983 Commits

Author SHA1 Message Date
2cbd9de2eb change interrupt mutation 2024-05-29 15:49:52 +02:00
4c8a435cfd fix corpuscase dump 2024-05-29 12:32:34 +02:00
Mrmaxmeier
b96b9be674
tutorial fuzzer: switch lain fork to AFLplusplus/lain (#2257) 2024-05-28 20:45:18 +02:00
Mrmaxmeier
7fe43a28e8
fix duplicate package warning (#2258)
warning: skipping duplicate package `fuzzbench` found at `~/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/058e15f/fuzzers/fuzzbench`
2024-05-28 20:45:04 +02:00
Romain Malmain
65af5a7f78
Fix libnyx, library upgrades (#2254)
* try this thing

* this?

* use new mmap signature in nix.

* fix import

* fix to work with addr2line v0.23.

* remove unused flag

* update strum also for dependency...

* clippy

* clippy

* update lain git hash

* bump many outdated crates

* fix hash
2024-05-28 17:15:08 +02:00
Dongjia "toka" Zhang
e6eb6c48d2
LibAFL Dynamic Analysis (#2208)
* aa

* push

* push

* push

* claude ai

* push

* add

* add stuff

* upd

* rdm

* fix

* ci

* fix

* fix

* fixing

* feature

* revert

* no submodules

* ci
2024-05-24 14:43:27 +02:00
Romain Malmain
5fbe2415e1
Generic QEMU snapshot checking (#2240)
* generic snapshot checking.
2024-05-23 22:57:13 +02:00
Dominik Maier
1fafaf6454
Make every Builder ::builder(), so BobTheBuilder::new() becomes BobThe::builder() (#2242)
* Make every builder ::builder()

* Fix no_std

* More

* Fix clippy, stuff

* More fun

* Make NopShMem do something

* Alloc

* more fmt

* Remove UB in tinyinst executor builder

* Make builder order not matter for tinyinst

* More better

* fix

* docs

* fmt

* more fmt

* clippy

* fix fixes

* tiny thing

* more betterg

* more more

* more builder

* more builder

* more nyx

* undo breaking clippy

* clip
2024-05-23 18:56:39 +02:00
35c99fba3a increase max abb count 2024-05-23 16:44:56 +02:00
ffedc1fd41 revert changes to interrupt injection 2024-05-23 10:28:34 +02:00
7701fff969 config fix 2024-05-23 10:25:23 +02:00
de5c16e601 plot micro fixes 2024-05-23 10:16:28 +02:00
83e9a29d12 skip dumping every trace 2024-05-23 10:15:25 +02:00
35716cc4be fix initial corpus 2024-05-22 22:36:00 +02:00
915da3fb42 fix config 2024-05-22 22:27:04 +02:00
5901e3d9c5 prioritize long tarces 2024-05-22 22:18:56 +02:00
bde16f8297 scheduler, mutator changes 2024-05-22 21:54:07 +02:00
c533b7e184 change interrupt injection timing, stg scheduler 2024-05-22 13:52:13 +02:00
Dongjia "toka" Zhang
336d7fcc4f
Refactor events/llmp.rs (#2234)
* push

* refactor

* FMT

* fixes

* aaaaaa

* done

* aa

* docdoc

* rename

* no std

* nautilus

* feature fix

* aa

---------

Co-authored-by: Your Name <you@example.com>
2024-05-22 12:58:44 +02:00
Dominik Maier
684b31279e
Add BytesSubInput to mutate sub-parts of a bytes-backed input (#2220)
* Add BytesSubMutator that allows us to mutate sub-parts of a bytes-backed input

* no_std

* fix string mutator

* make build

* Fix clippy on macOS

* Docs

* More docs

* Better docs

* --amend

* Renamed bsi to sub_input. Too much BSI

* More more

* balance backticks

* Make splicing usable with sub_input (not that it makes sense)

* More annotations

* more input annotations?

* Implement HasMutatorBytes for &mut Vec

* clippy

* Use a wrapper type instead

* Add wrapper type for Vec as well

* Remove the duplicate BytesInput... lol
2024-05-22 01:50:07 +02:00
5342812cf7 build fixes 2024-05-21 18:50:55 +02:00
71ff7487e6 add feature dependencies 2024-05-21 18:48:46 +02:00
54fa7cce62 add edge filter 2024-05-21 18:47:12 +02:00
b9b6e1fc12 fix snakefile 2024-05-21 18:33:15 +02:00
e9c27b3065 fixes timing, scheduler 2024-05-21 18:24:23 +02:00
2886aafb65 remove dead code, restructure features 2024-05-21 16:06:53 +02:00
Dongjia "toka" Zhang
19ef29ed60
New forkserver (#2213)
* step 1

* done

* cmplog?

* targets

* check if working and add env_logger

* typo
2024-05-21 15:20:28 +02:00
3ed8ccd0c7 exclude QemuSystemStateObserver when not needed 2024-05-21 13:03:55 +02:00
7d8717ff15 remove shortcut cases and assertions from state 2024-05-21 12:59:56 +02:00
87ddf4a77d work around rare non-started abbs 2024-05-21 12:43:03 +02:00
3444fdd8ec fix interrupt shifter, isr tracer 2024-05-21 12:32:00 +02:00
f13412c175 fix interrupt shifter 2024-05-21 09:03:11 +02:00
ede6cf48a4 fix build 2024-05-21 01:57:23 +02:00
5edb6e5677 fix snakefile 2024-05-21 01:51:54 +02:00
21c97c8484 WIP: fix isr_starter 2024-05-21 00:22:50 +02:00
b9d6f41ac6 WIP: deprecate graph and use STG 2024-05-20 10:54:43 +02:00
s1341
864c2259e7
launcher: add launch_delay option (#2227)
* launcher: add launch_delay option

* Centralized too

* Use in test

* Undo

* Windows too

* Format

* Fix cfg guard
2024-05-20 10:06:33 +03:00
Dominik Maier
30f65512d8
Remove unused dependencies (#2221)
* Remove unused dependencies

* Add guard
2024-05-20 02:30:53 +02:00
Romain Malmain
dfd3b3278e
QEMU command system refactoring (#2189)
* implemented generic command builder

* Added builder to `Emulator`.
2024-05-18 20:43:56 +02:00
8f652f754c WIP: complet rework of STG 2024-05-17 15:57:44 +02:00
Dongjia "toka" Zhang
c7303ace53
Static analysis pass (#2178)
* copy

* fmt

* aa

* a

* Goodbye z3, i hope i won't build you forever

* doc

* fmt
2024-05-15 16:50:20 +02:00
s1341
19087f3dab
Windows frida support (#1607)
* WIP: windows frida

* frida-windows: fix hooks not present on windows

* windows: allow building using cargo xwin

* frida-windows: fmrt

* frida-windows: cleanup and allow asan/drcov on windows

* frida-windows: fmt

* frida-windows: fix clippy

* frida-windows: handle unknown exceptions gracefully

* frida-windows: rework shadow mapping algo

* frida-windows: add hook functions

* frida-windows: hook functions; fix stack register

* minibsod: enable for windows

* check_shadow: fix edge casees

* asan_rt: rework and add hooks for windows

* inprocess: add minibsod on windows

* Fix warnings

* minibsod: disable test on windows

* WIP: HookRuntime

* Cleanup after merge

* Bump frida-gum version

* Fix conflict marker; update frida

* Make winsafe windows-specific

* Fmt

* Format

* Better detection of clang++ (using cc)

* Make AsanErrors crate public so we can use it in tests

* Add helper to get immediate of operand

* Use HookRuntime to hook asan functions

Tests now passing

* fmt

* Implement recurisve jmp resolve

* Fix reversed logic

* windows_hooks: Don't die if functions are already replaced

* Allow utils to work on windows

* Enable allocator hooking on windows

* Warnings; add trace to free

* Make ASAN tests run windows (with cargo xwin compilation)

* Fmt

* clang-format

* clang-format

* Add more tests

* Fix partial range access bug in unpoisoning/shadow_check

* Merge main

* Fix check_shadow and implement unit tests

* Fix hooking and PC retrieval

* WIP: Working gdiplus fuzzing with frida-ASAN, no false positives

* LibAFL Frida asan_rt and hook_rt fixes for frida_windows (#2095)

* Introduce aarch64

* MacOS fix - MemoryAreas is broken on MacOS and just loops

* Introduce working aarch64 ASAN check

* Implement large blob

* Fix hook_rt for arm64

* Fix poison/unpoison

* Fix shadow check

* Update x86-64

* Fix aarch64 unused import

* Remove extraneous println statement

* merge main

* Fixes

* alloc: add tests, pass the tests

* HookRuntime before AsanRuntime, and don't Asan if Hooked

* hook_rt: Fixes

* Frida windows check shadow fix (#2159)

* Fix check_shadow and add additional tests

* add some additional documentation

* Revert to Interceptor based hooks

* fixes

* format

* Get rid of hook_rt; fixes

* clang-format

* clang-format

* Fix with_threshold

* fixes

* fix build.rs

* fmt

* Fix offset to RDI on stack

* Fix clippy

* Fix build.rs

* clippy

* hook MapViewOfFile

* fmt

* fix

* clippy

* clippy

* Missing brace

* fix

* Clippy

* fomrrat

* fix i64 cast

* clippy exclude

* too many lines

* Undo merge fails

* fmt

* move debug print

* Fix some frida things

* Remove unused frida_to_cs fn for aarch64

* name

* Don't touch libafl_qemu

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Sharad Khanna <sharad@mineo333.dev>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Dominik Maier <dmnk@google.com>
2024-05-14 10:45:56 +02:00
Dongjia "toka" Zhang
bf4d1de7cd
Remove observer_stdout/observer_stderr from Observer trait (#2167)
* stuff

* upd

* cargo test

* doc

* fmt

* nyx stuff
2024-05-13 17:10:55 +02:00
ba3850cf4d remove stg feedback from systemstate flag 2024-05-08 12:49:40 +02:00
3f9a2ed6c0 trace executed abbs, instead of states 2024-05-08 12:30:10 +02:00
Dominik Maier
c97c8cf83e
Rename Handler -> Handled, various other cleanups after #2142 (#2152)
* Handle name cleanup after #2142

* Handleable -> CanBeHandled

* CanBeHandled -> Handled

* clippy

* forgot one

* Handled more
2024-05-07 19:23:13 +02:00
Romain Malmain
bed500471a
QEMU generic memory iterator (#2148)
* QEMU generic memory iterator + Refactoring

* Generic Memory Iterator (systemmode only for now): It is now possible to iterator over memory ranges, independently of the address kind

* Refactoring or Emulator / Qemu structures: they are now handled separately in different files

* Refactoring of Exit Handlers: Result / Error structs have been clarified

* Simple handler for signals

* add new `check-cfg` calls for libafl qemu
2024-05-07 10:46:15 +02:00
88c5c8a19f feedback for aggregated traces 2024-05-06 16:00:11 +02:00
0393f18a47 add stg edge feedback 2024-05-06 14:46:35 +02:00
Dongjia "toka" Zhang
d4ff7b86b1
Add windows test & ci & fix (#2144)
* fix

* ignore

* fmt

* a
2024-05-05 14:53:27 +02:00