319 Commits

Author SHA1 Message Date
Romain Malmain
94a2a2363a
Add CPUArchStatePtr to backdoor signature (#2038) 2024-04-11 17:30:59 +02:00
Stefan Zabka
48463d079b
Fix error handling in libafl_qemu_build (#2036)
* fix(libafl_qemu_build): assert command success

* fix(libafl_qemu_build): make sure linker_interceptor.py picks up correct compiler

Currently linker_interceptor.py uses 'cc' as the __LIBAFL_QEMU_BUILD_CC environment variable is never set

* remove redudant arg
2024-04-10 18:36:36 +02:00
WorksButNotTested
374f8735fa
Implement user-space QEMU ASAN (#1806)
* Implement user-space QEMU ASAN

* Fix wrong cfgs

* fmt

* merge conflicts in libafl qemu

* A few more fixes to qemu_launcher

* Change commit of qemu-libafl-bridge

* Fix clippy in qemu_launcher

* Fix commit id again

* Empty commit to trigger CI

* Fix path to fuzzer for test in qemu_launcher?

* Revert location of target binary and show the full error log from qemu_launcher test

* Appease the clippy gods

* Empty

* Fix format

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2024-04-10 01:11:28 +02:00
Romain Malmain
33c6ea1ae4
Fix libafl_qemu python bindings and example (#2030) 2024-04-09 16:09:47 +02:00
Mrmaxmeier
f252469d86
CI: A few updates and fixes (#2023)
* CI: Don't run cargo clean in order to preserve build caches

* CI: run yaml formatter >:)

* CI: try sharing build caches between similar jobs

* CI: it looks like the `ucd-generate` tool is not used anymore

* CI: Sneak in merge queue support :)

* CI: split out `cargo fmt --check` job

* libafl_qemu injections: be more resilient about mapping paths
2024-04-09 12:55:07 +02:00
Dominik Maier
7479726c3e
Un-Unfix libafl_qemu fixes after #2020, remove python CI (#2024)
* Un-Unfix libafl_qemu fixes after #2020

* remove CI for removed python bindings
2024-04-08 22:06:40 +02:00
Dominik Maier
f19302c9b1
Bring back python bindings for sugar,qemu (partially revert #2005) (#2020)
* Bring back python bindings for sugar,qemu (partially revert #2005)

* sugarman, won't you hurry

* Test?
2024-04-08 19:36:54 +02:00
Dongjia "toka" Zhang
e8fe5bb614
Move HasMetadata/HasNamedMetadata trait to libafl_bolts (#2016)
* move around

* fmt

* rev

* fmt

* doc job

* name

* move to libafl

* separate even more

* miri
2024-04-08 19:24:56 +02:00
Dominik Maier
ff938261df
Fix Clippy on MacOS for qemu, accept some clippy::missing_transmute_annotations suggestions (#2009)
* Fix Clippy/CI

* Ignore transmute annotations in pybind

* fix

* more clippy

* more clippy

* fix fixes
2024-04-08 16:24:10 +02:00
Andrea Fioraldi
e29897dd44
Fix GuestMaps in userspace LibAFL QEMU (#2013) 2024-04-08 08:30:23 +02:00
Dongjia "toka" Zhang
527b892c1d
Separate fuzzer test in CI (#2010)
* ci

* ci

* ci

* aa

* aa

* a

* a

* a

* fix

* no fail fast

* system

* what is this lint...

* a

* clp

* disk

* ok no fastfail

* no qemu for now, reenable monday
2024-04-06 21:01:57 +02:00
Dongjia "toka" Zhang
4901846588
Remove python bindings (#2005)
* delete python bindings

* fix

* example

* fix
2024-04-06 15:16:46 +02:00
Romain Malmain
50be2f4aaf
Fix of libafl qemu runtime files (#1996)
* Change naming and fix LibAFLQEMU header file. Fix and document LibAFL QEMU Windows ASM file.

* fmt
2024-04-03 11:57:48 +02:00
Romain Malmain
cca4e3daa9
Make inputs in libafl_qemu generic (#1991)
* fix non-generic input in libafl_qemu

* Update setup_libxml2.sh of nyx_libxml2_standalone fuzzer (#1990)

On testing this on my machine not all neccessary files for fuzzing with nyx where provided by the setup. Compared to the nyx_libxml2_parallel fuzzer this packer generation line was missing.
After adding this the fuzzer was able to start.

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Tobias Mayer <arbeitskraftmayer@gmail.com>
2024-04-02 12:30:12 +02:00
Romain Malmain
50e0f80d1e
Refactoring of qemu_systemmode fuzzers (#1980)
* Added backdoors to portable header file.

* fix arm macros.

* copy `libafl_qemu.h` in target directory.

* Merged all qemu_systemmode examples into one, settable with features.
Automatic building using `Makefile.toml`

* fix typo.

* added test of QEMU systemmode fuzzers.

* replace test by build for now.
2024-03-30 17:04:37 +01:00
Romain Malmain
44c841ffb1
WIP: QEMU exit handler (#1745)
* Added paging filtering.
Reworked address range filtering to fit with new generic code.

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Renamed sync breakpoint to sync exit.

* Split emu in systemmode.rs / usermode.rs for specific code.
EmuExitHandler implementation.

* sync_backdoor.rs removal.
Formatting.

* Updated `bindgen` and `which`.
Adapting code to work with update.

* fix: reconfigure cleanly if prior configure was interrupted abruptly.

* Enable sanitizers in QEMU during debug.

* Added target-usable files.

* Added breakpoint structure.

* Adapted other files to work with ExitHandler.

* Adapted existing fuzzer to work with new exit handler.

* fix: use get to avoid crashes.

* Updated README to indicate cargo-make should be installed.

* Added QEMU internal exit handler.

* Adapted qemu_systemmode example with new exit handler.

* Fixed fuzzers to work with new exit handler.

* Trying to fix CI (#1739)

* test

* dummy

* dummy

* Added new examples.

* Forgot to add build scripts.

* format

* format

* clang-format

* python emulator adaptation.

* fixed python bindings.

* clippy fixes.

* python bindings.

* fix qemu_sugar.

* fix fuzzbench.

* fixed import issues.

* misc fixes.

* renamed crate.

* Updated x86_64 stub bindings.

* Fixed static naming.

* binding fmt

* clippy

* clippy

* Removed useless return statement.

* removed advice to install cargo-make in individual repositories.

* symcc_update (#1749)

* Remove unused create_anymap_for_trait macro (fixes #1719) (#1752)

* Fix `as_object` UB discussed in #1748 (#1751)

* Fix as_object UB discussed in #1748

* More cleanup, more less UB

* Fix fixes

* Added uninit_on_shmem api

* clippy

* fmt

* trying to fix fuzzers, libfuzzer wrapper

* Add OwnedRefMit::owned constructor, libfuzzer fix

* Some more fixes

* Add BacktaceObserver::owned fn

* fmt

* more fmt

* Ignore SigPipe by default (#1741)

* Ignore SigPipe by default

* Fix no_std

* fmt

* Fix incorrect imports (#1758)

* Fix incorrect imports

https://doc.rust-lang.org/core/simd/trait.SimdOrd.html

* Fix

* Try fix ci

* Documentation fixes (#1761)

* Documentation fixes

* Fix InProcessExecutor url

* Update all urls to latest

* Miri ignores for M1 regex (#1762)

* Enabling DrCov on Windows (#1765)

* Enabling DrCov for Windows

* Dedup common code in scheduler (#1702)

* dedup common code in scheduler

* del eco

* fixing

* fix

* replace `Emulator::new_empty` by `Emulator::get` calls outside of `emu.rs` for safety. (#1763)

* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, and more (#1754)

* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, set_error_print_panic_hook

* Trying to fix #1753

* typo

* More fix

* Fix test?

* more testcase fixes

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Split emu in systemmode.rs / usermode.rs for specific code.
EmuExitHandler implementation.

* format

* format

* format

* Replace sync_exit with sync_backdoor.

* Rework command system.

* fix bad import.

* format.

* cargo fmt

* disable af-xdp as well to avoid linking errors.

* End of merging.

* format.

* Adaptation for usermode.

* format.

* injection support.

* usermode fixes.
format.

* clippy

* clippy + format

* Do not unwrap emu + format.

* fix: entry_point breakpoint

* inital commit.

* clippy

* tests

* clippy

* adapt example

* systemmode.

* renaming

* fmt

* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.

* merge continue.

* renamed modules as well.

* fixing merge.

* systemmode compiling.

* fmt

* fix early emulator drop.

* fmt

* fix cast to c_void of the wrong object.

* Added global enum for snapshot managers.
Some renaming.

* move things around.

* WIP: generic inclusion of QEMU Executor in exit handler.

* * Moved extern calls to `libafl_qemu_sys`
* Replaced old `Emulator` by `Qemu` and only kept C functions wrappers
* Now `Emulator` is for higher-level interactions with QEMU. Kept old functions for compatibility calling to `Qemu` functions
* A direct side effect of this slit is the removal of the `IsEmuExitHandler` trait dependency added in many parts of the code.
* Removed old dirty casting for `QemuExecutor` helpers and used the brand-new access to `QemuExecutorState` instead.
* Minor changes to `Qemu` and `Emulator` `get` methods for cleaner getters.

* Add missing `Qemu` function.

* Updated `qemu_systemmode` example.

* Adapted QEMU fuzzers + renaming.

* Fixed python.

* fix libafl_sugar with new implementation.

* fix dangling RefCell.
adapt new examples.
TODO: merge `libafl_systemmode.*` examples.

* clippy.

* fix more fuzzers.

* clippy.

* Implement `HasInstrumentationFilter` generically.
Updated `StdInstrumentationFilter` accordingly.

* Renamed breakpoint functions for QEMU.
`qemu.run()` handling.

* Removed OnceCell / RefCell in signature.
more explicit `MmapPerms` method names.

* minor code refactoring

* Emulator::run_handle refactoring

* deprecated Emulator functions calling directly to QEMU functions.

* IsSnapshotManager -> SnapshotManager

* IsEmuExitHandler -> EmuExitHandler + fmt

* Generic register when it makes sense.

* reverted IsSnapshotManager -> SnapshotManager because of a collision.

* fix syntax + clippy

* fmt

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: lazymio <mio@lazym.io>
Co-authored-by: Bet4 <0xbet4@gmail.com>
Co-authored-by: mkravchik <mkravchik@hotmail.com>
2024-03-22 18:03:29 +01:00
Dominik Maier
a0143d02a6
Rename OSError -> OsError and merge with redundant Error::File (#1944)
* OSError -> OsError

* Move File errors to io Errors

* Removing File errors

* fixes :)

* More format

* fix libfuzzer runtime
2024-03-18 08:46:48 +01:00
Stefan Zabka
fbd0d497d4
Refactor(build.rs): extract common code between branches (#1950) 2024-03-17 21:31:30 +01:00
Romain Malmain
b3ddab3bce
fix libafl_qemu_sys unnecessarily rebuilding. (#1938) 2024-03-14 18:25:19 +01:00
Dongjia "toka" Zhang
afa2965f3c
Remove some arguments from pre_exec/post_exec in ExecutorHook (#1933)
* refactor

* no std, fmt

* win mac

* state

* frida

* ctx

* trait bound

* clip
2024-03-13 18:49:09 +01:00
Romain Malmain
9b96149f6c
Do not build doc with all features. (#1928)
Add documentation about default features for documentation.
2024-03-12 23:08:37 +01:00
Dominik Maier
dd410c590a
Allow dyn in StagesTuple, add Current Testcase API, Untraitify Progress (#1915)
* Move into_vec to extra trait

* fix no_std

* First step towards stages tuples as vecs

* Allow dyn in StagesTuple, add Current Testcase API, un-traitify Progress, cleanups

* Move from generics to impl keyword, more replacements with better API

* rename fn

* Fix additional stages, more cleanup, rename progress to retries

* Fix more fixes

* Fixes

* Rename ProgressHelper -> RestartHelper

* Fix sugar, python, add perform_restartable

* fixes

* remove prelude bs

* rename to restart_progress_should_run

* more cleanup, remove tests I don't understand (sorry)

* fix docs

* more fix

* fix miri

* unsafe safety annotations

* more comments

* last docs

* Mixed_attributes only allowed for bindgen
2024-03-12 00:58:07 +01:00
Romain Malmain
e745401a39
Update QEMU version. (#1922)
* update QEMU version.

* clippy
2024-03-08 13:15:00 +01:00
Romain Malmain
55a300d508
Make executor state available to the harness V2 (#1900)
* inital commit.

* clippy

* tests

* clippy

* adapt example

* systemmode.

* renaming

* fmt

* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.

* renamed modules as well.
2024-03-05 19:28:46 +01:00
Dongjia "toka" Zhang
1a0e692f33
Print PID when you create a new Llmp Sender. (#1898)
* aaaa

* FMT

* adding std
2024-03-05 16:02:47 +01:00
Romain Malmain
d96a1426d5
Fix lint errors (#1909)
* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.
2024-03-05 14:16:26 +01:00
Dongjia "toka" Zhang
1a41e65a5b
Sancov based ngram & ctx implementation (#1864)
* ngram

* ctx

* push stuff

* passing cargo check

* save stuf

* add

* no default

* fuzzbench ready

* formatt

* aaaaaaaa

* adaptive map

* add all

* chg

* fix

* deleting stuff

* fmt

* clang18

* fuck

* save space

* fix?

* feature name

* fucking nightly only

* harness

* fix libafl_cc

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-03-01 13:59:13 +01:00
Addison Crump
7a4fb06d02
make nopstate public so that it can be used as reproducer (#1888) 2024-02-27 16:48:08 +01:00
Dominik Maier
263af87652
Less useless allocs for monitor display (#1874)
* Less useless allocs for monitor display

* More less String

* Lol who needs generics

* clippy

* remove &String
2024-02-19 21:15:11 +01:00
Dominik Maier
fafe8f5ce8
Fixing clippy some more (#1872)
* Fixing clippy some more

* more commit

* Git gud

* remove more useless imports
2024-02-19 16:46:06 +01:00
Dominik Maier
578a22a3d9
Revert "Companion patch to qemu-libafl-bridge #46 (#1830)" (#1865)
This reverts commit b999b4aac591818d4342773ff48e98f2896f141e.
2024-02-16 20:50:18 +01:00
Dominik Maier
0a995f241c
Cleanup Pointer Clippy Lints (#1861)
* Fix pointer clippy lints

* More clippy

* fix build

* fix
2024-02-15 16:31:18 +01:00
cube0x8
b999b4aac5
Companion patch to qemu-libafl-bridge #46 (#1830)
* fixing qemu-libafl-bridge #46

* cargo fmt

* updated QEMU revision

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2024-02-15 16:30:05 +01:00
Rubens Brandão
97a83aba3b
feature(libqasan): add strndup (#1860)
* feature(libqasan): add asprintf and vasprintf

* feature(libqasan): add asprintf and vasprintf to hotpatch

* feature(libqasan): add strndup
2024-02-15 16:13:46 +01:00
Rubens Brandão
d6d6a23f69
feature(libqasan): add asprintf and vasprintf (#1844)
* feature(libqasan): add asprintf and vasprintf

* feature(libqasan): add asprintf and vasprintf to hotpatch

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-02-15 13:56:35 +01:00
Romain Malmain
5151f1e35c
fix qemu linking error. (#1846)
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-02-15 00:29:33 +01:00
Dongjia "toka" Zhang
973c4358e6
clippy (#1851) 2024-02-13 13:19:00 +01:00
Rubens Brandão
40c8645ed3
Fix libafl_qemu libqasan Makefile (#1835)
* fix libafl_qemu libqasan Makefile

* remove make clean from libafl_qemu libqasan build

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2024-02-07 15:36:36 +01:00
Andrea Fioraldi
41d24ca375
Fix broken closure hooks in libafl_qemu (#1839)
* Fix broken crash hook

* fix hooks

* clippy

* pin
2024-02-07 15:03:27 +01:00
Romain Malmain
99a70e5771
Update qemu-libafl-bridge with upstream. (#1829)
QEMU update to v8.2.1
2024-02-05 14:24:02 +01:00
Rubens Brandão
241b93036e
Fix libafl_qemu hooks references (#1825)
* fix libafl_qemu hooks references

* restrict the fatptr transmutation
2024-02-02 21:52:58 +01:00
Rubens Brandão
c96d103b37
HookId trait and types in libafl_qemu (#1796)
* libafl_qemu fix remove_hook

* libafl_qemu specialize hooks into separated types

* libafl_qemu generalize HookState to allow any HookId implementation

* fmt: external C qemu hook functions

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2024-02-01 10:55:55 +01:00
Dominik Maier
244c6b0da5
QEMU: Fix injections build for hexagon, disable on system mode (#1821)
* Fix CI for Clippy, QEMU

* Clippy, fixes for system mode

* clippy

* clippy

* fixing new clippy
2024-01-30 04:25:14 +01:00
Dominik Maier
e7df233dc1
QEMU: add injections mode default (#1818) 2024-01-28 17:12:20 +01:00
Dominik Maier
0cb7b25f39
Replace static borrows with addr_of!, rust 2024 compatibility (#1800)
* Less UB

* fmt

* fix warning

* clippy fixes

* addr_of_mut allthethings

* removed duplicate import

* fix imports

* remove comment

* more windows

* fmt

* fix tests

* fixes

* qemu

* fix more cases, qemu

* fix

* fmt
2024-01-24 17:47:55 +01:00
Romain Malmain
a0e30d01d3
QEMU: safe linking of extern "C" declarations (#1810)
* safe linking initial commit

* Fix static declaration.

* Works also for static variables, even for thread-unsafe types.

* Remove warnings.

* fixed visibility for function.

* remove `rustversion` from dependencies.
2024-01-23 22:38:06 +01:00
Dongjia "toka" Zhang
2ac154d473
Refactor InProcessExecutor, merge timeout executors (#1789)
* move windows, inprocess fork to a different file, try new hook mechanism for the executor

* fix

* even more

* more

* more

* fix

* fix

* macosgit add -ugit add -u

* windows!

* windows!

* aa

* aa

* macos

* std

* wtf unresolved?

* Copy, Clone

* why you just don't have the same API!

* inproc

* next; inprocess

* windows?

* ci

* ci

* ci

* unused

* ci

* unused

* no_std

* windows no std

* fix

* inprocess

* fix

* windows

* fuzzers

* macos , book

* fix

* aa

* allow

* fix

* stop suggesting wrong lint AAAAAAAAAAAAAAAAA!!!

* stop suggesting wrong lint AAAAAAAAAAAAAAAAA!!!

* win

* fix

* wip

* wip2

* windows done?

* remove TimeoutExecutor

* ci

* ci

* miri

* fixfi

* compile on windows

* a

* clp

* no_std stuff

* windows no_std

* mac stuff

* m

* a

* ci

* ci

* deleting timeoutexecutor, gradually

* fucking macos

* ci

* test

* ci

* ci

* batch mode constructor

* fix

* ci

* aa

* miri

* aaa

* tmate again

* fix windows stuff

* final fix

* another win fix

* add

* let's add the new fix later

* more

* fi

* parse

* win clippy

* win no std

* safety

* fix

* DEFAULT

* final fix

* libafl_libfuzzer

* comments

* fix

* fix fuzzres

* fixxxxx

* fixxxxx

* last fix

* change name
2024-01-23 22:35:14 +01:00
2ac7874895 fix build 2024-01-16 15:53:57 +01:00
Dongjia "toka" Zhang
3ed231db69
Don't use assert fail when building on libafl_libfuzzer on windows (#1792)
* fix

* fix

* clippy

* clippy
2024-01-13 16:02:10 +01:00
van Hauser
0f2cf80085
libafl_qemu injections (#1743)
* nits

* first steps

* different approach

* fixes

* remove temps

* remove temp

* initial import

* more tests

* bug hunt

* cleanup

* yaml function target 0x.... support

* final

* update doc

* other work

* Clippy, fmt

* Removed lazystatic dependency

* More small cleanups

* optimize to_lowercase

* move funtionality to libafl_qemu

* add missing file

* ready

* remove qemu_injections

* move test files to test directory

* doc update

* add todos

* fixes

* add file comment

* add test and other platform support

* fix clippy

* Replace Emulator::new_empty by Emulator::get.
Fix visibility identifier.

* clippy

* let's try this

* cpu_target?

* fmt

* cleanup build system, enable missing fuzzers

* fix qemu_launcher

* enable hexagon in qemu_launcher

* Removed useless `any` predicate in cfg attribute.
Replaced wrong types in `syscall_hook` signature.

* format

* move to read_function_argument

* add hexagon injections support

* enable injections fuzzing everywhere

* unify error msg

* Fix build, add initial toml support

* intermediate push, wip

* fix build

* More WIP

* Fix build

* Clippy

* fix qemu

* Fix arm

* fix more wrong things

* fix testcase

* try to fix it again?

* more release?

* make makefile independent of dev/release

* trying more fix?

* More ugly more works

* more trying to fix the testcase

* allow yml as filename too

* more docs

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
Co-authored-by: Romain Malmain <romain.malmain@pm.me>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-01-09 19:56:19 +01:00