806 Commits

Author SHA1 Message Date
Dongjia "toka" Zhang
9e88e5734e
Timeout executor cfg fix (#1088)
* fix

* fix

* fix from mac

* fix

* fix

* fix

* ?

* fix
2023-02-22 10:20:11 +09:00
Addison Crump
b7296db406
Fix exits which may cause double-free corruption (#1086) 2023-02-21 07:34:16 +09:00
Addison Crump
bdac876dd4
Mutator sampling probability fixes (#1030)
* fixes for standard mutations

* more mutation updates for sampling probability, tests

* slight doc fix

* clippy gripe

* clippy fixes

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-02-16 17:29:57 +01:00
Michael Rodler
46b75747ef
Make sure input was loaded to avoid panic on unwrap in MutatedTransform (#1077)
* make sure input was loaded to avoid panic on unwrap
fixes issue #1059

* avoid unnecessary clone, avoid unnecessary branching

---------

Co-authored-by: Michael Rodler <m@mrodler.eu>
Co-authored-by: Addison Crump <addison.crump@cispa.de>
2023-02-16 17:29:33 +01:00
Addison Crump
f454d17482
CMin: don't add to map if it's the initial value (uninteresting) (#1078) 2023-02-16 17:28:49 +01:00
Dongjia "toka" Zhang
8bffd28b4c
fix (#1076) 2023-02-16 10:29:24 +09:00
Dongjia "toka" Zhang
e7ef6ae8b7
Forkserver: 1. Add mem barrier 2. Don't send the initial 4 bytes message when it uses dynamic map option only (#1073)
* fix

* Real fix

* a
2023-02-16 09:42:28 +09:00
Addison Crump
26aace6073
Fix grimoire when used with on_replace/on_remove (#1075) 2023-02-16 00:14:26 +01:00
Addison Crump
e42cd9c12f
Fixes for on_replace/on_remove and related for StdFuzzer and MapFeedback (#1067)
* scheduler replace fixes

* oops, no-std

* add

* changes on the fuzzers

* move map feedback history updates to append_metadata

* fixes for python bindings

* learn to clippy

* fix for fuzzer add_input

* clippy fixes for frida

* additional powersched differences

* corrections for bitmap_size

* off-by-one

* I live in a prison of my own creation and clippy is the warden

* clear the novelties map for the situation where is_interesting is invoked, but not append_metadata

---------

Co-authored-by: tokatoka <tokazerkje@outlook.com>
2023-02-15 17:04:18 +01:00
radl97
e61ac10656
Fix StdErrObserver not implementing needed traits (#1072) 2023-02-15 12:39:23 +01:00
Vincent
71d367af30
TimeObserver: Use Instant::now instead of Duration (#1064)
* Use Instant::now instead of duration

* Use Some

* add custom serde for Instant

* fix linter

* only enable TimeFeedback when std flag is enabled

* fix typo

* fix linter std

* cargo fmt

* allow clippy::trivially_copy_pass_by_ref on custom serde serialize function

* allow TimeObserver and Timefeedback for no_std

* cargo fmt

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-02-15 12:38:25 +01:00
David CARLIER
fb0d3b07ea
MiniBSoD: solaris on amd64 implementations (#1068) 2023-02-15 12:27:45 +01:00
Fabian Freyer
53dba5f49d
Use the log facade instead of println (#1060)
* switched a couple of println / dbg statements to use log crate
* Use pyo3-log for logging in python bindings
2023-02-14 10:01:51 +01:00
Dongjia "toka" Zhang
bd2de16b4e
Colorization stage (#1039)
* type_replace

* separate

* more

* heap

* comment

* f

* fix

* clp

* need rev

* comment

* ColorizationTracingStage

* get_raw_map_hash_run

* process_execution

* metadat

* unused TE

* resolve type errors

* remove colorizationtracingstage

* Finally compiles

* clp

* fmt

* a few debug println

* revert

* fix
2023-02-13 15:02:19 +09:00
Dongjia "toka" Zhang
4d78878c02
Send stability in calibration stage & FridaInstrumentationHelper retunrs Result<Self, Error> (#1056)
* fix

* fix

* clippy
2023-02-13 05:35:09 +09:00
Dongjia "toka" Zhang
b7a0b823c6
Fix frida_gdiplus (#1045)
* fix

* I don't like prelude

* clp

* cargo make test

* poc

* one to_vec()

* fix?

* del

* fix
2023-02-08 00:20:38 +09:00
Andrea Fioraldi
0173d722c6
Fix typo in directory visiting (#1050) 2023-02-07 10:47:36 +01:00
Dongjia "toka" Zhang
30e296968b
Rename LLMP Timeout message, increase timeout (#1048)
* rename

* Update llmp.rs

* Print every 30 seconds only

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
2023-02-06 16:42:14 +01:00
Langston Barrett
4e15be182e
Increase default initial capacity of NewHashFeedback (#1049) 2023-02-06 15:50:26 +01:00
R. Elliott Childre
4d5a759955
Update deps for libafl (#1042)
Reduces total number of packages from 577 to 571 on building with:
`cargo +nightly build --workspace --all-features`

* ahash 0.7 -> 0.8
  * Move `AHasher::new_with_keys` to `RandomState::with_seeds` given the
    recommendation from: aHash maintainer:
    https://github.com/tkaitchuck/aHash/issues/132#issuecomment-1288207069

* bindgen: 0.61 -> 0.63

* c2rust-bitfields: 0.3 -> 0.17

* criterion: 0.3 -> 0.4

* crossterm: 0.25 -> 0.26

* dynasmrt: 1.2 -> 2

* goblin: 0.5.3 -> 0.6

* hashbrown: 0.12 -> 0.13

* nix: 0.25 -> 0.26
  * The `addr` arg of `mmap` is now of type `Option<NonZeroUsize>`
  * The `length` arg of `mmap` is now of type `NonZeroUsize`
  * Requires updating implementers to update `nix` as well

* prometheus-client: 0.18.0 -> 0.19
  * Do not box metrics
  * Gauges (a majority of the LibAFL metrics) are now i64 types so there
    is a small chance of overflow, with the u64 values that LibAFL
    tracks, but unlikely to be problematic.
 * Keep `exec_rate` as a floating point value

* serial_test: 0.8 -> 1

* typed-builder: 0.10.0 -> 0.12

* windows: 0.42.0 -> 0.44

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-02-06 12:24:42 +01:00
Langston Barrett
e75f65080e
libafl: with_capacity method for NewHashFeedback (#1034)
Most of the time, fuzzing campaigns are reasonably long. Accordingly, when
using `NewHashFeedback`, you might have good reason to believe that you'll
find thousands (or more) different observations with different hashes. When
the `HashSet` outgrows its capacity, it can cause reallocation, which is slow.
See the following link for more details:

https://doc.rust-lang.org/std/vec/struct.Vec.html#capacity-and-reallocation
2023-02-06 01:44:57 +01:00
Dominik Maier
48caffb802
Allow to load a list of files (#1044) 2023-02-05 21:22:58 +01:00
Andrea Fioraldi
eaf5ff9de0
Restart loading initial inputs even after a crash/timeout (#1040)
* Track initial inputs loading

* libfuzzer libpng

* fuzzbench

* fix no_std

* fix no_std

* clippy

* fuzzers
2023-02-03 11:56:47 +01:00
Dominik Maier
cc53da85fb
Remove {update,clear}_hash from ObserverWithHashField, add hasher (extending #1019) (#1028)
* libafl: Remove `{update,clear}_hash` from `ObserverWithHashField`

These methods aren't used by `NewHashFeedback`, so there's no compelling reason
to keep them in the interface. They preclude implementations of
`ObserverWithHashField` that calculcate a hash on-the-fly from a value. For
example, my use-case is to store the stdout of a process, and use
`NewHashFeedback` to only collect inputs that result in new messages on stdout.

Both of these methods are pretty suspicious to begin with - why should other
code be able to update the internal state of the observer? What are the
semantics of `update_hash`? If there are compelling reasons to keep these
methods, let's clarify their intent in the documentation.

* libafl: Return hash by value from `ObserverWithHashField`

This allows implementors of this trait to not store the hash, but rather to
compute it on-the-fly. Since `Option<u64>` is `Copy` (and quite small), and
this method is called once per execution of the target program, this is likely
to have negligible performance impact.

* libafl: Implement `ObserverWithHashField` for `ValueObserver`

This demonstrates the utility of the previous two commits. Now, `ValueObserver`
can be used with `NewHashFeedback`.

* Clippy, move to ahasher

* Oops :)

---------

Co-authored-by: Langston Barrett <langston.barrett@gmail.com>
2023-01-31 10:45:42 +01:00
Andrea Fioraldi
fdf579bcd5
Bump to 0.9.0 (#946)
* bump to 0.9.0

* fix libafl_tinyinst

* fix

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-01-31 10:42:01 +01:00
Dominik Maier
33ddce2cea
Introduce MutatorId, Tuneable fixes (#1022)
* Add simpler APIs for TunableStage

* Make API usable

* Add TunableScheduledMutator APIs

* Introduce MutatorId

* More API

* Cleanup

* add sampling-based mutation scheduling

* reduce precision for sampling

* clippy
2023-01-30 18:04:42 +01:00
Dongjia "toka" Zhang
b927fc9b06
Add filename_path to MmapShMemProvider (#1014)
* change how it is named

* Add more comments

* more

* macOS 32bytes onlyu

* chg

* comment, fix
2023-01-26 00:53:37 +01:00
Dominik Maier
e5c220519e
LLMP Broker: timeouts for inactive clients (#1005)
* LLMP Timeouts

* Make broker timeouts optional

* fix warning

* fix warning
2023-01-25 12:03:23 +01:00
Andrea Fioraldi
92c0c5eeab
Fix second Forkserver Broken Pipe (#1013)
* Truncate at MAX_FILE

* AFL_MAP_SIZE

* todo
2023-01-24 20:50:56 +01:00
Addison Crump
00ec7e143c
fix for MapIndexesMetadata (#1008)
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-01-23 15:08:33 +01:00
Dongjia "toka" Zhang
fe51286586
TinyInst Update (#968)
* tmp

* more

* save

* TODO

* fix

* update to tinyinst on crates

* dep

* fmt

* shmem done

* cpp fmt

* clp

* fmt

* why??

* ver

* more makefile.toml

* windows test

* Update build_and_test.yml

* fix

* a

* install

* fmt

* fix

* only macos and win

* more

* The order matters

* remove

* fmt

* chg

* typo

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-01-23 11:11:53 +01:00
Andrea Fioraldi
7fd9ac0952
SyncFromBrokerStage to sync from a broker with a different Input type (#997)
* ConverterLlmpEventManager

* docs

* SyncFromBrokerStage

* fix

* separate InputConverter

* nautilus

* nautilus_sync

* send testcases

* upd nautilus

* meta

* fix

* clippy

* fix

* Update build_and_test.yml

* fix

* fix

* Use find_libpython

* ci

* upd qemu
2023-01-20 17:16:29 +01:00
Addison Crump
ebc886032f
Fixes for multiple subtle bugs with grimoire, mutators, and state (#1001)
* fix multiple subtle bugs with grimoire, mutators, and state

* obey the clippy overlord

* grimoire: skip over token after splice

* remove extraneous length check
2023-01-18 13:53:31 +01:00
Paul Walker
333a51aeaa
StacktraceObserver speedup using unresolved backtrace (#1002)
We don't use the symbols anyway, and it makes the call *way* faster.
2023-01-18 13:51:42 +01:00
Dongjia "toka" Zhang
1446692f02
Fix stability UI (#1000)
* Update mod.rs

* fmt
2023-01-18 19:00:50 +09:00
van Hauser
15c1c0fb5e
Avoid no-op in ByteRandMutator (#999) 2023-01-17 11:07:50 +01:00
Dominik Maier
97e88af0c5
OnDiskCorpus: Write metadata by default, metadata gzip compression (#995)
* Write metadata by default

* fix fuzzers

* Cleanup, gzip feature

* Fix casing for ondisk corpus

* fix fmt, clippy

* clippy

* clippy for gdiplus fuzzer

* fmt
2023-01-13 01:07:36 +01:00
Addison Crump
28786c943a
Grimoire fixes (#993)
* fixup grimoire/generalisation, remove GeneralizedInput in favour of metadata

* additional cleanup

* transformable inputs to solve the grimoire problem

* explicit use of 'transforming' to keep typing compatible with normal usage

* clippy fix

* fixes for nautilus, python

* explicit inlining for reflexive impl

* fix for tutorial

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-01-13 01:07:21 +01:00
Andrea Fioraldi
ec84c71eae
Corpus maps (#947)
* hashmap corpus for inmemory

* corpus_btreemap feature

* CorpusId

* queue

* MinimizerScheduler::remove

* fixes

* continue

* keys

* working corpus

* ok

* weighted left

* wip

* port weighted scheduler

* it compiles

* doc

* fix mutators

* fix queue

* fix iter

* tests

* fix

* fix

* fix

* py

* clippy

* clippy

* clippy

* cmin

* fix

* fix

* fix

* clippy

* remove Corpus::random_id
2023-01-09 14:15:07 +01:00
Dominik Maier
159e6ea480
Fix Launcher for M1, fix frida_libpng harness compilation, fix CI (#987)
* Fix harness compilation for frida_libpng

* M1: Always use fast cores

* always ignore result

* seeing if manualy installing libunistring fixes wget

* seeing if manualy installing wget fixes it, instead

* un-remove comment
2023-01-05 14:26:20 +01:00
Dongjia "toka" Zhang
d2985c5b2e
Clippy fix (#978)
* fix

* mac

* clp
2023-01-02 20:35:41 +09:00
Dongjia "toka" Zhang
9458549fef
Remove declare -A (#976)
* fix

* fix

* debug

* debug

* older version

* newer version

* fix

* unix?

* fix
2022-12-30 02:02:38 +09:00
Dongjia "toka" Zhang
676a149497
Update CorpusWeightTestcaseScore (#975)
* fix

* clp

* fmt
2022-12-28 22:16:08 +01:00
Patrick Gersch
2b092f40fa
SimpleMonitor optionally displays user_monitor stats (#970)
* Adding with_user_monitor() to SimpleMonitor

* Satisfy clippy

* Satisfy fmt and pylibafl

* Fix leading whitespace
2022-12-26 11:20:30 +01:00
Dongjia "toka" Zhang
476cb7e7dc
Frida Makefile.toml fix (#969)
* frida build script fix

* fix

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml

* Update build_and_test.yml
2022-12-26 14:19:37 +09:00
Dominik Maier
75f12bd0eb
Remodelling Observers/Examples that rely on UB, API cleanups (#950)
* Tackling UB

* PtrMut -> MutPtr, moved mapobservers to non-UB

* QEMU fixes

* test fixes

* qemu

* Change all interfaces, fix all fuzzers

* fixes

* fix more fixes

* fmt

* fix qemu sugar

* fix some qemus

* atheris

* fmt

* more fmt

* most fmt

* more fix

* nyx fyx

* fix qemu

* clippy, fixes

* more fixes

* no unfix, only fix

* fix

* fix

* more clippy

* fixes

* ListObserver

* fmt, clippy

* fix qemu on arm

* update zlib target

* fix?

* fix

* added migration guide

* ignore doc

* fix symcc

* fix new win fuzzer

* Fixes, rename PTR_SIZE to PTR_NUM

* Try fix linking on win

* Trying to fix win linking

* more cov

* trying to fix win some more

* trying to fix mac

* trying to fix mac

* Fix tests

* Fix tests

* trying to fix win

* more mac

* giving up for windows

* fmt

* python3

* mac?

* undo windows tests
2022-12-24 14:20:44 +01:00
Dongjia "toka" Zhang
d77d9d5f31
Frida: Make stalker.exclude() configurable from command line arguments (#956)
* remove exclude on windows

* linux x86_64

* option
2022-12-21 11:23:57 +01:00
Dongjia "toka" Zhang
3c7dcac41d
Deduplicate crash handlers (#951)
* unix

* win

* std

* fmt

* more

* more

* win

* rename

* win

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2022-12-21 10:41:18 +01:00
Dominik Maier
ccf6cc708a
Windows clippy fixes (#948) 2022-12-18 12:35:30 +01:00
radl97
016a4c3778
Human readable execs & run/exec rounding fix (#936)
* Calculate run/exec statistics as float to solve rounding issues

* Fixup

* Clippy fixes

* Clippy fixes

* Change execs_per_sec() to return float per suggestions

* Monitors: Write 2 decimal floating-point for execs/sec

* Prettify exec/sec

* Formatting & fix copy pasta

* Pretty-print floats in monitor: use mega and kilo SI suffices

* prettify -> prettify_float, apply suggestion

* Clippy

* Fix prometheus client cannot handle float values yet

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2022-12-16 23:46:33 +01:00