745 Commits

Author SHA1 Message Date
Dongjia "toka" Zhang
c415b4d5f6
0.13.0 (#2253)
* 0.13

* z3

* capstone

* fixer

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-06-13 23:35:35 +02:00
Dongjia "toka" Zhang
0ed295842b
Use filename for MmapShMemProvider (#2303)
* fixer

* comment

* a

* bb

* apple
2024-06-11 20:15:11 +02:00
Dominik Maier
93085782d6
Rename string stages to unicode stages for consistency (#2293) 2024-06-08 16:59:49 +01:00
Dominik Maier
ba84170777
Fix docs on crates.io for LibAFL_Frida, introduce auto-download feature (#2270)
* Fix docs on crates.io for LibAFL_Frida, introduce auto-download feature

* remove it more

* more testing

* more features

* more CI

* CI?

* CI?

* More fix?

* nicer

* More fix?

* test?

* more try?

* why?

* more more
2024-06-08 13:02:59 +01:00
Romain Malmain
14263b9c69
Rusty LibAFL fmt (#2271) 2024-06-07 23:41:50 +02:00
Romain Malmain
399fbccea2
Closure builder for inner managers of centralized. (#2279)
* generic inner manager for centralized, with builder closures.

* moved options inside the function

* removed useless bound

* unused import

* remove useless clone bound.

* make clearer what is secondary node

* same inner manager for main and secondary

* fix example
2024-06-05 19:12:21 +02:00
Dominik Maier
58c39680c9
Move Nautilus to LibAFL, remove AGPL dependencies (#2265)
* Copy choose method for unbounded iterators

* Add choose method for unbounded iterators

* Copy&paste in nautilus grammartec

* cargo

* fmt

* Initial Nautilus in LibAFL

* missing link

* clippy

* clippy

* more clippy

* docs

* docs

* more docs

* remove nautilus default

* fix doctest

* fmt

* less vec

* test

* less flakey

* clippy

* clippy
2024-06-03 14:18:52 +02:00
Romain Malmain
1102ea0fe7
Better RW errors for QEMU (#2260)
* better error for rw in qemu.

* fix python

* clippy

* Fix error in fuzzers

* Fix error in fuzzers

* fix systemmode error

* import
2024-05-30 15:14:17 +02:00
Mrmaxmeier
b96b9be674
tutorial fuzzer: switch lain fork to AFLplusplus/lain (#2257) 2024-05-28 20:45:18 +02:00
Mrmaxmeier
7fe43a28e8
fix duplicate package warning (#2258)
warning: skipping duplicate package `fuzzbench` found at `~/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/058e15f/fuzzers/fuzzbench`
2024-05-28 20:45:04 +02:00
Romain Malmain
65af5a7f78
Fix libnyx, library upgrades (#2254)
* try this thing

* this?

* use new mmap signature in nix.

* fix import

* fix to work with addr2line v0.23.

* remove unused flag

* update strum also for dependency...

* clippy

* clippy

* update lain git hash

* bump many outdated crates

* fix hash
2024-05-28 17:15:08 +02:00
Dongjia "toka" Zhang
e6eb6c48d2
LibAFL Dynamic Analysis (#2208)
* aa

* push

* push

* push

* claude ai

* push

* add

* add stuff

* upd

* rdm

* fix

* ci

* fix

* fix

* fixing

* feature

* revert

* no submodules

* ci
2024-05-24 14:43:27 +02:00
Romain Malmain
5fbe2415e1
Generic QEMU snapshot checking (#2240)
* generic snapshot checking.
2024-05-23 22:57:13 +02:00
Dominik Maier
1fafaf6454
Make every Builder ::builder(), so BobTheBuilder::new() becomes BobThe::builder() (#2242)
* Make every builder ::builder()

* Fix no_std

* More

* Fix clippy, stuff

* More fun

* Make NopShMem do something

* Alloc

* more fmt

* Remove UB in tinyinst executor builder

* Make builder order not matter for tinyinst

* More better

* fix

* docs

* fmt

* more fmt

* clippy

* fix fixes

* tiny thing

* more betterg

* more more

* more builder

* more builder

* more nyx

* undo breaking clippy

* clip
2024-05-23 18:56:39 +02:00
Dongjia "toka" Zhang
336d7fcc4f
Refactor events/llmp.rs (#2234)
* push

* refactor

* FMT

* fixes

* aaaaaa

* done

* aa

* docdoc

* rename

* no std

* nautilus

* feature fix

* aa

---------

Co-authored-by: Your Name <you@example.com>
2024-05-22 12:58:44 +02:00
Dominik Maier
684b31279e
Add BytesSubInput to mutate sub-parts of a bytes-backed input (#2220)
* Add BytesSubMutator that allows us to mutate sub-parts of a bytes-backed input

* no_std

* fix string mutator

* make build

* Fix clippy on macOS

* Docs

* More docs

* Better docs

* --amend

* Renamed bsi to sub_input. Too much BSI

* More more

* balance backticks

* Make splicing usable with sub_input (not that it makes sense)

* More annotations

* more input annotations?

* Implement HasMutatorBytes for &mut Vec

* clippy

* Use a wrapper type instead

* Add wrapper type for Vec as well

* Remove the duplicate BytesInput... lol
2024-05-22 01:50:07 +02:00
Dongjia "toka" Zhang
19ef29ed60
New forkserver (#2213)
* step 1

* done

* cmplog?

* targets

* check if working and add env_logger

* typo
2024-05-21 15:20:28 +02:00
s1341
864c2259e7
launcher: add launch_delay option (#2227)
* launcher: add launch_delay option

* Centralized too

* Use in test

* Undo

* Windows too

* Format

* Fix cfg guard
2024-05-20 10:06:33 +03:00
Dominik Maier
30f65512d8
Remove unused dependencies (#2221)
* Remove unused dependencies

* Add guard
2024-05-20 02:30:53 +02:00
Romain Malmain
dfd3b3278e
QEMU command system refactoring (#2189)
* implemented generic command builder

* Added builder to `Emulator`.
2024-05-18 20:43:56 +02:00
Dongjia "toka" Zhang
c7303ace53
Static analysis pass (#2178)
* copy

* fmt

* aa

* a

* Goodbye z3, i hope i won't build you forever

* doc

* fmt
2024-05-15 16:50:20 +02:00
s1341
19087f3dab
Windows frida support (#1607)
* WIP: windows frida

* frida-windows: fix hooks not present on windows

* windows: allow building using cargo xwin

* frida-windows: fmrt

* frida-windows: cleanup and allow asan/drcov on windows

* frida-windows: fmt

* frida-windows: fix clippy

* frida-windows: handle unknown exceptions gracefully

* frida-windows: rework shadow mapping algo

* frida-windows: add hook functions

* frida-windows: hook functions; fix stack register

* minibsod: enable for windows

* check_shadow: fix edge casees

* asan_rt: rework and add hooks for windows

* inprocess: add minibsod on windows

* Fix warnings

* minibsod: disable test on windows

* WIP: HookRuntime

* Cleanup after merge

* Bump frida-gum version

* Fix conflict marker; update frida

* Make winsafe windows-specific

* Fmt

* Format

* Better detection of clang++ (using cc)

* Make AsanErrors crate public so we can use it in tests

* Add helper to get immediate of operand

* Use HookRuntime to hook asan functions

Tests now passing

* fmt

* Implement recurisve jmp resolve

* Fix reversed logic

* windows_hooks: Don't die if functions are already replaced

* Allow utils to work on windows

* Enable allocator hooking on windows

* Warnings; add trace to free

* Make ASAN tests run windows (with cargo xwin compilation)

* Fmt

* clang-format

* clang-format

* Add more tests

* Fix partial range access bug in unpoisoning/shadow_check

* Merge main

* Fix check_shadow and implement unit tests

* Fix hooking and PC retrieval

* WIP: Working gdiplus fuzzing with frida-ASAN, no false positives

* LibAFL Frida asan_rt and hook_rt fixes for frida_windows (#2095)

* Introduce aarch64

* MacOS fix - MemoryAreas is broken on MacOS and just loops

* Introduce working aarch64 ASAN check

* Implement large blob

* Fix hook_rt for arm64

* Fix poison/unpoison

* Fix shadow check

* Update x86-64

* Fix aarch64 unused import

* Remove extraneous println statement

* merge main

* Fixes

* alloc: add tests, pass the tests

* HookRuntime before AsanRuntime, and don't Asan if Hooked

* hook_rt: Fixes

* Frida windows check shadow fix (#2159)

* Fix check_shadow and add additional tests

* add some additional documentation

* Revert to Interceptor based hooks

* fixes

* format

* Get rid of hook_rt; fixes

* clang-format

* clang-format

* Fix with_threshold

* fixes

* fix build.rs

* fmt

* Fix offset to RDI on stack

* Fix clippy

* Fix build.rs

* clippy

* hook MapViewOfFile

* fmt

* fix

* clippy

* clippy

* Missing brace

* fix

* Clippy

* fomrrat

* fix i64 cast

* clippy exclude

* too many lines

* Undo merge fails

* fmt

* move debug print

* Fix some frida things

* Remove unused frida_to_cs fn for aarch64

* name

* Don't touch libafl_qemu

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Sharad Khanna <sharad@mineo333.dev>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dominik Maier <dmnk@google.com>
2024-05-14 10:45:56 +02:00
Dongjia "toka" Zhang
bf4d1de7cd
Remove observer_stdout/observer_stderr from Observer trait (#2167)
* stuff

* upd

* cargo test

* doc

* fmt

* nyx stuff
2024-05-13 17:10:55 +02:00
Dominik Maier
c97c8cf83e
Rename Handler -> Handled, various other cleanups after #2142 (#2152)
* Handle name cleanup after #2142

* Handleable -> CanBeHandled

* CanBeHandled -> Handled

* clippy

* forgot one

* Handled more
2024-05-07 19:23:13 +02:00
Romain Malmain
bed500471a
QEMU generic memory iterator (#2148)
* QEMU generic memory iterator + Refactoring

* Generic Memory Iterator (systemmode only for now): It is now possible to iterator over memory ranges, independently of the address kind

* Refactoring or Emulator / Qemu structures: they are now handled separately in different files

* Refactoring of Exit Handlers: Result / Error structs have been clarified

* Simple handler for signals

* add new `check-cfg` calls for libafl qemu
2024-05-07 10:46:15 +02:00
Dongjia "toka" Zhang
d4ff7b86b1
Add windows test & ci & fix (#2144)
* fix

* ignore

* fmt

* a
2024-05-05 14:53:27 +02:00
Dongjia "toka" Zhang
b0ac25a7b5
Rename Reference to Handle (#2142)
* rename

* rename

* fmt

* fix

* fmt
2024-05-04 18:16:28 +02:00
Valentin Huber
7fe0c576db
Make CommandExecutor Generic on the specific Input (#2129) 2024-05-02 15:39:06 -04:00
Romain Malmain
02ef0c4dda
fix qemu systemmode fuzzers exit code (#2133) 2024-05-02 16:27:07 +02:00
Stefan Zabka
ec944a0ea4
Allow setting stdout_file in non-fork launcher (#2127)
* fix(launcher.rs): hide file output behind appropriate feature flag

discovered while debugging #2111

* fix(launcher.rs): implement stdout/stderr piping for non-forking unix

* hide all accesses to stdout_file in cfg blocks

* Conditionally add stdout_file config in frida_gdiplus
2024-05-02 10:24:36 -04:00
Romain Malmain
935100e7a7
Qemu update to latest version + various fixes (#2119)
* Fix maps iterator

* Added paranoid debug feature.

* Fix snapshot bugs.

* Update qemu-libafl-bridge.

* Added auto-generation of `x86_64_stub_bindings.rs` .

* Fix sync_exit calling to stopped CPU.
2024-05-02 09:31:54 +02:00
Dongjia "toka" Zhang
2f7c19e2b1
Change centralized launcher signature (#2094)
* poc

* ai suggestion

* rename this

* aaaa

* fmt

* simplify

* delete blob

* ignore

* fixup?

* some progress on cow-ification

* some more

* clippy fixes, finalise tests

* whoops, missed a spot

* no std compat

* api change: Named now requires alloc feature

* doc fix

* missed a spot

* additional fixes

* libfuzzer fixes

* fix tutorial

* fix

* add

* aa

* fix tutorial

* fix

* Rename

* fix

* aa

* fmt

* aa

* aa

* another closure

* clp

* fix stuff

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-04-30 19:44:57 +02:00
Gregory Petrosyan
b49ab999e3
libafl_bolts: rands super mega ultra giga house cleaning of doom (#2123)
* rands: simpler rand_trait code, remove useless test

* rands: provide and use proper random_seed()

* rands: add missing golden tests

* Don't use current_nanos() for seeding

* rands: remove RandomSeed trait
2024-04-29 11:00:44 -04:00
Dongjia "toka" Zhang
50f14d44fa
Restrict more on edges map API (#2117)
* fix

* fix

* feature guard

* use

* cannnot find

* fmt

* more

* fix

* fix

* more

* fucking fmt just shut

* rename and change stuff

* fix

* fix

* fixxxxxxxxxx
2024-04-29 16:28:40 +02:00
Addison Crump
28c43b332f
Match by Ref fix (#2105)
* match by ref fix

* impl Named for Reference

* rename

* magic indexing

* whoops

* docs, clippy

* some additional CI complaints

* other libafl_qemu fixes

* missed an alloc feature

* a smattering of fixes

* use from not direct construction

* tinyinst fix

* horrible double-mutability things

* fixup nyx

* from not new

* forkserver_simple fixes

* dogfood: forkserver

* mmmm yummy dogfood

* round one CI fixes

* clippy appeasement

* deref generic impl to simplify usage

* adaptive serialization (ouch)

* remaining clippy items

* I am tired

* new not with

* fixup: aflpp tracing was not actually constructable

* fix tmin

* reduce complexity of map feedback now that we do not need to constrain

* frida fixes

* fix concolic

* type_ref => reference
2024-04-27 18:08:09 +02:00
Dongjia "toka" Zhang
084b9b5878
Batch timeout fix (#2109)
* fix

* FMT

* unused
2024-04-26 17:10:36 +02:00
Romain Malmain
dd0fbff819
Small refactoring of libafl_qemu structure (#2098)
* Architecture-specific stuff is now in the `arch` directory

* Helpers are now in the `helpers` directory

* `emu.rs` has been moved as `emu/mod.rs` for consistency with the rest of the repository
2024-04-24 21:47:29 +02:00
Dongjia "toka" Zhang
176659821a
Add TypeRefCreator trait (#2065)
* poc

* ai suggestion

* rename this

* aaaa

* fmt

* simplify

* delete blob

* ignore

* fixup?

* some progress on cow-ification

* some more

* clippy fixes, finalise tests

* whoops, missed a spot

* no std compat

* api change: Named now requires alloc feature

* doc fix

* missed a spot

* additional fixes

* libfuzzer fixes

* fix tutorial

* fix

* add

* aa

* fix tutorial

* fix

* Rename

* fix

* aa

* fmt

* aa

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-04-23 19:03:30 +02:00
Josef Haider
d34965192d
Add FeedbackFactory implementations for CrashFeedback, CombinedFeedback and DiffFeedback. (#2060)
* Add FeedbackFactory implementations for CrashFeedback, CombinedFeedback and DiffFeedback

* remove redundant type CrashFeedbackFactory
2024-04-23 15:48:52 +02:00
Dongjia "toka" Zhang
ea6a36b0a5
fix (#2091) 2024-04-22 21:55:55 +02:00
Dongjia "toka" Zhang
0f3ad288e7
Fix #1932 (#2089)
* fix

* Stupid lint

* increase rate

* fix
2024-04-22 19:27:13 +02:00
Romain Malmain
fef6c8d1b1
Run qemu_systemmode tests with self-hosted runners (#2018)
* run qemu fuzzers (qemu_systemmode only for now) in self-hosted runners

* Remove qemu-related fuzzers to general fuzzers

* fix

* Install dependencies before anything else

* Do not use sudo

* Install sudo

* Revert "Install dependencies before anything else"

This reverts commit 107addad5d9f68dec5a9af50831112cd72c28f4d.

* added qemu specific prerequisites

* add -y flag

* Format with nightly

* Do not use nightly only.
Install fmt and clippy for stable as well.

* Install qemu-img for qemu

* fix qemu-img install

* apt update

* Changed timeout.

* Fix qemu_systemmode test

* fmt

* clippy + decorrelate build and run for qemu_systemmode.

* fix fuzzer

* clippy

* add sqlite3-dev to package prerequisites.

* add arm-none-eabi-gcc

* fix profile dir

* fix condition.

* Run less QEMU stuff faster

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2024-04-22 18:17:22 +02:00
Tobias Mayer
fe64d10a5c
Fix typo in setup_libxml2.sh (#2088)
exit for a non-zero exit code
2024-04-22 14:37:41 +02:00
Addison Crump
fd364d15fe
cargo-fuzz testing (#2081)
* Build cargo-fuzz end to end

* Workaroudn failing CI

* Fix toml

* Build

* Exclude from workspace

* Fix version

* Fix workspace

* Fix workspace

* FIx workspace

* Fix path

* Set path correctly

* Install llvm-tools

* Test with distro llvm installed

* Use build

* complete

* remove from includes

* add back fuzzer tests, format

* add test for whether all fuzzers are actually tested in pipeline

* whoops

* I hate CI I hate CI I hate CI

* revert removal of llvm

* sh compatibility

* sigh

---------

Co-authored-by: Max Ammann <max@maxammann.org>
2024-04-19 23:55:28 +02:00
Dongjia "toka" Zhang
e8cc1ba93d
Revert "Revert splitting libafl_edges_map_max and libafl_edges_map_in_use" (#2082)
* Revert "Revert splitting libafl_edges_map_max and libafl_edges_map_in_use (#2…"

This reverts commit c68b3816fb680b635f99c337f78185e699864705.

* all

* more
2024-04-19 19:03:58 +02:00
Dongjia "toka" Zhang
c68b3816fb
Revert splitting libafl_edges_map_max and libafl_edges_map_in_use (#2079)
* fix

* aa

* push

* fix

* fmt
2024-04-19 13:24:25 +02:00
Addison Crump
276bfc6386
tee not pipe (#2078) 2024-04-18 18:23:57 +02:00
mkravchik
2b18562b08
Fixing the inconsistency btw #2012 and #2066 (#2074) 2024-04-18 13:33:29 +02:00
Romain Malmain
39c32d55e7
Fix main not passing CI tests (#2075)
* Fix sancov import

* fmt

* fmt
2024-04-18 13:33:18 +02:00
mkravchik
886519b10c
Pr/fixing forkserver libafl cc (#2066)
* Fixing forserver_libafl_cc

* Adding tests and showing user stats

* Restoring the map truncation

* Fmt

* small fix

* fix

* fix

* fix

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-04-17 18:28:34 +02:00