70 Commits

Author SHA1 Message Date
Dongjia "toka" Zhang
c415b4d5f6
0.13.0 (#2253)
* 0.13

* z3

* capstone

* fixer

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-06-13 23:35:35 +02:00
Dominik Maier
93085782d6
Rename string stages to unicode stages for consistency (#2293) 2024-06-08 16:59:49 +01:00
Marco Neumann
b1bec42044
fix: libafl_libfuzzer build script (#2282)
- features check was inverted
- print helpful message when `llvm-nm` wasn't found, which happens to be
  the case on _stable_

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-06-07 23:37:08 +02:00
Romain Malmain
af12b4ba24
LLmp hooks (#2280)
* llmp hooks

* separate llmp broker from inner state to allow doing more stuff
2024-06-06 16:07:55 +02:00
Dongjia "toka" Zhang
6373a1e1b3
Use Self::State as much as possible and remove unnecessary type bounds (#2263)
* use Self::State as much as possible

* makeing progress, little by little

* more

* add

* more and more

* more

* more

* mre

* fix

* a

* pp

* fix

* fix

* more

* version

* fix cargo fuzz
2024-06-05 15:16:43 +02:00
Aarnav
bce0f08294
Introduce feedbacks hit tracking for testcases (#2248)
* introduce feedbacks hit tracking for testcases

* make Testcase::hit_feedbacks into Cow<&str> instead of String
rename get_hit_feedbacks to append_hit_feedbacks
update documentation

* simplify ConstFeedback

* rename Feedback::last_result to prev_result

* impl TODO prev_result for NewHashFeedback, ListFeedback, TransferredFeedback, NautilusFeedback

* rename prev_result to last_result

* add docs

* introduce Objectives hit tracking

* update docs

* update Cargo.toml docs

* update docs

* track Feedbacks & Objectives hit in Fuzzer::add_input

* fmt

* clippy

* fix type error in OomFeedback::last_result

* impl last_result for AsanErrorsFeedback

* add track_hit_feedbacks as a feature to libafl_libfuzzer_runtime

* fix clippy

* change return type of Feedback::last_result to a Result

* remove expect in NewHashFeedback::is_interesting

* move Error::premature_last_result to libafl from libafl_bolts
2024-05-28 11:43:05 +02:00
Romain Malmain
4d45100a63
Fix libafl_qemu.h (#2250)
* fix header for gcc

* fix comment
2024-05-28 11:39:24 +02:00
Valentin Huber
7c9bd1157c
Adding DiffExitKindFeedback (#2246)
* adding DiffExitKindFeedback

* refactoring

* fixing CI
2024-05-24 16:12:32 +02:00
Dominik Maier
07dca4b59b
LibAFL_Libfuzzer: Add clippy warnings (#2244)
* clip

* More clippyness
2024-05-24 14:00:09 +02:00
Dominik Maier
1fafaf6454
Make every Builder ::builder(), so BobTheBuilder::new() becomes BobThe::builder() (#2242)
* Make every builder ::builder()

* Fix no_std

* More

* Fix clippy, stuff

* More fun

* Make NopShMem do something

* Alloc

* more fmt

* Remove UB in tinyinst executor builder

* Make builder order not matter for tinyinst

* More better

* fix

* docs

* fmt

* more fmt

* clippy

* fix fixes

* tiny thing

* more betterg

* more more

* more builder

* more builder

* more nyx

* undo breaking clippy

* clip
2024-05-23 18:56:39 +02:00
Dominik Maier
b97a9a1398
Rename peek_next_free_id to peek_free_id (that it's the next is obvious) (#2243) 2024-05-23 15:44:32 +02:00
Aarnav
1ed1c4eb31
Add peek function to Corpus (#2238)
* add peek function to Corpus

* send 0 as next peek in NopCorpus

* rename peek to peek_next_free_id

* fix clippy

* add peek_next_free_id to libafl_libfuzzer

* impl peek_next_free_id for ArtifactCorpus
2024-05-22 13:30:47 +02:00
Dominik Maier
684b31279e
Add BytesSubInput to mutate sub-parts of a bytes-backed input (#2220)
* Add BytesSubMutator that allows us to mutate sub-parts of a bytes-backed input

* no_std

* fix string mutator

* make build

* Fix clippy on macOS

* Docs

* More docs

* Better docs

* --amend

* Renamed bsi to sub_input. Too much BSI

* More more

* balance backticks

* Make splicing usable with sub_input (not that it makes sense)

* More annotations

* more input annotations?

* Implement HasMutatorBytes for &mut Vec

* clippy

* Use a wrapper type instead

* Add wrapper type for Vec as well

* Remove the duplicate BytesInput... lol
2024-05-22 01:50:07 +02:00
Max Ammann
6040133080
Use MultiMonitor when fuzzing in non-forking mode (#2192) 2024-05-18 20:24:41 +02:00
Addison Crump
614b149cae
Fix cfg uses across codebase (#2154)
* start fixup of cfgs

* whoops

* remaining issues

* maybe fixup macos

* apparently that is ios code?

* fix no_std

* Re-enable tcp_compression

* fix tcp broker

* remove tcp_debug flag

* fmt

* clippy

* less unwrap while we're at it

* doc

* add back pub star uses for libafl_qemu

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
2024-05-08 14:31:10 +02:00
Max Ammann
f6d2eaacb4
Fix libafl_libfuzzer's compatibility with LLVM 14 (#2136)
* Always use Rust's nm instead of host system one

* Fix formatting

* Fix formatting
2024-05-08 13:53:12 +02:00
Gregory Petrosyan
b49ab999e3
libafl_bolts: rands super mega ultra giga house cleaning of doom (#2123)
* rands: simpler rand_trait code, remove useless test

* rands: provide and use proper random_seed()

* rands: add missing golden tests

* Don't use current_nanos() for seeding

* rands: remove RandomSeed trait
2024-04-29 11:00:44 -04:00
Langston Barrett
b0248461e2
Allow for AsIter(Mut)/AsSlice(Mut) to be implemented in safe Rust (#2120)
* Generalize `AsIter` to allow iterating over contents of a `RefCell`

Towards `MapObserver`s in safe Rust.

* Helpers for `RefCellValueObserver`

* MapObserver: Return owned Self::Entry from .get()

`Self::Entry` is `Copy`, so there's not much value in returning a
reference from `get()`. Futhermore, returning a reference limits the
possible implementations of `MapObserver`, because it forces the
borrow/reset to outlive the body of the method.

* MapObserver: Replace `.get_mut()` with `.set(idx, val)`

Like the previous commit, this is intended to expand the possible
implementations of `MapObserver` to types with interior mutability,
which can't necessarily loan out their content.

* Make `RefCellValueObserver` into a safe `MapObserver`

* as iter mut

* as slice (mut): allow for non-& refs

* nostd

* CI round 1

* cleanup + AsSlice defs for RefCellValueObserver

* clippy fixes

* avoid unnecessary imports

* whoops, too aggressive

* use deref instead of as slice

* whoops

* fix as slice conditional importing in stable

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-04-27 18:36:56 +02:00
Addison Crump
28c43b332f
Match by Ref fix (#2105)
* match by ref fix

* impl Named for Reference

* rename

* magic indexing

* whoops

* docs, clippy

* some additional CI complaints

* other libafl_qemu fixes

* missed an alloc feature

* a smattering of fixes

* use from not direct construction

* tinyinst fix

* horrible double-mutability things

* fixup nyx

* from not new

* forkserver_simple fixes

* dogfood: forkserver

* mmmm yummy dogfood

* round one CI fixes

* clippy appeasement

* deref generic impl to simplify usage

* adaptive serialization (ouch)

* remaining clippy items

* I am tired

* new not with

* fixup: aflpp tracing was not actually constructable

* fix tmin

* reduce complexity of map feedback now that we do not need to constrain

* frida fixes

* fix concolic

* type_ref => reference
2024-04-27 18:08:09 +02:00
Dongjia "toka" Zhang
176659821a
Add TypeRefCreator trait (#2065)
* poc

* ai suggestion

* rename this

* aaaa

* fmt

* simplify

* delete blob

* ignore

* fixup?

* some progress on cow-ification

* some more

* clippy fixes, finalise tests

* whoops, missed a spot

* no std compat

* api change: Named now requires alloc feature

* doc fix

* missed a spot

* additional fixes

* libfuzzer fixes

* fix tutorial

* fix

* add

* aa

* fix tutorial

* fix

* Rename

* fix

* aa

* fmt

* aa

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-04-23 19:03:30 +02:00
Josef Haider
d34965192d
Add FeedbackFactory implementations for CrashFeedback, CombinedFeedback and DiffFeedback. (#2060)
* Add FeedbackFactory implementations for CrashFeedback, CombinedFeedback and DiffFeedback

* remove redundant type CrashFeedbackFactory
2024-04-23 15:48:52 +02:00
edwin1729
c238b69498
Implement Hash for MapObserver (#1989)
* MapObserver implements Hash

* Rename the hash utility function (in MapObserver) to hash_easy

* Use hash_slice as a helper function to impl Hash trait

* define_python_map_observer macro implements Hash trait

* Also rename hash_easy to hash_simple

* Rename hash_slice to hash_helper

* hash_helper is used to define the implementation of hash function/trait

* Factor out the Hash trait and function for runtime library structs (#1977)

* Simplify hash_simple (of trait MapObserver) (#1977)

 * Use hash_one function to make hash_simple a one-liner

* remove hash_helper

---------

Co-authored-by: Edwin Fernando <ef322@ic.ac.uk>
Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-04-19 15:06:14 +02:00
Addison Crump
04cd792df2
fix libfuzzer by simply adding the needed feature (#2080) 2024-04-19 13:35:35 +02:00
Dongjia "toka" Zhang
cbb323f26c
LibAFL 0.12 (#1823) 2024-04-12 18:42:14 +02:00
Addison Crump
3d702f403b
Implement CanTrack tracking enforcement through rust types (#1886)
* sample implementation of tracking enforcement (incomplete)

* helpful compiler output

* make it look like a real compiler output

* ensure that the macro may be used outside of libafl

* separate index/novelty tracking funcs

* default const generic values so that we don't need to change this everywhere

* fix tests

* rollback unnecessary specification of stdmapobserver

* register metadata in doc tests

* doc fixes

* doc cleanup

* doc cleanup 2

* reduce implementor overhead to zero

* renaming/docs fixes

* asref isn't reflexive??

* generalization stage updates

* add better documentation about require_{indices,novelties}_tracking

* remaining generic updates

* round one CI pass (knowingly introduces breaking changes)

* typo

* round 2 clippy

* rollback: libafl_frida changes

* fmt

* moar porting

* fix remaining fuzzers

* fix windows build, maybe

* fixup libafl_libfuzzer

* fmt nighlty all the things

* attempt to fix some broken additions

* fix fmt

* oops

* fix new invocation

* minimizer scheduler fixes

* fix accounting

* rename

* fix

* Fix build

* Sort generics

* Move more generics into the right place

* Rename A -> C

* Fix test

* Fix test some more

* Fix doc some more

* critical formatting

* More A->C

* CanTrack harder

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
2024-04-12 18:33:52 +02:00
Aarnav
47c41c2925
Introduce disabled testcases for splicing (#1932)
* introduce disabled field to Testcase

* separate executor's processing of execution (adding to corpus/solution/discarding) and execution of input

* introduce add_disabled_input function

* enable splicing mutators to fetch disabled inputs

* reset modified example

* clean up

* update docs

* update docs for count_with_disabled

* fix random_corpus_id for splicing mutator not considering disabled entries

* fmt

* update docs

* clippy

* fix corpus_btreemap not working

* fix clippy warnings

* fix python bindings

* typo in count_with_disabled implementations

* fix certain splicing mutators not considering disabled inputs

* rename count_with_disabled to count_all

* introduce count_disabled function

* update docs for count_all, count_disabled and count

* * introduce get_from_all and nth_from_all for corpus implementations so get() and nth() do not silently fetch disabled entries.
* remove boolean flag from random_corpus_id which allowed inclusion of disabled ids and make it into a new function random_corpus_id_with_disabled
* update docs

* remove boolean is_disabled flag from corpus::insert and make it into a separate function insert_disabled

* rename do_insert to _insert

* make get_from_all inline for cached and inmemory

* add missing functions implementation for PythonCorpus
prevent writing feedback when adding disabled testcases

* fix nth_from_all overfetching enabled corpus entries

* fix clippy & rename execute_with_res to execute_no_process

* refactor _insert for corpus_btreemap

* make LibfuzzerCorpus and ArtifactCorpus to accomodate disabled entries

* fix typo

* fix missing docs for map field

* fix clippy

* test

* (hopefully) fix CachedOnDiskCorpus using incorrect corpus when caching testcase

* fix typo in inmemory_ondisk leading to fetching disabled entry from enabled corpus

---------

Co-authored-by: aarnav <aarnav@srlabs.de>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-04-10 01:03:00 +02:00
Mrmaxmeier
f252469d86
CI: A few updates and fixes (#2023)
* CI: Don't run cargo clean in order to preserve build caches

* CI: run yaml formatter >:)

* CI: try sharing build caches between similar jobs

* CI: it looks like the `ucd-generate` tool is not used anymore

* CI: Sneak in merge queue support :)

* CI: split out `cargo fmt --check` job

* libafl_qemu injections: be more resilient about mapping paths
2024-04-09 12:55:07 +02:00
Dongjia "toka" Zhang
e8fe5bb614
Move HasMetadata/HasNamedMetadata trait to libafl_bolts (#2016)
* move around

* fmt

* rev

* fmt

* doc job

* name

* move to libafl

* separate even more

* miri
2024-04-08 19:24:56 +02:00
Dongjia "toka" Zhang
15f4613894
More usable ListFeedback (#1959)
* real list feedback

* add

* fox

* obs

* fix

* FMT

* more

* fmt

* rev
2024-03-21 16:21:15 +01:00
Dominik Maier
a0143d02a6
Rename OSError -> OsError and merge with redundant Error::File (#1944)
* OSError -> OsError

* Move File errors to io Errors

* Removing File errors

* fixes :)

* More format

* fix libfuzzer runtime
2024-03-18 08:46:48 +01:00
Dongjia "toka" Zhang
ee6385c25b
Fire events in append_metadata not in is_interesting (#1936)
* stuff

* ok

* Recalc filled slightly differently... (#1939)

* Recalc filled slightly differently...

* Make requested changes as per PR review

* unused

* fix

---------

Co-authored-by: Dan Blackwell <danblackwell95@yahoo.co.uk>
2024-03-15 13:24:26 +01:00
Romain Malmain
d96a1426d5
Fix lint errors (#1909)
* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.
2024-03-05 14:16:26 +01:00
Addison Crump
035c01b4a1
update libfuzzer docs about macos (#1903) 2024-03-01 18:26:22 +01:00
Dongjia "toka" Zhang
1a41e65a5b
Sancov based ngram & ctx implementation (#1864)
* ngram

* ctx

* push stuff

* passing cargo check

* save stuf

* add

* no default

* fuzzbench ready

* formatt

* aaaaaaaa

* adaptive map

* add all

* chg

* fix

* deleting stuff

* fmt

* clang18

* fuck

* save space

* fix?

* feature name

* fucking nightly only

* harness

* fix libafl_cc

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-03-01 13:59:13 +01:00
Addison Crump
8c773a6b85
Implement RetryProgress for limiting retry attempts in stages (#1890)
* do that again but smarter

* remember to register

* appease the clippy

* cleanup

* autofix clippy

* more clippy fixes

* more clippy...

* small clippy fix

* with_tries => with_retries

* most recent suggestions

* final clippy... hopefully
2024-02-28 14:12:28 +01:00
Dominik Maier
263af87652
Less useless allocs for monitor display (#1874)
* Less useless allocs for monitor display

* More less String

* Lol who needs generics

* clippy

* remove &String
2024-02-19 21:15:11 +01:00
Sameer Puri
50892ddc75
Finalize macOS support for libafl_libfuzzer (#1843)
* libafl_targets: on macOS, do not provide a default implementation for weak functions

* libafl_libfuzzer: update README to talk about macOS specifics

* libafl_targets: allow __sanitizer_cov_pcs_init to be called more than once

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-02-15 22:45:15 +01:00
Dongjia "toka" Zhang
49ad380068
fix (#1859) 2024-02-14 23:28:20 +01:00
Dominik Maier
dede78159c
Remove unused shmem structs, update Nix (#1845)
* Remove unused shmem structs

* More unused stuff

* Unified crate versions, updated docker rust version

* clean up nix 27 mess?

* Windows?

* Fix frida

* Fix frida

* fix fuzzers with nix
2024-02-11 17:45:09 +01:00
Sameer Puri
13dd1cc4ec
libafl_libfuzzer: macOS build support (#1711)
* libafl_libfuzzer: macOS support

* make clippy happy

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-01-31 02:41:08 +01:00
Karthik Prakash
519ea435ed
LibAFL_libFuzzer: Default ignore_* flags to true when tui=1 (#1820)
* default `ignore_*` flags to true if `tui=1`

* update docs

* refactor code to use `Option<bool>` instead of extra struct members
2024-01-30 16:25:59 +01:00
Dominik Maier
0cb7b25f39
Replace static borrows with addr_of!, rust 2024 compatibility (#1800)
* Less UB

* fmt

* fix warning

* clippy fixes

* addr_of_mut allthethings

* removed duplicate import

* fix imports

* remove comment

* more windows

* fmt

* fix tests

* fixes

* qemu

* fix more cases, qemu

* fix

* fmt
2024-01-24 17:47:55 +01:00
Dongjia "toka" Zhang
2ac154d473
Refactor InProcessExecutor, merge timeout executors (#1789)
* move windows, inprocess fork to a different file, try new hook mechanism for the executor

* fix

* even more

* more

* more

* fix

* fix

* macosgit add -ugit add -u

* windows!

* windows!

* aa

* aa

* macos

* std

* wtf unresolved?

* Copy, Clone

* why you just don't have the same API!

* inproc

* next; inprocess

* windows?

* ci

* ci

* ci

* unused

* ci

* unused

* no_std

* windows no std

* fix

* inprocess

* fix

* windows

* fuzzers

* macos , book

* fix

* aa

* allow

* fix

* stop suggesting wrong lint AAAAAAAAAAAAAAAAA!!!

* stop suggesting wrong lint AAAAAAAAAAAAAAAAA!!!

* win

* fix

* wip

* wip2

* windows done?

* remove TimeoutExecutor

* ci

* ci

* miri

* fixfi

* compile on windows

* a

* clp

* no_std stuff

* windows no_std

* mac stuff

* m

* a

* ci

* ci

* deleting timeoutexecutor, gradually

* fucking macos

* ci

* test

* ci

* ci

* batch mode constructor

* fix

* ci

* aa

* miri

* aaa

* tmate again

* fix windows stuff

* final fix

* another win fix

* add

* let's add the new fix later

* more

* fi

* parse

* win clippy

* win no std

* safety

* fix

* DEFAULT

* final fix

* libafl_libfuzzer

* comments

* fix

* fix fuzzres

* fixxxxx

* fixxxxx

* last fix

* change name
2024-01-23 22:35:14 +01:00
Dongjia "toka" Zhang
3ed231db69
Don't use assert fail when building on libafl_libfuzzer on windows (#1792)
* fix

* fix

* clippy

* clippy
2024-01-13 16:02:10 +01:00
Addison Crump
ba8ca6723b
Resumable stages redux (#1780)
* initial stage refactor

* repair test

* redqueen

* fixup python bindings

* docs and clippy fixes

* misc hidden changes

* Status => Progress

* fix remaining fuzzers

* fix libafl_libfuzzer

* implement resume for nested stages

* deep testing for stage resumeability

* refactor: use let-else, docfix

* refactor in fuzzbench_forkserver_cmplog

* fmt

* actually use progress

* HasStageStatus => HasCurrentStage
2024-01-09 15:18:14 +01:00
Dominik Maier
a07563def0
Add mute_inprocess_target fn, SimpleFdLogger::set_logger, and more (#1754)
* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, set_error_print_panic_hook

* Trying to fix #1753

* typo

* More fix

* Fix test?

* more testcase fixes
2024-01-01 23:14:59 +01:00
Dominik Maier
c93291ab57
Fix as_object UB discussed in #1748 (#1751)
* Fix as_object UB discussed in #1748

* More cleanup, more less UB

* Fix fixes

* Added uninit_on_shmem api

* clippy

* fmt

* trying to fix fuzzers, libfuzzer wrapper

* Add OwnedRefMit::owned constructor, libfuzzer fix

* Some more fixes

* Add BacktaceObserver::owned fn

* fmt

* more fmt
2023-12-22 16:49:01 +01:00
Dominik Maier
4e7d2caa9f
Remove unused create_anymap_for_trait macro (fixes #1719) (#1752) 2023-12-22 16:48:43 +01:00
Dongjia "toka" Zhang
78060ea308
0.11.2 (#1735) 2023-12-18 14:33:14 +01:00
Dongjia "toka" Zhang
ee447468c6
message (#1726) 2023-12-16 00:13:21 +09:00