29 Commits

Author SHA1 Message Date
Marco C.
b9e6363826
Avoid using feature flags and env variable to set the same parameter pt.1 emulation_mode (#2512)
* Remove emulation_mode env variable and custom cfg

* Using only the feature flag simplifies things a bit and allow the usage of optional dependencies

* Do not use --all-features on libafl_qemu

* Add missing target_os = "linux"
2024-10-25 15:16:55 +02:00
Dominik Maier
684b31279e
Add BytesSubInput to mutate sub-parts of a bytes-backed input (#2220)
* Add BytesSubMutator that allows us to mutate sub-parts of a bytes-backed input

* no_std

* fix string mutator

* make build

* Fix clippy on macOS

* Docs

* More docs

* Better docs

* --amend

* Renamed bsi to sub_input. Too much BSI

* More more

* balance backticks

* Make splicing usable with sub_input (not that it makes sense)

* More annotations

* more input annotations?

* Implement HasMutatorBytes for &mut Vec

* clippy

* Use a wrapper type instead

* Add wrapper type for Vec as well

* Remove the duplicate BytesInput... lol
2024-05-22 01:50:07 +02:00
Addison Crump
614b149cae
Fix cfg uses across codebase (#2154)
* start fixup of cfgs

* whoops

* remaining issues

* maybe fixup macos

* apparently that is ios code?

* fix no_std

* Re-enable tcp_compression

* fix tcp broker

* remove tcp_debug flag

* fmt

* clippy

* less unwrap while we're at it

* doc

* add back pub star uses for libafl_qemu

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
2024-05-08 14:31:10 +02:00
Romain Malmain
bed500471a
QEMU generic memory iterator (#2148)
* QEMU generic memory iterator + Refactoring

* Generic Memory Iterator (systemmode only for now): It is now possible to iterator over memory ranges, independently of the address kind

* Refactoring or Emulator / Qemu structures: they are now handled separately in different files

* Refactoring of Exit Handlers: Result / Error structs have been clarified

* Simple handler for signals

* add new `check-cfg` calls for libafl qemu
2024-05-07 10:46:15 +02:00
Romain Malmain
a0e30d01d3
QEMU: safe linking of extern "C" declarations (#1810)
* safe linking initial commit

* Fix static declaration.

* Works also for static variables, even for thread-unsafe types.

* Remove warnings.

* fixed visibility for function.

* remove `rustversion` from dependencies.
2024-01-23 22:38:06 +01:00
Evan Richter
7150ffc5e6
[libafl_qemu] EasyElf::resolve_symbol return GuestAddr (#540)
Also enforce Linux support at the crate level instead of item by item
2022-02-16 21:34:56 +01:00
Andrea Fioraldi
63d89463a3
Improve libafl_qemu snapshots (#484)
* mprotect

* expose EnumIter

* thread safe mem snapshot

* update qemu hash

* clippy

* child helpers

* fixes

* fix build

* fix dep
2022-02-09 09:40:59 +01:00
Andrea Fioraldi
8870c50ff5 Do not build QEMU when generating docs 2022-01-10 11:27:53 +01:00
Andrea Fioraldi
e6f2f2d0b2 Merge branch 'main' of github.com:AFLplusplus/LibAFL into main 2022-01-07 11:53:54 +01:00
Andrea Fioraldi
181160d80b Clone only one specific commit on libafl_qemu build.rs 2022-01-07 11:53:34 +01:00
Evan Richter
9f76386668
[libafl_qemu] prevent unneeded build.rs runs (#441)
`libqasan/libqasan.so` never exists during a normal `cargo build` because the .so is built in the target_dir, not in the source directory. This was triggering cargo to rerun the build script every time a user of this library made an incremental change to their code.

pointing `rerun-if-changed` to a directory will make cargo rerun build.rs if any file in that directory changes.
2022-01-02 01:03:35 +01:00
Evan Richter
e47c3be3fd
[libafl_qemu] fix build.rs (#435)
I noticed qemu was only building on one core, so I debugged the jobs environment variable. Evidently cargo passes `CARGO_BUILD_JOBS` is passed to build.rs scripts as `NUM_JOBS`. Other env vars for build.rs can be found [here](https://web.mit.edu/rust-lang_v1.25/arch/amd64_ubuntu1404/share/doc/rust/html/cargo/reference/environment-variables.html#environment-variables-cargo-sets-for-build-scripts)
2021-12-29 01:30:14 +01:00
Andrea Fioraldi
6274ad4594
Refactor libafl_qemu creating the Emulator struct and post syscall hooks (#430)
* working without asan.rs

* working asan

* update fuzzers

* mremap in snapshot

* sugar

* python

* fix python

* clippy

* fmt

* fuck you loader
2021-12-23 09:10:13 +01:00
Andrea Fioraldi
785cddc1f0 Fix meson.build issue updating QEMU git hash 2021-12-21 12:42:41 +01:00
Andrea Fioraldi
208d69342d Update QEMU git hash 2021-12-21 11:35:06 +01:00
Dominik Maier
83583a867f
QEMU target arch selector via feature flag (#405)
* QEMU target arch selector via feature flag

* fix ci

* fixing ci some mmore

* more ci fixes, defaulting to x86_64 always

* more ci

* i368 -> i386 typo fix

* revert forkserver changes

* trying to fix clippy

* docs

* fixed warnings

* more clippy action

* qemu example arch

* bring back deprecated function I don't know how to replace

* get rid of deprecated feature again'

* builds?i
2021-12-06 20:06:47 +01:00
Andrea Fioraldi
c3ea7a042c Update QEMU bridge revision hash 2021-12-06 10:04:59 +01:00
Andrea Fioraldi
3ccf884d86 Hook cmp on arm/aarch64 in libafl_qemu 2021-11-19 14:37:59 +01:00
Andrea Fioraldi
d2fbc1040e
Qemu fixes and syscalls for every supported arch (#386)
* cpu_target

* report

* track mmap in x64 snapshots

* fixes in libafl_qemu and qemu bridge

* clippy

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-11-18 09:33:26 +01:00
Andrea Fioraldi
fd5e793e57
libafl_qemu cpu_target cfg (#383)
* cpu_target

* report

* track mmap in x64 snapshots
2021-11-17 12:50:10 +01:00
Andrea Fioraldi
00d38dc535
AddressSanitizer for libafl_qemu (#378)
* build libqasan

* asan runtime

* working simple asan

* init_with_asan

* fmt

* incomplete instr filter

* harden dealloc

* clippy
2021-11-16 13:53:28 +01:00
Andrea Fioraldi
87677be11d Update QEMU commit in libafl_qemu 2021-11-15 14:10:29 +01:00
Andrea Fioraldi
131483410f Update QEMU git hash 2021-10-04 10:44:55 +02:00
Andrea Fioraldi
91ce28deac
Python generic qemu hook (#314)
* python generic hook and value

* python generic hook
2021-10-01 17:10:35 +02:00
Andrea Fioraldi
a420eb0513
Qemu generic hooks (#313)
* generic hooks

* Fix generic hooks
2021-10-01 16:27:26 +02:00
Andrea Fioraldi
90928d3d97
Qemu Helpers and basic snapshotting (#310)
* store executor_ptr

* QemuHelpers

* working hooks and snapshot helper

* walk only the list of dirty pages on restore()

* mem hooks for snpashot

* brk snapshot

* snapshot method

* macos shit

* sugar and clippy
2021-10-01 12:17:28 +02:00
Andrea Fioraldi
21f88b58b5 Pylibafl 2021-09-27 14:09:15 +02:00
Andrea Fioraldi
1fde608145
Qemu as lib (#301)
* linking problems

* use shared lib

* ci

* clippy, ci fixegit pushs

* ingoring distclean result

* clippy

* clippy

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-09-24 13:22:33 +02:00
Andrea Fioraldi
d472a1242a
libafl_qemu (#211)
* empty libafl_qemu crate

* fuzzbench qemu fuzzer skeleton

* emu.run() works without bp

* working emu loop

* resolve elf symbols

* running Qemu fuzzer without coverage

* qemu fuzzer with edge coverage

* merge into inprocess::GLOBAL_STATE

* create QemuExecutor and remove QemuEmulator

* qemu hooks and persist edges mapping storing them in State

* windows fix

* add libafl_qemu to workspace

* windows fix

* some clippy

* clippy

* fix fuzzbench_qemu

* fix fuzzbench_qemu makefile

* fuck you macos
2021-07-08 15:21:14 +02:00