3576 Commits

Author SHA1 Message Date
Dongjia "toka" Zhang
6648bc90d2
Collect envs in AsanModuleBuilder::default() (#2921)
* collect envs in AsanModuleBuilder::default

* migration

* fmt
2025-02-01 09:57:29 +01:00
Dominik Maier
84702d12a8
Make sure EM and Z remain consistent in InProcessExecutor (#2873)
* Make sure EM and Z remain consistent in InProcessExecutor

* first make them compile

* a

* hah

* fix intel pt

* decouple fuzzer from em

* lol

* 3

* fix tcp

* fix

* fix

* fix

* fixer

* std

* fixer

* plz

* plzplzplz

* plzplzplzplz

* mm

* more

* symbol

* a

* a

* mm

* mmm

* mmmm

* mmmmm

* ff

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2025-02-01 08:23:40 +01:00
Dongjia "toka" Zhang
6cd97e7105
Decouple fuzzer functions from event manager (#2915)
* decouple fuzzer from em

* lol

* 3

* fix tcp

* fix

* fix

* fix

* fixer

* std

* fixer

* plz

* plzplzplz

* plzplzplzplz

* mm

* more

* symbol

* a

* a

* mm

* mmm

* mmmm

* mmmmm

* ff
2025-02-01 07:52:42 +01:00
Dongjia "toka" Zhang
ace2a76ece
Update rand_core (#2919)
* a

* upd lain
2025-01-31 19:26:32 +01:00
Romain Malmain
75feedd1a0
Add builder and tests for QASAN (#2898)
* Add tests for QASAN from aflplusplus

* refactor asan module to use the builder pattern

* move injection tests to the new tests directory
2025-01-31 15:43:50 +01:00
Dongjia "toka" Zhang
37fc43f53c
0.15.1 (#2917)
* 0.16.0

* 0.15.1
2025-01-30 18:53:00 +01:00
Dongjia "toka" Zhang
5c248d7da3
Add license file symlinks (#2916)
* license

* more

* incl

* FMT
2025-01-30 18:03:52 +01:00
Railroad6230
85c1d03425
Rename libafl_bolts::rands::Rand::zero_upto to below_or_zero. (#2911)
Hi LibAFL!

I was playing with the [`Rand`] trait when I realized that the
documentation of [`Rand::zero_upto`] did not match what I was expected:

fd6271fa35/libafl_bolts/src/rands/mod.rs (L139-L142)

When using the following RNGs, [`Rand::zero_upto`] never returns the upper bound `n` as it would have been expected according to the documentation:

 - `RomuDuoJrRand`
 - `RomuTrioRand`
 - `Sfc64Rand`
 - `XkcdRand`
 - `XorShift64Rand`
 - `Xoshiro256PlusPlusRand`

The default implementation of [`Rand::zero_upto`] is to use [`fast_bound_usize`],
which excludes the given upper bound, thus I believe here that the default implementation
of [`Rand::zero_upto`] is wrong.

As discussed here: https://github.com/AFLplusplus/LibAFL/pull/2911#issuecomment-2623773829,
we believe that renaming the method would be better than changing the actual
implementation.

[`Rand`]: fd6271fa35/libafl_bolts/src/rands/mod.rs (L108)
[`Rand::zero_upto`]: fd6271fa35/libafl_bolts/src/rands/mod.rs (L139-L142)
[`fast_bound_usize`]: fd6271fa35/libafl_bolts/src/rands/mod.rs (L100-L103)
2025-01-30 14:16:23 +01:00
Railroad6230
5c5f6affcb
Fix Lehmer64 implementation of next. (#2912)
The implementation of [`Lehmer64Rand::next`] performs a mul on `u128`, which
is not checked against overflows. It leads to panic in debug mode.


[`Lehmer64Rand`]: fd6271fa35/libafl_bolts/src/rands/mod.rs (L373-L376)

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-01-30 12:26:46 +01:00
Dongjia "toka" Zhang
d8df9b4910
Fix Clippy (#2913)
* clp

* lol

* this is false positive

* a

* clippy all

* aa
2025-01-30 11:17:01 +01:00
149dd4b36a copter 20ms minar 2025-01-29 16:55:29 +01:00
Dongjia "toka" Zhang
fd6271fa35
Delete useless trait bounds from share_objectives feature (#2908)
* fix

* a
2025-01-29 13:55:38 +01:00
Dongjia "toka" Zhang
5002336fad
Delete evaluate_input_events (#2906) 2025-01-28 19:06:43 +01:00
Dongjia "toka" Zhang
2ec534a39c
Make drcov_dump_address.rs accept list of directories (#2904)
* accept folders

* lol

* use walkdir instead of my impl
2025-01-28 19:06:27 +01:00
Dongjia "toka" Zhang
6b965816cd
tips (#2903) 2025-01-28 17:06:41 +01:00
Dongjia "toka" Zhang
bb4b1f1b33
LLVM 20 update (#2902)
* LLVM 20

* clang format
2025-01-28 14:41:13 +01:00
EvianZhang
f30b05419b
Add combined monitor (#2900)
* Add combined monitor

* Sync start_time when initializing

* Use clone_from instead of clone to make clippy happy
2025-01-28 12:13:41 +01:00
s1341
7c84a7903a
Frida updates and FASAN fixes (#2838)
* Frida updates and FASAN fixes

* fmt

* Fixes

* clippy

* fmt

* Clippy

* Update to frida 0.16.2

* fix windows hooks

* Fix

* Fmt

* windows fix

* Bump frida version to 0.16.3

* Get rid of call to LLVMFuzzerInitialize

* bump version 0.16.5; use find_global_export_by_name

* allow unused_macro_rules

* Don't do stdout_file on windows

* fmt

* Add tmate to debug

* fix windows frida_libpng

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-01-28 11:48:52 +02:00
Romain Malmain
ba0da5121b
QASan: remove chunk_struct (#2899) 2025-01-28 01:46:09 +01:00
Romain Malmain
b320a8dbab
Add PC to QEMU's read / write callbacks + logger module (#2896)
* Logger module (only read/write for now)

* add pc to rw callbacks

* regen bindings
2025-01-27 15:01:20 +01:00
f7e61665be refactoring 2025-01-27 13:56:43 +01:00
Dongjia "toka" Zhang
133a0ffe7a
Merge LlmpEventManager and LlmpRestartingEventManager (#2891)
* add

* add 2

* feature

* fix nyx launcher

* a bit of doc

* addressing comments
2025-01-26 13:43:04 +01:00
Romain Malmain
1addbd04b9
Expose qemu's image_info for qemu usermode (#2889)
* image info for qemu usermode

* must use

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2025-01-24 20:05:38 +01:00
Romain Malmain
4083f0ba73
Fix drcov path parsing (#2884)
* fix drcov path parsing

* refactoring of drcov tool

* add the possibility to sort addresses in drcov tools

* more aggressive clippy. it now catches more warnings as errors than before

* reduce the number of unfixable warnings displayed.
2025-01-24 18:21:51 +01:00
WorksButNotTested
c5b7c7c235
Add SnapshotModule to qemu_coverage tool (#2885)
Co-authored-by: Your Name <you@example.com>
2025-01-23 11:23:37 +01:00
Romain Malmain
e84429012b
Add a qemu_coverage test in ci (#2883)
* add a qemu_coverage test in ci

* update CI path for changes in qemu-related code
2025-01-22 16:59:46 +01:00
Romain Malmain
2cc2298e98
Fix qemu_coverage v2 (#2882) 2025-01-22 16:00:20 +01:00
Romain Malmain
d9e8b59cb6
Fix qemu cov (#2875)
* fix drcov module hooks setup
2025-01-22 14:05:25 +01:00
Dongjia "toka" Zhang
2842f95e2a
Dedup StdOut/StdErr observer pt.2 (#2876)
* dedup stdout stdin

* mm

* Claude was not enough

* but was good enough

* ok

* okok

* okokok

* shorter now

* lol

* fixer
2025-01-21 16:53:02 +01:00
Dongjia "toka" Zhang
6eabb79920
Dedup stdout/stdin observer (#2871)
* dedup stdout stdin

* mm

* Claude was not enough

* but was good enough

* ok

* okok

* okokok

* shorter now
2025-01-21 15:17:07 +01:00
Dominik Maier
7e18887a32
Remove shmem associated type (#2870)
* reduce shm trait bound

* Rename to SendExiting

* alpha beta gamam

* alphabet

* work

* std only

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2025-01-20 20:28:19 +01:00
Dongjia "toka" Zhang
72adb483b5
0.15.0 (#2848)
* libafl pre-release edition

* oops

* aaa
2025-01-20 17:44:55 +01:00
Dongjia "toka" Zhang
6ee26a8afa
Decouple address_filters() from EmulatorModuleTuple into HasAddressFilters (#2869)
* 1

* fixe
2025-01-20 17:44:44 +01:00
Romain Malmain
8089b18d34
Remove ShMemProvider bound from struct definitions (#2861)
* No more ShMemProvider bound constraint in struct definition whenever possible

* Introduce StdShMem

* Update CONTRIBUTING.md
2025-01-20 17:25:55 +01:00
WorksButNotTested
348bfdc7d7
Add support for env_logger for qemu binary only fuzzers (#2817)
Co-authored-by: Your Name <you@example.com>
2025-01-20 09:46:47 +00:00
h1k0
9a64a53d12
Qemu launcher bugfix (#2858)
* Fixed the issue where compilation failed under the simplemgr configuration.

* Fixed the issue where the crash handler would fail during rerun.

* update fmt

---------

Co-authored-by: h1k0 <h1k0naka@outlook.com>
2025-01-20 00:01:01 +00:00
Dominik Maier
a949452453
Rename ResizableMutator, make it generic (#2859)
* Rename ResizableMutator, make it generic

* fix

* more fix

* reorer

* fmt, fixes

* fixes

* more commit

* fmt
2025-01-19 17:17:50 +00:00
Dhanvith Nayak
2a36b78fd6
Share objectives between nodes (#2754)
* add support to share new objectives in CentralizedEventManager

* handle received Objectives

* remove duplicate event fires in centralized event manager

* share input on share_objectives feature (broken)

* split impl LlmpEventManager based on share_objectives

* reduce code duplication in impl LlmpEventManager (broken)

* fix traits error (temp)

* fix mismatched types

* fix cargo format issue

* merge duplicated functions into single impl in llmp/mod.rs

* merge duplicate impl blocks in stages/sync.rs

* fix clippy warnings

* deduplicate handle_in_client

* cleanup unnecessary code

* handle objectives in tcp eventmanager

* handle objectives in llmp eventmanager (broken)

* handle objectives in llmp eventmanager

* fix doc test

* format

* clippy

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-01-19 17:00:24 +01:00
Dominik Maier
f2eefeb52a
Fix libafl-jumper for powerpc (#2866) 2025-01-19 13:15:48 +00:00
Dominik Maier
51d371acba
Revert "Set rust-analyzer.cargo.allTargets to False in setings.json.default (…" (#2867)
This reverts commit da854587d719fb0ece6c966afbb7a4bc5677cd11.
2025-01-19 13:57:32 +01:00
Dongjia "toka" Zhang
2afa947652
Fix CI (#2865)
* chg

* ci
2025-01-18 16:36:20 +01:00
Dongjia "toka" Zhang
da854587d7
Set rust-analyzer.cargo.allTargets to False in setings.json.default (#2864) 2025-01-18 13:32:57 +01:00
Konstantin Bücheler
faeed19c43
Add NyxCmpObserver and nyx_launcher example fuzzer (#2826)
* Add NyxCmpObserver to libafl_nyx

* Add nyx_launcher example fuzzer

* Cargo Format/Clippy

* Adapt to naming scheme

* Taplo fmt

* Add hex decode function to remove hex dependency

* Add nyx_launcher to CI

* Remove UsesState

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2025-01-18 13:21:04 +01:00
Dongjia "toka" Zhang
2e26af90db
Better error message in testcase_score.rs pt.2 (#2863)
* msg

* l
2025-01-18 13:07:14 +01:00
Dongjia "toka" Zhang
019c71a368
Better error for missing TopRatedsMetadata (#2860) 2025-01-17 21:42:51 +01:00
Romain Malmain
f8ad61e14a
Remove Input associated type (#2854)
* Completely remove Input as an associated type in multiple traits

* Unify usage of Input as generic instead 

* Remove many unused bounds, in particular HasCorpus

* fix multiple generic ordering

* update and fix CONTRIBUTING.md

* update MIGRATION

* use the same generic input type for new / with_max_iterations to make typing easier in most cases.

* Restore libafl_libfuzzer test in CI
2025-01-17 14:53:51 +01:00
h1k0
d4add04f87
Add comments for EmulatorModule trait (#2842)
* Add comments for EmulatorModule trait

---------

Co-authored-by: h1k0 <h1k0naka@outlook.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2025-01-16 17:49:22 +01:00
Valentin Huber
93c5adde4d
Remove MapObserver dependency from observer-dependent stages and schedulers in favour of generic hashing (#2851)
* Introdue SimpleHash separate from MapObserver

* Move to Hash for hashing

* Fix docs, remove even more restrictions

* fix libafl_targets

* fix fuzzer

* Remove broken and unnecessary derive

* Remove unnecessary trait restriction

* Remove unnecessary import

* Add changes to MIGRATION.md

* Remove more unnecessary imports
2025-01-16 16:34:58 +00:00
Railroad6230
15aa498d5e
Fix #2853: split HasMutatorBytes trait into two traits. (#2856)
(See #2853.)

This commit attempts to improve the [`HasMutatorBytes`] trait to allow it to
be used along with input types that cannot be resizable.

[`HasMutatorBytes`] is split into two traits:

 - [`HasMutatorBytes`]: requires `bytes` and `bytes_mut`.
 - `HasMutatorResizableBytes`: requires [`HasMutatorBytes`], and also requires
   a few other methods for resizing / shrinking the underlying input type.


N.B.: I believe that if merged, this would introduce a breaking change.

[`HasMutatorBytes`]: 198cd5dbc5/libafl/src/inputs/bytes.rs (L26)
2025-01-16 17:06:19 +01:00
Valentin Huber
198cd5dbc5
Fix formatting in MIGARTION.md (#2855) 2025-01-16 14:16:47 +01:00