50 Commits

Author SHA1 Message Date
5fad373199 update to 0.13.0 API 2024-06-19 13:30:36 +02:00
df7333b764 WIP: merge 2024-06-17 14:17:06 +02:00
Dongjia "toka" Zhang
c415b4d5f6
0.13.0 (#2253)
* 0.13

* z3

* capstone

* fixer

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-06-13 23:35:35 +02:00
Dongjia "toka" Zhang
454176427b
Windows clippy (#2295)
* add

* real one

* fuck

* abc

* def

* ghi

* jkl

* fix

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-06-08 20:32:40 +02:00
Romain Malmain
65af5a7f78
Fix libnyx, library upgrades (#2254)
* try this thing

* this?

* use new mmap signature in nix.

* fix import

* fix to work with addr2line v0.23.

* remove unused flag

* update strum also for dependency...

* clippy

* clippy

* update lain git hash

* bump many outdated crates

* fix hash
2024-05-28 17:15:08 +02:00
Dominik Maier
117741e1b1
Run Clippy on macOS (#2222)
* macos clippy

* Fix clippy on macOS
2024-05-20 02:58:42 +02:00
Romain Malmain
b127f0579d
Regenerate QEMU binding stubs only for newer versions of the nightly compiler (#2177)
* Regenerate binding stubs only for newer versions of the nightly compiler.

* fmt

* clippy
2024-05-15 01:42:59 +02:00
Romain Malmain
b0d95676f9
Fix regex fixing generated bindings for QEMU (#2163)
* Fix regex fixing generated bindings

* Do not write 2 times bindings to filesystem

* Update stub bindings

* fmt

* clippy

* fmt

* use `unsafe extern "C"` instead of `extern "C"`.
2024-05-13 17:41:56 +02:00
Romain Malmain
edb6b509c2
Generate stub bindings less aggressively. (#2164)
Emit warning when using runtime files for an incompatible architecture.
2024-05-13 11:58:19 +02:00
Addison Crump
614b149cae
Fix cfg uses across codebase (#2154)
* start fixup of cfgs

* whoops

* remaining issues

* maybe fixup macos

* apparently that is ios code?

* fix no_std

* Re-enable tcp_compression

* fix tcp broker

* remove tcp_debug flag

* fmt

* clippy

* less unwrap while we're at it

* doc

* add back pub star uses for libafl_qemu

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
2024-05-08 14:31:10 +02:00
Romain Malmain
bed500471a
QEMU generic memory iterator (#2148)
* QEMU generic memory iterator + Refactoring

* Generic Memory Iterator (systemmode only for now): It is now possible to iterator over memory ranges, independently of the address kind

* Refactoring or Emulator / Qemu structures: they are now handled separately in different files

* Refactoring of Exit Handlers: Result / Error structs have been clarified

* Simple handler for signals

* add new `check-cfg` calls for libafl qemu
2024-05-07 10:46:15 +02:00
Dongjia "toka" Zhang
b0ac25a7b5
Rename Reference to Handle (#2142)
* rename

* rename

* fmt

* fix

* fmt
2024-05-04 18:16:28 +02:00
Romain Malmain
2302f1b35c
Fix QEMU doc not building (again) (#2130)
* fix doc not building.
2024-05-02 15:17:35 +02:00
Romain Malmain
935100e7a7
Qemu update to latest version + various fixes (#2119)
* Fix maps iterator

* Added paranoid debug feature.

* Fix snapshot bugs.

* Update qemu-libafl-bridge.

* Added auto-generation of `x86_64_stub_bindings.rs` .

* Fix sync_exit calling to stopped CPU.
2024-05-02 09:31:54 +02:00
Romain Malmain
dd0fbff819
Small refactoring of libafl_qemu structure (#2098)
* Architecture-specific stuff is now in the `arch` directory

* Helpers are now in the `helpers` directory

* `emu.rs` has been moved as `emu/mod.rs` for consistency with the rest of the repository
2024-04-24 21:47:29 +02:00
Dongjia "toka" Zhang
176659821a
Add TypeRefCreator trait (#2065)
* poc

* ai suggestion

* rename this

* aaaa

* fmt

* simplify

* delete blob

* ignore

* fixup?

* some progress on cow-ification

* some more

* clippy fixes, finalise tests

* whoops, missed a spot

* no std compat

* api change: Named now requires alloc feature

* doc fix

* missed a spot

* additional fixes

* libfuzzer fixes

* fix tutorial

* fix

* add

* aa

* fix tutorial

* fix

* Rename

* fix

* aa

* fmt

* aa

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-04-23 19:03:30 +02:00
Romain Malmain
bc3ef5952b
Rework of libafl_qemu configuration (#2054)
* LibAFL QEMU can now be dynamically linked
* LibAFL QEMU reconfiguration happens less frequently (now using a signature check)
* Possibility to have custom rpath in QEMU
2024-04-16 11:35:15 +02:00
Dongjia "toka" Zhang
cbb323f26c
LibAFL 0.12 (#1823) 2024-04-12 18:42:14 +02:00
Romain Malmain
ec935bf95f
Fix GuestMaps iterator in LibAFL QEMU. (#2041)
* Fix maps iterator.

* Use native QEMU structs instead of pointer casting.

* Update stub bindings.

* Maps operations stored in usermode.
2024-04-12 14:40:53 +02:00
Romain Malmain
94a2a2363a
Add CPUArchStatePtr to backdoor signature (#2038) 2024-04-11 17:30:59 +02:00
WorksButNotTested
374f8735fa
Implement user-space QEMU ASAN (#1806)
* Implement user-space QEMU ASAN

* Fix wrong cfgs

* fmt

* merge conflicts in libafl qemu

* A few more fixes to qemu_launcher

* Change commit of qemu-libafl-bridge

* Fix clippy in qemu_launcher

* Fix commit id again

* Empty commit to trigger CI

* Fix path to fuzzer for test in qemu_launcher?

* Revert location of target binary and show the full error log from qemu_launcher test

* Appease the clippy gods

* Empty

* Fix format

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2024-04-10 01:11:28 +02:00
Dominik Maier
f19302c9b1
Bring back python bindings for sugar,qemu (partially revert #2005) (#2020)
* Bring back python bindings for sugar,qemu (partially revert #2005)

* sugarman, won't you hurry

* Test?
2024-04-08 19:36:54 +02:00
Dominik Maier
ff938261df
Fix Clippy on MacOS for qemu, accept some clippy::missing_transmute_annotations suggestions (#2009)
* Fix Clippy/CI

* Ignore transmute annotations in pybind

* fix

* more clippy

* more clippy

* fix fixes
2024-04-08 16:24:10 +02:00
Andrea Fioraldi
e29897dd44
Fix GuestMaps in userspace LibAFL QEMU (#2013) 2024-04-08 08:30:23 +02:00
Dongjia "toka" Zhang
4901846588
Remove python bindings (#2005)
* delete python bindings

* fix

* example

* fix
2024-04-06 15:16:46 +02:00
Romain Malmain
44c841ffb1
WIP: QEMU exit handler (#1745)
* Added paging filtering.
Reworked address range filtering to fit with new generic code.

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Renamed sync breakpoint to sync exit.

* Split emu in systemmode.rs / usermode.rs for specific code.
EmuExitHandler implementation.

* sync_backdoor.rs removal.
Formatting.

* Updated `bindgen` and `which`.
Adapting code to work with update.

* fix: reconfigure cleanly if prior configure was interrupted abruptly.

* Enable sanitizers in QEMU during debug.

* Added target-usable files.

* Added breakpoint structure.

* Adapted other files to work with ExitHandler.

* Adapted existing fuzzer to work with new exit handler.

* fix: use get to avoid crashes.

* Updated README to indicate cargo-make should be installed.

* Added QEMU internal exit handler.

* Adapted qemu_systemmode example with new exit handler.

* Fixed fuzzers to work with new exit handler.

* Trying to fix CI (#1739)

* test

* dummy

* dummy

* Added new examples.

* Forgot to add build scripts.

* format

* format

* clang-format

* python emulator adaptation.

* fixed python bindings.

* clippy fixes.

* python bindings.

* fix qemu_sugar.

* fix fuzzbench.

* fixed import issues.

* misc fixes.

* renamed crate.

* Updated x86_64 stub bindings.

* Fixed static naming.

* binding fmt

* clippy

* clippy

* Removed useless return statement.

* removed advice to install cargo-make in individual repositories.

* symcc_update (#1749)

* Remove unused create_anymap_for_trait macro (fixes #1719) (#1752)

* Fix `as_object` UB discussed in #1748 (#1751)

* Fix as_object UB discussed in #1748

* More cleanup, more less UB

* Fix fixes

* Added uninit_on_shmem api

* clippy

* fmt

* trying to fix fuzzers, libfuzzer wrapper

* Add OwnedRefMit::owned constructor, libfuzzer fix

* Some more fixes

* Add BacktaceObserver::owned fn

* fmt

* more fmt

* Ignore SigPipe by default (#1741)

* Ignore SigPipe by default

* Fix no_std

* fmt

* Fix incorrect imports (#1758)

* Fix incorrect imports

https://doc.rust-lang.org/core/simd/trait.SimdOrd.html

* Fix

* Try fix ci

* Documentation fixes (#1761)

* Documentation fixes

* Fix InProcessExecutor url

* Update all urls to latest

* Miri ignores for M1 regex (#1762)

* Enabling DrCov on Windows (#1765)

* Enabling DrCov for Windows

* Dedup common code in scheduler (#1702)

* dedup common code in scheduler

* del eco

* fixing

* fix

* replace `Emulator::new_empty` by `Emulator::get` calls outside of `emu.rs` for safety. (#1763)

* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, and more (#1754)

* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, set_error_print_panic_hook

* Trying to fix #1753

* typo

* More fix

* Fix test?

* more testcase fixes

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Split emu in systemmode.rs / usermode.rs for specific code.
EmuExitHandler implementation.

* format

* format

* format

* Replace sync_exit with sync_backdoor.

* Rework command system.

* fix bad import.

* format.

* cargo fmt

* disable af-xdp as well to avoid linking errors.

* End of merging.

* format.

* Adaptation for usermode.

* format.

* injection support.

* usermode fixes.
format.

* clippy

* clippy + format

* Do not unwrap emu + format.

* fix: entry_point breakpoint

* inital commit.

* clippy

* tests

* clippy

* adapt example

* systemmode.

* renaming

* fmt

* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.

* merge continue.

* renamed modules as well.

* fixing merge.

* systemmode compiling.

* fmt

* fix early emulator drop.

* fmt

* fix cast to c_void of the wrong object.

* Added global enum for snapshot managers.
Some renaming.

* move things around.

* WIP: generic inclusion of QEMU Executor in exit handler.

* * Moved extern calls to `libafl_qemu_sys`
* Replaced old `Emulator` by `Qemu` and only kept C functions wrappers
* Now `Emulator` is for higher-level interactions with QEMU. Kept old functions for compatibility calling to `Qemu` functions
* A direct side effect of this slit is the removal of the `IsEmuExitHandler` trait dependency added in many parts of the code.
* Removed old dirty casting for `QemuExecutor` helpers and used the brand-new access to `QemuExecutorState` instead.
* Minor changes to `Qemu` and `Emulator` `get` methods for cleaner getters.

* Add missing `Qemu` function.

* Updated `qemu_systemmode` example.

* Adapted QEMU fuzzers + renaming.

* Fixed python.

* fix libafl_sugar with new implementation.

* fix dangling RefCell.
adapt new examples.
TODO: merge `libafl_systemmode.*` examples.

* clippy.

* fix more fuzzers.

* clippy.

* Implement `HasInstrumentationFilter` generically.
Updated `StdInstrumentationFilter` accordingly.

* Renamed breakpoint functions for QEMU.
`qemu.run()` handling.

* Removed OnceCell / RefCell in signature.
more explicit `MmapPerms` method names.

* minor code refactoring

* Emulator::run_handle refactoring

* deprecated Emulator functions calling directly to QEMU functions.

* IsSnapshotManager -> SnapshotManager

* IsEmuExitHandler -> EmuExitHandler + fmt

* Generic register when it makes sense.

* reverted IsSnapshotManager -> SnapshotManager because of a collision.

* fix syntax + clippy

* fmt

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: lazymio <mio@lazym.io>
Co-authored-by: Bet4 <0xbet4@gmail.com>
Co-authored-by: mkravchik <mkravchik@hotmail.com>
2024-03-22 18:03:29 +01:00
Romain Malmain
9b96149f6c
Do not build doc with all features. (#1928)
Add documentation about default features for documentation.
2024-03-12 23:08:37 +01:00
Dominik Maier
0a995f241c
Cleanup Pointer Clippy Lints (#1861)
* Fix pointer clippy lints

* More clippy

* fix build

* fix
2024-02-15 16:31:18 +01:00
Andrea Fioraldi
41d24ca375
Fix broken closure hooks in libafl_qemu (#1839)
* Fix broken crash hook

* fix hooks

* clippy

* pin
2024-02-07 15:03:27 +01:00
Romain Malmain
b8d48013c0
updated QEMU. Adapted emu.rs to fit new interface. (#1774)
* updated QEMU. Adapted emu.rs to fit new interface.

* format
2024-01-03 20:10:20 +01:00
Dongjia "toka" Zhang
78060ea308
0.11.2 (#1735) 2023-12-18 14:33:14 +01:00
Andrea Fioraldi
1545514ed8
JIT fast path for edge cov hooks in libafl_qemu (#1696)
* JIT fast path for edge cov hooks in libafl_qemu

* fix

* fmt

* fix

* unify hooks as opt
2023-11-27 13:20:20 +01:00
Andrea Fioraldi
f1aee3c376
Refactor QEMU hooks (#1690)
* Rewrite QEMU Asan

* fake sys

* New hooks

* edge cov helper

* opaque raw hook

* new hooks

* EMulator::get

* new asan

* fix fuzzers

* fix types

* fix

* fix

* fix

* merge fix

* fix
2023-11-23 18:57:15 +01:00
Andrea Fioraldi
cc1ebb29f7
Add CmpLog routines to LibAFL QEMU and various fixes (#1664)
* Add CmpLog routines to LibAFL QEMU and various fixes

* format

* fix

* fix read_function_argument

* fix

* multithread

* fix qemu fork

* fix

* clippy

* fix systemmode

* unused imports
2023-11-17 16:59:50 +01:00
Andrea Fioraldi
406e77faa9
QEMU Asan backtrace and report (#1628)
* wip

* ExtractFirstRefMutType

* Asan report with backtrace

* Print asan reports and fix backtraces in libafl qemu

* print context

* enlarge redzone

* nopstate

* fix

* reproducer

* clippy

* clippy

* Fix android

* Crash hook
2023-10-25 15:58:32 +02:00
Dominik Maier
f27107c5e4
Fix docs build for libafl_qemu (#1495)
* Fix docs build for libafl_qemu

* turn around

* does this work?

* build all-features in CI

* fixes

* fix ci
2023-09-02 21:56:01 +02:00
Andrea Fioraldi
00033426e7
Bump to 0.11.1 (#1491) 2023-08-31 15:07:31 +02:00
Andrea Fioraldi
7dd7c1a485
Bump to 0.11.0 (#1469)
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-08-28 15:36:43 +02:00
Andrea Fioraldi
04c8d5208b
qemu: Fix cpu page size function for full-system (#1452)
* Revert "qemu: add cpu page_size call (#1433)"

This reverts commit d338b30c080ecfe1a6639185b6505b7a7b8edbeb.

* Reintroduce page_size
2023-08-25 11:42:23 +02:00
Dominik Maier
e89e8dbaab
Remove dependencies, add doc.rs metadata (#1450)
* Remove dependency, add doc.rs metadata

* remove lazy_static

* even less lazy_static

* serial_test no default
2023-08-24 11:34:38 +02:00
David CARLIER
d338b30c08
qemu: add cpu page_size call (#1433)
* qemu handy cpu page size call proposal.

* changes from feedback.
2023-08-23 20:27:58 +02:00
Andrea Fioraldi
ac4a0e7330
libafl_qemu snapshot device filter (#1386)
* libafl_qemu snapshot device filter

* Working device list

* regenerate bindings stub
2023-08-01 12:01:10 +02:00
Ivan Fratric
829b5049e6
Hexagon support (#1323)
* Hexagon support

* Fix format

* Fix needless bool

* Address comments

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-07-04 11:08:36 +02:00
WorksButNotTested
747a636f4f
Add sample fuzzer which collects DrCov coverage for various architect… (#1300)
* Add sample fuzzer which collects DrCov coverage for various architectures using QEMU instrumentation

* Fix clippy

* Rename NullCorpus to NopCorpus

* Added support for verbose output

* Attempt to fix clippy again

* Fix remaining defaults to use x86_64 when no arch specified and be more robust handling partial builds

* Make build even more robust against partial re-builds

* Added missing dependencies to workflow, updated README

* Add missing dependencies for i386

* Another dependency

* More dependencies

* Disable tests on OSX

* Add tmate

* Add missing dependencies and symlink header directory

* Tidy up after test so we don't hog all the disk space

---------

Co-authored-by: Your Name <you@example.com>
2023-06-06 11:50:38 +02:00
Dongjia "toka" Zhang
6f21cb3848
Bump to 0.10.1 (#1280)
* bmp

* remove DEBUG env var
2023-05-22 12:42:36 +02:00
Andrea Fioraldi
0f633962ff
Bump to 0.10.0 (#1156)
* Bump to 0.10.0

* fix

* Fix CI

* Fix copyright

* fmt

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-04-05 17:49:53 +02:00
Andrea Fioraldi
b77c0b78cc
Fix readme position in qemu sys (#1032) 2023-01-31 13:40:28 +01:00
Andrea Fioraldi
fdf579bcd5
Bump to 0.9.0 (#946)
* bump to 0.9.0

* fix libafl_tinyinst

* fix

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-01-31 10:42:01 +01:00
Andrea Fioraldi
50708f4d9c
Fast device+mem QEMU snapshots (#930)
* Simple fast root snapshots

* clippy

* epd

* mips
2022-12-12 10:49:44 +01:00
Andrea Fioraldi
71dd58396c
libafl_qemu_sys and libafl_qemu_build to have bindgen with QEMU (#915)
* build and sys qemu crates

* working libafl_qemu_build

* libafl_qemu_sys

* switch libafl_qemu to use libafl_qemu_sys

* fix

* use sys

* fmt

* mmu lookup

* fix

* autofix

* clippy

* fix

* allow

* cl

* docker

* docker

* fix

* mem access info in mem hooks

* fmt

* fix

* kill libafl_page_size

* fix

* clippy

* default bindings for docs.rs

* macos

* fix arm build

* fix

* plugins

* fix

* fix fuzzer

* Correct PC on breakpoint

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2022-12-02 17:01:28 +01:00