clippy

* move setter to hasobjectives

* better way to handle incoming objective

* fmt

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-03-07 14:18:48 +01:00
Dongjia "toka" Zhang
7b0a3b861e
Forbid overwriting MapIndexesMetadata (#3048) 2025-03-06 20:56:48 +01:00
lazymio
c0894c40e5
Fix implementation of UniqueTrace and add UnclassifiedTrace (#3046)
* Fix implementation of UniqueTrace and add UnclassifiedTrace

* Update comments

* Move the implemetnation to classify_counts

* Only init for unique trace

* The missing inline

* Add a TODO
2025-03-06 16:04:39 +01:00
lazymio
de2bc166f0
Implementation of SAND: Decoupling Sanitization from Fuzzing for Low Overhead (#3037)
* Reference implementation of SAND: Decoupling Sanitization from Fuzzing for Low Overhead

* Format code

* make clippy happy

* Update docs

* clean output

* fmt

* Fix for nostd

* Update docs

* use use alloc::vec::Vec;

* Docs updates

* Update docs

* Format toml

* Format again

* Add CI

* Rename run_targets to run_target_all

* Update docs

* Update justfile to test fuzzer

* left out justfile

* Format

* Corner case when bitmap size is as small as 1

* Add comments

* clippy

* Format vuln.c

* Format toml

* Fix doc

* Fix justfile

* Move ExecutorsTuple to executors/mod.rs

* Fix

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-03-06 14:15:22 +01:00
Dongjia "toka" Zhang
977ff10a0f
Make corpus and solution not mutually exclusive (#3029)
* make fuzzer great again

* crash handlers

* hello from windows

* fk

* gee

* m

* temporary fix

* f

* mm

* CICI

* fixer

* Fix Dockerfile

* lol

* clp

* Fuck you clippy

* This lint makes no sense, 0

* ??

* a

* fix

* this lint makes 0 sense

* mm

* clp

* a

* a

* clp

* clippy

* clp

* mm

* FMT

* p

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: toka <toka@tokas-MacBook-Air.local>
2025-03-05 20:10:04 +01:00
Dongjia "toka" Zhang
89342b22c2
Revert #2935 (#3031)
* revert

* null check

* no std
2025-02-28 20:09:01 +01:00
Romain Malmain
e864bc28b1
Abort on triple fault for in process executors, refactor AddressFilter and PageFilter (#3026)
* abort on triple fault in generic inprocess signal handler

* refactor qemu filters

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2025-02-28 15:44:22 +01:00
Dominik Maier
ce5fd435ea
Move all unnecessary std uses to core,alloc (#3027)
* Move all unnecessary std uses to core,alloc

* More

* more fix

* more

* more

* Remove libafl-fuzz grimoire

* more

* more

* more cleanup

* remove bins

* fix

* more fix
2025-02-27 14:32:37 +01:00
Dominik Maier
c7207dceb0
Rust 2024 edition (#3022)
* Rust 2024 edition

* gen = generalized

* Fixes

* more fix

* More fix

* even more fix

* fix libfuzzer

* ignore clippy lint

* even more

* fix docs?

* more?

* More pub more better

* win

* docs

* more

* More

* doc stuff?

* counter_maps->counters_maps

* libafl qemu fixes for rust 2024

* fix?

* fmt

* unsafe lint

* final fixes

* fmt

* working?

* not working

* unused import

* win?

* update libafl qemu hash

* fmt

* fix

* unused imports

* fix

* fix

* more foix

* less edition

* fix

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2025-02-27 00:12:29 +01:00
Dominik Maier
7c83be2408
Add auto format to settings.json.default, format documentation and macros (#3019)
* Add auto format to settings.json.default

* Add more nightly rustfmt features
2025-02-21 13:31:31 +01:00
Dominik Maier
14eee111c2
Fix Clippy for Rust 1.85 (#3017)
* Fix latest Clippy

* fixed template

* How did I not see this
2025-02-21 13:15:12 +01:00
Dongjia "toka" Zhang
d40f18f377
Fix finish_stage call (#3014)
* fixer

* clp

---------

Co-authored-by: toka <toka@tokas-MacBook-Air.local>
2025-02-21 12:23:00 +01:00
EvianZhang
1debeb74a7
Add statsd monitor documentation (#2996)
* Initial commits

* Complete statsd docs

* Add docs about optionally enabled StatsD monitor
2025-02-21 09:24:49 +01:00
Dongjia "toka" Zhang
d3bae6a503
Add try_insert for SerdeAnyMap (#3012)
* add

* use hashbrown method

---------

Co-authored-by: toka <toka@tokas-MacBook-Air.local>
2025-02-20 19:27:35 +01:00
EvianZhang
7bf7e4c2dc
Add logics monitors (#3011)
* Add logics monitors

* Re-export logics monitors
2025-02-20 13:43:16 +01:00
Valentin Huber
1eef4ffb58
Introduce ListInput (#2972)
* Introduce ListInput

* Add remove mutators for ListInput

* Merge ListInput and MultipartInput

* Reimplement MultipartInput as a special case of ListInput

* Revert changes to Cargo.toml

* Add collection of generic listinput mutators

* Fix example

* Add note to MIGRATION

* Split list and multi into separate modules

* Fix docs

* Using string names again in the multi example fuzzer

* Remove unnecessary code

* Fix fuzzer

* Use key instead of name for MultipartInput key

* Prettier code in example fuzzer

* Do not convert slice to vec manually
2025-02-20 13:41:53 +01:00
Dongjia "toka" Zhang
98ef505a0e
Add add_metadata_checked method (#3008)
* new api

* found a bug :>
2025-02-19 20:24:15 +01:00
Dongjia "toka" Zhang
9f28672ea1
Fix ReplayStage (#3007) 2025-02-19 18:06:49 +01:00
Dongjia "toka" Zhang
61568a9be1
Restartable trait (#3004)
* separate into Restartable

* typo

* fixes, blanket impl

* aa

* lol

* aa

* fixer

* lol
2025-02-19 15:06:31 +01:00
Dongjia "toka" Zhang
0e4c6722f0
Replay stage (#3003)
* replay stage

* seems to be working

* a

* rever

* rev

* rdy for merge

* fmt

* lol
2025-02-18 19:55:02 +01:00
Dongjia "toka" Zhang
70eb8158e5
Refactor stages (#3002)
* refactor

* miss

* lol

* revivet tests

* aa

* ?

* a

* fuck

* fuck

* a

* m

* fuck
2025-02-18 14:25:21 +01:00
Dominik Maier
641db5f19b
Change type generic of ValueInput from I to T (#3001) 2025-02-18 03:07:00 +01:00
Marco C.
47f7978b91
Bump Libipt 0.3, add HW breakpoint support (#2984)
* Decode with callback

* WIP restore intelpt module

* Fix build_target if target_dir doesn't exist

* WIP itelpt qemu/kvm example: bootloader

* qemu config refactoring

* Fix intel_pt_command_executor target dir

* * QEMU error refactoring*
* back to one QEMU init function
* other small things

* update test

* Bump libipt

* waitpid_filtered to ignore SIGWINCH

* Fix warnings unused manifest key: *.version

* Add export_raw feature to libafl_intelpt

* derive Debug for IntelPTHook

* Clippy

* Light refactor of EmulatorModules

* qemu is now a parameter to EmulatorModule callbacks and most function hooks.
* EmulatorModules is initialized before QEMU is initialized.

* Update target program ELF offsets

* fmt

* * asan fixed size accesses working with generics
* continue to propagate qemu argument as hook first parameter
* use pre_syscall* and post_syscall* everywhere
* fix some clippy stuff

* fmt

* Add comment to KVM pt_mode check

* refactor

* Add intel_pt_export_raw feature in libafl

* fix fuzzers

* * refactor asan and asanguest modules to avoid custom init of QEMU and use the module interface instead.
* adapt qemu_launcher example to fully work with emulator, since qemu must now be initialized by emulator.

* fmt

* clippy

* fix qemu_coverage

* fmt

* forgot qemu args in launcher

* map_error instead of unwrap

* use correct args

* Update to new libafl_qemu

* adapt api

* borrow checker friendly join_split_trace

and copy trace before deocde to prevent decoding failures

* testing stuff

* Set ip_filters (also) with builder

* Move trace to file

* Store a pt_builder in module

enable the setting of filters and other pt settings

* baby_bootloader target

* Best bootloader ever

* new builder?

* use closure for qemu config from emulator builder.

* better format

* clippy + fmt

* Fix build target

Create target directory if doesn't exist

* Remove filter on speculatively exec blocks

since also committed blocks can have this flag

* Add current ip_filters getter

* Fix possibile infinite loop in trace decode

* HW breakpoint + snapshot

* add snapshot and exit at first objective

* prefer raw pointers to slice_from_raw_parts_mut

since the latter is highly unsafe and allows more potentially dangerous reordering

* Add cpu option to QEMU config

* Add cpu option and minor improvements

* fix cargo run causing recompile

* no default devices

* windows clippy fix

* Exclude intel_pt feature from CI as all systemmode feats

* Add qemu_intel_pt_bootloader to CI

* Fix NopPageFilter

* Fix qemu_config

* Restore HW breakpoints

* Lints

* return Result for hw bp set/remove

* mark join_split_trace as unsafe

* Put the qcow2 in a tmpfs ramdisk

10x exec/sec

* Post merge fixes

* Try out libipt 0.3 alpha

* Try out libipt 0.3 alpha also in hook

* Clippy

* New libipt

* Post merge fixes

* Bump libipt

* Drive cache None

* Post merge fixes

* Use SectionInfo from libipt

* No slice::from_raw_parts_mut, just use raw pointer

* Cache the decoder builder

* Update qemu-bridge

* Add qemu -append param

* Move linux specific code to a mod, less #[cfg]s

* Add qemu initrd config

* Add qemu monitor tcp

* Add not enough ip filters message

* Fix wrong must_use

* Prevent possible infinite loop in block decoding in debug mode

* Clippy

* fix CI?

* Revert, keep libipt 0.3 and hw bp

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
Co-authored-by: Marco Cavenati <marco@lenovo300e>
2025-02-17 14:50:07 +01:00
henri2h
9a2a42ccca
Fix libafl_unicorn CI (#2991)
* fix: clippy

* fix: allow specifying thumb mode or not

* fix: timeout for testcase
2025-02-17 10:45:07 +01:00
mkravchik
b3fe744e57
Pr/fasan multithreading fixes upstream (#2955)
* Fixing the test_harness library name

* Fasan works, but testing of all features is pending

* Tests pass, before fixing clippy and fmt

* CLippy+fmt

* CLippy+fmt+tests running on linux

* Clippy

* Not stalkering the fuzzer. In the correct way

* Removing the instrumentation upon crash. Proper hooking of UnmapViewOfFile

* Fixes after the merge from the upstream (before 0.15.0). Still need to add the observer, clippy, fmt, and at least linux compilation

* Adding the helper observer and using it in the test

* Removing the observer from the wrong location

* Adapting to the new helper ownership model

* Adding an observer to shut down instrumentation upon crash

* Clippy + fmt

* Using mimalloc everywhere

* Deactivating before activating with the harness. Otherwise, gets stuck on Linux.

* Fixing imports for windows

* Using the new way of passing the handler

* Using frida_helper_shutdown_observer

* Clippy+fmt

* no-std, clippy

* Fmt

* Stable thread_id

* Clippy 18

* More clippy

* Formatting toml

* Fixing apples

* Fixing apples 2

* Fixing apples 3

* Upping to 0.16.7 (necessary for Windows)

* Clippy+fmt

* Enabling the allocator test after the fix and clarifying the importantce of the static runtime linking.

* Moving has_tls to bolts

* Proper handling of no-std, hopefully

* Another attempt to fix win no-std

* Not mine clippy complaint...

* Not mine clippy complaint #2...

* Dlmalloc not used, removing from dependencies

* Restoring target in config.toml (otherwise fails CI on Linux)

* lots of digging around, pray for us

* fixup?

* Revert "lots of digging around, pray for us"

This reverts commit 706c27201918e906e3401cd0d9e76546f889d1f5.

* Revert "fixup?"

This reverts commit 1d7c5d4fb5b1bd31f5e0c07492aa8ed64c6822f3.

* Revert artifact

* Revert fixups

* Removing unused

* Reverting to upstream/main

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-14 13:45:38 +01:00
Dominik Maier
f9715392af
Try to solve corpus issue related to #2981 (#2982)
* Try to solve corpus issue related to #2981

* clippy
2025-02-14 02:07:14 +01:00
EvianZhang
f3887697ba
Use expect instead of allow for clippy cast_precision_loss (#2974) 2025-02-13 01:55:05 +01:00
EvianZhang
5281b41abb
Add StatsD monitor (#2969)
* Add StatsD monitor

* Fix

* Use f64 instead of fractal
2025-02-13 01:15:27 +01:00
WorksButNotTested
739156cb23
Add SnapshotModule to qemu_launcher (#2887)
* Add SnapshotModule to qemu_launcher

---------

Co-authored-by: Your Name <you@example.com>
2025-02-11 18:42:20 +01:00
Dominik Maier
b7fcfdd192
Change combine_monitors macro to be tuple_list of Monitors (#2963)
* Make Monitors tuple_list

* fix

* no_std

* unused

* more
2025-02-11 02:40:53 +01:00
Dominik Maier
c62c6a7ecc
Move statistics to monitors/stats (#2962)
* Move statistics back to monitors/stats

* More fun

* more stats

* more
2025-02-11 01:07:17 +01:00
EvianZhang
800b8b417d
Add global stats cache (#2956)
* Add global stats cache

* Fix

* Make clippy happy

* Merge manager files; Implement default for GlobalStats

* fmt code

* Use &Cow to avoid unnecessary clone

* Avoid push_str without cleanup
2025-02-10 16:11:36 +01:00
Dongjia "toka" Zhang
404227d1a3
Don't panic inside sig handler (#2958)
* fix_handler

* hello

* fmt

---------

Co-authored-by: Your Name <you@example.com>
2025-02-10 10:56:07 +01:00
Dongjia "toka" Zhang
89e470250f
Properly use in_handler (#2957)
* properly use it

* a

* a

* typo
2025-02-09 15:08:09 +01:00
EvianZhang
abe955137f
Remove base-pattern for Monitor (#2953)
* Remove base-pattern for Monitor

* Fix runtime parameter for log_record

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-08 14:08:00 +01:00
EvianZhang
ce01f4a427
Move start_time to ClientStatsManager (#2948)
* Move start_time to ClientStatsManager

* Remove unnessary &self

* Make clippy happy

* Make clippy happy
2025-02-07 16:39:39 +01:00
Celian G.
64554d68bb
Small improvements for Qemu (#2938)
* Remove uneeded Executor trait from handlers functions + set inproc_qemu_crash_handler to pub

* Add some documentation for QemuHooks

---------

Co-authored-by: celian <cglenaz>
2025-02-07 13:28:11 +01:00