983 Commits

Author SHA1 Message Date
c013628017 fix scheduler for storage changes 2024-03-28 14:14:34 +01:00
730fbcf6d4 fix capture in api calls 2024-03-27 15:24:44 +01:00
Dongjia "toka" Zhang
f0ee6e0587
Make fuzzer examples's argument parser tell that --input is mandatory (#1973)
* add

* not ture

* fmt
2024-03-26 20:02:42 +01:00
Maurice
a0d4a5b240
libafl_nyx: Add documentation to NyxSettings fields 2024-03-23 15:20:35 +01:00
Romain Malmain
44c841ffb1
WIP: QEMU exit handler (#1745)
* Added paging filtering.
Reworked address range filtering to fit with new generic code.

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Renamed sync breakpoint to sync exit.

* Split emu in systemmode.rs / usermode.rs for specific code.
EmuExitHandler implementation.

* sync_backdoor.rs removal.
Formatting.

* Updated `bindgen` and `which`.
Adapting code to work with update.

* fix: reconfigure cleanly if prior configure was interrupted abruptly.

* Enable sanitizers in QEMU during debug.

* Added target-usable files.

* Added breakpoint structure.

* Adapted other files to work with ExitHandler.

* Adapted existing fuzzer to work with new exit handler.

* fix: use get to avoid crashes.

* Updated README to indicate cargo-make should be installed.

* Added QEMU internal exit handler.

* Adapted qemu_systemmode example with new exit handler.

* Fixed fuzzers to work with new exit handler.

* Trying to fix CI (#1739)

* test

* dummy

* dummy

* Added new examples.

* Forgot to add build scripts.

* format

* format

* clang-format

* python emulator adaptation.

* fixed python bindings.

* clippy fixes.

* python bindings.

* fix qemu_sugar.

* fix fuzzbench.

* fixed import issues.

* misc fixes.

* renamed crate.

* Updated x86_64 stub bindings.

* Fixed static naming.

* binding fmt

* clippy

* clippy

* Removed useless return statement.

* removed advice to install cargo-make in individual repositories.

* symcc_update (#1749)

* Remove unused create_anymap_for_trait macro (fixes #1719) (#1752)

* Fix `as_object` UB discussed in #1748 (#1751)

* Fix as_object UB discussed in #1748

* More cleanup, more less UB

* Fix fixes

* Added uninit_on_shmem api

* clippy

* fmt

* trying to fix fuzzers, libfuzzer wrapper

* Add OwnedRefMit::owned constructor, libfuzzer fix

* Some more fixes

* Add BacktaceObserver::owned fn

* fmt

* more fmt

* Ignore SigPipe by default (#1741)

* Ignore SigPipe by default

* Fix no_std

* fmt

* Fix incorrect imports (#1758)

* Fix incorrect imports

https://doc.rust-lang.org/core/simd/trait.SimdOrd.html

* Fix

* Try fix ci

* Documentation fixes (#1761)

* Documentation fixes

* Fix InProcessExecutor url

* Update all urls to latest

* Miri ignores for M1 regex (#1762)

* Enabling DrCov on Windows (#1765)

* Enabling DrCov for Windows

* Dedup common code in scheduler (#1702)

* dedup common code in scheduler

* del eco

* fixing

* fix

* replace `Emulator::new_empty` by `Emulator::get` calls outside of `emu.rs` for safety. (#1763)

* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, and more (#1754)

* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, set_error_print_panic_hook

* Trying to fix #1753

* typo

* More fix

* Fix test?

* more testcase fixes

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Split emu in systemmode.rs / usermode.rs for specific code.
EmuExitHandler implementation.

* format

* format

* format

* Replace sync_exit with sync_backdoor.

* Rework command system.

* fix bad import.

* format.

* cargo fmt

* disable af-xdp as well to avoid linking errors.

* End of merging.

* format.

* Adaptation for usermode.

* format.

* injection support.

* usermode fixes.
format.

* clippy

* clippy + format

* Do not unwrap emu + format.

* fix: entry_point breakpoint

* inital commit.

* clippy

* tests

* clippy

* adapt example

* systemmode.

* renaming

* fmt

* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.

* merge continue.

* renamed modules as well.

* fixing merge.

* systemmode compiling.

* fmt

* fix early emulator drop.

* fmt

* fix cast to c_void of the wrong object.

* Added global enum for snapshot managers.
Some renaming.

* move things around.

* WIP: generic inclusion of QEMU Executor in exit handler.

* * Moved extern calls to `libafl_qemu_sys`
* Replaced old `Emulator` by `Qemu` and only kept C functions wrappers
* Now `Emulator` is for higher-level interactions with QEMU. Kept old functions for compatibility calling to `Qemu` functions
* A direct side effect of this slit is the removal of the `IsEmuExitHandler` trait dependency added in many parts of the code.
* Removed old dirty casting for `QemuExecutor` helpers and used the brand-new access to `QemuExecutorState` instead.
* Minor changes to `Qemu` and `Emulator` `get` methods for cleaner getters.

* Add missing `Qemu` function.

* Updated `qemu_systemmode` example.

* Adapted QEMU fuzzers + renaming.

* Fixed python.

* fix libafl_sugar with new implementation.

* fix dangling RefCell.
adapt new examples.
TODO: merge `libafl_systemmode.*` examples.

* clippy.

* fix more fuzzers.

* clippy.

* Implement `HasInstrumentationFilter` generically.
Updated `StdInstrumentationFilter` accordingly.

* Renamed breakpoint functions for QEMU.
`qemu.run()` handling.

* Removed OnceCell / RefCell in signature.
more explicit `MmapPerms` method names.

* minor code refactoring

* Emulator::run_handle refactoring

* deprecated Emulator functions calling directly to QEMU functions.

* IsSnapshotManager -> SnapshotManager

* IsEmuExitHandler -> EmuExitHandler + fmt

* Generic register when it makes sense.

* reverted IsSnapshotManager -> SnapshotManager because of a collision.

* fix syntax + clippy

* fmt

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: lazymio <mio@lazym.io>
Co-authored-by: Bet4 <0xbet4@gmail.com>
Co-authored-by: mkravchik <mkravchik@hotmail.com>
2024-03-22 18:03:29 +01:00
Maurice
50843b19d1
libafl_nyx: Allow custom input buffer size to be passed to NyxHelper (#1960)
* add option to specify input buffer size

* fix typo

* use `libafl::Error` as default error type

* derive `TypedBuilder` for `NyxSettings`

* update nyx_libxml2_standalone

* update nyx_libxml2_parallel

* update nyx_libxml2_standalone

* update nyx_libxml2_standalone

* update nyx_libxml2_parallel
2024-03-21 22:53:01 +01:00
Dongjia "toka" Zhang
6b94db2260
Use OwnedPtr in ListObserver (#1961)
* aaa

* clp
2024-03-21 19:46:42 +01:00
Dongjia "toka" Zhang
15f4613894
More usable ListFeedback (#1959)
* real list feedback

* add

* fox

* obs

* fix

* FMT

* more

* fmt

* rev
2024-03-21 16:21:15 +01:00
am009
5eab4fb78b
Update tinyinst_simple to support Linux (#1316) (#1955)
* Make fuzzers/tinyinst_simple support Linux (#1316)

Fix a documentation error for `MmapShMemProvider`.

* Support shmem for `fuzzers/tinyinst_simple` on Linux.

Format code.

* Fix CI to install cxxbridge-cmd.

* Add `CARGO_TARGET_DIR` in makefile to fix CI.
2024-03-19 20:15:07 +01:00
Michael Chen
fde9cda5ee
Gramatron: Upgrade automaton files (#1956)
`auto.postcard` file is following `postcard@0.7` wire format, which is
not compatible with the `postcard@1.0` dependency. `auto.json` is out of
date with the latest `Trigger` struct definition. Regenerated both using
the data from `auto.postcard`
2024-03-19 20:09:47 +01:00
Romain Malmain
928cf80782
fix unwrap. (#1954) 2024-03-18 18:51:19 +01:00
Dongjia "toka" Zhang
0f26f6ea32
Remove useless feedback (#1953)
* stuff

* FMT

* remove stuff
2024-03-18 16:41:43 +01:00
Dongjia "toka" Zhang
ee6385c25b
Fire events in append_metadata not in is_interesting (#1936)
* stuff

* ok

* Recalc filled slightly differently... (#1939)

* Recalc filled slightly differently...

* Make requested changes as per PR review

* unused

* fix

---------

Co-authored-by: Dan Blackwell <danblackwell95@yahoo.co.uk>
2024-03-15 13:24:26 +01:00
Dominik Maier
04d87ccc89
Remove (almost) unused stage_idx (#1929)
* Remove (almost) unused stage_idx

* Fix text-based test

* fixed critical whitespace

* clippy

* more fmt

* fix push stage
2024-03-14 13:14:57 +01:00
Dongjia "toka" Zhang
afa2965f3c
Remove some arguments from pre_exec/post_exec in ExecutorHook (#1933)
* refactor

* no std, fmt

* win mac

* state

* frida

* ctx

* trait bound

* clip
2024-03-13 18:49:09 +01:00
Dominik Maier
2763d945a3
Cleanup last redundant corpus_idx usages (#1930)
* Cleanup last redundant corpus_idx usages

* More cleanup
2024-03-13 01:24:11 +01:00
Dongjia "toka" Zhang
5f67b9fbc4
Event Manager handle_in_client hooks (#1916)
* event manager hooks

* tcp

* fix

* FMT

* fix

* fix
2024-03-12 14:39:16 +01:00
Dominik Maier
dd410c590a
Allow dyn in StagesTuple, add Current Testcase API, Untraitify Progress (#1915)
* Move into_vec to extra trait

* fix no_std

* First step towards stages tuples as vecs

* Allow dyn in StagesTuple, add Current Testcase API, un-traitify Progress, cleanups

* Move from generics to impl keyword, more replacements with better API

* rename fn

* Fix additional stages, more cleanup, rename progress to retries

* Fix more fixes

* Fixes

* Rename ProgressHelper -> RestartHelper

* Fix sugar, python, add perform_restartable

* fixes

* remove prelude bs

* rename to restart_progress_should_run

* more cleanup, remove tests I don't understand (sorry)

* fix docs

* more fix

* fix miri

* unsafe safety annotations

* more comments

* last docs

* Mixed_attributes only allowed for bindgen
2024-03-12 00:58:07 +01:00
7e79f4051d clean trace from ISRs without effect, prevent race-conditions 2024-03-09 13:41:26 +01:00
6793d48dbd extract ABBs 2024-03-08 14:04:23 +01:00
Aarnav
d6fe67c3c8
Introduce multicore loading for the initial seed corpus (#1905)
* introduce multicore load initial corpus

* update fuzzers/libfuzzer_libpng_norestart to use multicore corpus loading

* run clippy

* use CoreId and Cores in state if std

* misc. typos

* adapt multicore load initial inputs to allow resumable corpus loading
in case of crashes or timeouts during corpus loading.

* add std feature flag to multicore_inputs_processed

* fix doc comment

* run fmt for example fuzzer

---------

Co-authored-by: aarnav <aarnav@srlabs.de>
Co-authored-by: Romain Malmain <romain.malmain@pm.me>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-03-08 02:56:08 +01:00
Mrmaxmeier
e48c8c0e23
fuzzbench_ctx: fix duplicate package warning (#1918)
Cargo previously complained when loading libafl as a git dependency:

warning: skipping duplicate package `fuzzbench` found at
`~/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/55a300d/fuzzers/fuzzbench`
2024-03-07 17:56:40 +01:00
Dongjia "toka" Zhang
9a2e7b0e64
Fix redundant xor in Ngram calculation (#1901)
* fix double xor

* tmp

* clp

* no notnightly

* fix

* plural
2024-03-07 14:49:01 +01:00
Romain Malmain
55a300d508
Make executor state available to the harness V2 (#1900)
* inital commit.

* clippy

* tests

* clippy

* adapt example

* systemmode.

* renaming

* fmt

* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.

* renamed modules as well.
2024-03-05 19:28:46 +01:00
a045b7bcd6 track api calls and isrs 2024-03-05 09:56:13 +01:00
Dongjia "toka" Zhang
1a41e65a5b
Sancov based ngram & ctx implementation (#1864)
* ngram

* ctx

* push stuff

* passing cargo check

* save stuf

* add

* no default

* fuzzbench ready

* formatt

* aaaaaaaa

* adaptive map

* add all

* chg

* fix

* deleting stuff

* fmt

* clang18

* fuck

* save space

* fix?

* feature name

* fucking nightly only

* harness

* fix libafl_cc

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-03-01 13:59:13 +01:00
5d9bcba0e6 break on all api functions 2024-02-26 08:40:07 +01:00
Dongjia "toka" Zhang
1dcfe8ef56
Make the map size larger for some of the example fuzzers (#1879) 2024-02-23 17:19:00 +01:00
Dongjia "toka" Zhang
b97598d239
Windows fix (#1876)
* win fix

* just some ci

* test

* revert

* aaaaa

* bbbbbb
2024-02-22 14:56:30 +01:00
3817892ff1 Fix graph output formatting 2024-02-13 08:28:53 +01:00
Dominik Maier
dede78159c
Remove unused shmem structs, update Nix (#1845)
* Remove unused shmem structs

* More unused stuff

* Unified crate versions, updated docker rust version

* clean up nix 27 mess?

* Windows?

* Fix frida

* Fix frida

* fix fuzzers with nix
2024-02-11 17:45:09 +01:00
Niklas Gögge
15c98de52f
fuzzers: Fix qemu_launcher zlib include path (#1841) 2024-02-08 13:08:36 +01:00
beee8d8cb7 rewrite info dumps as macros 2024-02-08 10:08:25 +01:00
Nereuxofficial
5c18dca792
Fixed Link in baby_fuzzer_nautilus (#1824) 2024-02-01 12:07:13 +01:00
Dongjia "toka" Zhang
a4f753b0f0
Merge TimeoutForkserverExecutor into ForkserverExecutor (#1819)
* delete timeout forkserver

* clippies

* name

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-01-30 17:34:39 +01:00
Dominik Maier
244c6b0da5
QEMU: Fix injections build for hexagon, disable on system mode (#1821)
* Fix CI for Clippy, QEMU

* Clippy, fixes for system mode

* clippy

* clippy

* fixing new clippy
2024-01-30 04:25:14 +01:00
Rubens Brandão
59945fbcc9
Fix typo on qemu_launcher options help message (#1816) 2024-01-25 13:50:20 +01:00
Dominik Maier
6a0ba7b647
Add SimpleMgr feature to qemu_launcher (#1790) 2024-01-24 17:54:52 +01:00
Dongjia "toka" Zhang
2ac154d473
Refactor InProcessExecutor, merge timeout executors (#1789)
* move windows, inprocess fork to a different file, try new hook mechanism for the executor

* fix

* even more

* more

* more

* fix

* fix

* macosgit add -ugit add -u

* windows!

* windows!

* aa

* aa

* macos

* std

* wtf unresolved?

* Copy, Clone

* why you just don't have the same API!

* inproc

* next; inprocess

* windows?

* ci

* ci

* ci

* unused

* ci

* unused

* no_std

* windows no std

* fix

* inprocess

* fix

* windows

* fuzzers

* macos , book

* fix

* aa

* allow

* fix

* stop suggesting wrong lint AAAAAAAAAAAAAAAAA!!!

* stop suggesting wrong lint AAAAAAAAAAAAAAAAA!!!

* win

* fix

* wip

* wip2

* windows done?

* remove TimeoutExecutor

* ci

* ci

* miri

* fixfi

* compile on windows

* a

* clp

* no_std stuff

* windows no_std

* mac stuff

* m

* a

* ci

* ci

* deleting timeoutexecutor, gradually

* fucking macos

* ci

* test

* ci

* ci

* batch mode constructor

* fix

* ci

* aa

* miri

* aaa

* tmate again

* fix windows stuff

* final fix

* another win fix

* add

* let's add the new fix later

* more

* fi

* parse

* win clippy

* win no std

* safety

* fix

* DEFAULT

* final fix

* libafl_libfuzzer

* comments

* fix

* fix fuzzres

* fixxxxx

* fixxxxx

* last fix

* change name
2024-01-23 22:35:14 +01:00
expend20
72c862171e
POC attempt to make cmplog work on x64 (#1713)
* POC attempt to make cmplog work on x64

windows POC seems working

unix POC seems working :)

* no register collisions
* rsp-related ref support

iced optional dep

iced depends on cmplog

warnings

one more warning

comments cleanup

ci unbreak

rebase windows unbreak

rebase unix unbreak

unix only

fmt check

clang formatting

clang formatting again

make clippy happy

formatting

double import

windows unbreak

hashmap is conditional

leftover definition

tutorial related formatter

review fixes

comments

.asm fuzz targets for cmplog on Windows

more tests

rip-relative reference support without index register form

proper ignore rip-related references and ignore 8 bit comparisons

another try_into packing

* harness modification reverted

* dummy commit to restart CI

* review comments

---------

Co-authored-by: sbarsky <sbarsky@denuvo.com>
Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2024-01-19 11:52:15 +01:00
WorksButNotTested
e615cb4aed
Disable QemuInjectionHelper if not configured (#1804)
Co-authored-by: Your Name <you@example.com>
2024-01-18 18:53:42 +01:00
Dongjia "toka" Zhang
001e132186
Fix windows after #1350 (#1801)
* fix

* apt update

* apt update

* a

* split even more

* tmate

* ci

* can't fix this shit

* s
2024-01-17 18:51:56 +01:00
2ac7874895 fix build 2024-01-16 15:53:57 +01:00
mkravchik
b93a5bb414
Pr/fix qemu launcher build - fixes 1785 (#1786)
* Fixing qemu_launcher build (#1785)

* Fixed the instructions for using the injection feature
2024-01-10 13:17:53 +01:00
van Hauser
0f2cf80085
libafl_qemu injections (#1743)
* nits

* first steps

* different approach

* fixes

* remove temps

* remove temp

* initial import

* more tests

* bug hunt

* cleanup

* yaml function target 0x.... support

* final

* update doc

* other work

* Clippy, fmt

* Removed lazystatic dependency

* More small cleanups

* optimize to_lowercase

* move funtionality to libafl_qemu

* add missing file

* ready

* remove qemu_injections

* move test files to test directory

* doc update

* add todos

* fixes

* add file comment

* add test and other platform support

* fix clippy

* Replace Emulator::new_empty by Emulator::get.
Fix visibility identifier.

* clippy

* let's try this

* cpu_target?

* fmt

* cleanup build system, enable missing fuzzers

* fix qemu_launcher

* enable hexagon in qemu_launcher

* Removed useless `any` predicate in cfg attribute.
Replaced wrong types in `syscall_hook` signature.

* format

* move to read_function_argument

* add hexagon injections support

* enable injections fuzzing everywhere

* unify error msg

* Fix build, add initial toml support

* intermediate push, wip

* fix build

* More WIP

* Fix build

* Clippy

* fix qemu

* Fix arm

* fix more wrong things

* fix testcase

* try to fix it again?

* more release?

* make makefile independent of dev/release

* trying more fix?

* More ugly more works

* more trying to fix the testcase

* allow yml as filename too

* more docs

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
Co-authored-by: Romain Malmain <romain.malmain@pm.me>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2024-01-09 19:56:19 +01:00
Addison Crump
ba8ca6723b
Resumable stages redux (#1780)
* initial stage refactor

* repair test

* redqueen

* fixup python bindings

* docs and clippy fixes

* misc hidden changes

* Status => Progress

* fix remaining fuzzers

* fix libafl_libfuzzer

* implement resume for nested stages

* deep testing for stage resumeability

* refactor: use let-else, docfix

* refactor in fuzzbench_forkserver_cmplog

* fmt

* actually use progress

* HasStageStatus => HasCurrentStage
2024-01-09 15:18:14 +01:00
Addison Crump
99fd69acdc
Multipart Input support (#1617)
* initial commit: multipart

* document + wrap up baby fuzzer

* oops

* core

* add from method, option to iter

* improve example; use minmap; fix initial_mut

* bindings

* clippy, again

* moar clippy

* fmt

* drop rand dep because we don't need it, actually

* docfix

* ok actually fix docs pls
2024-01-04 01:51:29 +01:00
Konstantin Bücheler
9b2a17896f
Fix export of afl-clang-fast if already in PATH (#1773) 2024-01-03 23:22:42 +01:00
Dominik Maier
d143cac663
Fix atheris fmt, clippy (#1769) 2024-01-02 23:12:37 +01:00
Dominik Maier
925b33889f
LibAFL Atheris Compatibility (#1576)
* Made changes to libafl_atheris/src/lib.rs to work with Atheris

* Removed unused imports

* Ran  on libafl_atheris

* Fixed issue with using extra_counters and issue with using println

---------

Co-authored-by: eceo902 <evan.seeyave@gmail.com>
Co-authored-by: Evan <53020947+eceo902@users.noreply.github.com>
2024-01-02 22:18:34 +01:00