19 Commits

Author SHA1 Message Date
Romain Malmain
c9b0dc216f
LibAFL QEMU update to v10.0.0 (#3181)
* update qemu hash

* clippy, fmt

* update

* Revert "Update hashbrown requirement from 0.14.5 to 0.15.3 (#3184)" (#3186)

This reverts commit 4448799dc2205e4cb1753b8b8d91b4f6d299365d.

* update qemu

* fix systemmode

* update qemu

* update qemu

* update qemu with fix

* debug

* cargo hack

* FMT

---------

Co-authored-by: Dongjia Zhang <tokazerkje@outlook.com>
2025-05-12 16:58:11 +02:00
forky2
c3475cd577
Qemu tmin (#3118)
* Start on qemu_tmin

* WIP

* qemu_tmin working for single testcase.
Also some comment improvements.

* Add env_logger to baby_fuzzer

* Remove old reference.

* Added comment doc for qemu_tmin.

* Slight reorder for parallelisation

* Finished single-thread qemu_tmin

* Finishing touches to single thread version.

* A pre_commit.sh change I didn't notice.

* Duplicate to attempt multi-threaded version

* Fix taplo whine.
Mark "fork" mode as broken.

* Launcher for parallelisation implemented, but for one core.

* Running in parallel. Now need tidy up.

* Parallel version complete.

* Add comment

* Merged single-core/multi-core qemu_tmin into one crate

* Removed forkexecutor mode.

* Precommit fixes

* Add qemu_tmin to build_and_test.yml

* Clippy fixes

* Change tmin test cores to 0.
2025-04-25 23:08:18 +02:00
Romain Malmain
184b69be8e
Update QEMU syshook ret value (#3092)
* update syshook ret value
2025-03-31 15:51:01 +02:00
Romain Malmain
58607dc333
Update QEMU to v9.2.2 (#3088)
* update qemu to v9.2.2

* alignment field has been removed
2025-03-25 14:34:44 +01:00
Romain Malmain
d67296f34e
Soft recovery from crashes in libafl qemu usermode (#3073)
* soft recovery from crashes in qemu

* regen bindings for clippy

* configurable crash behaviour
2025-03-14 16:56:03 +01:00
Dominik Maier
c7207dceb0
Rust 2024 edition (#3022)
* Rust 2024 edition

* gen = generalized

* Fixes

* more fix

* More fix

* even more fix

* fix libfuzzer

* ignore clippy lint

* even more

* fix docs?

* more?

* More pub more better

* win

* docs

* more

* More

* doc stuff?

* counter_maps->counters_maps

* libafl qemu fixes for rust 2024

* fix?

* fmt

* unsafe lint

* final fixes

* fmt

* working?

* not working

* unused import

* win?

* update libafl qemu hash

* fmt

* fix

* unused imports

* fix

* fix

* more foix

* less edition

* fix

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2025-02-27 00:12:29 +01:00
Romain Malmain
8398f8f99a
Qemu signal refactoring (#2920)
* qemu signal refactoring

* udpate qemu

* clippy, moving things around

* update bindings

* nostd

* cfg

* fmt

* nostd

* clippy

* fmt

* aaa

* windowsssssss

* systemmode

* reimport fix

* remove llmp from replay mode

* lol

* fixer

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-02-04 14:43:26 +01:00
Romain Malmain
b320a8dbab
Add PC to QEMU's read / write callbacks + logger module (#2896)
* Logger module (only read/write for now)

* add pc to rw callbacks

* regen bindings
2025-01-27 15:01:20 +01:00
Romain Malmain
17336dcf57
Nyx hypercall API support for LibAFL QEMU (#2801)
* Nyx hypercall API support

* fix linux kernel fuzzer

* hash_me -> hash_64_fast

* fix multiple bug in kernel harness

* do not check libmozjpeg's C files format.
2025-01-06 16:58:57 +01:00
Romain Malmain
d96d833760
Support on_crash & on_timeout callbacks for libafl_qemu modules (#2620)
* support (unsafe) on_crash / on_timeout callbacks for modules

* use libc types in bindgen
2024-10-21 17:59:04 +02:00
Romain Malmain
d48a7d508d
Centralize clippy lints in workspace (#2606)
* centralize clippy definition

* fmt

* add update bindings script

* add a checked and unchecked version of memory read to qemu stuff

also, a lot of clippy thing

* update binding position

* rm old script, new one is a bit better

* update doc

* macos clippy

* adapt fuzzers

* windows clippy

* fix fuzzer

* windows clippy

* remove old allowed clippy

* remove some allowed clippy

* use default features for serde_json in gramatron

* better error handler for failed rw to memory
2024-10-15 13:31:01 +02:00
Romain Malmain
c944a70056
Linux kernel fuzzing example (#2496)
* linux kernel (x509_cert) and process fuzzing example

* rework filters

* update to latest qemu

* working for process and kernel fuzzing

* new i2s mutator for binary only fuzzers

* refactoring modules with new filtering interface

* add state as parameter of harness

* hide unused global in usermode

* Script for stub bindings generation

* do not try to check whether it is worth generating the bindings, always
  generate when the env variable is on.

* add taplo to fmt_all.sh

* Moved fuzzers (again) in a target-centric way.

* fix rust 2024 warnings.

* new libafl_qemu harness structure.

* rename qemu_systemmode into qemu_baremetal

* fix qemu baremetal makefile

* fix formatter

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2024-09-26 14:29:33 +02:00
Romain Malmain
00806b177d
Qemu native hooks refactoring (#2480)
* qemu native hooks refactoring (companion patch of qemu-libafl-bridge#82)

* update stubs
2024-08-13 18:40:51 +02:00
Romain Malmain
c96ea616fe
Qemu helpers & hooks refactoring (#2267)
* Helper is now called Module.

* Emulator now contains hooks state.

* Emulator is managed by QemuExecutor.

* QEMU hooks have been completely refactored on the rust side.

* Generics cleanup.
2024-07-17 11:46:42 +02:00
Dongjia "toka" Zhang
51db18eea8
Format desyscall (#2316)
* f

* clippy and stuff

* no apple
2024-06-16 12:20:08 +01:00
Romain Malmain
b127f0579d
Regenerate QEMU binding stubs only for newer versions of the nightly compiler (#2177)
* Regenerate binding stubs only for newer versions of the nightly compiler.

* fmt

* clippy
2024-05-15 01:42:59 +02:00
Romain Malmain
bed500471a
QEMU generic memory iterator (#2148)
* QEMU generic memory iterator + Refactoring

* Generic Memory Iterator (systemmode only for now): It is now possible to iterator over memory ranges, independently of the address kind

* Refactoring or Emulator / Qemu structures: they are now handled separately in different files

* Refactoring of Exit Handlers: Result / Error structs have been clarified

* Simple handler for signals

* add new `check-cfg` calls for libafl qemu
2024-05-07 10:46:15 +02:00
Dongjia "toka" Zhang
b0ac25a7b5
Rename Reference to Handle (#2142)
* rename

* rename

* fmt

* fix

* fmt
2024-05-04 18:16:28 +02:00
Romain Malmain
2302f1b35c
Fix QEMU doc not building (again) (#2130)
* fix doc not building.
2024-05-02 15:17:35 +02:00