1400 Commits

Author SHA1 Message Date
Aarnav
d1c746a0a2
Set rlimit to inifinity for core dumps if AFL_DEBUG=1 (#2643)
* forkserver: set rlimit to inifinity for core dumps if AFL_DEBUG=1

* move coredump rlimit to a separate func

* update docs
2024-11-06 14:11:58 +01:00
Dominik Maier
36a24ab418
Custom Executor Example (#2570)
* [WIP] Custom Executor Example

* readme

* src/main.rs

* Finish

* fix warnings

* reame

* CI
2024-11-05 16:49:07 +01:00
Valentin Huber
4431f069e5
Fix crossover mutators for empty multipart inputs (#2663) 2024-11-05 14:45:56 +01:00
Dongjia "toka" Zhang
e0c5304e32
Don't use workspace dependencies (#2652)
* rev

* postcard

* serde

* fmt

* a

* dependabot

* postcard again

* hashbrown

* upd

* add

* serde?
2024-11-04 17:47:40 +01:00
dependabot[bot]
cbe89b096d
Update ratatui requirement from 0.28.1 to 0.29.0 (#2657)
Updates the requirements on [ratatui](https://github.com/ratatui/ratatui) to permit the latest version.
- [Release notes](https://github.com/ratatui/ratatui/releases)
- [Changelog](https://github.com/ratatui/ratatui/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ratatui/ratatui/compare/v0.28.1...v0.29.0)

---
updated-dependencies:
- dependency-name: ratatui
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-04 17:08:04 +01:00
Romain Malmain
49ea0b03a6
Compile-time edge module compilation check, native support for ConstMapObserver (#2592)
* compile-time edge module compilation trick

* clippy

* possible since rust 1.79

* split edge module in submodules

* Update frida to 0.14.0 (#2596)

* update frida crate to the latest version

* adapt libafl_frida to the latest version of frida

* tracers and generators private modules

* do not use star export.

* same for drcov

* forgot a file...

* first draft of generic-based edge module for ConstantLengthMapObserver.

* integration of OwnedSizedSlice.

replaced OwnedSlice in ConstMapObserver by the new OwnedSizedSlice.

* fix serde stuff

* no std

* import

* fixed qemu_cmin with new constant map abstraction.

* fix const map

* fix clippy from another pr...

* fix non-null usage

* fix ci?

* new feature stuff

* fixes

* minor fixes

* fmt

* non null

* im stupid

* fmt

* fix fuzzer

* fix fuzzers

* sized slice

* fuzzer fixes

* ptr::NonNull -> NonNull

* shorter trait length

* fmt
2024-11-04 14:34:52 +01:00
Dominik Maier
c86e116d9a
Remove serde_json dependency from libafl_bolts (#2639)
* Remove serde_json dependency from libafl_bolts

* more like a serialize err

* Fix nautilus json
2024-10-31 14:16:53 +01:00
894c11935f display stats 2024-10-30 15:27:48 +01:00
Dominik Maier
6eb2dafd34
Feature: Make executors and feedbacks easier to use outside of the fuzzing loop (extends #2511) (#2637)
* feat(libafl_core): make executors and feedbacks more cleanly usable outside of LibAFLs Fuzzer loop

* cargo +nightly fmt

* updated type constraints

* reformatted and final type constraint fixes

* made unicode extraction stage useful separately

* fix libafl_cc error message

* fix state type constraint to be constrained on the method

* removed unnecessary observer constraint

* renamed unused variables

* fix unnecessary error wrapping in helper functions

* converted unicode conversion stage into associated function and fixed nautilus changes

* more update

* Remove extra I

* more fmt

* bounds?

* less bounds

* more less bounds

* different trait bounds again

* more less generics

* fix unicode

* fix list

* remove unneeded bound

---------

Co-authored-by: Lukas Dresel <Lukas-Dresel@users.noreply.github.com>
Co-authored-by: Toka <tokazerkje@outlook.com>
2024-10-29 18:35:17 +01:00
013f3db487 implement STGSnippetStage, fix missing metadata 2024-10-29 14:07:52 +01:00
Aarnav
0f744a3abb
Add Python Grammar Loader for Nautilus (#2635)
* add python grammar loader for Nautilus

* fmt

* fmt toml

* add python to macos CI deps

* install python

* fmt

* ci

* clippy

* fix workflow

* fmt

* fix baby nautilus

* fix nautilus sync

* fmt

* fmt

* clippy

* typo

* fix miri

* remove pyo3 from workspace to packages which need it and make it optional

* go back to AsRef<Path> for nautilus grammar loading

* replace hardcoded python flags for macos build

* typo

* taplo fmt

* revert formatting of libafl_qemu_arch

* ci

* typo

* remove expects in NautilusContext::from_file and make them Results

* remove not(miri) clause in test

* try and fix python build fir ios and android

* again

* android

* tmate

* fix android build

* document load_python_grammar

* log if python or json when loading nautilus grammar

* make nautilus optional

* add nautilus as feature to forkserver_simple_nautilus
2024-10-29 11:32:59 +01:00
Aarnav
58fad2befd
libafl-fuzz: separate frida build + cmplog debug (#2591)
* libafl-fuzz: separate frida build

* cmplog debug

* update

* merge AflStatsStage
move time_tracker stage to LibAFL

* mandate track_hit_feedbacks feature for AflStatsStage

* afl_stats do not hardcode TimeoutFeedback and CrashFeedback names

* typo

* typo

* fix generics order

* add verify timeouts stage

* libafl: introduce set_timeout func to dynamically set timeouts for executor
libafl-fuzz: add verify_timeout stage

* add missing set_timeout implementations

* libafl-fuzz: move set_timeout and timeout from Executor to HasTimeout

* libafl-fuzz: add removed gitignore

* remove timeout from libafl_nyx::Executor and move it to NyxHelper

* clippy

* fix HasTimeout for QemuExecutor

* libafl-fuzz: remove observer handle usage in verify_timeouts
misc: remove prelude imports

* libafl-fuzz: fix foreign_sync_dirs option

* fmt && clippy

* clippy && fmt

* missing doc

* clippy

* bruh

* damned doc build

* trait fix

* impl HasTimeout for InProcessExecutor only if std

* clippy

* fix typo

* fix nostd build

* clippy

* remove most HasTimeout implementations for now

* typo

* remove redundant import

* misc

* fmt

* simplify trait bounds

* add old AflStatsStage back and rename it to StatsStage

* fix ci

* make set_timeout and timeout of HasTimeout inline

* fmt

* add gitignore

* serde_any fix

* tmate

* misc

* remove tmate

* test

* coordinate between capture_timeout and verify_timeout

* makefile

* fix

* fix

* fmt

* increase cmplog timeout

* semantic

* debug

* debug

* remove dbeug

* only test libafl-fuzz on CI for now

* better seed for cmplog?

* remove preflight check for now

* set Input type in forkserver

* debug

* tmate

* fix capture_timeout

* revert workflow

* run only libafl-fuzz

* remove pre-flight

* re-enable fuzzers on CI

* move capture_timeouts and verify_timeouts to main lib

* run fmt

* add note for verify timeouts

* add note in verify timeouts stage

* typo

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-10-28 11:40:04 +01:00
Marco C.
053d125254
fix clippy redundant field names in struct initialization (#2633) 2024-10-25 16:07:34 +02:00
Dominik Maier
e27ec269ce
Add TargetBytesConverter to allow Nautilus for ForkserverExecutor (#2630)
* Add TargetBytesConverter to allow Nautilus for ForkserverExecutor

* ci

* ci

* More

* fmt
2024-10-24 14:10:26 +02:00
Dongjia "toka" Zhang
f0da4d15da
Fix Generator (#2627)
* no min but max

* import

* large stack arrays ?
2024-10-21 16:27:25 +02:00
Dongjia "toka" Zhang
fda1596ee2
Use nonzero! macro (#2589)
* nonzero_lit

* nonzero

* std instead of core

* a

* l

* test

* import

* api

* api

* aaaaa

* apiapi

* api

* api

* api

* mm

* api

* non zero

* FMT

* pls

* nnnaaasdfadsfafdsa

* pls

* MM

* fix

* a

* sat add

* aa

* mistake

* unreachable

* no generic

* api change

* a
2024-10-18 23:33:03 +02:00
Dominik Maier
4710915b61
Revert "Revert "Fix pipe I/O in forkserver"" (#2614)
* Revert "Revert "Fix pipe I/O in forkserver (#2602)" (#2612)"

This reverts commit 888c608e5e56e2df55271dab262bb0eac400a416.

* More expressive errors

* fix testcase
2024-10-15 16:31:25 +02:00
Romain Malmain
d48a7d508d
Centralize clippy lints in workspace (#2606)
* centralize clippy definition

* fmt

* add update bindings script

* add a checked and unchecked version of memory read to qemu stuff

also, a lot of clippy thing

* update binding position

* rm old script, new one is a bit better

* update doc

* macos clippy

* adapt fuzzers

* windows clippy

* fix fuzzer

* windows clippy

* remove old allowed clippy

* remove some allowed clippy

* use default features for serde_json in gramatron

* better error handler for failed rw to memory
2024-10-15 13:31:01 +02:00
Dongjia "toka" Zhang
888c608e5e
Revert "Fix pipe I/O in forkserver (#2602)" (#2612)
This reverts commit ea4a281d535cce1b522ed0fb328f02b016a4b4ea.
2024-10-14 14:17:40 +02:00
Henry Chu
ea4a281d53
Fix pipe I/O in forkserver (#2602)
* Fix read_st_size in forkserver

* fixed read_st, read_st_size, and write_ctl

with read_exact and write_all

* Cleanup redundant return values in forkserver pipe I/O

* Forkserver: avoid using read_exact/write_all for reading/writing integers

* Forkserver: avoid initializing the vec twice when reading a chunk of bytes

* Fix code formatting
2024-10-14 11:49:06 +02:00
Dominik Maier
cad9e2717e
Remove prelude from default features (#2608)
* Remove prelude from default features

* Prelude

* something
2024-10-12 13:16:22 +02:00
Dominik Maier
66a8682c9e
Add DrCov &.rerun options to QEMU_Launcher (#2607)
* Move all target-specific code to harness.rs

* Add IfModule to LibAFL_Qemu

* More more

* Added DrCov tracing

* Add DrCov rerun to launcher

* fixes
2024-10-11 16:02:01 +02:00
Dongjia "toka" Zhang
19ccb0807c
Don't do generalization on larger inptus (#2603) 2024-10-10 16:13:08 +02:00
Henry Chu
a69cd98432
Make ASAN log dumping optional (#2600) 2024-10-10 09:44:26 +02:00
Romain Malmain
c03653f7be
Remove useless allocation in colorization stage (#2598)
* do not allocate here

* clippy
2024-10-09 17:16:53 +02:00
cube0x8
1e4d38d744
Fix file sync timing and prevent crash on missing SyncFromDiskMetadata (#2595)
* max_time is the current_time(); SyncFromDiskMetadata might not be in state

* using metadata_or_insert_with
2024-10-09 17:16:32 +02:00
cube0x8
2b05e0a1fd
Do not start another logger in prometheus (#2599) 2024-10-09 17:15:56 +02:00
Dongjia "toka" Zhang
c12c6f31e2
Change fuzzbench_qemu fuzzer (#2520)
* change fuzzbench_qemu

* real test

* fix qemu crash hook

* update bindings

* fix fork executor, reduce trait bound overhead

* make EdgeModule depend on observer to get ptrs.

* do not make EdgeCoverageModule::new public

* map observer as builder call

* adapt examples with new edge coverage module builder.

* TMP: everyone is a variable length map observer

* reuse profile path script

* fix absolute paths

* remove some dependencies to make pipeline faster

* compile-time builder initialization check

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-10-08 15:18:13 +02:00
Romain Malmain
1fbb18cb99
Versioning unification, dependencies update, logging optimization (#2560)
* versioning unification: use x.y.z format everywhere

* do not compile low-level logs (< info level) by default in fuzzers

* update dependencies to the latest versions

* add members to workspace.

* use workspace for common dependencies

* add vscode native support

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2024-10-07 12:03:29 +02:00
Dominik Maier
4fc136cd1c
Rand below should take a NonZero parameter (#2519)
* Rand below should take a NonZero parameter

* More

* more

* More

* fix build

* bit of clippy

* more clippy

* more clippy

* More clippy

* More more

* more nonzero

* fix multipart

* Cleanup, more unsafe

* fix

* fix unicode

* clippy, fmt

* more

* More safer and more better

* MaxStackPow

* fix merge fails

* make random_slize_size faster

* fix

* more

* fix
2024-10-04 02:16:10 +02:00
Romain Malmain
15157e0b72
Discard no tc mm (follow-up) (#2584)
* forgot to set the flags
2024-10-03 20:26:28 +02:00
Romain Malmain
9a50868058
Discard non-new testcase events for multi-machine messages (#2583)
* discard non-new testcase events

* clippy
2024-10-03 18:46:26 +02:00
Romain Malmain
9ceb9917a5
Do not embed client exec count in testcase and objective (#2582)
* do not include exec count in testcase

* remove exec count from objective as well

* fmt
2024-10-03 16:42:11 +02:00
Dongjia "toka" Zhang
cbce7ffdfd
No Uses* for Feedbacks (#2578)
* add from addison's change

* fixing

* one left

* adding

* 444444

* okoko

* no prelude

* i hate rust

* stuff

* no std/win

* getting closer

* a

* a

* aa

* a

* a

* libafl_fuzz

* toml

* tutorial

* libafl_libfuzzer
2024-10-02 14:07:08 +02:00
Dongjia "toka" Zhang
a212d66afe
No Uses* for Observers (#2568)
* first

* Round 2

* Round 3

* Round 4

* Round 5

* Round 6

* Round 7

* Round 8

* clp

* from windows

* roll back

* baby building

* doc

* no deref

* frida

* api

* a

* impl HasLen

* libafl-fuzz and fmt

* asan error

* Cargo toml

* who cares abotu freebsd seriously?????

* aaaa

* qemu stuf

* fixing what i can fix

* nyx

* more for qemu stuf

* fixup libfuzzer

* fix baby swap

* AsIterMut

* UsesObservers eliminated

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-10-01 17:51:09 +02:00
Romain Malmain
173aeddbcc
libafl multimachine: disable ratelimiting (#2558)
* disable rate limiting for now

* fix

* clippy

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-09-30 15:57:10 +02:00
Dominik Maier
82110472d6
Mark unsafe functions unsafe, as Ferris intended (#2559)
* Mark unsafe functions unsafe, as Ferris inteded

* More

* more safety?

* more fix

* actually safe

* More cleanup

* More fix

* more unsafe

* fix imports

* more unsafe

* fixes

* bring back the memories
2024-09-28 16:46:39 +02:00
Dongjia "toka" Zhang
23168af003
Delete redundant elapsed_since_signal from Batch timeout (#2567) 2024-09-27 14:36:44 +02:00
Dongjia "toka" Zhang
79b8390214
No Uses* for Corpus, Mutators (#2547)
* wip

* this shit is crazy

* from windows

* fmt

* fuck

* fmt

* aa

* reduce generics for generator

* do stuff for mutators, too

* aa

* a

* fmt

* idk

* getting things compiling

* fix merge

* idk

* fuzzers

* nire

* more

* a

* frida win

* cmin

* mm

* qemu?

* del ubuntu dep

---------

Co-authored-by: Your Name <you@example.com>
2024-09-26 20:03:03 +02:00
Romain Malmain
c944a70056
Linux kernel fuzzing example (#2496)
* linux kernel (x509_cert) and process fuzzing example

* rework filters

* update to latest qemu

* working for process and kernel fuzzing

* new i2s mutator for binary only fuzzers

* refactoring modules with new filtering interface

* add state as parameter of harness

* hide unused global in usermode

* Script for stub bindings generation

* do not try to check whether it is worth generating the bindings, always
  generate when the env variable is on.

* add taplo to fmt_all.sh

* Moved fuzzers (again) in a target-centric way.

* fix rust 2024 warnings.

* new libafl_qemu harness structure.

* rename qemu_systemmode into qemu_baremetal

* fix qemu baremetal makefile

* fix formatter

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2024-09-26 14:29:33 +02:00
Nils Bars
5ab7a07f14
Only track stability for runs that did not timeout (#2561) 2024-09-26 14:12:33 +02:00
Dan Blackwell
4e54182b35
Use const to Inform CmpLog Replacements (#2528)
* Add some knowledge of const parameters in cmplogs

* Careful with the CmpLog unions and clean macros

* Fix for macros?

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-09-24 17:16:07 +02:00
Dominik Maier
2bc211cc86
Make map size mismatch return a proper error instead of abort (#2553)
* Make map size mismatch return a proper error instead of abort

* More illegal state
2024-09-24 15:09:39 +02:00
Nils Bars
bacbffa6c1
Keep num_covered_map_indexes in sync with history map if block listing flaky entries (#2542) 2024-09-24 03:31:32 +02:00
Dominik Maier
f0d85aaaa5
No more (direct) mutable references to mutable statics (#2550)
* No more (direct) mutable references to mutable statics

* More

* Fix build, but it's unsafe dude

* more

* fmt

* More fix

* more?
2024-09-24 03:29:49 +02:00
Aarnav
7432bd0f59
libafl-fuzz: fix libafl-fuzz scheduler (#2545) 2024-09-23 18:56:09 +02:00
Aarnav
085db55f19
libafl-fuzz: fix not loading seeds recursively from directories (#2532)
* libafl-fuzz: fix not loading seeds recursively from directories

* add walk_initial_inputs to State

* libafl-fuzz: add afl++ style seed filename when copying initial files

* typo
2024-09-23 18:55:01 +02:00
Dongjia "toka" Zhang
cbfd194723
Reducing type parameters and bounds from Scheduler (#2544)
* actually reducing type parameters

* no std

* aa

* aa

* a
2024-09-23 17:01:21 +02:00
Dominik Maier
35779863c4
Bring back placeholder value in CommandExecutor to fix #2541 (#2543) 2024-09-23 15:59:06 +02:00
Dominik Maier
173a9ad8ea
Fix ForkserverExecutorBuilder::shmem_provider (#2539) (#2540)
* Fix ForkserverExecutorBuilder::shmem_provider (#2539)

* fmt
2024-09-23 14:15:11 +02:00