52 Commits

Author SHA1 Message Date
Dongjia "toka" Zhang
c12c6f31e2
Change fuzzbench_qemu fuzzer (#2520)
* change fuzzbench_qemu

* real test

* fix qemu crash hook

* update bindings

* fix fork executor, reduce trait bound overhead

* make EdgeModule depend on observer to get ptrs.

* do not make EdgeCoverageModule::new public

* map observer as builder call

* adapt examples with new edge coverage module builder.

* TMP: everyone is a variable length map observer

* reuse profile path script

* fix absolute paths

* remove some dependencies to make pipeline faster

* compile-time builder initialization check

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-10-08 15:18:13 +02:00
Dominik Maier
1fafaf6454
Make every Builder ::builder(), so BobTheBuilder::new() becomes BobThe::builder() (#2242)
* Make every builder ::builder()

* Fix no_std

* More

* Fix clippy, stuff

* More fun

* Make NopShMem do something

* Alloc

* more fmt

* Remove UB in tinyinst executor builder

* Make builder order not matter for tinyinst

* More better

* fix

* docs

* fmt

* more fmt

* clippy

* fix fixes

* tiny thing

* more betterg

* more more

* more builder

* more builder

* more nyx

* undo breaking clippy

* clip
2024-05-23 18:56:39 +02:00
s1341
19087f3dab
Windows frida support (#1607)
* WIP: windows frida

* frida-windows: fix hooks not present on windows

* windows: allow building using cargo xwin

* frida-windows: fmrt

* frida-windows: cleanup and allow asan/drcov on windows

* frida-windows: fmt

* frida-windows: fix clippy

* frida-windows: handle unknown exceptions gracefully

* frida-windows: rework shadow mapping algo

* frida-windows: add hook functions

* frida-windows: hook functions; fix stack register

* minibsod: enable for windows

* check_shadow: fix edge casees

* asan_rt: rework and add hooks for windows

* inprocess: add minibsod on windows

* Fix warnings

* minibsod: disable test on windows

* WIP: HookRuntime

* Cleanup after merge

* Bump frida-gum version

* Fix conflict marker; update frida

* Make winsafe windows-specific

* Fmt

* Format

* Better detection of clang++ (using cc)

* Make AsanErrors crate public so we can use it in tests

* Add helper to get immediate of operand

* Use HookRuntime to hook asan functions

Tests now passing

* fmt

* Implement recurisve jmp resolve

* Fix reversed logic

* windows_hooks: Don't die if functions are already replaced

* Allow utils to work on windows

* Enable allocator hooking on windows

* Warnings; add trace to free

* Make ASAN tests run windows (with cargo xwin compilation)

* Fmt

* clang-format

* clang-format

* Add more tests

* Fix partial range access bug in unpoisoning/shadow_check

* Merge main

* Fix check_shadow and implement unit tests

* Fix hooking and PC retrieval

* WIP: Working gdiplus fuzzing with frida-ASAN, no false positives

* LibAFL Frida asan_rt and hook_rt fixes for frida_windows (#2095)

* Introduce aarch64

* MacOS fix - MemoryAreas is broken on MacOS and just loops

* Introduce working aarch64 ASAN check

* Implement large blob

* Fix hook_rt for arm64

* Fix poison/unpoison

* Fix shadow check

* Update x86-64

* Fix aarch64 unused import

* Remove extraneous println statement

* merge main

* Fixes

* alloc: add tests, pass the tests

* HookRuntime before AsanRuntime, and don't Asan if Hooked

* hook_rt: Fixes

* Frida windows check shadow fix (#2159)

* Fix check_shadow and add additional tests

* add some additional documentation

* Revert to Interceptor based hooks

* fixes

* format

* Get rid of hook_rt; fixes

* clang-format

* clang-format

* Fix with_threshold

* fixes

* fix build.rs

* fmt

* Fix offset to RDI on stack

* Fix clippy

* Fix build.rs

* clippy

* hook MapViewOfFile

* fmt

* fix

* clippy

* clippy

* Missing brace

* fix

* Clippy

* fomrrat

* fix i64 cast

* clippy exclude

* too many lines

* Undo merge fails

* fmt

* move debug print

* Fix some frida things

* Remove unused frida_to_cs fn for aarch64

* name

* Don't touch libafl_qemu

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Sharad Khanna <sharad@mineo333.dev>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dominik Maier <dmnk@google.com>
2024-05-14 10:45:56 +02:00
Addison Crump
614b149cae
Fix cfg uses across codebase (#2154)
* start fixup of cfgs

* whoops

* remaining issues

* maybe fixup macos

* apparently that is ios code?

* fix no_std

* Re-enable tcp_compression

* fix tcp broker

* remove tcp_debug flag

* fmt

* clippy

* less unwrap while we're at it

* doc

* add back pub star uses for libafl_qemu

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
2024-05-08 14:31:10 +02:00
Dongjia "toka" Zhang
e8cc1ba93d
Revert "Revert splitting libafl_edges_map_max and libafl_edges_map_in_use" (#2082)
* Revert "Revert splitting libafl_edges_map_max and libafl_edges_map_in_use (#2…"

This reverts commit c68b3816fb680b635f99c337f78185e699864705.

* all

* more
2024-04-19 19:03:58 +02:00
Dongjia "toka" Zhang
c68b3816fb
Revert splitting libafl_edges_map_max and libafl_edges_map_in_use (#2079)
* fix

* aa

* push

* fix

* fmt
2024-04-19 13:24:25 +02:00
Dongjia "toka" Zhang
c50af44099
Split edges_map_size and edges_map_size_alloc (#2012)
* two sizes

* rename

* build.rs

* rename

* capital

* FMT

* macro

* fuck

* fff
2024-04-17 17:58:08 +02:00
Romain Malmain
d96a1426d5
Fix lint errors (#1909)
* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.
2024-03-05 14:16:26 +01:00
Dongjia "toka" Zhang
1a41e65a5b
Sancov based ngram & ctx implementation (#1864)
* ngram

* ctx

* push stuff

* passing cargo check

* save stuf

* add

* no default

* fuzzbench ready

* formatt

* aaaaaaaa

* adaptive map

* add all

* chg

* fix

* deleting stuff

* fmt

* clang18

* fuck

* save space

* fix?

* feature name

* fucking nightly only

* harness

* fix libafl_cc

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-03-01 13:59:13 +01:00
Dominik Maier
244c6b0da5
QEMU: Fix injections build for hexagon, disable on system mode (#1821)
* Fix CI for Clippy, QEMU

* Clippy, fixes for system mode

* clippy

* clippy

* fixing new clippy
2024-01-30 04:25:14 +01:00
Dominik Maier
0cb7b25f39
Replace static borrows with addr_of!, rust 2024 compatibility (#1800)
* Less UB

* fmt

* fix warning

* clippy fixes

* addr_of_mut allthethings

* removed duplicate import

* fix imports

* remove comment

* more windows

* fmt

* fix tests

* fixes

* qemu

* fix more cases, qemu

* fix

* fmt
2024-01-24 17:47:55 +01:00
Dongjia "toka" Zhang
bb443027f7
Observer fix (#1807)
* fix

* Increase default edgemap size for libafl_cc and libafl_targets (#1798)

* fmt

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
2024-01-24 03:30:22 +01:00
Dongjia "toka" Zhang
df8fa71aa7
Revert "Increase default edgemap size" (#1803) 2024-01-18 14:58:29 +01:00
Dongjia "toka" Zhang
c240cdec38
Increase default edgemap size for libafl_cc and libafl_targets (#1798) 2024-01-14 01:25:22 +01:00
Dongjia "toka" Zhang
75fcd47044
Recover useful CmpLog updates from #1630 (#1684)
* add

* ci

* wip

* make type name more clear

* last

* add

* more fix

* chg

* fmt

* save changes

* fix_handler

* cfg

* win

* fix

* toml

* f

* more

* fix all the stuff

* fix

* revert fuzzers/fuzzbench to origin/main
2024-01-03 23:44:32 +01:00
Rowan Hart
5d5ee40329
Add Features for C Targets (#1663)
* Allow disabling C targets for platforms that dont support them when using cmp observers

* Make sancov depend on coverage
2023-11-27 22:34:41 +01:00
Addison Crump
a278357ed9
Add whole-archive feature to libafl_targets (#1544)
* maybe fix linkage?

* fix hack CI

* interceptors

* do not call strstr and friends

* format

* whoops

* enforce nightly; fixup linkage by featuring interceptors

* skip libafl_libfuzzer in stable cargo hack check

* oops

* packed_bundled_libs is stablised
2023-11-20 10:38:17 +01:00
s1341
7acdeacae8
Allow compiling 32bit (#1666)
* Allow compiling for 32bit

* Fmt

* Clean up minibsod for 32bit

* fmt
2023-11-15 12:43:04 +01:00
Dongjia "toka" Zhang
bc91436ef4
Refactor cmplog observers (#1603)
* refactor

* Rename Everything

* fmt

* chg

* test

* aa

* doc fix

* fix?

* doc
2023-10-06 15:22:11 +02:00
Dongjia "toka" Zhang
f17e49e9aa
Remove warnings (#1609)
* two falgs

* UNIX ONLY FLAGS

* moa

* FMT
2023-10-05 15:25:55 +02:00
Addison Crump
0b889312ae
mac forkserver linkage fix (#1503) 2023-09-14 12:52:29 +02:00
Addison Crump
9aa40c0734
Document libafl_libfuzzer (#1457)
* prep for publishing libafl_libfuzzer

* learn to use linkers

* document-features

* special handling for fuzzbench builds

* Update cmplog.c

* drop dep for llvm-tools; add testcase for memcmp sanity

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2023-08-24 20:24:38 +02:00
Addison Crump
862de53cf6
Full libfuzzer shimming (for cargo-fuzz libfuzzer alternative and other use cases) (#981)
* squash libfuzzer edits

* fixup: compat with custom mutators

* use tui flag

* add introspection support

* use libfuzzer dep now that we've merged

* force input loading

* some fixes

* begin docs, impl shrink

* make whole-archive conditional and not default

* make more copies of counters maps

* lol, remember to add the observer

* make size edge map observer an observer

* fixup: make def of run driver conditional

* add sanity checks for insertion

* revert silencing of forks

* add experimental tmin support; add default asan flags

* use default options instead of specifying our own

* implement lockless mode

* fix merge

* fixup lockless corpus

* fixup for generalisation

* remove erroneous drop_in_place

* improve error logging in the case of corpus loading failure

* ok, use lock files 😔

* fix tmin

* implement merge (again); fix rare cases with maps being too small

* implement a scheduler for removing excess

* implement a walking strategy for corpus loading for large corpora

* revert filename parameter; rename and remove duplicates

* various cleanup and clippy satisfaction

* fix no_std tests

* clang-format

* expand and satisfy the clippy gods

* fix sanitizer_ifaces bindgen for no_std

* fix wasm fuzzer

* fixup clippy script

* rename and provide a small amount of explanation for sanitizer_interfaces

* fixup: HasLastReportTime

* fix clippy oddities

* restrict clippy checks to linux-only for libafl_libfuzzer_runtime

* name the mutators

* format

* fix clippy warning

* hope docker is fixed

* fix cmin lint

* clippy pass

* more docs

* more clippy

* fix remaining clippy complaints

* fix import

* miri fixes (no constructors executed)

* exclude libafl_libfuzzer from cargo-hack

* fix clippy check for sanitizer_interfaces

* fmt

* fix CI (?)

* deduplicate sancov 8bit for improved perf on ASAN

* merge 8bit coverage regions + comment out insane deduplication

* no erroring out on free hooks

* fixup for non-forking merge

* skip the corpus dir if we use it

* fixup: recent libafl changes and feature flags

* libafl_libfuzzer: use rust-lld for whole-archive feature

* clarify cause of failure

* mark unsafe

* clippy :cursed_cowboy:

* attempt to fix wasm

* spooky unknowable bug 👻

* more clippy lints

* clippy fix for merge

* use the version pin

* add unsafe to ::register

* Serdeany autoreg fix

* make type assert actionable

* miri fixes

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dominik Maier <dmnk@google.com>
Co-authored-by: Mrmaxmeier <Mrmaxmeier@gmail.com>
2023-08-24 13:30:23 +02:00
Elsa Granger
44b69666da
Fix fuzzbench build (#1004)
* Fix -z,defs handle

* Add libfuzzer_no_link_main option in libfuzzer

* Use libfuzzer_no_link_main for fuzzbench

* no_link_main feature

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-02-15 11:58:32 +01:00
Dominik Maier
68fbfc8914
Fix Clippy (#926)
* Fix clippy

* undo comment fmt

* add unstracked nyx files to gitignore

* fix

* windows, no_std

* fix

* fix

* more

* macos

* remove doctest

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2022-12-06 00:05:42 +09:00
Dongjia "toka" Zhang
93d99beecf
[Windows] Setup ASAN death callback (#908)
* step 1

* i forgot to change this

* add handler

* doc

* fmt

* move to libafl_targets

* fix

* windows

* clp

* fix

* clp

* cfg

* fix

* clp

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2022-12-04 18:56:56 +01:00
David CARLIER
f7f6392a4b
forkserver support attempt on freebsd (#898)
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2022-11-18 07:14:15 +09:00
Andrea Fioraldi
31077765de
Fix CI (#862)
* Autofix with new clippy

* Clippy
2022-10-26 09:41:08 +02:00
Dominik Maier
94f0c7f56e
Moving to named parameters in format strings (#827)
* autofix

* you're just asking for a clamping

* autofmt on linux

* fix nits

* change back nit

* unfixing as u64 for GuestAddr

* fix

* ignoring clippy for GuestAddress
2022-10-11 13:45:01 +02:00
Andrea Fioraldi
e7e82af52c
C forkserver logic in libafl_targets (#650)
* C forkserver logic in libafl_targets

* fix, enabled apple

* disable apple

* fixes

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-05-31 14:56:59 +02:00
Andrea Fioraldi
f527aab15e
Non weak default sanitizers options functions (#519) 2022-02-03 10:44:23 +01:00
Andrea Fioraldi
dd002a081b
Implement coverage accounting (BB metric atm) (#507)
* bb accounting llvm pass

* bb metric

* accoutning corpus scheduler

* fix warnings

* alloc

* clippy

* fix dockerfile

* clippy

* coverage accounting example

* finish CoverageAccountingCorpusScheduler

* fmt

* --libs in llvm-config

* merge
2022-02-01 14:08:38 +01:00
Dominik Maier
6810e6085b
Builder for CommandExecutor & Tokens Refactoring (#508)
* builder for CommandExecutor

* tokens api cleanup, clippy

* fix doctest

* cleanup

* added testcase, remodelled

* command executor builder fix

* fix fuzzer(?)

* implemented From for configurator

* nits

* clippy

* unused

* autotokens

* cleanup

* nits

* Err instead of empty tokens

* fix tokens fn

* fix err

* more error fixing

* tokens remodelling

* typo

* recoverable fail on missing autotokens

* clippy, nostd

* asslice, into_iter, etc. for tokens

* adapt fuzzers

* iter

* fixes, clippy

* fix

* more clippy

* no_std

* more fix

* fixed typo

* cmd_executor builds again

* bring back ASAN stuff to Command Executor

* forkserver speedup

* no need to static

* back to earlier
2022-02-01 10:10:47 +01:00
Andrea Fioraldi
2fb1c3520a
More LLVM passes from AFL++ (#394)
* afl coverage pass

* working ctx coverage

* MAYBE_THREAD_LOCAL

* doh

* fix for msvc

* ci

* clippy

* atheris

* thread_local
2021-12-01 13:27:39 +01:00
Andrea Fioraldi
54ac57b6f7 Default ASan options from AFL++ in libafl_targets 2021-09-27 15:24:35 +02:00
Dominik Maier
3db1765537 cleanup 2021-08-26 19:25:48 +02:00
Andrea Fioraldi
8056cbe5cb Weak main to link non-fuzzing targets 2021-06-28 11:41:04 +02:00
Andrea Fioraldi
5b54f0f068
Llvm passes (#185)
* enable llvm passes in libafl_cc

* cmplog rtn pass in fuzzbench fuzzer

* improve libafl_cc

* silence fuzzbench compiler wrapper

* instrumentation and runtime for rtn cmplog

* fix test

* fix test

* fuck clippy

* remove anon union in CmpLogMap

* windows.h

* remove libafl_targets_cmplog_wrapper

* no inline linking

* adapt fuzzers/
2021-06-23 09:38:15 +02:00
Andrea Fioraldi
6c926c4841 Clippy go brrr 2021-06-18 10:02:44 +02:00
Andrea Fioraldi
5d49933a23 Fix libafl_targets 2021-06-17 10:55:12 +02:00
Andrea Fioraldi
1ea8442478 Set maps size at compile time with env vars 2021-06-17 10:36:27 +02:00
Andrea Fioraldi
397a43c5d3 update build.rs for libafl_targets 2021-06-08 09:53:58 +02:00
Andrea Fioraldi
acc5ed42a2
Basic CmpLog (#113)
* libafl_targets: refactor sancov trace-pc

* cmp observer

* libaf_targets: new structure to isolate sancov

* fix C warning

* combined executor

* cmp observer and feedback

* I2SRandReplace mutator

* impl CmpMap for CmpLogMap in libafl_targets

* cmplog observer

* clippy

* TracingStage

* working random cmplog mutations

* enable cmplog for libfuzzer_stb_image

* re-enable new testcase stats print

* fix update stats display

* bump 0.3.1

* clippy

* clippy

* no clippy for fuzzers/

* fix

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-05-20 14:05:20 +02:00
Andrea Fioraldi
15917fa189 format 2021-04-12 15:26:59 +02:00
Andrea Fioraldi
5846aa2292 cmplog runtime 2021-04-12 15:26:32 +02:00
Dominik Maier
8577d5c6a0 clippy fixes 2021-04-07 11:30:03 +02:00
Andrea Fioraldi
1c9ea4138e format 2021-03-29 19:49:24 +02:00
Andrea Fioraldi
bd9aa89753 libfuzzer_libmozjpeg readme 2021-03-29 16:07:56 +02:00
Andrea Fioraldi
1f7be63031 value profile in libafl_targets 2021-03-26 17:53:47 +01:00
andreafioraldi
3b625981fa do not enforce clang in libafl_targets 2021-03-26 11:46:50 +01:00