* frida_asan: Implemented initial asan runtime library
* frida_asan: Switch to hashbrown
* Implemented GOT-based hooking to isolate the hooking of the memory functions. Implemented initial ASAN instrumentation
* WIP: Shadowing all used memory. Currently tracking pages using a BTreeSet. Slow AF!
* Add SigTrap to unix_signals and inprocess
* Working frida-asan, almost no speed degradation.
Currently the shadow check is reversed, so it checks only that the shadow is not 0.
We need to implement sub-8-byte checking.
* Format
* Cleanup and formatting
* Sub-qword and 16-byte checks implemented; Fixed unaligned access to QWORD
* Pass the ucontext_t to signal handlers. Initial regdump on crash
* Fix typo
* Make the context argument a mut ref
* Add missing files; Implement initial reporting
* Refactor out gothook; Move safety checkers to dynasm
* Get rid of const assembly blobs no longer needed
* Move to a handler function instead of using SIGTRAP.
This bloats the transformed code, but doesn't seem to have a major impact on performance.
Also, implemented pretty backtraces and assembly output.
* Formatting
* Get rid of all the pinning crap I wasted my day on, We don't need it
* windows fixes
* ashmem
* ashmem_service: server side ready
* ashmem_service: client side ready. Ready for integration
* ashmem_service: changes to UnixShMem to make it 'threadable'
* ashmem_service: format
* ashmem_service: Undo changes to UnixShMem, make the thread own the AshmemService instead; Fix protocol bug
* ashmem_service: working ashmem service. Fix merge issues
* use the newly released capston e 0.8.0; Fix a nasty bug where the afl_area an pc_pointer were reversed. Changed Vectors to Boxed [u8]
* Implement type detection for reporting; Implement double-free/unallocated free checking
* fmt
* Cleanup code a little
* frida-asan: This is an omnibus commit. Should probably have been a bunch of small commits, but I don't have the time/patience.
- Implemented DrCov support in order to debug a failing harness. This is actually
generic and should be moved out of libafl_frida.
- Implemented LIBAFL_FRIDA_OPTIONS env var to pass options to the frida helper,
to dynamically enable/disable asan and drcov.
- Implemented memory reuse - after each test case the used pages are recycled and
can be reused in the next test case.
- Implemented and tested vectorized instruction instrumentation.
- Implemented not instrumenting atomic load/store instructions. The cost of
trying to emulate their behaviour is too high at the moment.
- Implemented probing of shadow bit to determine the best match for the current
system.
- Implemented shadow memory pre-mapping where it is available. We probe for this
too.
- Implemented ability to specify a list of modules to instrument on the command
line. This allows fine-grained control of which modules are instrumented for
coverage/asan/drcov.
- Implemented unpoisoning of the Input target_bytes in a pre_exec hook.
- Added support for zero-sized allocations. We return 0x10 bytes at the moment.
- Added all known operator new/delete functions to hooks.
- Added workaround for frida_gum_allocate_near bug.
- Cleaned up reporting, added reporting for different error types.
* frida-asan: Implement leak detection
* Fix merge issues
* Rebased on dev to get llmp/shmem changes; Clippy fixes
* Add FridaOptions struct
* Add the Custom ExitKind; Get rid of Clone/PartialEq on ExitKind
* Make it possible to recover from an ASAN error
* Add SIGTRAP to crashing signals
* Add back (conditional) crashing on Asan errors.
* Fix too-large immediates in add instruction
* Implement RcShMemProvider, finally fix the EOP bug
* Clear ASAN_ERRORS before each test
* Fix warnings; Fix review issues
* Cleanup prints
* Add timeout to Frida mode
* Make allocation-/free-site backtraces optional
* CPU Context and backtrace (on android/aarch64 atm) on crash
* Make stalker conditional
* Add metadata to solution, and write metadata files
* Add addresses to backtrace; Add reporting of ASAN stack errors; Fix ASAN reporting bugs
* Remove meaningless backtrace on crash
* Fix the x0, x1 load in report
* use upstream color-backtrace
* use __builtin_thread_pointer instead of custom asm
* Don't unwrap ASAN_ERRORS if it isn't some
* Fix bug where we weren't clearing the drcov basicblocks after each run
* Fix bug where we were dropping an ashmem too soon
* Fix OwnedPtr instead of CPtr
* Fix gettls for all archs
* cfg guards for target arch, disabling Frida-ASAN/-DrCov if not on aarch64
* Cargo fmt
* Only panic in options when asan/drcov are turned on; Merge fixes
* gothook only supported on unix
* Fix gettls on msvc
* Another attempt to fix MSVC gettls
* Fix backtrace use
* nostd fixes; warning fixes
* formatting
* Migrate FridaEdgeCoverageHelper into libafl_frida, and rename to FridaInstrumentationHelper
* Clean up uses
* Move DrCovWriter to libafl_targets
* Refactor DrCovWriter to get a vec of DrCovBasicBlocks; formatting
* Update to newer backtrace which supports android with gimli
* windows fixes
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: andreafioraldi <andreafioraldi@gmail.com>
* shmeme/llmp refactor to convert ShMem into a stateful ShMemProvider
factory.
At the moment we use parking_lot::ReentrantMutex. That may not be
necessary.
* fix merge issue
* formatting
* Fix fuzzer examples for new ShMemProvider
* Fix clippy warnings
* Fix build and clippy for x86_64
* Resolve review comments
* Remove ReentrantMutex and RefCell - they are not needed
* Hopefully fix win32 build
* Fix tests, windows build
* Rename ShMemProvider to ShMem
* Revert "Rename ShMemProvider to ShMem"
This reverts commit eca07c8d7bb3d5e829fecf3f7213c763470a41e9.
* Rename ShMemMapping to ShMem; Test fixes
* Add missing trait to scope
* Fix from_int
* Fix try_into
* Move to alloc::sync::Arc and spin::Mutex to support nostd
* Fix tests
* nostd fixes; Make new() a part of the ShMemProvider trait
* Fix errant ?
* Fix windows
* Fix missing trait
* nostd remove dbg!
* Add Default and Clone to ShMemProvider
* Formatting
* Fix windows
* Get rid of ArcMutex in favor of RefCell
* Rc RefCell
* moved to refs
* SHP->SP
* Use alloc::rc::Rc instead of std::rc::Rc
* Format
* Add setup_restarting_mgr_std which selects the right ShMemProvider; changed fuzzers to use it
* Get rid of unnecessary clone
* Fix clippy error on windows
* Fix nostd
* Fix formatting
* Make StdShmemProvider include ServedShMemProvider
* Get rid of lifetime specifiers now that we are using Rc
* Get rid of unneccesary spin
* Rename ShMemProvider::Mapping to ShMemProvider::Mem
* Formatting
* fix Windows
* Rename DefaultUnixShmem* to CommonUnixShmem*
Co-authored-by: Dominik Maier <domenukk@gmail.com>
* fix_android_and_optimize_frida: Fix build and run for android; optimize frida maybe_log functions
* fix_android_and_optimize_frida: Get rid of the HasFd trait; cleanup warnings
* fix_android_and_optimize_frida: fmt
* add LogMutation trait
* change &self to &mut self
* move self.scheduler out of StdFuzzer
* reorder generics?, implement post_exec
* append metadata to the corresponding testcase in the corpus
* turn mutations into Mutators
* impl Named for mutations
* add LoggerScheduledMutator, add fn get_name() to MutatorTuple
* Fix BytesDeleteMutator, and format
* remove TupleList bound on Tail
* turn TokenInsert, TokenReplace into Mutator, fill havoc_mutations
* libfuzzer_libpng
* libfuzzer_libpng_cmpalloc
* libfuzzer_libmozjpeg
* fix tests
* fix libfuzzer_libmozjpeg
* fix tests
* fix LoggerScheduledMutator::mutate
* use vec<u8> instead of String
* fix post_exec and get_name
* fmt
* NamedTuple and HasNameIdTuple
* always clear mutations log
* fix tests
* format
* remove libafl_targets default features
* use vec<string> instead of vec<vec<u8>>
* add alloc::string::String
* format
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
* windows fuzzer target and minor changes - breaks android support and maybe linux build
* adapted windows example
* removed warnings from build.rs
* fixed build on unix
* fixed no_std
* build fix, silenced warnings
* no_std warning silenced
* clippy fixes
* fmt
* windows fuzzer target and minor changes - breaks android support and maybe linux build
* adapted windows example
* removed warnings from build.rs
* fixed build on unix
* fixed no_std
* build fix, silenced warnings
* no_std warning silenced
* clippy fixes
* fmt
* clippy
* trying to add clang support
* debugging win build
* debugging win build more
* debuggin..
* debuggin....
* more debugging
* giving up
Co-authored-by: richinseattle <richinseattle@gmail.com>
* inprocess: Allow InProcessExecutor to take a function pointer or a closure
* frida: initial working (but slow + buggy) frida helper
Issues:
- it's slow as ****
- there is an Llmp exception after the 227th corpus entry is found
- Cargo.toml lines currently import from a local ../frida-rust dir, as frida-rust is still under development
* inprocess: let the InProcessExecutor take a closure or a function pointer
* frida: working FridaHelper with InProcessExecutor
* frida: Apply suggestions; Move to RefCell; Cleanup warnings
* frida: link libstdc++_static.a on android
* take an FnMut in InProcessExecutor
* adapt libfuzzer_libpng to FnMut in InProcessExecutor
* create FridaInProcessExecutor and FridaEdgeCoverageHelper
* fix frida build.rs
* frida: move gum to main, get rid of lazy_static; use PageProtection enum
* stalker exclude
* frida: implement inline map-update for x86_64
* inprocess: add harness/harness_mut accessors
* format
* remove get_module_size from FridaEdgeCoverageHelper
* frida: implement aarch64 inline map update
* frida: add missing IndexMode
* add timeouts for executors
* move timeouts to observer
* add with_timeout constructor for Observer
* cast to i64 later in pre_exec
* add cfg(unix) guards
* add TimeoutExecutor
* add TimeoutFeedback and send ExitKind::Timeout from the handler
* pass Duration and move timeout stuff to post_exec
* format
* add timeouts to libpng_libfuzzer
* 10 sec timeout
* timeout executor file
* fix timeout executor no_std
* format
* todos
* Win32ShMem
* win32 exceptions
* fixes
* fix win32 build.rs
* fix win32 build.rs
* fixes fro win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* inprocess::windows_exception_handler
* inprocess::windows_exception_handler fixes
* windows_exception_handler in InProcessExecutor
* inprocess::windows_exception_handler fix
* fix windows exceptions mapping
* format
* format
* inprocess: Allow InProcessExecutor to take a function pointer or a closure
* frida: initial working (but slow + buggy) frida helper
Issues:
- it's slow as ****
- there is an Llmp exception after the 227th corpus entry is found
- Cargo.toml lines currently import from a local ../frida-rust dir, as frida-rust is still under development
* inprocess: let the InProcessExecutor take a closure or a function pointer
* frida: Apply suggestions; Move to RefCell; Cleanup warnings
* take an FnMut in InProcessExecutor
* adapt libfuzzer_libpng to FnMut in InProcessExecutor
* reenabled ci for prs
* frida: update to frida-rust 0.3.2
* frida: fix buid errors
* frida: fix build_and_test.yml
* frida: uses crates.io for frida-gum and frida-gum-sys
* fix merge errors
* fix typo
* frida: x86_64 now working
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: toka <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
