654 Commits

Author SHA1 Message Date
Dominik Maier
f73e2006fc
Removed more new_ (#1200) 2023-04-07 02:34:28 +02:00
Andrea Fioraldi
0f633962ff
Bump to 0.10.0 (#1156)
* Bump to 0.10.0

* fix

* Fix CI

* Fix copyright

* fmt

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-04-05 17:49:53 +02:00
Felipe Baltor
6523341c4d
fix: output directory name; monitor output with println! (#1192) 2023-04-05 11:00:21 +02:00
Andrey Fedotov
1bd21509af
CASR deduplication for StacktraceObservers (#1184)
* Implement CasrAsanBacktraceObserver for dedupe crashes using libCASR and ASAN reports.

* Use casr observer with forkserver executor

* Add casr deduplication for AsanBacktraceObserver

* Add casr deduplication for BacktraceObserver

* Add Stacktrace filtering

* Move init_ignored_frames to constructors

* Add go ignore regexps for BacktraceObservers

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-04-04 19:03:11 +02:00
Dongjia "toka" Zhang
ccd1211cd2
Remove qemu_arm_launcher test from CI (#1179)
* remove qemu arm

* trigger all

* debug

* revert

* api chg

* fix

* try

* debug

* remove qemu

* no_std

* Update build_and_test.yml

* llvm16

* revert z3

* macos

* fix

* remove test

* don't grep on mac

* fix

* ok

* f

* f

* f

* aaa
2023-04-04 14:49:58 +02:00
LiuZhihong
590d3655cd
add readme documentation description about the tui feature (#1198) 2023-04-04 10:34:22 +02:00
ToSeven
ea512f70f8
Fix a build error in baby_fuzzer_minimizing (#1195)
Co-authored-by: toseven <Byone.heng@gmail.com>
2023-04-03 13:38:11 +02:00
Andrea Fioraldi
a01863696e
Implement restarting without serializing the corpus (#1182)
* Restart without serializing state option

* libfuzzer libpng example

* clippy

* libfuzzer_libpng_norestart

* fix
2023-03-30 14:35:58 +02:00
Dongjia "toka" Zhang
0c9933c3e4
Remove libfuzzer_stb_image_sugar for now (#1177)
* a

* better check

* slow
2023-03-24 02:41:15 +09:00
Dominik Maier
620b2861e3
Fix libafl_qemu testcase (#1173)
* Fix libafl_qemu testcase

* stb?

* Undo change for stb
2023-03-23 15:15:54 +01:00
Dominik Maier
66b2867ba2
Fix example fuzzers (#1171)
* Fix example fuzzers

* fmt
2023-03-23 11:02:18 +01:00
Dominik Maier
76e4f6031d
Fmt, no_std fixes (#1167)
* Fmt, no_std fixes

* push-stage fix
2023-03-23 00:10:01 +01:00
v1ce0ye
7c514c3669
ix UB in baby_fuzzer_grimoire (#1166) 2023-03-22 15:37:57 +01:00
Vincent
38ea17b426
libafl_frida for Linux executables (#1117)
* add frida_executable_libpng

* fix makefile

* fix README.md

* remove author from Cargo.toml

* fix fuzzer

* fix fuzzer

* fix Makefile

* fix linter

* fix clang-format-13

* unsupport mac os

* fix build_and_test_fuzzers

* fix cargo fmt

* cargo fmt

* add safer libc_start_main

* fix call rax addr

* fix frida

* fix cargo fmt

* fix metadata() to metadata_map()

* fix toml

* fix maxmapfeedback
2023-03-22 15:18:21 +01:00
Dominik Maier
8f8e74d670
Don't build z3 from source by default (and add static_z3 feature) (#1160)
* Reduce build times by using preinstaled z3

* fix env order

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-03-20 10:04:27 +01:00
Dominik Maier
f4f23de32b
Fix fuzzers after HasTestcase (#1123) (#1162)
* Fix fuzzers after HasTestcase (#1123)

* Make the trait a trait

* Implement HasTestcase for Corpora

* fix

* fix

* a

* a

* fix

* wasm32

* a

* f

* f

* aa

---------

Co-authored-by: tokatoka <tokazerkje@outlook.com>
2023-03-19 11:58:32 +09:00
Dominik Maier
bbe4e85768
Removed new_ from constructors that don't need it (API consistency) (#1159)
* Removed new_ from constructors that don't need it (API consistency)

* un-change python bindings
2023-03-17 17:02:21 +01:00
Dongjia "toka" Zhang
6c98945fc3
Fix fuzzbench_forkserver 2023-03-15 13:32:04 +09:00
Matheus Baptistella
c38405ef83
Shorthand functions to get typed metadata, renamed metatdata -> metadata_map (#1123)
* Created macro to get the metadata form State and Testcase

* Expanded the macros for mutable, or not, State and Testcase metadata

* Created functions on traits HasMetadata and HasNamedMetadatato get, mutable or not, metadata

* Created the functions to get metadata

* Added #[inline] attribute and renamed the functions

* Renamed the functions and added #[inline] attribute

* Temporarily added testcase() function

* Added testcase() function

* Changed Ref import to core::cell:Ref

* Added testcase_mut() and renamed occurences of metadata() and metadata_mut()

* Renamed more occurences

* Renamed the metadata() on impl HasMetadata for NopState

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-03-14 14:24:33 +01:00
Dominik Maier
8dfdee6fce
Fix UB for differential map observer example (#1140)
* Fix UB for differential map observer example

* clippy

* undo submodule foo
2023-03-14 13:50:50 +01:00
Dominik Maier
6894a37ceb
Added Truncate trait (#1141) 2023-03-13 17:34:58 +01:00
Addison Crump
786af9f6a9
resolve zero-sized allocation in swap diff fuzzer (#1139) 2023-03-12 23:24:22 +01:00
Dominik Maier
2ed6583041
CI: Run miri tests (#1130)
* Fixes/ignores for miri support

* linux

* fix doctest for miri

* fix docs

* fix UB in baby_fuzzer

* no custom allocator in miri
2023-03-08 19:21:17 +01:00
Vincent
c8254dbd0e
Check CI result on cargo make test for available fuzzers (#1107)
* fix libfuzzer_libpng_cmin

* fix libfuzzer_libpng_ctx

* revert libfuzzer_libpng_cmin and check ci by grepping broker stdout result instead

* revert libfuzzer_libpng_ctx and check ci by grepping broker stdout result instead

* add check ci for fuzzers

* add check ci for fuzzers

* add check ci

* add fuzzbench test

* add validation for qemu fuzzer

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-03-06 23:21:24 +09:00
Dongjia "toka" Zhang
9df95bd936
Use InMemoryCorpus in libfuzzer_libpng (#1125) 2023-03-05 23:23:42 +09:00
Arpan Kapoor
672f4d1668
Use a different crash history in forkserver examples (#1118) 2023-03-02 19:49:50 +09:00
Dominik Maier
fbe8cce1b8
Real OnDiskCorpus (#1096)
* Real OnDiskCorpus

* clippy

* python

* docs

* clippy

* docs

* move to reuse cachedinmem corpus

* fmt
2023-02-28 15:41:05 +01:00
Andrea Fioraldi
dc800f0814
on_evaluation Scheduler method (#1106)
* add on evaluation hook in schedulers

* on_evaluation for WeightedScheduler

* fix PowerQueueScheduler

* fix fuzzers

* upd qemu

* tests

* upd
2023-02-28 11:33:26 +01:00
Addison Crump
0727c80347
Add example for WASM (#1093)
* add baby_fuzzer for wasm targets

* elaborate in README

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-02-26 17:02:22 +01:00
Addison Crump
e42cd9c12f
Fixes for on_replace/on_remove and related for StdFuzzer and MapFeedback (#1067)
* scheduler replace fixes

* oops, no-std

* add

* changes on the fuzzers

* move map feedback history updates to append_metadata

* fixes for python bindings

* learn to clippy

* fix for fuzzer add_input

* clippy fixes for frida

* additional powersched differences

* corrections for bitmap_size

* off-by-one

* I live in a prison of my own creation and clippy is the warden

* clear the novelties map for the situation where is_interesting is invoked, but not append_metadata

---------

Co-authored-by: tokatoka <tokazerkje@outlook.com>
2023-02-15 17:04:18 +01:00
Andrea Fioraldi
cf0a0a0698
Add stub lib for fuzzbench (#1074) 2023-02-15 12:05:10 +01:00
Elsa Granger
44b69666da
Fix fuzzbench build (#1004)
* Fix -z,defs handle

* Add libfuzzer_no_link_main option in libfuzzer

* Use libfuzzer_no_link_main for fuzzbench

* no_link_main feature

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-02-15 11:58:32 +01:00
Fabian Freyer
53dba5f49d
Use the log facade instead of println (#1060)
* switched a couple of println / dbg statements to use log crate
* Use pyo3-log for logging in python bindings
2023-02-14 10:01:51 +01:00
Dongjia "toka" Zhang
30b51bb810
Remove unused dependencies (#1069) 2023-02-14 09:02:18 +01:00
Dongjia "toka" Zhang
a74e5da268
Revert FridaInstrumentationHelper changes (#1062)
* Revert "Send stability in calibration stage & FridaInstrumentationHelper retunrs Result<Self, Error> (#1056)"

This reverts commit 4d78878c02846b2c0a49686cd05cccadd2b0ac72.

* fux

* poc

* revert
2023-02-13 10:02:26 +09:00
Dongjia "toka" Zhang
4d78878c02
Send stability in calibration stage & FridaInstrumentationHelper retunrs Result<Self, Error> (#1056)
* fix

* fix

* clippy
2023-02-13 05:35:09 +09:00
Dongjia "toka" Zhang
b7a0b823c6
Fix frida_gdiplus (#1045)
* fix

* I don't like prelude

* clp

* cargo make test

* poc

* one to_vec()

* fix?

* del

* fix
2023-02-08 00:20:38 +09:00
R. Elliott Childre
4d5a759955
Update deps for libafl (#1042)
Reduces total number of packages from 577 to 571 on building with:
`cargo +nightly build --workspace --all-features`

* ahash 0.7 -> 0.8
  * Move `AHasher::new_with_keys` to `RandomState::with_seeds` given the
    recommendation from: aHash maintainer:
    https://github.com/tkaitchuck/aHash/issues/132#issuecomment-1288207069

* bindgen: 0.61 -> 0.63

* c2rust-bitfields: 0.3 -> 0.17

* criterion: 0.3 -> 0.4

* crossterm: 0.25 -> 0.26

* dynasmrt: 1.2 -> 2

* goblin: 0.5.3 -> 0.6

* hashbrown: 0.12 -> 0.13

* nix: 0.25 -> 0.26
  * The `addr` arg of `mmap` is now of type `Option<NonZeroUsize>`
  * The `length` arg of `mmap` is now of type `NonZeroUsize`
  * Requires updating implementers to update `nix` as well

* prometheus-client: 0.18.0 -> 0.19
  * Do not box metrics
  * Gauges (a majority of the LibAFL metrics) are now i64 types so there
    is a small chance of overflow, with the u64 values that LibAFL
    tracks, but unlikely to be problematic.
 * Keep `exec_rate` as a floating point value

* serial_test: 0.8 -> 1

* typed-builder: 0.10.0 -> 0.12

* windows: 0.42.0 -> 0.44

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-02-06 12:24:42 +01:00
R. Elliott Childre
5d76707ede
Bump deps and fix Clippy warns in example fuzzers (#1043)
* Mostly addressing changing the `uninlined_format_args` lint which was
  changed to warn-by-default in rust clippy 1.67

* Bump dependencies:
  bindgen:  0.61 -> 0.63
  cc:       1.0 -> 1.0.42 (Exclue versions w/incompat rayon dependency)
  clap:     3.x -> 4.0
  rangemap: 0.1 -> 1
  xz -> xz2:  move to updated version

* Add fallthrough default return to `LLVMFuzzerTestOneInput` in
  **/fuzz.c to prevent Clang's -Wreturn-type

* libafl_atheris: Improve POSIX compatibility and reduce warnings
  * Check for .dylib and .so libraries
  * `source` -> `.` for POSIX shells
  * install wheel into the venv to support newer Python packaging
    standards
  * `LDPRELOAD` -> `LD_PRELOAD`
2023-02-05 21:53:45 +01:00
Andrea Fioraldi
eaf5ff9de0
Restart loading initial inputs even after a crash/timeout (#1040)
* Track initial inputs loading

* libfuzzer libpng

* fuzzbench

* fix no_std

* fix no_std

* clippy

* fuzzers
2023-02-03 11:56:47 +01:00
Dongjia "toka" Zhang
db62c26eda
Remove unused imports (#1035)
* remove unused imports

* fmt
2023-02-01 12:26:56 +01:00
Andrea Fioraldi
fdf579bcd5
Bump to 0.9.0 (#946)
* bump to 0.9.0

* fix libafl_tinyinst

* fix

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-01-31 10:42:01 +01:00
Dominik Maier
ff9208f107
Fixing python example (#1016)
* Fixing python example

* Fix python baby fuzzer

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-01-30 20:03:07 +01:00
Dominik Maier
33ddce2cea
Introduce MutatorId, Tuneable fixes (#1022)
* Add simpler APIs for TunableStage

* Make API usable

* Add TunableScheduledMutator APIs

* Introduce MutatorId

* More API

* Cleanup

* add sampling-based mutation scheduling

* reduce precision for sampling

* clippy
2023-01-30 18:04:42 +01:00
Andrea Fioraldi
92c0c5eeab
Fix second Forkserver Broken Pipe (#1013)
* Truncate at MAX_FILE

* AFL_MAP_SIZE

* todo
2023-01-24 20:50:56 +01:00
Dongjia "toka" Zhang
fe51286586
TinyInst Update (#968)
* tmp

* more

* save

* TODO

* fix

* update to tinyinst on crates

* dep

* fmt

* shmem done

* cpp fmt

* clp

* fmt

* why??

* ver

* more makefile.toml

* windows test

* Update build_and_test.yml

* fix

* a

* install

* fmt

* fix

* only macos and win

* more

* The order matters

* remove

* fmt

* chg

* typo

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-01-23 11:11:53 +01:00
Andrea Fioraldi
7fd9ac0952
SyncFromBrokerStage to sync from a broker with a different Input type (#997)
* ConverterLlmpEventManager

* docs

* SyncFromBrokerStage

* fix

* separate InputConverter

* nautilus

* nautilus_sync

* send testcases

* upd nautilus

* meta

* fix

* clippy

* fix

* Update build_and_test.yml

* fix

* fix

* Use find_libpython

* ci

* upd qemu
2023-01-20 17:16:29 +01:00
Dominik Maier
97e88af0c5
OnDiskCorpus: Write metadata by default, metadata gzip compression (#995)
* Write metadata by default

* fix fuzzers

* Cleanup, gzip feature

* Fix casing for ondisk corpus

* fix fmt, clippy

* clippy

* clippy for gdiplus fuzzer

* fmt
2023-01-13 01:07:36 +01:00
Addison Crump
28786c943a
Grimoire fixes (#993)
* fixup grimoire/generalisation, remove GeneralizedInput in favour of metadata

* additional cleanup

* transformable inputs to solve the grimoire problem

* explicit use of 'transforming' to keep typing compatible with normal usage

* clippy fix

* fixes for nautilus, python

* explicit inlining for reflexive impl

* fix for tutorial

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-01-13 01:07:21 +01:00
Andrea Fioraldi
ec84c71eae
Corpus maps (#947)
* hashmap corpus for inmemory

* corpus_btreemap feature

* CorpusId

* queue

* MinimizerScheduler::remove

* fixes

* continue

* keys

* working corpus

* ok

* weighted left

* wip

* port weighted scheduler

* it compiles

* doc

* fix mutators

* fix queue

* fix iter

* tests

* fix

* fix

* fix

* py

* clippy

* clippy

* clippy

* cmin

* fix

* fix

* fix

* clippy

* remove Corpus::random_id
2023-01-09 14:15:07 +01:00