* nautilus dep
* nautilus generation
* fix mutator
* start new mutator for nautilus
* other mutators
* baby
* ci
* NautilusFeedback
* fix unparse
* ci
* ci
* ci
* ci
* nigghtly clippy
* ci
* fix
* ci
* ci
* update construct automatata
* fix
* ci
* clippy
* clippy
* nightly clippy
* more clippy
* minor clippy
Co-authored-by: Dominik Maier <domenukk@gmail.com>
* initial atheris libfuzzer harness
* cmplog, kinda
* added makefile to generic_inmemory
* Makefile for atheris fuzzer
* moved away from clap yaml
* fixed arg parsing
* fuzzing
* ldpreload lib to replace exit with abort
* fixed docker, docs
* fix docker some more
* better documentation
* less commented out important things
* Make makefile less crashy
* create a separate crate for symcc url and commit hash
also contains functions to checkout and build symcc from a build script
* fix dockerfile
* clippy
* add stub runtime that links with symcc common runtime code
* implement tracing runtime to generate message file
* move ShMemCursor to libafl proper
* qualify enum imports to make clippy happy
* fix warnings
* formatting
* update symcc submodule to point to AFL++ org repo
* fix naming of ShMemCursor and remove std requirement
* ensure runtime is named correctly after compilation
* add devcontainer files for easier development
(will be removed later)
* move rust nightly install into devcontainer.json
this makes it run after the container has been built
* dev container: install recommended packages
* switch to building rust runtime from SymCC cmake
* install corrosion in dev container for cmake-cargo integration
* add smoke test for symcc-runtime integration
* update symcc submodule
* add rustfmt to devcontainer
* properly mark the end of a constraint trace
Using a special "End" message
* small tool to dump constraints from a traced process
* extend smoke test to include parsing & printing of constraints
* update symcc submodule
* first draft of expression filters for concolic
* fix type in runtime method name
* update symcc submodule
* implement extensions to serdeany map:
* remove -> Option<T>
* insert_boxed(Box<T>) (avoids allocation if value is already boxed)
* implement std::io::Seek for ShMemCursor
* implement framing for in-memory traces
this allows to efficiently get the length of trace.
this is important for efficiently copying the trace out of the shared
memory region.
* fix for serdeany map
* fuzzer that associates concolic traces with test
case
* ensure runtime can handle 0-expressions
* move metadata, observer and feedback into separate files
* convert executor to command executor and move to separate file
* refactoring and streamlining
* move panic mode configuration to cmake script
* compile cmake from source, because debians version is too old.........
* use separate stage for tracing
* fix dockerfile
* move runtime into the workspace
using prior work on compilation flags from cmake
* actually make use of selective symbolication filter
* update to support latest symcc changes
* implement hitmap for concolic runtime
* clippy
* implement selective symbolization and coverage map for dump_constraints tool
* use concolic runtime coverage for concolic fuzzer feedback
* actually kill process on timeout
* be extra careful after killing process
* increase command executor busy wait to 5ms
* implement concolic tracing stage
* address naming issue
* implement floating point expression filter for runtime
* rename expression filters to be less verbose
* implement expression pruning
* implement ConcolicMutationalStage
* refactor command executor and remove busy loop
* implement generic command executor
* remove debug prints
* refactor + documentation
* refactor
* add stub runtime that links with symcc common runtime code
* implement tracing runtime to generate message file
* move ShMemCursor to libafl proper
* qualify enum imports to make clippy happy
* fix warnings
* formatting
* update symcc submodule to point to AFL++ org repo
* fix naming of ShMemCursor and remove std requirement
* ensure runtime is named correctly after compilation
* add devcontainer files for easier development
(will be removed later)
* move rust nightly install into devcontainer.json
this makes it run after the container has been built
* dev container: install recommended packages
* switch to building rust runtime from SymCC cmake
* install corrosion in dev container for cmake-cargo integration
* add smoke test for symcc-runtime integration
* update symcc submodule
* add rustfmt to devcontainer
* properly mark the end of a constraint trace
Using a special "End" message
* small tool to dump constraints from a traced process
* extend smoke test to include parsing & printing of constraints
* update symcc submodule
* first draft of expression filters for concolic
* fix type in runtime method name
* update symcc submodule
* implement extensions to serdeany map:
* remove -> Option<T>
* insert_boxed(Box<T>) (avoids allocation if value is already boxed)
* implement std::io::Seek for ShMemCursor
* implement framing for in-memory traces
this allows to efficiently get the length of trace.
this is important for efficiently copying the trace out of the shared
memory region.
* fix for serdeany map
* fuzzer that associates concolic traces with test
case
* ensure runtime can handle 0-expressions
* move metadata, observer and feedback into separate files
* convert executor to command executor and move to separate file
* refactoring and streamlining
* move panic mode configuration to cmake script
* compile cmake from source, because debians version is too old.........
* use separate stage for tracing
* fix dockerfile
* move runtime into the workspace
using prior work on compilation flags from cmake
* actually make use of selective symbolication filter
* update to support latest symcc changes
* implement hitmap for concolic runtime
* clippy
* implement selective symbolization and coverage map for dump_constraints tool
* use concolic runtime coverage for concolic fuzzer feedback
* actually kill process on timeout
* be extra careful after killing process
* increase command executor busy wait to 5ms
* implement concolic tracing stage
* address naming issue
* implement floating point expression filter for runtime
* rename expression filters to be less verbose
* implement expression pruning
* implement ConcolicMutationalStage
* refactor command executor and remove busy loop
* implement generic command executor
* remove debug prints
* refactor + documentation
* refactor
* fixed build, clippy
* no_std
* implement WithObservers executor as discussed
* add symqemu as a submodule
* fix symqemu submodule URL to be relative
* update the concolic runtime to match the new interface
* update the trace file header regularly to save constraints in case the program crashes
* add build dependencies for symqemu
* handle full mesage buffer properly
* better policy for updating trace header
* less aggregiously inefficient GC information serialization
* move concolic runtime hitmap count to filter
this is in preparation for the new runtime interface
* very WIP new runtime interface
* use more convenient types in rust runtime
* EmptyRuntime -> NopRuntime
* hide cpp_runtime and formatting
* implement tracing runtime using new runtime interface
* implement filters with new runtime interface
* use a local checkout for symcc_runtime
* make test runtime tracing
* use test_runtime in smoke test
* fix formatting
* make the clippy overlord happy?
* disable symcc build on everything but linux
* make more of symcc_runtime linux only
* fix linking symcc_runtime with C++ stdlib
* will clippy ever be happy?
* formatting
* don't export symcc runtime when compiling tests
* clippy...
* "don't export symcc runtime when compiling tests" for runtime crate as well
* clippy
* move command executor to LibAFL
* move concolic crate into LibAFL
* move concolic{metada,observer} into LibAFL
* move ConcolicFeedback into LibAFL
* move ConolicStage into LibAFL
* fix bug in symcc part of concolic runtime
* stb_image fuzzer with concolic as example fuzzer
* clean up basic_concolic_fuzzer
* clean up and document concolic example fuzzer
* formatting
* clippy
* remove basic_concolic_fuzzer (it is now part of the examples)
* remove the runtime crate in favor of symcc_runtime
* re-architect concolic smoke test and remove git submodules
* remove old submodule directories
* make coverage filter public
* focker docker build
* clippy
* clippy fixes
* fix ubuntu as well
* remove .gitmodules
* move concolic mutational stage into libafl behind feature flag
* script to install dependencies for concolic smoke test
* fix bug
* clippy
* add github action to run smoke test
* fix action
* ensure smoke test is run in correct directory
* remove devcontainer files
* address feedback
* clippy
* more clippy
* address more feedback
Co-authored-by: Dominik Maier <domenukk@gmail.com>
* empty libafl_qemu crate
* fuzzbench qemu fuzzer skeleton
* emu.run() works without bp
* working emu loop
* resolve elf symbols
* running Qemu fuzzer without coverage
* qemu fuzzer with edge coverage
* merge into inprocess::GLOBAL_STATE
* create QemuExecutor and remove QemuEmulator
* qemu hooks and persist edges mapping storing them in State
* windows fix
* add libafl_qemu to workspace
* windows fix
* some clippy
* clippy
* fix fuzzbench_qemu
* fix fuzzbench_qemu makefile
* fuck you macos
* add Forkserver, Pipe Outfile struct
* add forkserver executor struct, and shmem init
* close pipes in the destructor of Forkserver
* fill pre_exec to write out the inputs
* fix
* read_st, write_ctl
* more handshakes
* wrap Pipe in Arc, fill post_exec
* add Forkserver, Pipe Outfile struct
* add forkserver executor struct, and shmem init
* close pipes in the destructor of Forkserver
* fill pre_exec to write out the inputs
* fix
* read_st, write_ctl
* more handshakes
* wrap Pipe in Arc, fill post_exec
* fix for the lastest HasExecHooks trait
* use Dominik's pipe, remove Arc and temporarily pass RawFd to setstdin but trying to figure out other solutions
* add libafl_tests, put a very simple vulnerable program
* fix
* added forkserver_simple (mostly copy-pasted from babyfuzzer)
* fix test
* handle crash in post_exec
* add README.md
* check exec time to see why it's so slow
* remove double invokation of is_interesting for the obejctive
* make forkserver_simple AFL-like and improve speed
* some debugging help
* do not evaluate feedback if solution
* speedup the things
* working input placement via stdin in Forkserver
* don't call panic! but return errors, rewrite some comments
* use AFLplusplus/afl-cc instead of AFL
* use .cur_input like AFL
* bring the test for forkserver back
* add better README.md message
* failing the initial handshake should return an error
* delete some commented-out code
* format
* format
* ForkserverExecutor needs std and is unix-only for now
* clippy
* OutFile error handling
* fmt
* clippy
* don't build libafl_tests on windows
* fix
* keep test in forkserver.rs simple
* add forkserver_test feature for libafl_tests
* format
* some doc
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
* frida_asan: Implemented initial asan runtime library
* frida_asan: Switch to hashbrown
* Implemented GOT-based hooking to isolate the hooking of the memory functions. Implemented initial ASAN instrumentation
* WIP: Shadowing all used memory. Currently tracking pages using a BTreeSet. Slow AF!
* Add SigTrap to unix_signals and inprocess
* Working frida-asan, almost no speed degradation.
Currently the shadow check is reversed, so it checks only that the shadow is not 0.
We need to implement sub-8-byte checking.
* Format
* Cleanup and formatting
* Sub-qword and 16-byte checks implemented; Fixed unaligned access to QWORD
* Pass the ucontext_t to signal handlers. Initial regdump on crash
* Fix typo
* Make the context argument a mut ref
* Add missing files; Implement initial reporting
* Refactor out gothook; Move safety checkers to dynasm
* Get rid of const assembly blobs no longer needed
* Move to a handler function instead of using SIGTRAP.
This bloats the transformed code, but doesn't seem to have a major impact on performance.
Also, implemented pretty backtraces and assembly output.
* Formatting
* Get rid of all the pinning crap I wasted my day on, We don't need it
* windows fixes
* ashmem
* ashmem_service: server side ready
* ashmem_service: client side ready. Ready for integration
* ashmem_service: changes to UnixShMem to make it 'threadable'
* ashmem_service: format
* ashmem_service: Undo changes to UnixShMem, make the thread own the AshmemService instead; Fix protocol bug
* ashmem_service: working ashmem service. Fix merge issues
* use the newly released capston e 0.8.0; Fix a nasty bug where the afl_area an pc_pointer were reversed. Changed Vectors to Boxed [u8]
* Implement type detection for reporting; Implement double-free/unallocated free checking
* fmt
* Cleanup code a little
* frida-asan: This is an omnibus commit. Should probably have been a bunch of small commits, but I don't have the time/patience.
- Implemented DrCov support in order to debug a failing harness. This is actually
generic and should be moved out of libafl_frida.
- Implemented LIBAFL_FRIDA_OPTIONS env var to pass options to the frida helper,
to dynamically enable/disable asan and drcov.
- Implemented memory reuse - after each test case the used pages are recycled and
can be reused in the next test case.
- Implemented and tested vectorized instruction instrumentation.
- Implemented not instrumenting atomic load/store instructions. The cost of
trying to emulate their behaviour is too high at the moment.
- Implemented probing of shadow bit to determine the best match for the current
system.
- Implemented shadow memory pre-mapping where it is available. We probe for this
too.
- Implemented ability to specify a list of modules to instrument on the command
line. This allows fine-grained control of which modules are instrumented for
coverage/asan/drcov.
- Implemented unpoisoning of the Input target_bytes in a pre_exec hook.
- Added support for zero-sized allocations. We return 0x10 bytes at the moment.
- Added all known operator new/delete functions to hooks.
- Added workaround for frida_gum_allocate_near bug.
- Cleaned up reporting, added reporting for different error types.
* frida-asan: Implement leak detection
* Fix merge issues
* Rebased on dev to get llmp/shmem changes; Clippy fixes
* Add FridaOptions struct
* Add the Custom ExitKind; Get rid of Clone/PartialEq on ExitKind
* Make it possible to recover from an ASAN error
* Add SIGTRAP to crashing signals
* Add back (conditional) crashing on Asan errors.
* Fix too-large immediates in add instruction
* Implement RcShMemProvider, finally fix the EOP bug
* Clear ASAN_ERRORS before each test
* Fix warnings; Fix review issues
* Cleanup prints
* Add timeout to Frida mode
* Make allocation-/free-site backtraces optional
* CPU Context and backtrace (on android/aarch64 atm) on crash
* Make stalker conditional
* Add metadata to solution, and write metadata files
* Add addresses to backtrace; Add reporting of ASAN stack errors; Fix ASAN reporting bugs
* Remove meaningless backtrace on crash
* Fix the x0, x1 load in report
* use upstream color-backtrace
* use __builtin_thread_pointer instead of custom asm
* Don't unwrap ASAN_ERRORS if it isn't some
* Fix bug where we weren't clearing the drcov basicblocks after each run
* Fix bug where we were dropping an ashmem too soon
* Fix OwnedPtr instead of CPtr
* Fix gettls for all archs
* cfg guards for target arch, disabling Frida-ASAN/-DrCov if not on aarch64
* Cargo fmt
* Only panic in options when asan/drcov are turned on; Merge fixes
* gothook only supported on unix
* Fix gettls on msvc
* Another attempt to fix MSVC gettls
* Fix backtrace use
* nostd fixes; warning fixes
* formatting
* Migrate FridaEdgeCoverageHelper into libafl_frida, and rename to FridaInstrumentationHelper
* Clean up uses
* Move DrCovWriter to libafl_targets
* Refactor DrCovWriter to get a vec of DrCovBasicBlocks; formatting
* Update to newer backtrace which supports android with gimli
* windows fixes
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: andreafioraldi <andreafioraldi@gmail.com>
* windows fuzzer target and minor changes - breaks android support and maybe linux build
* adapted windows example
* removed warnings from build.rs
* fixed build on unix
* fixed no_std
* build fix, silenced warnings
* no_std warning silenced
* clippy fixes
* fmt
* windows fuzzer target and minor changes - breaks android support and maybe linux build
* adapted windows example
* removed warnings from build.rs
* fixed build on unix
* fixed no_std
* build fix, silenced warnings
* no_std warning silenced
* clippy fixes
* fmt
* clippy
* trying to add clang support
* debugging win build
* debugging win build more
* debuggin..
* debuggin....
* more debugging
* giving up
Co-authored-by: richinseattle <richinseattle@gmail.com>
* inprocess: Allow InProcessExecutor to take a function pointer or a closure
* frida: initial working (but slow + buggy) frida helper
Issues:
- it's slow as ****
- there is an Llmp exception after the 227th corpus entry is found
- Cargo.toml lines currently import from a local ../frida-rust dir, as frida-rust is still under development
* inprocess: let the InProcessExecutor take a closure or a function pointer
* frida: working FridaHelper with InProcessExecutor
* frida: Apply suggestions; Move to RefCell; Cleanup warnings
* frida: link libstdc++_static.a on android
* take an FnMut in InProcessExecutor
* adapt libfuzzer_libpng to FnMut in InProcessExecutor
* create FridaInProcessExecutor and FridaEdgeCoverageHelper
* fix frida build.rs
* frida: move gum to main, get rid of lazy_static; use PageProtection enum
* stalker exclude
* frida: implement inline map-update for x86_64
* inprocess: add harness/harness_mut accessors
* format
* remove get_module_size from FridaEdgeCoverageHelper
* frida: implement aarch64 inline map update
* frida: add missing IndexMode
* add timeouts for executors
* move timeouts to observer
* add with_timeout constructor for Observer
* cast to i64 later in pre_exec
* add cfg(unix) guards
* add TimeoutExecutor
* add TimeoutFeedback and send ExitKind::Timeout from the handler
* pass Duration and move timeout stuff to post_exec
* format
* add timeouts to libpng_libfuzzer
* 10 sec timeout
* timeout executor file
* fix timeout executor no_std
* format
* todos
* Win32ShMem
* win32 exceptions
* fixes
* fix win32 build.rs
* fix win32 build.rs
* fixes fro win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* fixes for win32
* inprocess::windows_exception_handler
* inprocess::windows_exception_handler fixes
* windows_exception_handler in InProcessExecutor
* inprocess::windows_exception_handler fix
* fix windows exceptions mapping
* format
* format
* inprocess: Allow InProcessExecutor to take a function pointer or a closure
* frida: initial working (but slow + buggy) frida helper
Issues:
- it's slow as ****
- there is an Llmp exception after the 227th corpus entry is found
- Cargo.toml lines currently import from a local ../frida-rust dir, as frida-rust is still under development
* inprocess: let the InProcessExecutor take a closure or a function pointer
* frida: Apply suggestions; Move to RefCell; Cleanup warnings
* take an FnMut in InProcessExecutor
* adapt libfuzzer_libpng to FnMut in InProcessExecutor
* reenabled ci for prs
* frida: update to frida-rust 0.3.2
* frida: fix buid errors
* frida: fix build_and_test.yml
* frida: uses crates.io for frida-gum and frida-gum-sys
* fix merge errors
* fix typo
* frida: x86_64 now working
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: toka <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
