1647 Commits

Author SHA1 Message Date
267309b954 add hists to plot script exp02 2023-01-26 09:47:12 +01:00
35435fbd97 speed up random generation 2023-01-25 16:14:17 +01:00
8fcc54bbdd write out times over time 2023-01-25 14:55:04 +01:00
1f538f9834 add sytemstate sceduler, fuzz until time 2023-01-25 12:59:17 +01:00
ba01f600ee re-add system state fuzzing 2023-01-24 09:11:45 +01:00
2cb479581d add virtual edge to longest runs 2023-01-19 10:33:13 +01:00
1fbf948478 do not force generated inputs 2023-01-17 10:26:27 +01:00
6e1d5695e3 debug stuff 2023-01-17 10:18:24 +01:00
8d31196614 random seeds, better plots 2023-01-17 10:01:15 +01:00
4c90144db5 add more benchmarks 2023-01-13 16:05:43 +01:00
eeaf7eb43f exectime increase feedback 2023-01-11 16:09:06 +01:00
68c4887dad rename bin, allow random fuzzing 2023-01-09 13:53:32 +01:00
7ca2d43f3d benchmark with duration 2023-01-09 12:39:51 +01:00
9f97852e4a add benchmark scripts 2023-01-09 12:39:35 +01:00
f4e1990387 add systemstate feature and dump times 2023-01-05 17:34:53 +01:00
d936234976 fix multicore build 2023-01-05 13:35:51 +01:00
795fbff61a ignore artifacts 2023-01-05 13:31:33 +01:00
6a9df35e28 minimal changes 2023-01-05 13:30:24 +01:00
9b9fbc3677 add interrupt injection 2023-01-03 20:09:45 +01:00
decae09931 input length and read input pointer 2022-12-23 15:32:20 +01:00
b812e994a6 draft: add graph feedback 2022-12-19 18:14:52 +01:00
4587f442d0 add TimeMaximizerCorpusScheduler 2022-12-19 17:44:58 +01:00
c748fecbe2 add last api callsite to system state 2022-12-19 13:13:38 +01:00
7595d25192 libafl_qemu: add jmp instrumentation 2022-12-19 13:12:37 +01:00
79bca99cc7 WIP: add systemstate tracking 2022-12-15 15:23:07 +01:00
b07f7ccbca add arguments 2022-12-12 17:41:33 +01:00
e3f38edd0a get time from ClockTimeFeedback 2022-12-12 15:30:05 +01:00
6ad55e3b29 fixup 2022-12-12 15:16:45 +01:00
f7ee38ebb2 WIP: port fret 2022-12-12 14:58:28 +01:00
Andrea Fioraldi
50708f4d9c
Fast device+mem QEMU snapshots (#930)
* Simple fast root snapshots

* clippy

* epd

* mips
2022-12-12 10:49:44 +01:00
radl97
4e2e4eb5c0
Fix typos (#935) 2022-12-11 00:59:59 +01:00
Max Ammann
2f9b279428
[Windows] Handle crashes without exception (#912)
* Handle that exception_pointers can be null

* Fix formatting

* windows: Handle crashes without exception
2022-12-10 09:29:27 +09:00
Langston Barrett
f9eac18542
libafl: Remove set_initial, initial_mut from MapObserver trait (#932)
These methods force a `MapObserver` to own an initial value, but
there's no reason for this to be the case - If you don't need to allow a
dynamically-changeable initial value, it might be nice to use `<<Self as
MapObserver>::Entry as Default>::default()` everywhere and have the compiler
statically propagate that value.

Not a lot of code used these methods (which seems like a good argument that
they aren't a fundamental part of the inteface).
2022-12-08 10:25:18 +01:00
Langston Barrett
61aa764dc4
Fix documentation typos (#933)
* libafl: Fix documentation typo in Push stage

* libafl: Fix documentation typo in PowerSchedule
2022-12-07 06:54:48 +01:00
omergreen
abfd834e98
Fix FridaInstrumentationHelper bugs caused by moving it after creation (#931)
* move Transformer out of FridaInstrumentationHelper's fields and create it dynamically instead; wrap CoverageRuntime in Pin<Arc<RefCell>>

* Update helper.rs

* run cargo fmt

* switch Arc for Rc
2022-12-06 17:46:59 +01:00
Dominik Maier
68fbfc8914
Fix Clippy (#926)
* Fix clippy

* undo comment fmt

* add unstracked nyx files to gitignore

* fix

* windows, no_std

* fix

* fix

* more

* macos

* remove doctest

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2022-12-06 00:05:42 +09:00
Dongjia "toka" Zhang
ee58375ac5
Revert fuzzbench changes (#927) 2022-12-05 05:59:55 +09:00
Dongjia "toka" Zhang
5d7fd8f914
TinyInst Binary-Only fuzzing for Windows (#854)
* step1 for tinyinst

* step2: minimal executor

* updated libafl

* Tinyinst Update (#853)

* Mac OS Autotokens (#723)

* mac_tokens

* more

* win fix

* fmt

* fmt c

* Use nightly fmt (#728)

* Fix compilation for aarch64 qemu (#731)

Typo lead to fail to compile for arm64

* Simd Fix (#729)

* simd fix

* fmt

* Fixing readme & docs (#730)

* fix

* fix

* add

* add

* fmt

* 0.8.1 (#732)

* New Pass Manager Arguments (#724)

* new pm arguments

* enable abgeana's code

* Fix tui with 1 client (#734)

* unbreak tui with 1 client

* clippy

* Add core affinity support for FreeBSD (#736)

* NYX Executor (GSoC '22) (#693)

* Add ccache

* Update codecov.yml

* Add libnyx

* Fix

* Add nyx build script

* Fix build.sh && init executor.rs

* Fix commit

* Fix code

* initialize `exector.rs`

* refine API in `nyx_bridge.rs`

* initialze `run_target`

* add `test_nyxhelper`

* initize `test_executor`

* remove `nyx_beidge.rs`

* make `test_executor` compile

* Improve test

* refine code

* update version

* fix docker

* fix docker

* Fix clippy

* Fix build

* fix build && add `set_timeout`

* Fix and refine CI

* fix CI

* Fix CI

* Add platform restrict

* cargo fmt

* add parallel mode

* add example `nyx_libxml2_parallel`

* fix fuzzer example

* fix CI

* add README

* fix CI

* fix CI

* fix CI

* remove unwrap and NyxResult

* code format fix

* add libnyx's rev

* fix format

* change Duration format && Fix CI

* caego fmt

* fix CI

* fix CI

* Add doc

* test CI

* Update test_all_fuzzers.sh

* Update test_all_fuzzers.sh

* Update test_all_fuzzers.sh

* add cache for apt and cargo-install

* Update build_and_test.yml

* Update build_and_test.yml

* tmp test CI

* fix CI

* remove debug cmd

* remove test

* code refine

* code refine

* code refine

* code refine

* add Makefile

* fix example doc for nyx

* add `NyxHelper::new_with_initial_timeout`

* fix `NyxHelper::new`

* fix curl parameter

* code refine

* add check for setup script

* use afl-clang-fast in nyx

* fix logic

* fix makefile

* fix CI

* Update build_and_test.yml

* Update build_and_test.yml

* remove debug cmd

Co-authored-by: syheliel <syheliel@gmail.com>
Co-authored-by: Dominik Maier <dmnk@google.com>

* Fix spelling error (#745)

* OSX force_load option (#743)

* Update clang.rs

* fmt

* Add continous JSON Logging monitor (#738)

* Add simple JSON Monitor

* Add documentation

* Log global state

* Fix formatting

* Save state depending on closure outcome, have file opened all the time

* Make OnDiskJSONMonitor cloneable

* Switch to FnMut to allow stateful closures

* Use &mut M: Monitor for the closure

* Fix documentation of Rand::below (#747)

* Netopenbsd build fix (#746)

* core affinity netbsd implementation.

* openbsd build fix

* Fix autotokens doc (#751)

* fix

* remove wrong doc

* Simplification for netbsd-specific code (#750)

the cpuset api is already present in libc...

* Add test case minimising stage (tmin) (#735)

* add test case minimising stage

* general purpose minimiser impl, with fuzzer example

* reorganise, document, and other cleanup

* correct python API return value

* correct some docs

* nit: versioning in fuzzers

* ise -> ize

* Implement a corpus minimiser (cmin) (#739)

* initial try

* correct case where cull attempts to fetch non-existent corpus entries

* various on_remove, on_replace implementations

* ise -> ize (consistency), use TestcaseScore instead of rolling our own

* oops, feature gate

* documentation!

* link c++

* doc-nit: correction in opt explanation

don't write documentation at 0300

* better linking

* Skippable stage, generator wrapper for Grimoire (#748)

* Skippable stage, generator wrapper for Grimoire

* more fancy wrapper

* MapFeedback: Adding support for with_name() (#752)

* Adding support for with_name()

* Adding with_name() function description

* dragonflybsd build fix for core affinity. (#753)

supporting most of linux sched api here.

* CI for FreeBSD (#754)

* CI for FreeBSD

* rustup -y?

* fixed path, switched to clippy

* bsd don't source

* added llvm

* clippy

* more yml

* ?

* testing ci

* llvm?

* llvm??

* more llvm, more tests

* fixed testcase'

* mem limits

* more sudo

* reenable all the CI

* Fixes for new Clippy (#755)

* New Clippy fixes for QEMU (#757)

* Core affinity for FreeBSD pinning task to the wanted cpu (#756)

* Do not zero-init struct in QEMU (#758)

* New Clippy fixes for QEMU

* no need to 0-initialize mem

* clippy

* Add doc for libafl_nyx (#759)

Co-authored-by: syheliel <syheliel@gmail.com>

* Adjust NyxExecutor trait bound to HasTargetBytes from HasBytesVec (#760)

* adjust NyxExecutor trait bound to HasTargetBytes from HasBytesVec

* oops actually use HasTargetBytes instead

* libafl_frida: ASan hook adding Apple's memset_pattern* api. (#761)

* Fix cargo doc on windows (#762)

* add doc cfg

* fix nostd docs

* ignore CommandConfigurator doc test execution on non-unix platform

* add cargo doc step pipeline on windows platform

* Enable memset_patter ASan hooks for Apple on libafl_frida (#763)

* Fix forkserver options (#771)

* Stability improve (#773)

* initial

* add

* fmt & fix

* dbg remove

* clp

* clp

* more

* clippy

* del

* fix

* remove unused

* fix

* doc

* Fix doc (#780)

* Add track_stability option to CalibrationStage  (#781)

* add

* Update gramatron.rs

* Update emu.rs

* try

* clp

* Dump registers on freebsd x86_64 (#779)

* Illumos support (#775)

implementing core affinity too.

* Reduce clang warnings for version output in libafl_cc. (#778)

* Extend gramatron recursive mutator (#783)

* Dump registers on NetBSD amd64 (#786)

* Add support for ARMBE8 (#768)

* Changes to build QEMU out-of-tree so that we don't need to clone the repo for each feature combination we build

* Add be support to libafl_qemu

* More config tweaks

Co-authored-by: Your Name <you@example.com>

* [AFLplusplus/LibAFL] dump registers on OpenBSD amd64 (PR #787)

* dump registers on openbsd

* write_crash implementations

* Windows gdiplus (#789)

* Initial steps

* Harness code cleanup

* don't panic on linux in order not to break the CI

* formatting once again

* restored cfg unix to unbreak linux build

* Remove clang download from windows CI (#791)

* Attempt to remove clang 12 setup

* frida_gdiplus added to CI

* Gdiplus comments (#792)

* Attempt to remove clang 12 setup

* frida_gdiplus added to CI

* Redundancy note

* formatting again :\

* mistake of directory name

* Fix len miscalculation in grimoire string replace (#794)

* Fix len miscalculation in grimoire string replace

* ok Rust i was writing JS these days

Co-authored-by: Andrea Fioraldi <andrea.fioraldi@trellix.com>

* Fix doc typos (#796)

* Fix CI  (#798)

* bump (#799)

* Support for write_crash on netbsd (#788)

* Support for bolts::cpu::read_time_counter on arm64 (#790)

* Add ability to use virtual dispatch to StagesTuple (#801)

* Add ability to use virtual dispatch to stagesTuple

* Fix lint

* Adding CPSR register for arm qemu (#800)

* trying to add in observer

* writing test

* got up to running with instrumentation but i still need to get the map

* fixing fuzzer code

* adding tinyinst fuzzer

* adding ffi to store all the map data into vec.

* adding some new things

* adding somewhat state of how i would like it should work

* fixing some things

* alot of false positives.

* fixing before adding args

* updated to use FileInput!

* adding build script to pull tinyinst

* fixing git issue

* writing instruction to run how to run tinyinst fuzzer

Co-authored-by: Dongjia Zhang <tokazerkje@outlook.com>
Co-authored-by: Dominik Maier <dmnk@google.com>
Co-authored-by: Phan Thanh Duy <phanthanhduypr@gmail.com>
Co-authored-by: Nicholas Lang <97475577+nicklangsysdig@users.noreply.github.com>
Co-authored-by: David CARLIER <devnexen@gmail.com>
Co-authored-by: syheliel <45957390+syheliel@users.noreply.github.com>
Co-authored-by: syheliel <syheliel@gmail.com>
Co-authored-by: Aiden Hall <AidenRHall@users.noreply.github.com>
Co-authored-by: Sönke <eknoes@users.noreply.github.com>
Co-authored-by: Sirui Mu <msrlancern@gmail.com>
Co-authored-by: Addison Crump <me@addisoncrump.info>
Co-authored-by: Patrick Gersch <gersch.patrick@gmail.com>
Co-authored-by: Teddy Heinen <teddy@heinen.dev>
Co-authored-by: Vincent <space_white@yahoo.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>
Co-authored-by: Your Name <you@example.com>
Co-authored-by: expend20 <36543551+expend20@users.noreply.github.com>
Co-authored-by: Andrea Fioraldi <andrea.fioraldi@trellix.com>
Co-authored-by: Ben Davis <ben@thebendavis.net>
Co-authored-by: radl97 <radl97@users.noreply.github.com>

* fix

* fmt

* Submodule

* Submodule?

* Tinyinst Update V2 (#905)

* updated to lastest libafl

* going to replace tinyinst to more like jackalope with tinyinstrumentation

* fixing clippy

* keep working on cpp ffi. sad

* updating litecov to tinyinst. also start making our own litecov

* revert to map instead of list. not sure why its not working

* making fuzzer listobserver

* working with listobserver!:

* cleaning up

* adding cargo make run

* updating cargo for tinyinst

* updating readme

* readme, clippy

* fmt

* fmt

* fix

* fix

* docker

* fix

* fmt

Co-authored-by: Dominik Maier <dmnk@google.com>
Co-authored-by: biazo <eric.l.biazo@gmail.com>
Co-authored-by: Phan Thanh Duy <phanthanhduypr@gmail.com>
Co-authored-by: Nicholas Lang <97475577+nicklangsysdig@users.noreply.github.com>
Co-authored-by: David CARLIER <devnexen@gmail.com>
Co-authored-by: syheliel <45957390+syheliel@users.noreply.github.com>
Co-authored-by: syheliel <syheliel@gmail.com>
Co-authored-by: Aiden Hall <AidenRHall@users.noreply.github.com>
Co-authored-by: Sönke <eknoes@users.noreply.github.com>
Co-authored-by: Sirui Mu <msrlancern@gmail.com>
Co-authored-by: Addison Crump <me@addisoncrump.info>
Co-authored-by: Patrick Gersch <gersch.patrick@gmail.com>
Co-authored-by: Teddy Heinen <teddy@heinen.dev>
Co-authored-by: Vincent <space_white@yahoo.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com>
Co-authored-by: Your Name <you@example.com>
Co-authored-by: expend20 <36543551+expend20@users.noreply.github.com>
Co-authored-by: Andrea Fioraldi <andrea.fioraldi@trellix.com>
Co-authored-by: Ben Davis <ben@thebendavis.net>
Co-authored-by: radl97 <radl97@users.noreply.github.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2022-12-04 19:04:06 +01:00
Dongjia "toka" Zhang
93d99beecf
[Windows] Setup ASAN death callback (#908)
* step 1

* i forgot to change this

* add handler

* doc

* fmt

* move to libafl_targets

* fix

* windows

* clp

* fix

* clp

* cfg

* fix

* clp

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2022-12-04 18:56:56 +01:00
Dongjia "toka" Zhang
cd8367d3e9
SIGINT handlers, and Release StateRestorer shmem (#894)
* drop not working

* why drop_in_place works but drop does not

* stop shmem leak

* don't kill -9 fuzzer

* don't put fuzzer background

* no &

* nostd

* fix

* fix

* windows, clippy

* fix

* fmt

* windows
2022-12-04 18:56:19 +01:00
omergreen
3bad100cb7
Handle broker-to-broker connection interruptions more gracefully (#921)
* Handle broker-to-broker connection interruptions more gracefully

Exit gracefully instead of panicking or getting stuck in infinite loops

* Run cargo-fmt
2022-12-04 18:55:55 +01:00
omergreen
c879a0a8d3
Fix frida ASAN incompatibility with mac m1 (#917)
Add MAP_JIT, and extract the writable portion of generate_instrumentation_blobs into AsanRuntime
2022-12-04 18:55:45 +01:00
Langston Barrett
2a2e70a636
Add ValueObserver, an observer for a single value (#923)
* libafl: ValueObserver, a simple and safe observer of a single value

* libafl: Generalize ValueObserver, don't force it to be a RefCell

There are other types with interior mutability that may be more suitable.

Add a few more methods, too.

* libafl: Use OwnedRef in ValueObserver

The previous version had ValueObserver take ownership, but that doesn't
actually work for working with types with interior mutability: both the
observer and the target need to take immutable references.

* libafl: ValueObserver shouldn't reset the contained value

Otherwise, it is useless for containing a `RefCell`.

* libafl: Add doctests to ValueObserver

* libafl: Fix clippy lints

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2022-12-04 18:55:04 +01:00
Dongjia "toka" Zhang
8444cf7cc8
Fix libafl_qemu i386 build (#924)
* fix

* fmt

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2022-12-04 15:07:30 +01:00
Andrea Fioraldi
71dd58396c
libafl_qemu_sys and libafl_qemu_build to have bindgen with QEMU (#915)
* build and sys qemu crates

* working libafl_qemu_build

* libafl_qemu_sys

* switch libafl_qemu to use libafl_qemu_sys

* fix

* use sys

* fmt

* mmu lookup

* fix

* autofix

* clippy

* fix

* allow

* cl

* docker

* docker

* fix

* mem access info in mem hooks

* fmt

* fix

* kill libafl_page_size

* fix

* clippy

* default bindings for docs.rs

* macos

* fix arm build

* fix

* plugins

* fix

* fix fuzzer

* Correct PC on breakpoint

Co-authored-by: Dominik Maier <domenukk@gmail.com>
2022-12-02 17:01:28 +01:00
Addison Crump
5252097819
Fix scores in minimizer when using on_replace (#920) 2022-11-30 14:32:26 +01:00
Andrea Fioraldi
c2776e117a
emu::current_cpu() is now the CPU that hitted the breakpoint in fullsystem (#910)
* emu::current_cpu() is now kept after vm stop and it is the CPU that hitted the breakpoint

* clippy

* uninit

* clippy

* clippy

* clippy

* clippy

* nightly override in CI

* nightly override in CI

* components

* components

* targets

* targets

* clippy

* clippy

* clippy

* clippy

* clippy (again)

* MaybeUninit

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-11-25 11:57:08 +01:00
Langston Barrett
bc85129cd9
libafl_frida: Point to the LibAFL book from API docs (#886)
Help users find the docs!
2022-11-25 01:48:21 +01:00
omergreen
889161e55e
Fix mac m1 incompatibility for cmplog in frida mode (#914)
For some reason, Apple's aarch64 processor throws a SIGILL when encountering LDP x5, x5 (or any other repeating register). STP works, but I changed both for symmetry.
2022-11-25 01:31:22 +01:00
Andrea Fioraldi
3f627aaf0b
Save and restore CPU state in libafl_qemu (#907)
* libafl_qemu: fix systemmode with slirp dependency

libslirp will be dropped from future QEMU releases (see https://wiki.qemu.org/ChangeLog/7.0).
This change adds the "slirp" feature,
which links with the host-systems libslirp.

* libafl_qemu: enable systemmode snapshots, vm_start

Re-enable snapshot functions.
Start the VM before qemu_main_loop.

* libafl_qemu: allow synchronous snapshotting

Add a flag to take snapshots synchronosly.
This should be used to take or load snapshots while the emulator is not
running.

* libafl_qemu: fallback cpu for read-/write_mem

In systemmode, current_cpu may not be set.
In such cases use the first cpus memory access methods.

* fuzzers: add example for libafl_qemu in systemmode

* libafl_qemu: update libafl-qemu-bridge revision

* libafl_qemu: add memory access by physcial address

* fix liabfl_qemu example

Use GuestAddr and physical memory access

* ci: install libslirp-dev for libafl_qemu

* fuzzers/qemu_systemmode: clean up example

* libafl_qemu: remove obsolete functions

emu::libafl_cpu_thread_fn
emu::libafl_start_vcpu
emu::start

* fuzzers/qemu_systemmode: simplify example

* improve build_linux.rs

* Update qemu_systemmode fuzzer

* upd

* clippy

* Save and restore CPU state in libafl_qemu

* clippy

* Clone

* upd

* upd

Co-authored-by: Alwin Berger <alwin.berger@tu-dortmund.de>
2022-11-22 16:29:43 +01:00