Fixes for frida, qemu_sugar (#1427)

* Fixes for frida, qemu_sugar

* tiny clippy

* clippy

* fix thread_id

* Attempted fix for qemu
This commit is contained in:
Dominik Maier 2023-08-20 12:00:41 +02:00 committed by GitHub
parent 173b14258b
commit 1d746b4074
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 25 additions and 12 deletions

View File

@ -109,7 +109,7 @@ pub fn main() -> Result<(), Error> {
let mut state = StdState::new( let mut state = StdState::new(
StdRand::with_seed(current_nanos()), StdRand::with_seed(current_nanos()),
InMemoryOnDiskCorpus::new(&minimized_dir).unwrap(), InMemoryOnDiskCorpus::new(minimized_dir).unwrap(),
InMemoryCorpus::new(), InMemoryCorpus::new(),
&mut (), &mut (),
&mut (), &mut (),

View File

@ -1,5 +1,5 @@
use core::fmt::{self, Debug, Formatter}; use core::fmt::{self, Debug, Formatter};
use std::{ffi::c_void, marker::PhantomData}; use std::{ffi::c_void, marker::PhantomData, process};
use frida_gum::{ use frida_gum::{
stalker::{NoneEventSink, Stalker}, stalker::{NoneEventSink, Stalker},
@ -35,7 +35,7 @@ where
{ {
base: InProcessExecutor<'a, H, OT, S>, base: InProcessExecutor<'a, H, OT, S>,
// thread_id for the Stalker // thread_id for the Stalker
thread_id: usize, thread_id: u32,
/// Frida's dynamic rewriting engine /// Frida's dynamic rewriting engine
stalker: Stalker<'a>, stalker: Stalker<'a>,
/// User provided callback for instrumentation /// User provided callback for instrumentation
@ -87,8 +87,11 @@ where
} else { } else {
self.followed = true; self.followed = true;
let transformer = self.helper.transformer(); let transformer = self.helper.transformer();
self.stalker self.stalker.follow::<NoneEventSink>(
.follow::<NoneEventSink>(self.thread_id, transformer, None); self.thread_id.try_into().unwrap(),
transformer,
None,
);
} }
} }
let res = self.base.run_target(fuzzer, state, mgr, input); let res = self.base.run_target(fuzzer, state, mgr, input);
@ -153,12 +156,21 @@ where
OT: ObserversTuple<S>, OT: ObserversTuple<S>,
RT: FridaRuntimeTuple, RT: FridaRuntimeTuple,
{ {
/// Creates a new [`FridaInProcessExecutor`] /// Creates a new [`FridaInProcessExecutor`].
pub fn new( pub fn new(
gum: &'a Gum, gum: &'a Gum,
base: InProcessExecutor<'a, H, OT, S>, base: InProcessExecutor<'a, H, OT, S>,
thread_id: usize,
helper: &'c mut FridaInstrumentationHelper<'b, RT>, helper: &'c mut FridaInstrumentationHelper<'b, RT>,
) -> Self {
Self::on_thread(gum, base, helper, process::id())
}
/// Creates a new [`FridaInProcessExecutor`] tracking the given `thread_id`.
pub fn on_thread(
gum: &'a Gum,
base: InProcessExecutor<'a, H, OT, S>,
helper: &'c mut FridaInstrumentationHelper<'b, RT>,
thread_id: u32,
) -> Self { ) -> Self {
let mut stalker = Stalker::new(gum); let mut stalker = Stalker::new(gum);
// Include the current module (the fuzzer) in stalked ranges. We clone the ranges so that // Include the current module (the fuzzer) in stalked ranges. We clone the ranges so that

View File

@ -2,7 +2,11 @@
use core::fmt::{self, Debug, Formatter}; use core::fmt::{self, Debug, Formatter};
#[cfg(feature = "fork")] #[cfg(feature = "fork")]
use libafl::{events::EventManager, executors::InProcessForkExecutor, state::HasMetadata}; use libafl::{
events::EventManager,
executors::InProcessForkExecutor,
state::{HasLastReportTime, HasMetadata},
};
use libafl::{ use libafl::{
events::{EventFirer, EventRestarter}, events::{EventFirer, EventRestarter},
executors::{Executor, ExitKind, HasObservers, InProcessExecutor}, executors::{Executor, ExitKind, HasObservers, InProcessExecutor},
@ -10,10 +14,7 @@ use libafl::{
fuzzer::{HasFeedback, HasObjective, HasScheduler}, fuzzer::{HasFeedback, HasObjective, HasScheduler},
inputs::UsesInput, inputs::UsesInput,
observers::{ObserversTuple, UsesObservers}, observers::{ObserversTuple, UsesObservers},
state::{ state::{HasClientPerfMonitor, HasCorpus, HasExecutions, HasSolutions, State, UsesState},
HasClientPerfMonitor, HasCorpus, HasExecutions, HasLastReportTime, HasSolutions, State,
UsesState,
},
Error, Error,
}; };
#[cfg(feature = "fork")] #[cfg(feature = "fork")]