2822 Commits

Author SHA1 Message Date
Dongjia "toka" Zhang
e8fe5bb614
Move HasMetadata/HasNamedMetadata trait to libafl_bolts (#2016)
* move around

* fmt

* rev

* fmt

* doc job

* name

* move to libafl

* separate even more

* miri
2024-04-08 19:24:56 +02:00
Dominik Maier
ff938261df
Fix Clippy on MacOS for qemu, accept some clippy::missing_transmute_annotations suggestions (#2009)
* Fix Clippy/CI

* Ignore transmute annotations in pybind

* fix

* more clippy

* more clippy

* fix fixes
2024-04-08 16:24:10 +02:00
Dongjia "toka" Zhang
fa58dff4b7
concurrency (#2017) 2024-04-08 15:20:42 +02:00
Andrea Fioraldi
e29897dd44
Fix GuestMaps in userspace LibAFL QEMU (#2013) 2024-04-08 08:30:23 +02:00
Dongjia "toka" Zhang
159da0d311
Change when weighted scheduler make new table & don't update global metadata in on_remove/on_replace (#2011)
* fix

* backtick
2024-04-07 17:24:27 +02:00
Dongjia "toka" Zhang
527b892c1d
Separate fuzzer test in CI (#2010)
* ci

* ci

* ci

* aa

* aa

* a

* a

* a

* fix

* no fail fast

* system

* what is this lint...

* a

* clp

* disk

* ok no fastfail

* no qemu for now, reenable monday
2024-04-06 21:01:57 +02:00
Dongjia "toka" Zhang
4901846588
Remove python bindings (#2005)
* delete python bindings

* fix

* example

* fix
2024-04-06 15:16:46 +02:00
Tobias Mayer
24fd098e66
Update Dockerfile to work for nyx (#2008)
Missing file to build libafl_nyx in Docker
2024-04-06 04:48:50 +02:00
Dongjia "toka" Zhang
17aae94efc
Move some C functions to Rust from sancov_cmp.c (#2003)
* some

* a

* clp

* aa

* just new line

* fix

* fxi

* fix
2024-04-06 01:03:01 +02:00
Dongjia "toka" Zhang
90c627a7e7
revert large map (#2004) 2024-04-05 17:06:47 +02:00
Dominik Maier
1c85c3af13
Add option to enabled/disable client stats and fix #1771 (#2001)
* Add option to enabled/disable client stats and fix #1771

* more fix

* fix map_density

* even more fix

* remove need for vec in Aggregator::aggregate

* fix json weirdness - remove individual clients (is that all right? )

* Make pretty
2024-04-05 14:23:56 +02:00
Dongjia "toka" Zhang
98d3dfe821
Replace LLMP client timeout with client deregistration (#1982)
* wip

* done

* fix

* fix

* some fixes

* stuff

* fmt

* stuff

* use

* not 1337

* comment

* move functions around

* fix

* fix

* doc

* mistake

* aa

* fixer

* wipe out restarter id

* denig

* fix

* fix

* include

* fix

* fix

* fix

* clp

* fix

* fix

* error log
2024-04-04 21:01:11 +02:00
Dominik Maier
e64233e203
LLMP: Fix page-size where allocated message is larger than the current map (#1997) 2024-04-03 13:27:19 +02:00
Romain Malmain
50be2f4aaf
Fix of libafl qemu runtime files (#1996)
* Change naming and fix LibAFLQEMU header file. Fix and document LibAFL QEMU Windows ASM file.

* fmt
2024-04-03 11:57:48 +02:00
Dominik Maier
d90d232e7a
Frida: Move ASAN_ERRORS values into a Mutex for shared access (#1995)
* Move ASAN_ERRORS values into a Mutex for shared access

* Fix frida doc

* oops

* clippy
2024-04-03 11:47:09 +02:00
f26582ed75 un-hardcode rtos api functions 2024-04-03 10:19:37 +02:00
Dongjia "toka" Zhang
2137ad0f8f
Don't resume in std mutational stage (#1946)
* fix

* fix

* fix

* fix

* FMT

* don't resume in mutational stage
2024-04-02 13:26:47 +02:00
Dominik Maier
44dca17a6c
Tiny Frida doc fix (#1994) 2024-04-02 13:25:59 +02:00
Romain Malmain
cca4e3daa9
Make inputs in libafl_qemu generic (#1991)
* fix non-generic input in libafl_qemu

* Update setup_libxml2.sh of nyx_libxml2_standalone fuzzer (#1990)

On testing this on my machine not all neccessary files for fuzzing with nyx where provided by the setup. Compared to the nyx_libxml2_parallel fuzzer this packer generation line was missing.
After adding this the fuzzer was able to start.

---------

Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Tobias Mayer <arbeitskraftmayer@gmail.com>
2024-04-02 12:30:12 +02:00
Dominik Maier
aaafe1fc6c
Use new Rust CStr constant (#1993) 2024-04-02 10:28:20 +02:00
Tobias Mayer
63a6d1aac0
Update setup_libxml2.sh of nyx_libxml2_standalone fuzzer (#1990)
On testing this on my machine not all neccessary files for fuzzing with nyx where provided by the setup. Compared to the nyx_libxml2_parallel fuzzer this packer generation line was missing.
After adding this the fuzzer was able to start.
2024-04-02 10:19:22 +02:00
Dominik Maier
26122b20a0
Add unsafe to AsanErrorsObserver, fix UBs, fix Frida Version missmatch (#1987)
* Add unsafe to AsanErrorsObserver, fix UBs, fix Frida Version missmatch

* Clippy

* simpler API

* fix build

* fix
2024-04-02 10:17:59 +02:00
ToSeven
10f373d587
fix AFL-Style UI errors when allowing the introspection feature (#1986) 2024-04-01 14:09:15 +02:00
Andrea Fioraldi
45d47214c2
Fix OOM restarts with LlmpShouldSaveState (#1974)
* LlmpSaveState and OOM restarts

* clippy

* clippy

* rename
2024-03-30 17:05:03 +01:00
Romain Malmain
69d7d7b1e3
Add backdoors to portable header file of LibAFL QEMU. (#1978)
* Added backdoors to portable header file.

* fix arm macros.

* copy `libafl_qemu.h` in target directory.

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2024-03-30 17:04:52 +01:00
Romain Malmain
50e0f80d1e
Refactoring of qemu_systemmode fuzzers (#1980)
* Added backdoors to portable header file.

* fix arm macros.

* copy `libafl_qemu.h` in target directory.

* Merged all qemu_systemmode examples into one, settable with features.
Automatic building using `Makefile.toml`

* fix typo.

* added test of QEMU systemmode fuzzers.

* replace test by build for now.
2024-03-30 17:04:37 +01:00
Dongjia "toka" Zhang
0cafa5c72d
Don't use unwrap() in the crash handler (#1979)
* don't

* win

* fix

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2024-03-30 17:04:28 +01:00
Marco C
15aabfe65d
Clean up warnings in baby_fuzzers (#1981) 2024-03-29 15:14:17 +01:00
s1341
1fc5ba63fa
batch_timeout: fix overflowing subtraction (#1976) 2024-03-28 16:50:12 +01:00
c013628017 fix scheduler for storage changes 2024-03-28 14:14:34 +01:00
am009
c221108916
Add MutatedTransform to the input type in TMinMutationalStage (#1251) (#1971)
* Support `MutatedTransform` in `TMinMutationalStage`.

* Run `MutatedTransformPost` for the replaced testcase.

* Add clone trait bound for `MutatedTransformPost`.

* Return an error instead of using unwrap.
2024-03-27 18:59:45 +01:00
730fbcf6d4 fix capture in api calls 2024-03-27 15:24:44 +01:00
Dongjia "toka" Zhang
f0ee6e0587
Make fuzzer examples's argument parser tell that --input is mandatory (#1973)
* add

* not ture

* fmt
2024-03-26 20:02:42 +01:00
Dongjia "toka" Zhang
cd12546748
Fix llvm api so it works with older LLVM version (#1964)
* aa

* fix

* fix

* fmt

* fmt
2024-03-26 19:26:19 +01:00
Dongjia "toka" Zhang
91778961da
Inline cmplog internal functions code (#1972)
* fmt

* aa

* sattic

* win

* frida

* expose API

* fmt

* frida
2024-03-26 17:42:03 +01:00
Dongjia "toka" Zhang
53bfae0a08
Increase llmp timeout & Print PID in logger (#1970)
* increase timeout & print pid for logger

* log

* aa

* rename stuff
2024-03-25 19:15:46 +01:00
Dongjia "toka" Zhang
7170b5391b
Fix UpdateExecStats not sent to the main broker in centralized 2024-03-25 16:39:30 +01:00
Dongjia "toka" Zhang
3cc8ea0336
Fix EventManagerHook (#1968) 2024-03-25 13:04:41 +01:00
Romain Malmain
4d3c6a3b9a
Fix libafl_qemu fuzzers not building in Docker (#1966)
* fixed rustup component added before switching to nightly.
added missing libafl_qemu source files.

* removed touch.
2024-03-24 11:07:33 +01:00
Maurice
f448b6fb24
libafl_nyx: Add bounds check for Nyx input buffer (#1963) 2024-03-23 18:31:07 +01:00
Maurice
a0d4a5b240
libafl_nyx: Add documentation to NyxSettings fields 2024-03-23 15:20:35 +01:00
Romain Malmain
44c841ffb1
WIP: QEMU exit handler (#1745)
* Added paging filtering.
Reworked address range filtering to fit with new generic code.

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Renamed sync breakpoint to sync exit.

* Split emu in systemmode.rs / usermode.rs for specific code.
EmuExitHandler implementation.

* sync_backdoor.rs removal.
Formatting.

* Updated `bindgen` and `which`.
Adapting code to work with update.

* fix: reconfigure cleanly if prior configure was interrupted abruptly.

* Enable sanitizers in QEMU during debug.

* Added target-usable files.

* Added breakpoint structure.

* Adapted other files to work with ExitHandler.

* Adapted existing fuzzer to work with new exit handler.

* fix: use get to avoid crashes.

* Updated README to indicate cargo-make should be installed.

* Added QEMU internal exit handler.

* Adapted qemu_systemmode example with new exit handler.

* Fixed fuzzers to work with new exit handler.

* Trying to fix CI (#1739)

* test

* dummy

* dummy

* Added new examples.

* Forgot to add build scripts.

* format

* format

* clang-format

* python emulator adaptation.

* fixed python bindings.

* clippy fixes.

* python bindings.

* fix qemu_sugar.

* fix fuzzbench.

* fixed import issues.

* misc fixes.

* renamed crate.

* Updated x86_64 stub bindings.

* Fixed static naming.

* binding fmt

* clippy

* clippy

* Removed useless return statement.

* removed advice to install cargo-make in individual repositories.

* symcc_update (#1749)

* Remove unused create_anymap_for_trait macro (fixes #1719) (#1752)

* Fix `as_object` UB discussed in #1748 (#1751)

* Fix as_object UB discussed in #1748

* More cleanup, more less UB

* Fix fixes

* Added uninit_on_shmem api

* clippy

* fmt

* trying to fix fuzzers, libfuzzer wrapper

* Add OwnedRefMit::owned constructor, libfuzzer fix

* Some more fixes

* Add BacktaceObserver::owned fn

* fmt

* more fmt

* Ignore SigPipe by default (#1741)

* Ignore SigPipe by default

* Fix no_std

* fmt

* Fix incorrect imports (#1758)

* Fix incorrect imports

https://doc.rust-lang.org/core/simd/trait.SimdOrd.html

* Fix

* Try fix ci

* Documentation fixes (#1761)

* Documentation fixes

* Fix InProcessExecutor url

* Update all urls to latest

* Miri ignores for M1 regex (#1762)

* Enabling DrCov on Windows (#1765)

* Enabling DrCov for Windows

* Dedup common code in scheduler (#1702)

* dedup common code in scheduler

* del eco

* fixing

* fix

* replace `Emulator::new_empty` by `Emulator::get` calls outside of `emu.rs` for safety. (#1763)

* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, and more (#1754)

* Add mute_inprocess_target fn, SimpleFdLogger::set_logger, set_error_print_panic_hook

* Trying to fix #1753

* typo

* More fix

* Fix test?

* more testcase fixes

* Fix: renamed remaining QemuInstrumentationFilter instances.

* Split emu in systemmode.rs / usermode.rs for specific code.
EmuExitHandler implementation.

* format

* format

* format

* Replace sync_exit with sync_backdoor.

* Rework command system.

* fix bad import.

* format.

* cargo fmt

* disable af-xdp as well to avoid linking errors.

* End of merging.

* format.

* Adaptation for usermode.

* format.

* injection support.

* usermode fixes.
format.

* clippy

* clippy + format

* Do not unwrap emu + format.

* fix: entry_point breakpoint

* inital commit.

* clippy

* tests

* clippy

* adapt example

* systemmode.

* renaming

* fmt

* fix lints.

* more lint fix.

* even more lint fixes.

* always more lint fixes.

* lint fix.

* allow unused qualifications for crate when it could be confusing.

* Still lint fixes.

* Lint fixes on generated code.

* Some lint fixes.

* merge continue.

* renamed modules as well.

* fixing merge.

* systemmode compiling.

* fmt

* fix early emulator drop.

* fmt

* fix cast to c_void of the wrong object.

* Added global enum for snapshot managers.
Some renaming.

* move things around.

* WIP: generic inclusion of QEMU Executor in exit handler.

* * Moved extern calls to `libafl_qemu_sys`
* Replaced old `Emulator` by `Qemu` and only kept C functions wrappers
* Now `Emulator` is for higher-level interactions with QEMU. Kept old functions for compatibility calling to `Qemu` functions
* A direct side effect of this slit is the removal of the `IsEmuExitHandler` trait dependency added in many parts of the code.
* Removed old dirty casting for `QemuExecutor` helpers and used the brand-new access to `QemuExecutorState` instead.
* Minor changes to `Qemu` and `Emulator` `get` methods for cleaner getters.

* Add missing `Qemu` function.

* Updated `qemu_systemmode` example.

* Adapted QEMU fuzzers + renaming.

* Fixed python.

* fix libafl_sugar with new implementation.

* fix dangling RefCell.
adapt new examples.
TODO: merge `libafl_systemmode.*` examples.

* clippy.

* fix more fuzzers.

* clippy.

* Implement `HasInstrumentationFilter` generically.
Updated `StdInstrumentationFilter` accordingly.

* Renamed breakpoint functions for QEMU.
`qemu.run()` handling.

* Removed OnceCell / RefCell in signature.
more explicit `MmapPerms` method names.

* minor code refactoring

* Emulator::run_handle refactoring

* deprecated Emulator functions calling directly to QEMU functions.

* IsSnapshotManager -> SnapshotManager

* IsEmuExitHandler -> EmuExitHandler + fmt

* Generic register when it makes sense.

* reverted IsSnapshotManager -> SnapshotManager because of a collision.

* fix syntax + clippy

* fmt

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: lazymio <mio@lazym.io>
Co-authored-by: Bet4 <0xbet4@gmail.com>
Co-authored-by: mkravchik <mkravchik@hotmail.com>
2024-03-22 18:03:29 +01:00
Maurice
50843b19d1
libafl_nyx: Allow custom input buffer size to be passed to NyxHelper (#1960)
* add option to specify input buffer size

* fix typo

* use `libafl::Error` as default error type

* derive `TypedBuilder` for `NyxSettings`

* update nyx_libxml2_standalone

* update nyx_libxml2_parallel

* update nyx_libxml2_standalone

* update nyx_libxml2_standalone

* update nyx_libxml2_parallel
2024-03-21 22:53:01 +01:00
Dongjia "toka" Zhang
6b94db2260
Use OwnedPtr in ListObserver (#1961)
* aaa

* clp
2024-03-21 19:46:42 +01:00
Dongjia "toka" Zhang
15f4613894
More usable ListFeedback (#1959)
* real list feedback

* add

* fox

* obs

* fix

* FMT

* more

* fmt

* rev
2024-03-21 16:21:15 +01:00
Dominik Maier
7abc26ebc9
Change AnyMap API, add unsafe_ assert (#1958)
* Change AnyMap API, add unsafe_ assert

* clippy

* Add anymap serialize test

* Add test

* fmt
2024-03-20 14:45:23 +01:00
Dominik Maier
14fd3040bd
Remove hash for AnyMap (since it's a hashmap already) (#1951) 2024-03-19 20:41:15 +01:00
Dominik Maier
2efa747292
SerdeAnyMap: add unsafe_stable_anymap feature that uses type_name instead of TypeId::of (#1952)
* Test: Use type_name instead of type_id in AnyMap

* Hide behind 'unsafe_stable_anymap' feature

* nostd?

* rename fn

* cleanup a bit
2024-03-19 20:15:31 +01:00
am009
5eab4fb78b
Update tinyinst_simple to support Linux (#1316) (#1955)
* Make fuzzers/tinyinst_simple support Linux (#1316)

Fix a documentation error for `MmapShMemProvider`.

* Support shmem for `fuzzers/tinyinst_simple` on Linux.

Format code.

* Fix CI to install cxxbridge-cmd.

* Add `CARGO_TARGET_DIR` in makefile to fix CI.
2024-03-19 20:15:07 +01:00
Michael Chen
fde9cda5ee
Gramatron: Upgrade automaton files (#1956)
`auto.postcard` file is following `postcard@0.7` wire format, which is
not compatible with the `postcard@1.0` dependency. `auto.json` is out of
date with the latest `Trigger` struct definition. Regenerated both using
the data from `auto.postcard`
2024-03-19 20:09:47 +01:00