182 Commits

Author SHA1 Message Date
Dominik Maier
244c6b0da5
QEMU: Fix injections build for hexagon, disable on system mode (#1821)
* Fix CI for Clippy, QEMU

* Clippy, fixes for system mode

* clippy

* clippy

* fixing new clippy
2024-01-30 04:25:14 +01:00
Marco Vanotti
e6184936ce
Expose PCs table to map coverage bitmap entries to the corresponding code (#1812)
This table allows users to map between coverage bitmap entries and the
corresponding code in memory.
2024-01-25 16:51:13 +01:00
Dominik Maier
0cb7b25f39
Replace static borrows with addr_of!, rust 2024 compatibility (#1800)
* Less UB

* fmt

* fix warning

* clippy fixes

* addr_of_mut allthethings

* removed duplicate import

* fix imports

* remove comment

* more windows

* fmt

* fix tests

* fixes

* qemu

* fix more cases, qemu

* fix

* fmt
2024-01-24 17:47:55 +01:00
Dongjia "toka" Zhang
2ac154d473
Refactor InProcessExecutor, merge timeout executors (#1789)
* move windows, inprocess fork to a different file, try new hook mechanism for the executor

* fix

* even more

* more

* more

* fix

* fix

* macosgit add -ugit add -u

* windows!

* windows!

* aa

* aa

* macos

* std

* wtf unresolved?

* Copy, Clone

* why you just don't have the same API!

* inproc

* next; inprocess

* windows?

* ci

* ci

* ci

* unused

* ci

* unused

* no_std

* windows no std

* fix

* inprocess

* fix

* windows

* fuzzers

* macos , book

* fix

* aa

* allow

* fix

* stop suggesting wrong lint AAAAAAAAAAAAAAAAA!!!

* stop suggesting wrong lint AAAAAAAAAAAAAAAAA!!!

* win

* fix

* wip

* wip2

* windows done?

* remove TimeoutExecutor

* ci

* ci

* miri

* fixfi

* compile on windows

* a

* clp

* no_std stuff

* windows no_std

* mac stuff

* m

* a

* ci

* ci

* deleting timeoutexecutor, gradually

* fucking macos

* ci

* test

* ci

* ci

* batch mode constructor

* fix

* ci

* aa

* miri

* aaa

* tmate again

* fix windows stuff

* final fix

* another win fix

* add

* let's add the new fix later

* more

* fi

* parse

* win clippy

* win no std

* safety

* fix

* DEFAULT

* final fix

* libafl_libfuzzer

* comments

* fix

* fix fuzzres

* fixxxxx

* fixxxxx

* last fix

* change name
2024-01-23 22:35:14 +01:00
Dongjia "toka" Zhang
3ed231db69
Don't use assert fail when building on libafl_libfuzzer on windows (#1792)
* fix

* fix

* clippy

* clippy
2024-01-13 16:02:10 +01:00
Addison Crump
ba8ca6723b
Resumable stages redux (#1780)
* initial stage refactor

* repair test

* redqueen

* fixup python bindings

* docs and clippy fixes

* misc hidden changes

* Status => Progress

* fix remaining fuzzers

* fix libafl_libfuzzer

* implement resume for nested stages

* deep testing for stage resumeability

* refactor: use let-else, docfix

* refactor in fuzzbench_forkserver_cmplog

* fmt

* actually use progress

* HasStageStatus => HasCurrentStage
2024-01-09 15:18:14 +01:00
Gheorghiță Mutu
48c9fed2da
[libafl_targets] # fix typo in windows_asan feature (#1779) 2024-01-05 23:31:57 +01:00
Dongjia "toka" Zhang
0a72d8abbc
Add header (#1777)
* add

* rdm

* CHATGPT

* CHATDUMB

* different action

* no

* fix

* ci

* ci

* ci

* fuck

* dir

* checkout?

* ci

* ci

* ci

* ci

* ci

* ci

* ci

* ci

* ci

* ci

* ci

* ci

* ci

* ci

* don't use shit

* ci

* ci

* ci
2024-01-05 19:35:36 +01:00
Dongjia "toka" Zhang
75fcd47044
Recover useful CmpLog updates from #1630 (#1684)
* add

* ci

* wip

* make type name more clear

* last

* add

* more fix

* chg

* fmt

* save changes

* fix_handler

* cfg

* win

* fix

* toml

* f

* more

* fix all the stuff

* fix

* revert fuzzers/fuzzbench to origin/main
2024-01-03 23:44:32 +01:00
Dominik Maier
c93291ab57
Fix as_object UB discussed in #1748 (#1751)
* Fix as_object UB discussed in #1748

* More cleanup, more less UB

* Fix fixes

* Added uninit_on_shmem api

* clippy

* fmt

* trying to fix fuzzers, libfuzzer wrapper

* Add OwnedRefMit::owned constructor, libfuzzer fix

* Some more fixes

* Add BacktaceObserver::owned fn

* fmt

* more fmt
2023-12-22 16:49:01 +01:00
Rowan Hart
5d5ee40329
Add Features for C Targets (#1663)
* Allow disabling C targets for platforms that dont support them when using cmp observers

* Make sancov depend on coverage
2023-11-27 22:34:41 +01:00
Dongjia "toka" Zhang
903a242e3e
Fix unused import (#1691) 2023-11-22 21:04:05 +01:00
Dongjia "toka" Zhang
379e2ae89b
Scalability introspector + State refactor (#1674)
* check

* clippy fmt fixing all the stuff

* restore Cargo.toml

* a

* ci

* ci

* a

* a

* workging?

* work

* ?

* why it worksgit add -u

* ci

* ci

* TMATE

* ci

* ci

* ci

* remove tmate

* less

* fuck; let's try with introspection first

* fucking macro

* another windows shit

* stop it

* i'm harassed by how shit windows is

* fixing

* ci

* ziopera

* fix from main

* ci

* ci
2023-11-21 14:38:48 +01:00
Addison Crump
a278357ed9
Add whole-archive feature to libafl_targets (#1544)
* maybe fix linkage?

* fix hack CI

* interceptors

* do not call strstr and friends

* format

* whoops

* enforce nightly; fixup linkage by featuring interceptors

* skip libafl_libfuzzer in stable cargo hack check

* oops

* packed_bundled_libs is stablised
2023-11-20 10:38:17 +01:00
Andrea Fioraldi
cc1ebb29f7
Add CmpLog routines to LibAFL QEMU and various fixes (#1664)
* Add CmpLog routines to LibAFL QEMU and various fixes

* format

* fix

* fix read_function_argument

* fix

* multithread

* fix qemu fork

* fix

* clippy

* fix systemmode

* unused imports
2023-11-17 16:59:50 +01:00
Andrea Fioraldi
d7825851e9
Fix SimpleRestartingMonitor after restart (#1669)
* Fix SimpleRestartingMonitor after restart

* a

* a

* a

* a

* a

* a

* a

* a

* a

* ci

---------

Co-authored-by: toka <tokazerkje@outlook.com>
2023-11-16 20:06:27 +01:00
s1341
7acdeacae8
Allow compiling 32bit (#1666)
* Allow compiling for 32bit

* Fmt

* Clean up minibsod for 32bit

* fmt
2023-11-15 12:43:04 +01:00
Dominik Maier
8a18ee4ece
Add Android Ashmem stub header to libafl_targets forkserver.c (#1648)
* Add Android Ashmem stub header to libafl_targets forkserver.c

* clang-format
2023-11-04 17:48:02 +01:00
Dongjia "toka" Zhang
0b38fabeb0
CmpLog {Instruction, Switches} pass (#1612)
* switch and instruction pass copy paste

* FMT

* add cb

* put things in the functions

* fi

* working

* oops

* options

* no 128bit int on windows

* no 128bit on windows

* oops

* unix only

* windows

* PACKED

* let's stop using it, it's ugly

* fmt

* adjust

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-10-14 11:47:16 +02:00
Andrea Fioraldi
4c17da00b0
Clipped Fixxy (#1622)
* clippy fix

* fix

* fix

* it works

* imports
2023-10-11 21:19:30 +02:00
Andrea Fioraldi
35e387773c
Format C code (#1621)
* Add iter() to owned slice

* Format C
2023-10-11 14:19:14 +02:00
Dongjia "toka" Zhang
bc91436ef4
Refactor cmplog observers (#1603)
* refactor

* Rename Everything

* fmt

* chg

* test

* aa

* doc fix

* fix?

* doc
2023-10-06 15:22:11 +02:00
Dominik Maier
0bba8535b8
Tiny typo fix (#1611) 2023-10-06 01:11:23 +09:00
Dongjia "toka" Zhang
2ade1ee1f6
Bring back some checks (#1597) 2023-10-05 16:14:55 +02:00
Dongjia "toka" Zhang
fc16b70a65
Format C (#1602) 2023-10-03 13:40:19 +02:00
Dongjia "toka" Zhang
f35c59131d
Fix redundant area_is_valid() (#1594) 2023-10-02 13:44:42 +02:00
Dongjia "toka" Zhang
b20fda2a4a
Use /dev/urandom instead of /dev/null for probing valid memory (#1586) 2023-10-01 23:08:29 -05:00
Dongjia "toka" Zhang
583c84ab4e
cmplog routines update & fix (#1592)
* update

* runtime

* Update cmplog-routines-pass.cc (#1589)

* rtm

* fix

* no link rt

* fmt

* let's change script in another pr

* colon

* adjust the checks

* fix

* more fixes

* FMT
2023-10-01 23:06:34 -05:00
Dongjia "toka" Zhang
2474691623
Fix libjpeg fuzzer (#1582)
* Revert "Insert into corpus if feedback is_interesting on crash/timeout (#1327)"

This reverts commit 871dfa0a013f31f84e43e125105febca2f137049.

* unused
2023-09-30 18:34:08 +02:00
Addison Crump
8f6efe993d
Address recent clippy changes; build clippy in debug instead of release for perf (#1516) 2023-09-19 00:42:46 +02:00
Rowan Hart
8d8fcdd8db
Add generic cmp observer metadata, rename cmp observers, fix cmplogmap reset (#1461)
* Make cmp metadata generic, rename ForkserverCmpObservers with more accurate names

* Fix zeroed assignment in cmplogmap

* Dont use prelude in libafl_targets

* Make _mut functions actually return mut references

* Fix fuzzbench forkserver build

* Add type alias for easier construction of the standard cmp observer and add aux data accessors
2023-08-26 09:54:31 +02:00
Addison Crump
9aa40c0734
Document libafl_libfuzzer (#1457)
* prep for publishing libafl_libfuzzer

* learn to use linkers

* document-features

* special handling for fuzzbench builds

* Update cmplog.c

* drop dep for llvm-tools; add testcase for memcmp sanity

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-08-24 20:24:38 +02:00
Dominik Maier
9208531951
Move from intervalltree to meminterval dep (#1456)
* Move from intervalltree to meminterval dep

* fixes
2023-08-24 14:15:24 +02:00
Addison Crump
862de53cf6
Full libfuzzer shimming (for cargo-fuzz libfuzzer alternative and other use cases) (#981)
* squash libfuzzer edits

* fixup: compat with custom mutators

* use tui flag

* add introspection support

* use libfuzzer dep now that we've merged

* force input loading

* some fixes

* begin docs, impl shrink

* make whole-archive conditional and not default

* make more copies of counters maps

* lol, remember to add the observer

* make size edge map observer an observer

* fixup: make def of run driver conditional

* add sanity checks for insertion

* revert silencing of forks

* add experimental tmin support; add default asan flags

* use default options instead of specifying our own

* implement lockless mode

* fix merge

* fixup lockless corpus

* fixup for generalisation

* remove erroneous drop_in_place

* improve error logging in the case of corpus loading failure

* ok, use lock files 😔

* fix tmin

* implement merge (again); fix rare cases with maps being too small

* implement a scheduler for removing excess

* implement a walking strategy for corpus loading for large corpora

* revert filename parameter; rename and remove duplicates

* various cleanup and clippy satisfaction

* fix no_std tests

* clang-format

* expand and satisfy the clippy gods

* fix sanitizer_ifaces bindgen for no_std

* fix wasm fuzzer

* fixup clippy script

* rename and provide a small amount of explanation for sanitizer_interfaces

* fixup: HasLastReportTime

* fix clippy oddities

* restrict clippy checks to linux-only for libafl_libfuzzer_runtime

* name the mutators

* format

* fix clippy warning

* hope docker is fixed

* fix cmin lint

* clippy pass

* more docs

* more clippy

* fix remaining clippy complaints

* fix import

* miri fixes (no constructors executed)

* exclude libafl_libfuzzer from cargo-hack

* fix clippy check for sanitizer_interfaces

* fmt

* fix CI (?)

* deduplicate sancov 8bit for improved perf on ASAN

* merge 8bit coverage regions + comment out insane deduplication

* no erroring out on free hooks

* fixup for non-forking merge

* skip the corpus dir if we use it

* fixup: recent libafl changes and feature flags

* libafl_libfuzzer: use rust-lld for whole-archive feature

* clarify cause of failure

* mark unsafe

* clippy :cursed_cowboy:

* attempt to fix wasm

* spooky unknowable bug 👻

* more clippy lints

* clippy fix for merge

* use the version pin

* add unsafe to ::register

* Serdeany autoreg fix

* make type assert actionable

* miri fixes

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dominik Maier <dmnk@google.com>
Co-authored-by: Mrmaxmeier <Mrmaxmeier@gmail.com>
2023-08-24 13:30:23 +02:00
Dominik Maier
f68fe95f09
Document features (#1453)
* Document features

* Fix doctest

* remove link

* <<<<head

* Fix doc links
2023-08-24 13:27:37 +02:00
Dominik Maier
e9e9c457d6
Move Bolts to libafl_bolts (#1335)
* sort memebers

* Building bolts

* fixing python, feature flags

* Cleanup bolts Cargo.toml

* Fix tests

* cleanup libafl

* removed duplicate examples

* Info text

* reenable agpl CI

* fix impl_serdeany

* new fmt

* Moved bolts

* fix some builds

* fix

* fix more fixes

* serdeany

* no_std

* Dependency cleanup

* Fix docs

* Docker

* add python bolts bindings

* no_std test fix

* merge fail

* typo fix

* add bolts dependency to fuzzers

* tiny fixes

* merge fun

* clippy

* link no longer exists

* make sure python gets rebuilt

* fix pybind

* doc fix

* remove bolts ref

* LibAFL bolts

* More info

* deprecation notice for launcher

* fix python

* cargo fmt

* fix concolic

* fix

* clippy

* fix libafl_cc

* fix tutorial, clippy

* fix concolic fuzzer

* fix push_stage_harness fuzzer

* prelude

* fix testcase post-merge

* mute clippy
2023-08-02 17:36:26 +02:00
WorksButNotTested
2002bbca35
Arch independent helpers in libafl_qemu (#1355)
* Add more features to libafl_qemu to remove some of the heavy lifting from the fuzzers

* Refactor qemu_coverage

* Minor tweaks to fix other fuzzers

* Autofix

* Add CallingConvention to write_function_argument

* Replay reverted clippy fixes

---------

Co-authored-by: Your Name <you@example.com>
2023-07-11 10:56:40 +02:00
Dongjia "toka" Zhang
109755208e
Revert "Make harness function take mut ref (#1338)" (#1358)
This reverts commit fe6daecf0bb178cd19970ae81c797443fd8cd88f.
2023-07-10 17:33:26 +02:00
Rowan Hart
fe6daecf0b
Make harness function take mut ref (#1338)
* Change executor trait to allow \&mut Input

* Add mut inprocess executor

* Add mut inprocess executor

* Format and fix clippy errors

* Fix more clippy errors

* Revert accidental refactoring of InMemoryCorpus

* Add mut versions of all executors that can support it

* Do not persist possible testcase mutation in stages, shadow/differential executors, or corpus minimization

* Fix missing imports

* Fix executor type for missed qemu items

* Add re-exports for mut executors

* Use InProcessForkExecutorMut in QemuForkExecutorMut

* Update BytesInput harnesses to take mutable references

* Update other-input-type-taking harnesses to take mut references

* Clippy fixes

* Feature gate TryFromIntError import

* Fix missed harness input type in baby_fuzzer

* Fix additional clippy issues

* Fix unnecessary hashes on string literal

* Even MORE clippy fixes

* Fix one more clippy issue

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-07-10 13:06:38 +02:00
s1341
871dfa0a01
Insert into corpus if feedback is_interesting on crash/timeout (#1327)
* Insert into corpus if feedback is_interesting on crash/timeout

* Use correct import for HasExecutions

* Windows add missing import

* QemuExecutor add HasFeedback

* Windows asan fix

* Add missing call to scheduler.on_add

* Add missing HasExecutions for windows frida

* QemuExecutor missing HasScheduler

* QemuExecutor missing HasCorput
2023-06-28 23:53:51 +02:00
Rowan Hart
5a6d683fed
Add an observer for COUNTERS_MAPS for 8-bit SanCov (#1283)
* Add sancov multimap observer to sancov_8bit target

* Undo autofmt of Cargo.toml

* Fix formatting

* Fix import errors under no-default-features, add Safety to counters_maps_observer

* Make observer function no_mangle to allow it to easily be used in a staticlib crate

* Make clippy happy by using export_name instead of no_mangle

* Add observers feature flag and hide counters maps observer behind it

* Fix formatting
2023-05-23 23:31:07 +02:00
Dongjia "toka" Zhang
5b02fb420d
Fix CI (#1241) 2023-05-02 17:38:56 +02:00
Michael Rodler
95d1069393
Use sancov_8bit.rs for OwnedMutSlice (#1235)
Co-authored-by: Michael Rodler <mrodler@amazon.de>
2023-05-02 14:41:33 +02:00
Dominik Maier
bbe4e85768
Removed new_ from constructors that don't need it (API consistency) (#1159)
* Removed new_ from constructors that don't need it (API consistency)

* un-change python bindings
2023-03-17 17:02:21 +01:00
Dongjia "toka" Zhang
4d778dd64d
Fix fuzz_level related thing, separate on_replace/on_remove from Scheduler & various fixes (#1119)
* delete HasFuzzedCorpusId

* more

* fmt clp

* aa

* fixing

* delete

* a

* append parent id when Objective

* add HasCorpus inprocss executor

* ecofuzz, delete was_fuzzed, update fuzz_level

* fix

* RemovableScheduler for Tunable, Queue, Weighted

* clp

* no std

* import

* on_execution

* fix

* win

* fmt

* fix

* revert to on_evaluation and propogate in the accounting scheduler

* fix

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-03-08 19:43:32 +01:00
Dominik Maier
31357aa7e2
Track parent testcase id, tuneable stage probabilistic settings (#1081)
* Added local event handlers

* clippy

* move tuned mutator to pow2

* Tunable updates

* parent ids

* no_std, etc

* windows

* remove local event manager handler

* maybe fix win

* win:

* win docs

* docs

* ASAN -> ASan
2023-02-28 16:36:04 +01:00
Dongjia "toka" Zhang
59bf118a5a
Clippy (#1105) 2023-02-28 01:08:19 +09:00
Elsa Granger
44b69666da
Fix fuzzbench build (#1004)
* Fix -z,defs handle

* Add libfuzzer_no_link_main option in libfuzzer

* Use libfuzzer_no_link_main for fuzzbench

* no_link_main feature

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-02-15 11:58:32 +01:00
Dongjia "toka" Zhang
f9dd67b59b
Comment Fix 2023-01-31 19:40:58 +09:00
Dongjia "toka" Zhang
9458549fef
Remove declare -A (#976)
* fix

* fix

* debug

* debug

* older version

* newer version

* fix

* unix?

* fix
2022-12-30 02:02:38 +09:00