Move to just (binary_only / full_system) (#2949)

* just port for binary only / systemmode fuzzers

* introduce just libraries, with pre-initialized variables and common recipes

---------

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>

.devcontainer/devcontainer.json

@@ -23,7 +23,7 @@
 	// "forwardPorts": [],
 	// Uncomment the next line to run commands after the container is created - for example installing curl.
 	// Install development components that shouldn't be in the main Dockerfile
-	"postCreateCommand": "rustup component add --toolchain nightly rustfmt clippy llvm-tools-preview && cargo binstall --locked cargo-make",
+	"postCreateCommand": "rustup component add --toolchain nightly rustfmt clippy llvm-tools-preview",
 	// Uncomment when using a ptrace-based debugger like C++, Go, and Rust
 	"runArgs": [
 		"--cap-add=SYS_PTRACE",

.github/workflows/build_and_test.yml

@@ -259,7 +259,7 @@ jobs:
           # Binary-only
           - ./fuzzers/binary_only/fuzzbench_fork_qemu
           - ./fuzzers/binary_only/frida_executable_libpng
-          - ./fuzzers/binary_only/frida_windows_gdiplus
+          # - ./fuzzers/binary_only/frida_windows_gdiplus
           - ./fuzzers/binary_only/frida_libpng
           - ./fuzzers/binary_only/fuzzbench_qemu
           - ./fuzzers/binary_only/intel_pt_baby_fuzzer
@@ -291,7 +291,6 @@ jobs:
 
           # In-process
           - ./fuzzers/fuzz_anything/cargo_fuzz
-          # - ./fuzzers/inprocess/dynamic_analysis
           - ./fuzzers/inprocess/fuzzbench
           - ./fuzzers/inprocess/fuzzbench_text
           - ./fuzzers/inprocess/fuzzbench_ctx
@@ -303,10 +302,10 @@ jobs:
           - ./fuzzers/inprocess/libfuzzer_libpng_cmin
           - ./fuzzers/inprocess/libfuzzer_libpng_norestart
           # - ./fuzzers/inprocess/libfuzzer_libpng_tcp_manager
+          # - ./fuzzers/inprocess/libfuzzer_windows_asan
           - ./fuzzers/inprocess/libfuzzer_stb_image_sugar
           - ./fuzzers/inprocess/libfuzzer_stb_image
           # - ./fuzzers/structure_aware/libfuzzer_stb_image_concolic
-          # - ./fuzzers/inprocess/libfuzzer_windows_asan
           # - ./fuzzers/inprocess/sqlite_centralized_multi_machine
 
           # Fuzz Anything
@@ -429,9 +428,9 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/workflows/windows-tester-prepare
       - name: Build fuzzers/binary_only/frida_libpng
-        run: cd fuzzers/binary_only/frida_libpng/ && cargo make test
+        run: cd fuzzers/binary_only/frida_libpng/ && just test
 
-  windows-frida-libfuzzer-stb-image:
+  windows-libfuzzer-stb-image:
     runs-on: windows-latest
     needs:
       - common
@@ -441,6 +440,16 @@ jobs:
       - name: Build fuzzers/inprocess/libfuzzer_stb_image
         run: cd fuzzers/inprocess/libfuzzer_stb_image && cargo build --release
 
+  windows-libfuzzer-asan:
+    runs-on: windows-latest
+    needs:
+      - common
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/workflows/windows-tester-prepare
+      - name: Build fuzzers/inprocess/libfuzzer_windows_asan
+        run: cd fuzzers/inprocess/libfuzzer_windows_asan && just test
+
   windows-frida-gdiplus:
     runs-on: windows-latest
     needs:
@@ -449,7 +458,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/workflows/windows-tester-prepare
       - name: Build fuzzers/binary_only/frida_windows_gdiplus
-        run: cd fuzzers/binary_only/frida_windows_gdiplus/ && cargo make test && cargo make test_cmplog
+        run: cd fuzzers/binary_only/frida_windows_gdiplus/ && just test && just test_cmplog
 
   windows-tinyinst-simple:
     runs-on: windows-latest
@@ -461,7 +470,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/workflows/windows-tester-prepare
       - name: Build fuzzers/binary_only/tinyinst_simple
-        run: cd fuzzers/binary_only/tinyinst_simple/ && cargo make test
+        run: cd fuzzers/binary_only/tinyinst_simple/ && just test
 
   windows-clippy:
     runs-on: windows-latest

.github/workflows/fuzzer-tester-prepare/action.yml

@@ -22,10 +22,6 @@ runs:
     - name: Add wasm target
       shell: bash
       run: rustup target add wasm32-unknown-unknown
-    - name: install cargo-make
-      uses: baptiste0928/cargo-install@v3
-      with:
-        crate: cargo-make
     - name: install just
       uses: extractions/setup-just@v2
       with:

.github/workflows/qemu-fuzzer-tester-prepare/action.yml

@@ -10,10 +10,6 @@ runs:
     - name: enable mult-thread for `make`
       shell: bash
       run: export MAKEFLAGS="-j$(expr $(nproc) \+ 1)"
-    - name: install cargo-make
-      uses: baptiste0928/cargo-install@v3
-      with:
-        crate: cargo-make
     - name: install just
       uses: extractions/setup-just@v2
       with:

.github/workflows/windows-tester-prepare/action.yml

@@ -15,9 +15,6 @@ runs:
     - name: Set LIBCLANG_PATH
       shell: pwsh
       run: echo "LIBCLANG_PATH=$((gcm clang).source -replace "clang.exe")" >> $env:GITHUB_ENV
-    - name: install cargo-make
-      shell: pwsh
-      run: cargo install --force cargo-make
     - name: install just
       uses: extractions/setup-just@v2
       with:

README.md

@@ -29,8 +29,8 @@ LibAFL is fast, multi-platform, no_std compatible, and scales over cores and mac
 - **LLVM tools**
     - The LLVM tools (including clang, clang++) are needed (newer than LLVM 15.0.0 up to LLVM 18.1.3) If you are using Debian/Ubuntu, again, we highly recommmend that you install the package from [here](https://apt.llvm.org/)
     - (In `libafl_concolic`, we only support LLVM version newer than 18)
-- Cargo-make:
+- Just:
-    - We use cargo-make to build the fuzzers in `fuzzers/` directory. You can install it with `cargo install cargo-make`
+    - We use [just](https://github.com/casey/just) to build the fuzzers in `fuzzers/` directory. You can find instructions to install it in your environment [in the Just Programmer's Manual](https://just.systems/man/en/packages.html).
  
 #### Clone the LibAFL repository with
 ```sh
@@ -52,9 +52,9 @@ cd docs && mdbook serve
 We collect all example fuzzers in [`./fuzzers`](./fuzzers/).
 Be sure to read their documentation (and source), this is *the natural way to get started!*
 ```sh
-cargo make run
+just run
 ```
-You can run each example fuzzer with this following command, as long as the fuzzer directory has `Makefile.toml` file. The best-tested fuzzer is [`./fuzzers/inprocess/libfuzzer_libpng`](./fuzzers/inprocess/libfuzzer_libpng), a multicore libfuzzer-like fuzzer using LibAFL for a libpng harness.
+You can run each example fuzzer with this following command, as long as the fuzzer directory has a `Justfile` file. The best-tested fuzzer is [`./fuzzers/inprocess/libfuzzer_libpng`](./fuzzers/inprocess/libfuzzer_libpng), a multicore libfuzzer-like fuzzer using LibAFL for a libpng harness.
 
 ### Resources 
 - [Installation guide](./docs/src/getting_started/setup.md)

fuzzers/binary_only/frida_executable_libpng/Justfile

@@ -0,0 +1,50 @@
+import "../../../just/libafl.just"
+
+FUZZER_NAME := "libfrida_executable_fuzzer"
+FUZZER_LIB := FUZZER + ".so"
+
+[unix]
+libpng:
+    #!/bin/bash
+    if [ ! -f v1.6.37.tar.gz ]; then
+        wget https://github.com/glennrp/libpng/archive/refs/tags/v1.6.37.tar.gz
+    fi
+    tar -xvf v1.6.37.tar.gz
+
+[unix]
+lib: libpng
+    cd libpng-1.6.37 && ./configure --enable-shared=no --with-pic=yes --enable-hardware-optimizations=yes
+    make -j -C libpng-1.6.37
+
+[unix]
+harness: lib
+    clang++ -O0 -c -fPIC harness.cc -o harness.o
+    clang++ -O0 harness.cc libpng-1.6.37/.libs/libpng16.a -lz -o libpng-harness -g
+
+[unix]
+build:
+    cargo build --profile {{ PROFILE }}
+
+[unix]
+run: build harness
+    LD_PRELOAD={{ FUZZER_LIB }} ./libpng-harness -i corpus -o out -H ./libpng-harness
+
+[unix]
+test: build harness
+    #!/bin/bash
+
+    rm -rf libafl_unix_shmem_server || true
+    LD_PRELOAD={{ FUZZER_LIB }} ./libpng-harness -i corpus -o out -H ./libpng-harness > fuzz_stdout.log &
+    sleep 10s && pkill libpng-harness
+    if grep -qa "corpus: 30" fuzz_stdout.log; then
+        echo "Fuzzer is working"
+    else
+        echo "Fuzzer does not generate any testcases or any crashes"
+        exit 1
+    fi
+
+[unix]
+clean:
+    rm -rf ./libpng-harness
+    make -C libpng-1.6.37 clean
+    cargo clean

fuzzers/binary_only/frida_executable_libpng/Makefile.toml

@@ -1,120 +0,0 @@
-# Variables
-[env]
-CARGO_TARGET_DIR = { value = "target", condition = { env_not_set = [
-  "CARGO_TARGET_DIR",
-] } }
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-PROFILE_DIR = { source = "${PROFILE}", default_value = "release", mapping = { "release" = "release", "dev" = "debug" }, condition = { env_not_set = [
-  "PROFILE_DIR",
-] } }
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Cargo-make not integrated yet on this"
-'''
-
-# libpng
-[tasks.libpng]
-linux_alias = "libpng_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.libpng_unix]
-condition = { files_not_exist = ["./libpng-1.6.37"] }
-script_runner = "@shell"
-script = '''
-wget https://github.com/glennrp/libpng/archive/refs/tags/v1.6.37.tar.gz
-tar -xvf v1.6.37.tar.gz
-'''
-
-# Library
-[tasks.lib]
-linux_alias = "lib_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.lib_unix]
-script_runner = "@shell"
-script = '''
-cd libpng-1.6.37 && ./configure --enable-shared=no --with-pic=yes --enable-hardware-optimizations=yes
-cd ..
-make -C libpng-1.6.37
-'''
-dependencies = ["libpng"]
-
-# Harness
-[tasks.harness]
-linux_alias = "harness_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.harness_unix]
-script_runner = "@shell"
-script = '''
-clang++ -O0 -c -fPIC harness.cc -o harness.o
-clang++ -O0 harness.cc libpng-1.6.37/.libs/libpng16.a -lz -o libpng-harness -g
-'''
-dependencies = ["lib"]
-
-# Fuzzer
-[tasks.fuzzer]
-linux_alias = "fuzzer_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.fuzzer_unix]
-script_runner = "@shell"
-script = '''
-cargo build --profile ${PROFILE}
-'''
-
-# Run the fuzzer
-[tasks.run]
-linux_alias = "run_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.run_unix]
-script_runner = "@shell"
-script = '''
-LD_PRELOAD=$CARGO_TARGET_DIR/${PROFILE_DIR}/libfrida_executable_fuzzer.so ./libpng-harness -i corpus -o out -H ./libpng-harness
-'''
-dependencies = ["fuzzer", "harness"]
-
-# Test
-[tasks.test]
-linux_alias = "test_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.test_unix]
-script_runner = "@shell"
-script = '''
-rm -rf libafl_unix_shmem_server || true
-LD_PRELOAD=$CARGO_TARGET_DIR/${PROFILE_DIR}/libfrida_executable_fuzzer.so ./libpng-harness -i corpus -o out -H ./libpng-harness > fuzz_stdout.log &
-sleep 10s && pkill libpng-harness
-if grep -qa "corpus: 30" fuzz_stdout.log; then
-    echo "Fuzzer is working"
-else
-    echo "Fuzzer does not generate any testcases or any crashes"
-    exit 1
-fi
-'''
-dependencies = ["fuzzer", "harness"]
-
-# Clean up
-[tasks.clean]
-linux_alias = "clean_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.clean_unix]
-# Disable default `clean` definition
-clear = true
-script_runner = "@shell"
-script = '''
-rm -f ./libpng-harness
-make -C libpng-1.6.37 clean
-cargo clean
-'''

fuzzers/binary_only/frida_libpng/Justfile

@@ -0,0 +1,67 @@
+import "../../../just/libafl.just"
+
+FUZZER_NAME := "frida_fuzzer"
+FUZZER_NAME_WIN := "frida_fuzzer.exe"
+
+set windows-shell := ['cmd.exe', '/c']
+set unstable
+
+[unix]
+libpng:
+    #!/bin/bash
+    if [ ! -f v1.6.37.tar.gz ]; then
+        wget https://github.com/glennrp/libpng/archive/refs/tags/v1.6.37.tar.gz
+    fi
+    tar -xvf v1.6.37.tar.gz
+
+[unix]
+lib: libpng
+    cd libpng-1.6.37 && ./configure --enable-shared=no --with-pic=yes --enable-hardware-optimizations=yes
+    make -j -C libpng-1.6.37
+
+[unix]
+harness: lib
+    clang++ -O3 -c -fPIC harness.cc -o harness.o
+    clang++ -O3 harness.o libpng-1.6.37/.libs/libpng16.a -shared -lz -o libpng-harness.so
+
+[windows]
+harness:
+    cl /c harness_win.cpp && link harness_win.obj /dll
+
+[unix]
+[windows]
+build:
+    cargo build --profile {{ PROFILE }}
+
+[unix]
+run: build harness
+    {{ FUZZER }} -F LLVMFuzzerTestOneInput -H ./libpng-harness.so -l ./libpng-harness.so
+
+[windows]
+run: build harness
+    {{TARGET_DIR}}\{{PROFILE}}\{{FUZZER_NAME_WIN}} -F LLVMFuzzerTestOneInput -H .\harness_win.dll -l .\harness_win.dll --cores=0
+
+[unix]
+test: build harness
+    #!/bin/bash
+
+    rm -rf libafl_unix_shmem_server || true
+    timeout 30s {{ FUZZER }} -F LLVMFuzzerTestOneInput -H ./libpng-harness.so -l ./libpng-harness.so | tee fuzz_stdout.log 2>/dev/null || true
+    if grep -qa "corpus: 70" fuzz_stdout.log; then
+        echo "Fuzzer is working"
+    else
+        echo "Fuzzer does not generate any testcases or any crashes"
+        exit 1
+    fi
+
+[windows]
+[script("cmd.exe", "/c")]
+test: build harness
+    start "" "{{TARGET_DIR}}\{{PROFILE}}\{{FUZZER_NAME_WIN}}" -F LLVMFuzzerTestOneInput -H .\harness_win.dll -l .\harness_win.dll --cores=0
+    ping -n 10 127.0.0.1>NUL && taskkill /im frida_fuzzer.exe /F
+    dir /a-d corpus_discovered && (echo Files exist) || (exit /b 1337)
+
+[unix]
+clean:
+    make -C libpng-1.6.37 clean
+    cargo clean

fuzzers/binary_only/frida_libpng/Makefile.toml

@@ -1,160 +0,0 @@
-# Variables
-[env]
-CARGO_TARGET_DIR = { value = "target", condition = { env_not_set = [
-  "CARGO_TARGET_DIR",
-] } }
-FUZZER_NAME = { source = "${CARGO_MAKE_RUST_TARGET_OS}", default_value = "frida_fuzzer", mapping = { "linux" = "frida_fuzzer", "macos" = "frida_fuzzer", "windows" = "frida_fuzzer.exe" } }
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-PROFILE_DIR = { source = "${PROFILE}", default_value = "release", mapping = { "release" = "release", "dev" = "debug" }, condition = { env_not_set = [
-  "PROFILE_DIR",
-] } }
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Cargo-make not integrated yet on this"
-'''
-
-# libpng
-[tasks.libpng]
-linux_alias = "libpng_unix"
-mac_alias = "libpng_unix"
-windows_alias = "unsupported"
-
-[tasks.libpng_unix]
-condition = { files_not_exist = ["./libpng-1.6.37"] }
-script_runner = "@shell"
-script = '''
-wget https://github.com/glennrp/libpng/archive/refs/tags/v1.6.37.tar.gz
-tar -xvf v1.6.37.tar.gz
-'''
-
-# Library
-[tasks.lib]
-linux_alias = "lib_unix"
-mac_alias = "lib_unix"
-windows_alias = "unsupported"
-
-[tasks.lib_unix]
-script_runner = "@shell"
-script = '''
-cd libpng-1.6.37 && ./configure --enable-shared=no --with-pic=yes --enable-hardware-optimizations=yes --disable-dependency-tracking
-cd ..
-make -C libpng-1.6.37
-'''
-dependencies = ["libpng"]
-
-# Harness
-[tasks.harness]
-linux_alias = "harness_unix"
-mac_alias = "harness_unix"
-windows_alias = "harness_windows"
-
-[tasks.harness_unix]
-script_runner = "@shell"
-script = '''
-clang++ -O3 -c -fPIC harness.cc -o harness.o
-clang++ -O3 harness.o libpng-1.6.37/.libs/libpng16.a -shared -lz -o libpng-harness.so
-'''
-dependencies = ["lib"]
-
-[tasks.harness_windows]
-script_runner = "@shell"
-script = '''
-cl /c harness_win.cpp && link harness_win.obj /dll
-'''
-
-# Fuzzer
-[tasks.fuzzer]
-linux_alias = "fuzzer_unix"
-mac_alias = "fuzzer_unix"
-windows_alias = "fuzzer_windows"
-
-[tasks.fuzzer_unix]
-script_runner = "@shell"
-script = '''
-cargo build --profile ${PROFILE}
-cp ${CARGO_TARGET_DIR}/${PROFILE_DIR}/${FUZZER_NAME} .
-'''
-
-[tasks.fuzzer_windows]
-script_runner = "@shell"
-script = '''
-cargo build --profile ${PROFILE}
-cp ./target/${PROFILE_DIR}/${FUZZER_NAME} .
-'''
-
-# Run the fuzzer
-[tasks.run]
-linux_alias = "run_unix"
-mac_alias = "run_unix"
-windows_alias = "run_windows"
-
-[tasks.run_unix]
-script_runner = "@shell"
-script = '''
-./${FUZZER_NAME} -F LLVMFuzzerTestOneInput -H ./libpng-harness.so -l ./libpng-harness.so
-'''
-dependencies = ["fuzzer", "harness"]
-
-[tasks.run_windows]
-script_runner = "@shell"
-script = '''
-./${FUZZER_NAME} -F LLVMFuzzerTestOneInput -H ./harness_win.dll -l ./harness_win.dll --cores=0
-'''
-dependencies = ["fuzzer", "harness"]
-
-# Test
-[tasks.test]
-linux_alias = "test_unix"
-mac_alias = "test_mac"
-windows_alias = "test_windows"
-
-[tasks.test_unix]
-script_runner = "@shell"
-script = '''
-rm -rf libafl_unix_shmem_server || true
-timeout 30s ./${FUZZER_NAME} -F LLVMFuzzerTestOneInput -H ./libpng-harness.so -l ./libpng-harness.so | tee fuzz_stdout.log 2>/dev/null || true
-if grep -qa "corpus: 70" fuzz_stdout.log; then
-    echo "Fuzzer is working"
-else
-    echo "Fuzzer does not generate any testcases or any crashes"
-    exit 1
-fi
-'''
-dependencies = ["fuzzer", "harness"]
-
-# Don't grep and check the result on macOS because it's unstable
-[tasks.test_mac]
-script_runner = "@shell"
-script = '''
-rm -rf libafl_unix_shmem_server || true
-timeout 30s ./${FUZZER_NAME} -F LLVMFuzzerTestOneInput -H ./libpng-harness.so -l ./libpng-harness.so | tee fuzz_stdout.log 2>/dev/null || true
-'''
-dependencies = ["fuzzer", "harness"]
-
-[tasks.test_windows]
-script_runner = "@shell"
-script = '''
-start "" "frida_fuzzer.exe" -F LLVMFuzzerTestOneInput -H ./harness_win.dll -l ./harness_win.dll --cores=0
-#ping is for timeout
-ping -n 10 127.0.0.1>NUL && taskkill /im frida_fuzzer.exe /F
->nul 2>nul dir /a-d "corpus_discovered\*" && (echo Files exist) || (exit /b 1337)
-'''
-dependencies = ["fuzzer", "harness"]
-
-# Clean up
-[tasks.clean]
-linux_alias = "clean_unix"
-mac_alias = "clean_unix"
-windows_alias = "unsupported"
-
-[tasks.clean_unix]
-# Disable default `clean` definition
-clear = true
-script_runner = "@shell"
-script = '''
-rm -f ./${FUZZER_NAME}
-make -C libpng-1.6.37 clean
-cargo clean
-'''

fuzzers/binary_only/frida_windows_gdiplus/Justfile

@@ -0,0 +1,49 @@
+import "../../../just/libafl.just"
+
+FUZZER_NAME := "frida_windows_gdiplus.exe"
+set windows-shell := ['cmd.exe', '/c']
+set unstable
+
+[windows]
+harness:
+    cl.exe /LD harness.cc /link /dll gdiplus.lib ole32.lib
+
+[windows]
+harness_cmplog_test:
+    ml64 cmplog_test.asm /subsystem:windows /link /dll /def:cmplog_test.def /entry:dll_main /out:cmplog.dll
+
+[windows]
+build:
+    cargo build --profile {{ PROFILE }}
+    copy {{TARGET_DIR}}\{{PROFILE}}\{{FUZZER_NAME}} .
+
+[windows]
+run: build harness
+    .\{{TARGET_DIR}}\{{PROFILE}}\{{FUZZER_NAME}} -H harness.dll -i corpus -o output --libs-to-instrument gdi32.dll --libs-to-instrument gdi32full.dll --libs-to-instrument gdiplus.dll --libs-to-instrument WindowsCodecs.dll --disable-excludes
+
+[windows]
+[script("cmd.exe", "/c")]
+test_cmplog: build harness_cmplog_test
+    @echo off
+
+    for %%i in (t1 t2 t3 t4 t5 t6 t7) do (
+      echo Testing %%i...
+      rmdir /s /q output_%%i
+      start "" "{{FUZZER_NAME}}" -H cmplog.dll -i corpus -o output_%%i --libs-to-instrument cmplog.dll -F %%i -C
+      ping -n 3 127.0.0.1>NUL && taskkill /im {{ FUZZER }} /F
+      dir /a-d "output_%%i" && (echo Files exist) || (exit /b 1337)
+    )
+
+    echo All tests done
+
+[windows]
+[script("cmd.exe", "/c")]
+test: build harness
+    start "" "{{FUZZER_NAME}}" -H harness.dll -i corpus -o output --libs-to-instrument gdi32.dll --libs-to-instrument gdi32full.dll --libs-to-instrument gdiplus.dll --libs-to-instrument WindowsCodecs.dll --disable-excludes
+    ping -n 10 127.0.0.1>NUL && taskkill /im frida_windows_gdiplus.exe /F
+    dir /a-d corpus_discovered && (echo Files exist) || (exit /b 1337)
+
+[windows]
+clean:
+    make -C libpng-1.6.37 clean
+    cargo clean

fuzzers/binary_only/frida_windows_gdiplus/Makefile.toml

@@ -1,99 +0,0 @@
-# Variables
-[env]
-CARGO_TARGET_DIR = { value = "target", condition = { env_not_set = [
-  "CARGO_TARGET_DIR",
-] } }
-FUZZER_NAME = { source = "${CARGO_MAKE_RUST_TARGET_OS}", default_value = "frida_windows_gdiplus", mapping = { "linux" = "frida_windows_gdiplus", "macos" = "frida_windows_gdiplus", "windows" = "frida_windows_gdiplus.exe" } }
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-PROFILE_DIR = { source = "${PROFILE}", default_value = "release", mapping = { "release" = "release", "dev" = "debug" }, condition = { env_not_set = [
-  "PROFILE_DIR",
-] } }
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Cargo-make not integrated yet on this"
-'''
-
-# Harness
-[tasks.harness]
-linux_alias = "unsupported"
-mac_alias = "unsupported"
-windows_alias = "harness_windows"
-
-
-[tasks.harness_windows]
-script_runner = "@shell"
-script = '''
-cl.exe /LD harness.cc /link /dll gdiplus.lib ole32.lib
-'''
-
-[tasks.harness_windows_cmplog_test]
-script_runner = "@shell"
-script = '''
-ml64 cmplog_test.asm /subsystem:windows /link /dll /def:cmplog_test.def /entry:dll_main /out:cmplog.dll
-'''
-
-# Fuzzer
-[tasks.fuzzer]
-linux_alias = "unsupported"
-mac_alias = "unsupported"
-windows_alias = "fuzzer_windows"
-
-[tasks.fuzzer_windows]
-script_runner = "@shell"
-script = '''
-cargo build --profile ${PROFILE}
-cp ./target/${PROFILE_DIR}/${FUZZER_NAME} .
-'''
-
-# Run the fuzzer
-[tasks.run]
-linux_alias = "unsupported"
-mac_alias = "unsupported"
-windows_alias = "run_windows"
-
-[tasks.run_windows]
-script_runner = "@shell"
-script = '''
-./${FUZZER_NAME} -H harness.dll -i corpus -o output --libs-to-instrument gdi32.dll --libs-to-instrument gdi32full.dll --libs-to-instrument gdiplus.dll --libs-to-instrument WindowsCodecs.dll --disable-excludes
-'''
-dependencies = ["fuzzer", "harness"]
-
-# Test
-[tasks.test]
-linux_alias = "unsupported"
-mac_alias = "unsupported"
-windows_alias = "test_windows"
-
-[tasks.test_cmplog]
-linux_alias = "unsupported"
-mac_alias = "unsupported"
-windows_alias = "test_windows_cmplog"
-
-[tasks.test_windows_cmplog]
-script_runner = "@shell"
-script = '''
-@echo off
-
-for %%i in (t1 t2 t3 t4 t5 t6 t7) do (
-  echo Testing %%i...
-  rmdir /s /q output_%%i
-  start "" "frida_windows_gdiplus.exe" -H cmplog.dll -i corpus -o output_%%i --libs-to-instrument cmplog.dll -F %%i -C
-  ping -n 3 127.0.0.1>NUL && taskkill /im frida_windows_gdiplus.exe /F
-  >nul 2>nul dir /a-d "output_%%i" && (echo Files exist) || (exit /b 1337)
-)
-
-echo All tests done
-'''
-dependencies = ["fuzzer", "harness_windows_cmplog_test"]
-
-[tasks.test_windows]
-script_runner = "@shell"
-script = '''
-start "" "frida_windows_gdiplus.exe" -H harness.dll -i corpus -o output --libs-to-instrument gdi32.dll --libs-to-instrument gdi32full.dll --libs-to-instrument gdiplus.dll --libs-to-instrument WindowsCodecs.dll --disable-excludes
-#ping is for timeout
-ping -n 10 127.0.0.1>NUL && taskkill /im frida_windows_gdiplus.exe /F
->nul 2>nul dir /a-d "corpus_discovered\*" && (echo Files exist) || (exit /b 1337)
-'''
-dependencies = ["fuzzer", "harness"]

fuzzers/binary_only/fuzzbench_fork_qemu/Justfile

@@ -0,0 +1,44 @@
+import "../../../just/libafl.just"
+
+FUZZER_NAME := "fuzzbench_fork_qemu"
+
+[unix]
+harness:
+    cc -c libfuzzer_main.c
+    cc \
+        ./fuzz.c \
+        ./libfuzzer_main.o \
+        -o {{ BUILD_DIR }}/harness \
+        -lm -lz
+
+[unix]
+build:
+    cargo build --profile {{ PROFILE }}
+
+[unix]
+run: build harness
+    cargo run \
+      --profile {{ PROFILE }} \
+      ./{{ FUZZER_NAME }} \
+      -- \
+      --libafl-in ./corpus \
+      --libafl-out ./out \
+      ./{{ FUZZER_NAME }}
+
+
+[unix]
+test: build harness
+    #!/bin/bash
+
+    rm -rf out/
+    timeout 15s {{ FUZZER }} {{ BUILD_DIR }}/harness -- --libafl-in ../../inprocess/libfuzzer_libpng/corpus --libafl-out out ./harness | tee fuzz_stdout.log
+    if grep -qa "corpus: 5" fuzz_stdout.log; then
+        echo "Fuzzer is working"
+    else
+        echo "Fuzzer does not generate any testcases or any crashes"
+        exit 1
+    fi
+
+[unix]
+clean:
+    cargo clean

fuzzers/binary_only/fuzzbench_fork_qemu/Makefile.toml

@@ -1,115 +0,0 @@
-env_scripts = ['''
-#!@duckscript
-profile = get_env PROFILE
-
-if eq ${profile} "dev"
-    set_env PROFILE_DIR debug
-else
-    set_env PROFILE_DIR ${profile}
-end
-''', '''
-#!@duckscript
-runs_on_ci = get_env RUN_ON_CI
-
-if ${runs_on_ci}
-    cargo_target_dir = get_env CARGO_MAKE_CRATE_TARGET_DIRECTORY
-    set_env TARGET_DIR ${cargo_target_dir}
-end
-''']
-
-# Variables
-[env]
-FUZZER_NAME = 'harness'
-PROJECT_DIR = { script = ["pwd"] }
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}"
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Qemu fuzzer not supported on windows"
-'''
-
-# fuzzer
-[tasks.fuzzer]
-linux_alias = "fuzzer_unix"
-mac_alias = "fuzzer_unix"
-windows_alias = "unsupported"
-
-[tasks.fuzzer_unix]
-command = "cargo"
-args = ["build", "--profile", "${PROFILE}"]
-
-# Harness
-[tasks.harness]
-linux_alias = "harness_unix"
-mac_alias = "harness_unix"
-windows_alias = "unsupported"
-
-[tasks.harness_unix]
-script_runner = "@shell"
-script = '''
-cc -c "${PROJECT_DIR}/libfuzzer_main.c"
-cc \
-    ./fuzz.c \
-    ./libfuzzer_main.o \
-    -o ${FUZZER_NAME} \
-    -lm -lz
-'''
-
-# Run the fuzzer
-[tasks.run]
-linux_alias = "run_unix"
-mac_alias = "run_unix"
-windows_alias = "unsupported"
-
-[tasks.run_unix]
-command = "cargo"
-args = [
-  "run",
-  "--profile",
-  "${PROFILE}",
-  "./${FUZZER_NAME}",
-  "--",
-  "--libafl-in",
-  "./corpus",
-  "--libafl-out",
-  "./out",
-  "./${FUZZER_NAME}",
-]
-dependencies = ["harness"]
-
-# Run the fuzzer
-[tasks.test]
-linux_alias = "test_unix"
-mac_alias = "test_unix"
-windows_alias = "unsupported"
-
-# Short test
-[tasks.test_unix]
-script_runner = "@shell"
-script = '''
-timeout 15s ${TARGET_DIR}/${PROFILE_DIR}/fuzzbench_fork_qemu ${PROJECT_DIR}/harness -- --libafl-in ${PROJECT_DIR}/../../inprocess/libfuzzer_libpng/corpus --libafl-out ${PROJECT_DIR}/out ${PROJECT_DIR}/harness | tee fuzz_stdout.log
-if grep -qa "corpus: 5" fuzz_stdout.log; then
-    echo "Fuzzer is working"
-else
-    echo "Fuzzer does not generate any testcases or any crashes"
-    exit 1
-fi
-'''
-dependencies = ["harness", "fuzzer"]
-
-# Clean up
-[tasks.clean]
-linux_alias = "clean_unix"
-mac_alias = "clean_unix"
-windows_alias = "unsupported"
-
-[tasks.clean_unix]
-# Disable default `clean` definition
-clear = true
-script_runner = "@shell"
-script = '''
-rm -f ./${FUZZER_NAME}
-cargo clean
-'''

fuzzers/binary_only/fuzzbench_qemu/Justfile

@@ -0,0 +1,42 @@
+import "../../../just/libafl.just"
+
+FUZZER_NAME := "fuzzbench_qemu"
+HARNESS_NAME := "harness"
+
+[unix]
+harness:
+    cc -c libfuzzer_main.c
+    cc \
+        ./fuzz.c \
+        ./libfuzzer_main.o \
+        -o {{ HARNESS_NAME }} \
+        -lm -lz
+
+[unix]
+build:
+    cargo build --profile {{ PROFILE }}
+
+[unix]
+run: build harness
+    {{ FUZZER }} \
+      --libafl-in ./corpus \
+      --libafl-out ./out \
+      ./{{ HARNESS_NAME }} \
+      -- \
+      ./{{ HARNESS_NAME }}
+
+
+[unix]
+test: build harness
+    #!/bin/bash
+    timeout 15s {{ FUZZER }} ./harness -- --libafl-in ../../inprocess/libfuzzer_libpng/corpus --libafl-out out ./harness | tee fuzz_stdout.log
+    if grep -qa "objectives: 5" fuzz_stdout.log; then
+        echo "Fuzzer is working"
+    else
+        echo "Fuzzer does not generate any testcases or any crashes"
+        exit 1
+    fi
+
+[unix]
+clean:
+    cargo clean

fuzzers/binary_only/fuzzbench_qemu/Makefile.toml

@@ -1,101 +0,0 @@
-# Variables
-[env]
-FUZZER_NAME = 'harness'
-PROJECT_DIR = { script = ["pwd"] }
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-PROFILE_DIR = { source = "${PROFILE}", default_value = "release", mapping = { "release" = "release", "dev" = "debug" }, condition = { env_not_set = [
-  "PROFILE_DIR",
-] } }
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}"
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Qemu fuzzer not supported on windows"
-'''
-
-# fuzzer
-[tasks.fuzzer]
-linux_alias = "fuzzer_unix"
-mac_alias = "fuzzer_unix"
-windows_alias = "unsupported"
-
-[tasks.fuzzer_unix]
-command = "cargo"
-args = ["build", "--profile", "${PROFILE}"]
-
-# Harness
-[tasks.harness]
-linux_alias = "harness_unix"
-mac_alias = "harness_unix"
-windows_alias = "unsupported"
-
-[tasks.harness_unix]
-script_runner = "@shell"
-script = '''
-cc -c "${PROJECT_DIR}/libfuzzer_main.c"
-cc \
-    ./fuzz.c \
-    ./libfuzzer_main.o \
-    -o ${FUZZER_NAME} \
-    -lm -lz
-'''
-
-# Run the fuzzer
-[tasks.run]
-linux_alias = "run_unix"
-mac_alias = "run_unix"
-windows_alias = "unsupported"
-
-[tasks.run_unix]
-script_runner = "@shell"
-script = '''
-cargo build \
-  --profile \
-  ${PROFILE}
-
-${TARGET_DIR}/${PROFILE_DIR}/fuzzbench_qemu \
-  --libafl-in \
-  ../../inprocess/libfuzzer_libpng/corpus \
-  --libafl-out \
-  ./out \
-  ./${FUZZER_NAME} \
-  -- \
-  ./${FUZZER_NAME}
-'''
-dependencies = ["harness"]
-
-# Run the fuzzer
-[tasks.test]
-linux_alias = "test_unix"
-mac_alias = "test_unix"
-windows_alias = "unsupported"
-
-# Short test
-[tasks.test_unix]
-script_runner = "@shell"
-script = '''
-timeout 15s ${TARGET_DIR}/${PROFILE_DIR}/fuzzbench_qemu ${PROJECT_DIR}/harness -- --libafl-in ${PROJECT_DIR}/../../inprocess/libfuzzer_libpng/corpus --libafl-out ${PROJECT_DIR}/out ${PROJECT_DIR}/harness | tee fuzz_stdout.log
-if grep -qa "objectives: 1" fuzz_stdout.log; then
-    echo "Fuzzer is working"
-else
-    echo "Fuzzer does not generate any testcases or any crashes"
-    exit 1
-fi
-'''
-dependencies = ["harness", "fuzzer"]
-
-# Clean up
-[tasks.clean]
-linux_alias = "clean_unix"
-mac_alias = "clean_unix"
-windows_alias = "unsupported"
-
-[tasks.clean_unix]
-# Disable default `clean` definition
-clear = true
-script_runner = "@shell"
-script = '''
-rm -f ./${FUZZER_NAME}
-cargo clean
-'''

fuzzers/binary_only/intel_pt_baby_fuzzer/Makefile.toml

@@ -1,26 +0,0 @@
-[env]
-RUST_BACKTRACE = "0"
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}"
-
-[env.development]
-PROFILE_DIR = "debug"
-CARGO_BUILD_ARG = ""
-
-[env.release]
-PROFILE_DIR = "release"
-CARGO_BUILD_ARG = "--release"
-
-[tasks.build]
-command = "cargo"
-args = ["build", "--profile", "${CARGO_MAKE_CARGO_PROFILE}"]
-
-[tasks.setcap]
-script = "sudo setcap cap_ipc_lock,cap_sys_ptrace,cap_sys_admin,cap_syslog=ep ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/${PROFILE_DIR}/${CARGO_MAKE_CRATE_NAME}"
-dependencies = ["build"]
-
-[tasks.run]
-command = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/${PROFILE_DIR}/${CARGO_MAKE_CRATE_NAME}"
-dependencies = ["build", "setcap"]
-
-[tasks.default]
-alias = "run"

fuzzers/binary_only/intel_pt_command_executor/Justfile

@@ -0,0 +1,31 @@
+import "../../../just/libafl.just"
+
+FUZZER_NAME := "intel_pt_command_executor"
+
+[unix]
+target_dir:
+    mkdir -p {{ TARGET_DIR }}
+
+[unix]
+build_target: target_dir
+    rustc src/target_program.rs --out-dir {{ TARGET_DIR }} -O
+
+[unix]
+build:
+    cargo build --profile {{ PROFILE }}
+
+[unix]
+setcap:
+    sudo setcap cap_ipc_lock,cap_sys_ptrace,cap_sys_admin,cap_syslog=ep {{ FUZZER }}
+
+[unix]
+run: build build_target setcap
+    {{ FUZZER }}
+
+[unix]
+test: build
+    echo "Build is successful."
+
+[unix]
+clean:
+    cargo clean

fuzzers/binary_only/intel_pt_command_executor/Makefile.toml

@@ -1,39 +0,0 @@
-[env]
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}"
-
-[env.development]
-PROFILE_DIR = "debug"
-
-[env.release]
-PROFILE_DIR = "release"
-
-[tasks.target_dir]
-condition = { files_not_exist = ["${TARGET_DIR}"] }
-script_runner = "@shell"
-script = '''
-mkdir -p ${TARGET_DIR}
-'''
-
-[tasks.build_target]
-dependencies = ["target_dir"]
-command = "rustc"
-args = ["src/target_program.rs", "--out-dir", "${TARGET_DIR}", "-O"]
-
-[tasks.build_fuzzer]
-command = "cargo"
-args = ["build", "--profile", "${CARGO_MAKE_CARGO_PROFILE}"]
-
-[tasks.build]
-dependencies = ["build_fuzzer", "build_target"]
-
-[tasks.setcap]
-script = "sudo setcap cap_ipc_lock,cap_sys_ptrace,cap_sys_admin,cap_syslog=ep ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/${PROFILE_DIR}/${CARGO_MAKE_CRATE_NAME}"
-dependencies = ["build_fuzzer"]
-
-[tasks.run]
-command = "cargo"
-args = ["run", "--profile", "${CARGO_MAKE_CARGO_PROFILE}"]
-dependencies = ["build", "setcap"]
-
-[tasks.default]
-alias = "run"

fuzzers/binary_only/qemu_cmin/Justfile

@@ -0,0 +1,45 @@
+import "../../../just/libafl-qemu-libpng.just"
+
+FUZZER_NAME := "qemu_cmin"
+HARNESS := TARGET_DIR / ("libpng-harness-" + PROFILE)
+
+[unix]
+build:
+    cargo build \
+      --profile {{ PROFILE }} \
+      --features {{ ARCH }} \
+      --target-dir {{ TARGET_DIR }}
+
+[unix]
+harness: libpng
+    #!/bin/bash
+
+    source {{ DOTENV }}
+
+    $CROSS_CXX \
+        ./harness.cc \
+        $CROSS_CFLAGS \
+        "{{TARGET_DIR}}/build-png/.libs/libpng16.a" \
+        "{{TARGET_DIR}}/build-zlib/libz.a" \
+        -I"{{TARGET_DIR}}/build-png" \
+        -I"{{TARGET_DIR}}/build-zlib/zlib/lib" \
+        -L"{{TARGET_DIR}}/build-zlib/zlib/lib" \
+        -o"{{ HARNESS }}" \
+        -lm -static
+
+[unix]
+run: harness build
+    {{ FUZZER }} \
+        --output ./output \
+        --input ./corpus \
+        --verbose \
+        -- {{ HARNESS }}
+
+[unix]
+test:
+    ARCH=x86_64 just run
+    ARCH=arm just run
+
+[unix]
+clean:
+    cargo clean

fuzzers/binary_only/qemu_cmin/Makefile.toml

@@ -1,320 +0,0 @@
-[env]
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-PROFILE_DIR = { source = "${PROFILE}", default_value = "release", mapping = { "release" = "release", "dev" = "debug" }, condition = { env_not_set = [
-  "PROFILE_DIR",
-] } }
-CROSS_CC = "x86_64-linux-gnu-gcc"
-CROSS_CXX = "x86_64-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/x86_64"
-LIBPNG_ARCH = "x86_64"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "x86_64"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-#LIBAFL_DEBUG_OUTPUT = "1"
-#CUSTOM_QEMU_DIR= "~/qemu-libafl-bridge"
-
-[env.arm]
-CROSS_CC = "arm-linux-gnueabi-gcc"
-CROSS_CXX = "arm-linux-gnueabi-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/arm"
-LIBPNG_ARCH = "arm"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "arm"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[env.aarch64]
-CROSS_CC = "aarch64-linux-gnu-gcc"
-CROSS_CXX = "aarch64-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/aarch64"
-LIBPNG_ARCH = "aarch64"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "aarch64"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[env.x86_64]
-CROSS_CC = "x86_64-linux-gnu-gcc"
-CROSS_CXX = "x86_64-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/x86_64"
-LIBPNG_ARCH = "x86_64"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "x86_64"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[env.i386]
-CROSS_CC = "x86_64-linux-gnu-gcc"
-CROSS_CXX = "x86_64-linux-gnu-g++"
-CROSS_CFLAGS = "-m32"
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/i386"
-LIBPNG_ARCH = "i386"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "i386"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[env.mips]
-CROSS_CC = "mipsel-linux-gnu-gcc"
-CROSS_CXX = "mipsel-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/mips"
-LIBPNG_ARCH = "mips"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "mips"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[env.ppc]
-CROSS_CC = "powerpc-linux-gnu-gcc"
-CROSS_CXX = "powerpc-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/ppc"
-LIBPNG_ARCH = "ppc"
-LIBPNG_OPTIMIZATIONS = "no"
-FEATURE = "ppc"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Qemu fuzzer not supported on windows/mac"
-'''
-
-
-[tasks.target_dir]
-condition = { files_not_exist = ["${CARGO_MAKE_CRATE_TARGET_DIRECTORY}"] }
-script_runner = "@shell"
-script = '''
-mkdir ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
-'''
-
-[tasks.deps_dir]
-dependencies = ["target_dir"]
-condition = { files_not_exist = ["${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/"] }
-script_runner = "@shell"
-script = '''
-mkdir ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
-'''
-
-[tasks.arch_target_dir]
-dependencies = ["target_dir"]
-condition = { files_not_exist = ["${TARGET_DIR}"] }
-script_runner = "@shell"
-script = '''
-mkdir ${TARGET_DIR}
-'''
-
-[tasks.zlib]
-linux_alias = "zlib_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.zlib_unix_wget]
-dependencies = ["deps_dir"]
-condition = { files_not_exist = [
-  "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13",
-] }
-script_runner = "@shell"
-# NOTE: There's no specific reason we're using an old version of zlib,
-# but newer versions get moved to fossils/ after a while.
-script = '''
-wget \
-    -O "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13.tar.gz" \
-    https://zlib.net/fossils/zlib-1.2.13.tar.gz
-
-tar \
-    zxvf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13.tar.gz \
-    -C ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
-'''
-
-[tasks.zlib_unix]
-dependencies = ["arch_target_dir", "zlib_unix_wget"]
-condition = { files_not_exist = ["${TARGET_DIR}/build-zlib/libz.a"] }
-script_runner = "@shell"
-script = '''
-rm -rf ${TARGET_DIR}/build-zlib/
-
-mkdir ${TARGET_DIR}/build-zlib/
-
-cd ${TARGET_DIR}/build-zlib/ && \
-    CC=$CROSS_CC \
-    CFLAGS=${CROSS_CFLAGS} \
-    ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13/configure \
-        --prefix=./zlib
-
-make install
-'''
-
-[tasks.libpng]
-linux_alias = "libpng_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.libpng_unix_wget]
-dependencies = ["deps_dir"]
-condition = { files_not_exist = [
-  "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37",
-] }
-script_runner = "@shell"
-script = '''
-wget \
-    -O "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/v1.6.37.tar.gz" \
-    https://github.com/glennrp/libpng/archive/refs/tags/v1.6.37.tar.gz
-
-tar \
-    -xvf "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/v1.6.37.tar.gz" \
-    -C ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
-'''
-
-[tasks.libpng_unix]
-dependencies = ["arch_target_dir", "zlib", "libpng_unix_wget"]
-condition = { files_not_exist = ["${TARGET_DIR}/build-png/.libs/libpng16.a"] }
-script_runner = "@shell"
-script = '''
-rm -rf ${TARGET_DIR}/build-png/
-
-mkdir ${TARGET_DIR}/build-png/
-
-cd ${TARGET_DIR}/build-png/ && \
-    CC=$CROSS_CC \
-    CFLAGS="${CROSS_CFLAGS} -I"${TARGET_DIR}/build-zlib/zlib/lib"" \
-    LDFLAGS=-L"${TARGET_DIR}/build-zlib/zlib/lib" \
-    ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37/configure \
-        --enable-shared=no \
-        --with-pic=yes \
-        --enable-hardware-optimizations=${LIBPNG_OPTIMIZATIONS} \
-        --host=${LIBPNG_ARCH} \
-
-make
-'''
-
-[tasks.build]
-linux_alias = "build_unix"
-mac_alias = "build_unix"
-windows_alias = "unsupported"
-
-[tasks.build_unix]
-command = "cargo"
-args = [
-  "build",
-  "--profile",
-  "${PROFILE}",
-  "--features",
-  "${FEATURE}",
-  "--target-dir",
-  "${TARGET_DIR}",
-]
-
-[tasks.fuzzer]
-dependencies = ["build"]
-script_runner = "@shell"
-script = '''
-rm -f ${TARGET_DIR}/${PROFILE_DIR}/qemu_cmin-${CARGO_MAKE_PROFILE}
-mv ${TARGET_DIR}/${PROFILE_DIR}/qemu_cmin ${TARGET_DIR}/${PROFILE_DIR}/qemu_cmin-${CARGO_MAKE_PROFILE}
-'''
-
-[tasks.harness]
-linux_alias = "harness_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.harness_unix]
-script_runner = "@shell"
-script = '''
-${CROSS_CXX} \
-    ./harness.cc \
-    $CROSS_CFLAGS \
-    "${TARGET_DIR}/build-png/.libs/libpng16.a" \
-	"${TARGET_DIR}/build-zlib/libz.a" \
-    -I"${TARGET_DIR}/build-png" \
-	-I"${TARGET_DIR}/build-zlib/zlib/lib" \
-	-L"${TARGET_DIR}/build-zlib/zlib/lib" \
-    -o"${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}" \
-    -lm \
-	-static
-'''
-dependencies = ["libpng"]
-
-[tasks.run]
-linux_alias = "run_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.run_unix]
-command = "${TARGET_DIR}/${PROFILE_DIR}/qemu_cmin-${CARGO_MAKE_PROFILE}"
-args = [
-  "--output",
-  "./output",
-  "--input",
-  "./corpus",
-  "--verbose",
-  "--",
-  "${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}",
-]
-dependencies = ["harness", "fuzzer"]
-
-[tasks.test]
-linux_alias = "test_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.test_unix]
-dependencies = ["lightweight"]
-# Tidy up after we've run our tests so we don't hog all the disk space
-command = "cargo"
-args = ["make", "clean"]
-
-[tasks.test_full]
-linux_alias = "test_unix_full"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.test_unix_full]
-dependencies = ["all"]
-# Tidy up after we've run our tests so we don't hog all the disk space
-command = "cargo"
-args = ["make", "clean"]
-
-[tasks.clean]
-linux_alias = "clean_unix"
-mac_alias = "clean_unix"
-windows_alias = "unsupported"
-
-[tasks.clean_unix]
-# Disable default `clean` definition
-clear = true
-script_runner = "@shell"
-script = '''
-rm -rf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
-cargo clean
-'''
-
-[tasks.arm]
-command = "cargo"
-args = ["make", "-p", "arm", "run"]
-
-[tasks.aarch64]
-command = "cargo"
-args = ["make", "-p", "aarch64", "run"]
-
-[tasks.x86_64]
-command = "cargo"
-args = ["make", "-p", "x86_64", "run"]
-
-[tasks.i386]
-command = "cargo"
-args = ["make", "-p", "i386", "run"]
-
-[tasks.mips]
-command = "cargo"
-args = ["make", "-p", "mips", "run"]
-
-[tasks.ppc]
-command = "cargo"
-args = ["make", "-p", "ppc", "run"]
-
-[tasks.all]
-dependencies = ["arm", "aarch64", "x86_64", "i386", "mips", "ppc"]
-
-[tasks.lightweight]
-dependencies = ["arm", "x86_64"]

fuzzers/binary_only/qemu_coverage/Justfile

@@ -0,0 +1,65 @@
+import "../../../just/libafl-qemu-libpng.just"
+
+FUZZER_NAME := "qemu_coverage"
+HARNESS := TARGET_DIR / ("libpng-harness-" + PROFILE)
+
+[unix]
+build:
+    cargo build \
+      --profile {{ PROFILE }} \
+      --features {{ ARCH }} \
+      --target-dir {{ TARGET_DIR }}
+
+[unix]
+harness: libpng
+    #!/bin/bash
+
+    source {{ DOTENV }}
+
+    $CROSS_CXX \
+        ./harness.cc \
+        $CROSS_CFLAGS \
+        "{{TARGET_DIR}}/build-png/.libs/libpng16.a" \
+        "{{TARGET_DIR}}/build-zlib/libz.a" \
+        -I"{{TARGET_DIR}}/build-png" \
+        -I"{{TARGET_DIR}}/build-zlib/zlib/lib" \
+        -L"{{TARGET_DIR}}/build-zlib/zlib/lib" \
+        -o"{{ HARNESS }}" \
+        -lm -static
+
+[unix]
+run: harness build
+    {{ FUZZER }} \
+        --coverage-path {{ TARGET_DIR }}/cov.drcov \
+        --input-dir ./corpus \
+        --verbose \
+        -- {{ HARNESS }}
+
+[unix]
+test_inner: run
+    #!/bin/bash
+
+    cargo run --manifest-path ../../../utils/drcov_utils/Cargo.toml --bin drcov_merge -- \
+        -i {{ TARGET_DIR }}/cov-000.drcov {{ TARGET_DIR }}/cov-001.drcov {{TARGET_DIR }}/cov-002.drcov {{ TARGET_DIR }}/cov-003.drcov \
+        --output {{ TARGET_DIR }}/cov-merged.drcov || exit 1
+
+    NB_BLOCKS=$(cargo run --manifest-path ../../../utils/drcov_utils/Cargo.toml --bin drcov_dump_addrs -- \
+        -i {{ TARGET_DIR }}/cov-merged.drcov -a | wc -l || exit 1)
+
+    echo "Nb blocks found: $NB_BLOCKS"
+
+    if [ $NB_BLOCKS -ge 1700 ]; then
+    echo "Test succeeded"
+    else
+    echo "Did not find more than 1700 blocks."
+    exit 1
+    fi
+
+[unix]
+test:
+    ARCH=x86_64 just test_inner
+    ARCH=arm just test_inner
+
+[unix]
+clean:
+    cargo clean

fuzzers/binary_only/qemu_coverage/Makefile.toml

@@ -1,350 +0,0 @@
-[env]
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-PROFILE_DIR = { source = "${PROFILE}", default_value = "release", mapping = { "release" = "release", "dev" = "debug" }, condition = { env_not_set = [
-  "PROFILE_DIR",
-] } }
-CROSS_CC = "x86_64-linux-gnu-gcc"
-CROSS_CXX = "x86_64-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/x86_64"
-LIBPNG_ARCH = "x86_64"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "x86_64"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-#LIBAFL_DEBUG_OUTPUT = "1"
-#CUSTOM_QEMU_DIR= "~/qemu-libafl-bridge"
-
-[env.arm]
-CROSS_CC = "arm-linux-gnueabi-gcc"
-CROSS_CXX = "arm-linux-gnueabi-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/arm"
-LIBPNG_ARCH = "arm"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "arm"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[env.aarch64]
-CROSS_CC = "aarch64-linux-gnu-gcc"
-CROSS_CXX = "aarch64-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/aarch64"
-LIBPNG_ARCH = "aarch64"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "aarch64"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[env.x86_64]
-CROSS_CC = "x86_64-linux-gnu-gcc"
-CROSS_CXX = "x86_64-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/x86_64"
-LIBPNG_ARCH = "x86_64"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "x86_64"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[env.i386]
-CROSS_CC = "x86_64-linux-gnu-gcc"
-CROSS_CXX = "x86_64-linux-gnu-g++"
-CROSS_CFLAGS = "-m32"
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/i386"
-LIBPNG_ARCH = "i386"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "i386"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[env.mips]
-CROSS_CC = "mipsel-linux-gnu-gcc"
-CROSS_CXX = "mipsel-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/mips"
-LIBPNG_ARCH = "mips"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "mips"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[env.ppc]
-CROSS_CC = "powerpc-linux-gnu-gcc"
-CROSS_CXX = "powerpc-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/ppc"
-LIBPNG_ARCH = "ppc"
-LIBPNG_OPTIMIZATIONS = "no"
-FEATURE = "ppc"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Qemu fuzzer not supported on windows/mac"
-'''
-
-
-[tasks.target_dir]
-condition = { files_not_exist = ["${CARGO_MAKE_CRATE_TARGET_DIRECTORY}"] }
-script_runner = "@shell"
-script = '''
-mkdir ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
-'''
-
-[tasks.deps_dir]
-dependencies = ["target_dir"]
-condition = { files_not_exist = ["${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/"] }
-script_runner = "@shell"
-script = '''
-mkdir ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
-'''
-
-[tasks.arch_target_dir]
-dependencies = ["target_dir"]
-condition = { files_not_exist = ["${TARGET_DIR}"] }
-script_runner = "@shell"
-script = '''
-mkdir ${TARGET_DIR}
-'''
-
-[tasks.zlib]
-linux_alias = "zlib_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.zlib_unix_wget]
-dependencies = ["deps_dir"]
-condition = { files_not_exist = [
-  "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13",
-] }
-script_runner = "@shell"
-# NOTE: There's no specific reason we're using an old version of zlib,
-# but newer versions get moved to fossils/ after a while.
-script = '''
-wget \
-    -O "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13.tar.gz" \
-    https://zlib.net/fossils/zlib-1.2.13.tar.gz
-
-tar \
-    zxvf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13.tar.gz \
-    -C ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
-'''
-
-[tasks.zlib_unix]
-dependencies = ["arch_target_dir", "zlib_unix_wget"]
-condition = { files_not_exist = ["${TARGET_DIR}/build-zlib/libz.a"] }
-script_runner = "@shell"
-script = '''
-rm -rf ${TARGET_DIR}/build-zlib/
-
-mkdir ${TARGET_DIR}/build-zlib/
-
-cd ${TARGET_DIR}/build-zlib/ && \
-    CC=$CROSS_CC \
-    CFLAGS=${CROSS_CFLAGS} \
-    ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13/configure \
-        --prefix=./zlib
-
-make install
-'''
-
-[tasks.libpng]
-linux_alias = "libpng_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.libpng_unix_wget]
-dependencies = ["deps_dir"]
-condition = { files_not_exist = [
-  "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37",
-] }
-script_runner = "@shell"
-script = '''
-wget \
-    -O "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/v1.6.37.tar.gz" \
-    https://github.com/glennrp/libpng/archive/refs/tags/v1.6.37.tar.gz
-
-tar \
-    -xvf "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/v1.6.37.tar.gz" \
-    -C ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
-'''
-
-[tasks.libpng_unix]
-dependencies = ["arch_target_dir", "zlib", "libpng_unix_wget"]
-condition = { files_not_exist = ["${TARGET_DIR}/build-png/.libs/libpng16.a"] }
-script_runner = "@shell"
-script = '''
-rm -rf ${TARGET_DIR}/build-png/
-
-mkdir ${TARGET_DIR}/build-png/
-
-cd ${TARGET_DIR}/build-png/ && \
-    CC=$CROSS_CC \
-    CFLAGS="${CROSS_CFLAGS} -I"${TARGET_DIR}/build-zlib/zlib/lib"" \
-    LDFLAGS=-L"${TARGET_DIR}/build-zlib/zlib/lib" \
-    ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37/configure \
-        --enable-shared=no \
-        --with-pic=yes \
-        --enable-hardware-optimizations=${LIBPNG_OPTIMIZATIONS} \
-        --host=${LIBPNG_ARCH} \
-
-make
-'''
-
-[tasks.build]
-linux_alias = "build_unix"
-mac_alias = "build_unix"
-windows_alias = "unsupported"
-
-[tasks.build_unix]
-command = "cargo"
-args = [
-  "build",
-  "--profile",
-  "${PROFILE}",
-  "--features",
-  "${FEATURE}",
-  "--target-dir",
-  "${TARGET_DIR}",
-]
-
-[tasks.fuzzer]
-dependencies = ["build"]
-script_runner = "@shell"
-script = '''
-rm -f ${TARGET_DIR}/${PROFILE_DIR}/qemu_coverage-${CARGO_MAKE_PROFILE}
-mv ${TARGET_DIR}/${PROFILE_DIR}/qemu_coverage ${TARGET_DIR}/${PROFILE_DIR}/qemu_coverage-${CARGO_MAKE_PROFILE}
-'''
-
-[tasks.harness]
-linux_alias = "harness_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.harness_unix]
-script_runner = "@shell"
-script = '''
-${CROSS_CXX} \
-    ./harness.cc \
-    $CROSS_CFLAGS \
-    "${TARGET_DIR}/build-png/.libs/libpng16.a" \
-	"${TARGET_DIR}/build-zlib/libz.a" \
-    -I"${TARGET_DIR}/build-png" \
-	-I"${TARGET_DIR}/build-zlib/zlib/lib" \
-	-L"${TARGET_DIR}/build-zlib/zlib/lib" \
-    -o"${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}" \
-    -lm \
-	-static
-'''
-dependencies = ["libpng"]
-
-[tasks.run]
-linux_alias = "run_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.run_unix]
-script_runner = "@shell"
-script = '''
-${TARGET_DIR}/${PROFILE_DIR}/qemu_coverage-${CARGO_MAKE_PROFILE} \
-  --coverage-path \
-  ${TARGET_DIR}/cov.drcov \
-  --input-dir \
-  ./corpus \
-  -- \
-  ${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}
-'''
-dependencies = ["harness", "fuzzer"]
-
-[tasks.test]
-linux_alias = "test_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.test_unix]
-dependencies = ["lightweight"]
-# Tidy up after we've run our tests so we don't hog all the disk space
-command = "cargo"
-args = ["make", "clean"]
-
-[tasks.test_full]
-linux_alias = "test_unix_full"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.test_unix_full]
-dependencies = ["all"]
-# Tidy up after we've run our tests so we don't hog all the disk space
-command = "cargo"
-args = ["make", "clean"]
-
-[tasks.clean]
-linux_alias = "clean_unix"
-mac_alias = "clean_unix"
-windows_alias = "unsupported"
-
-[tasks.clean_unix]
-# Disable default `clean` definition
-clear = true
-script_runner = "@shell"
-script = '''
-rm -rf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
-cargo clean
-'''
-
-[tasks.test_inner]
-script_runner = "@shell"
-script = '''
-cargo make ${FEATURE} || exit 1
-
-cargo run --manifest-path ../../../utils/drcov_utils/Cargo.toml --bin drcov_merge -- \
-  -i ${TARGET_DIR}/cov-000.drcov ${TARGET_DIR}/cov-001.drcov ${TARGET_DIR}/cov-002.drcov ${TARGET_DIR}/cov-003.drcov \
-  --output ${TARGET_DIR}/cov-merged.drcov || exit 1
-
-NB_BLOCKS=$(cargo run --manifest-path ../../../utils/drcov_utils/Cargo.toml --bin drcov_dump_addrs -- \
-  -i ${TARGET_DIR}/cov-merged.drcov -a | wc -l || exit 1)
-
-echo "Nb blocks found: $NB_BLOCKS"
-
-if [ $NB_BLOCKS -ge 1700 ]; then
-  echo "Test succeeded"
-else
-  echo "Did not find more than 1700 blocks."
-  exit 1
-fi
-'''
-
-[tasks.arm]
-command = "cargo"
-args = ["make", "-p", "arm", "run"]
-
-[tasks.test_arm]
-command = "cargo"
-args = ["make", "-p", "arm", "test_inner"]
-
-[tasks.aarch64]
-command = "cargo"
-args = ["make", "-p", "aarch64", "run"]
-
-[tasks.x86_64]
-command = "cargo"
-args = ["make", "-p", "x86_64", "run"]
-
-[tasks.test_x86_64]
-command = "cargo"
-args = ["make", "-p", "x86_64", "test_inner"]
-
-[tasks.i386]
-command = "cargo"
-args = ["make", "-p", "i386", "run"]
-
-[tasks.mips]
-command = "cargo"
-args = ["make", "-p", "mips", "run"]
-
-[tasks.ppc]
-command = "cargo"
-args = ["make", "-p", "ppc", "run"]
-
-[tasks.all]
-dependencies = ["arm", "aarch64", "x86_64", "i386", "mips", "ppc"]
-
-[tasks.lightweight]
-dependencies = ["test_x86_64", "test_arm"]

fuzzers/binary_only/qemu_launcher/Justfile

@@ -0,0 +1,96 @@
+import "../../../just/libafl-qemu-libpng.just"
+
+FUZZER_NAME := "qemu_launcher"
+
+HARNESS := TARGET_DIR / ("libpng-harness-" + PROFILE)
+
+[unix]
+build:
+    cargo build \
+      --profile {{ PROFILE }} \
+      --features {{ ARCH }} \
+      --target-dir {{ TARGET_DIR }}
+
+[unix]
+harness: libpng
+    #!/bin/bash
+
+    source {{ DOTENV }}
+
+    $CROSS_CXX \
+        ./harness.cc \
+        $CROSS_CFLAGS \
+        "{{ TARGET_DIR }}/build-png/.libs/libpng16.a" \
+        "{{ TARGET_DIR }}/build-zlib/libz.a" \
+        -I"{{ TARGET_DIR }}/build-png" \
+        -I"{{ DEPS_DIR }}/libpng-1.6.37" \
+        -I"{{ TARGET_DIR }}/build-zlib/zlib/lib" \
+        -L"{{ TARGET_DIR }}/build-zlib/zlib/lib" \
+        -o"{{ HARNESS }}" \
+        -lm
+
+[unix]
+run: harness build
+    {{ FUZZER }} \
+        --input ./corpus \
+        --output {{ TARGET_DIR }}/output/ \
+        --log {{TARGET_DIR}}/output/log.txt \
+        --cores 0-7 \
+        --asan-cores 0-3 \
+        --cmplog-cores 2-5 \
+        --iterations 1000000 \
+        --tui \
+        -- \
+        {{ HARNESS }}
+
+
+[unix]
+test_inner: harness build
+    #!/bin/bash
+
+    source {{ DOTENV }}
+
+    export QEMU_LAUNCHER={{ FUZZER }}
+
+    ./tests/injection/test.sh || exit 1
+
+    # complie again with simple mgr
+    cargo build --profile={{PROFILE}} --features="simplemgr,{{ARCH}}" --target-dir={{ TARGET_DIR }}
+    ./tests/qasan/test.sh || exit 1
+
+[unix]
+test:
+    ARCH=x86_64 just test_inner
+
+single: harness build
+    {{ FUZZER }} \
+        --input ./corpus \
+        --output {{ TARGET_DIR }}/output/ \
+        --log {{ TARGET_DIR }}/output/log.txt \
+        --cores 0 \
+        -- \
+        {{ HARNESS }}
+
+asan: harness build
+    {{ FUZZER }} \
+        --input ./corpus \
+        --output {{ TARGET_DIR }}/output/ \
+        --log {{ TARGET_DIR }}/output/log.txt \
+        --cores 0 \
+        --asan-cores 0 \
+        -- \
+        {{ HARNESS }}
+
+asan_guest: harness build
+    {{ FUZZER }} \
+        --input ./corpus \
+        --output {{ TARGET_DIR }}/output/ \
+        --log {{ TARGET_DIR }}/output/log.txt \
+        --cores 0 \
+        --asan-guest-cores 0 \
+        -- \
+        {{ HARNESS }}
+
+[unix]
+clean:
+    cargo clean

fuzzers/binary_only/qemu_launcher/Makefile.toml

@@ -1,424 +0,0 @@
-env_scripts = ['''
-#!@duckscript
-profile = get_env PROFILE
-
-if eq ${profile} "dev"
-    set_env PROFILE_DIR debug
-else
-    set_env PROFILE_DIR ${profile}
-end
-''']
-
-[env]
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-PROFILE_DIR = { source = "${PROFILE}", default_value = "release", mapping = { "release" = "release", "dev" = "debug" }, condition = { env_not_set = [
-  "PROFILE_DIR",
-] } }
-CROSS_CC = "x86_64-linux-gnu-gcc"
-CROSS_CXX = "x86_64-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/x86_64"
-LIBPNG_ARCH = "x86_64"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "x86_64"
-#LIBAFL_DEBUG_OUTPUT = "1"
-#CUSTOM_QEMU_DIR= "~/qemu-libafl-bridge"
-
-[env.arm]
-CROSS_CC = "arm-linux-gnueabi-gcc"
-CROSS_CXX = "arm-linux-gnueabi-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/arm"
-LIBPNG_ARCH = "arm"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "arm"
-
-[env.aarch64]
-CROSS_CC = "aarch64-linux-gnu-gcc"
-CROSS_CXX = "aarch64-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/aarch64"
-LIBPNG_ARCH = "aarch64"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "aarch64"
-
-[env.x86_64]
-CROSS_CC = "x86_64-linux-gnu-gcc"
-CROSS_CXX = "x86_64-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/x86_64"
-LIBPNG_ARCH = "x86_64"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "x86_64"
-
-[env.i386]
-CROSS_CC = "x86_64-linux-gnu-gcc"
-CROSS_CXX = "x86_64-linux-gnu-g++"
-CROSS_CFLAGS = "-m32"
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/i386"
-LIBPNG_ARCH = "i386"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "i386"
-
-[env.mips]
-CROSS_CC = "mipsel-linux-gnu-gcc"
-CROSS_CXX = "mipsel-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/mips"
-LIBPNG_ARCH = "mips"
-LIBPNG_OPTIMIZATIONS = "yes"
-FEATURE = "mips"
-
-[env.ppc]
-CROSS_CC = "powerpc-linux-gnu-gcc"
-CROSS_CXX = "powerpc-linux-gnu-g++"
-CROSS_CFLAGS = ""
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/ppc"
-LIBPNG_ARCH = "ppc"
-LIBPNG_OPTIMIZATIONS = "no"
-FEATURE = "ppc"
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Qemu fuzzer not supported on windows/mac"
-'''
-
-[tasks.target_dir]
-condition = { files_not_exist = ["${CARGO_MAKE_CRATE_TARGET_DIRECTORY}"] }
-script_runner = "@shell"
-script = '''
-mkdir ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
-'''
-
-[tasks.deps_dir]
-dependencies = ["target_dir"]
-condition = { files_not_exist = ["${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/"] }
-script_runner = "@shell"
-script = '''
-mkdir ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
-'''
-
-[tasks.arch_target_dir]
-dependencies = ["target_dir"]
-condition = { files_not_exist = ["${TARGET_DIR}"] }
-script_runner = "@shell"
-script = '''
-mkdir ${TARGET_DIR}
-'''
-
-[tasks.zlib]
-linux_alias = "zlib_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.zlib_unix_wget]
-dependencies = ["deps_dir"]
-condition = { files_not_exist = [
-  "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13",
-] }
-script_runner = "@shell"
-# NOTE: There's no specific reason we're using an old version of zlib,
-# but newer versions get moved to fossils/ after a while.
-script = '''
-wget \
-    -O "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13.tar.gz" \
-    https://zlib.net/fossils/zlib-1.2.13.tar.gz
-
-tar \
-    zxvf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13.tar.gz \
-    -C ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
-'''
-
-[tasks.zlib_unix]
-dependencies = ["arch_target_dir", "zlib_unix_wget"]
-condition = { files_not_exist = ["${TARGET_DIR}/build-zlib/libz.a"] }
-script_runner = "@shell"
-script = '''
-rm -rf ${TARGET_DIR}/build-zlib/
-
-mkdir ${TARGET_DIR}/build-zlib/
-
-cd ${TARGET_DIR}/build-zlib/ && \
-    CC=$CROSS_CC \
-    CFLAGS=${CROSS_CFLAGS} \
-    ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13/configure \
-        --prefix=./zlib
-
-make install
-'''
-
-[tasks.libpng]
-linux_alias = "libpng_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.libpng_unix_wget]
-dependencies = ["deps_dir"]
-condition = { files_not_exist = [
-  "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37",
-] }
-script_runner = "@shell"
-script = '''
-wget \
-    -O "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/v1.6.37.tar.gz" \
-    https://github.com/glennrp/libpng/archive/refs/tags/v1.6.37.tar.gz
-
-tar \
-    -xvf "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/v1.6.37.tar.gz" \
-    -C ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
-'''
-
-[tasks.libpng_unix]
-dependencies = ["arch_target_dir", "zlib", "libpng_unix_wget"]
-condition = { files_not_exist = ["${TARGET_DIR}/build-png/.libs/libpng16.a"] }
-script_runner = "@shell"
-script = '''
-rm -rf ${TARGET_DIR}/build-png/
-
-mkdir ${TARGET_DIR}/build-png/
-
-cd ${TARGET_DIR}/build-png/ && \
-    CC=$CROSS_CC \
-    CFLAGS="${CROSS_CFLAGS}" \
-    CPPFLAGS="-I${TARGET_DIR}/build-zlib/zlib/include" \
-    LDFLAGS=-L"${TARGET_DIR}/build-zlib/zlib/lib" \
-    ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37/configure \
-        --enable-shared=no \
-        --with-pic=yes \
-        --enable-hardware-optimizations=${LIBPNG_OPTIMIZATIONS} \
-        --host=${LIBPNG_ARCH} \
-
-make
-'''
-
-[tasks.build]
-linux_alias = "build_unix"
-mac_alias = "build_unix"
-windows_alias = "unsupported"
-
-[tasks.build_unix]
-command = "cargo"
-args = [
-  "build",
-  "--profile",
-  "${PROFILE}",
-  "--features",
-  "${FEATURE}",
-  "--target-dir",
-  "${TARGET_DIR}",
-]
-
-[tasks.fuzzer]
-dependencies = ["build"]
-script_runner = "@shell"
-script = '''
-rm -f ${TARGET_DIR}/${PROFILE_DIR}/qemu_launcher-${CARGO_MAKE_PROFILE}
-mv ${TARGET_DIR}/${PROFILE_DIR}/qemu_launcher ${TARGET_DIR}/${PROFILE_DIR}/qemu_launcher-${CARGO_MAKE_PROFILE}
-'''
-
-[tasks.harness]
-linux_alias = "harness_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.harness_unix]
-script_runner = "@shell"
-script = '''
-${CROSS_CXX} \
-    ./harness.cc \
-    $CROSS_CFLAGS \
-    "${TARGET_DIR}/build-png/.libs/libpng16.a" \
-	"${TARGET_DIR}/build-zlib/libz.a" \
-    -I"${TARGET_DIR}/build-png" \
-    -I"${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37" \
-	-I"${TARGET_DIR}/build-zlib/zlib/include" \
-	-L"${TARGET_DIR}/build-zlib/zlib/lib" \
-    -o"${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}" \
-    -lm
-'''
-dependencies = ["libpng"]
-
-[tasks.debug]
-linux_alias = "debug_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.debug_unix]
-command = "${TARGET_DIR}/${PROFILE_DIR}/qemu_launcher-${CARGO_MAKE_PROFILE}"
-args = [
-  "--input",
-  "./corpus",
-  "--output",
-  "${TARGET_DIR}/output/",
-  "--log",
-  "${TARGET_DIR}/output/log.txt",
-  "--cores",
-  "0-7",
-  "--asan-cores",
-  "0-3",
-  "--cmplog-cores",
-  "2-5",
-  "--iterations",
-  "100000",
-  "--verbose",
-  "--",
-  "${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}",
-]
-dependencies = ["harness", "fuzzer"]
-
-[tasks.run]
-linux_alias = "run_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.run_unix]
-command = "${TARGET_DIR}/${PROFILE_DIR}/qemu_launcher-${CARGO_MAKE_PROFILE}"
-args = [
-  "--input",
-  "./corpus",
-  "--output",
-  "${TARGET_DIR}/output/",
-  "--log",
-  "${TARGET_DIR}/output/log.txt",
-  "--cores",
-  "0-7",
-  "--asan-cores",
-  "0-3",
-  "--cmplog-cores",
-  "2-5",
-  "--iterations",
-  "1000000",
-  "--tui",
-  "--",
-  "${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}",
-]
-dependencies = ["harness", "fuzzer"]
-
-[tasks.single]
-linux_alias = "single_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.single_unix]
-command = "${TARGET_DIR}/${PROFILE_DIR}/qemu_launcher-${CARGO_MAKE_PROFILE}"
-args = [
-  "--input",
-  "./corpus",
-  "--output",
-  "${TARGET_DIR}/output/",
-  "--log",
-  "${TARGET_DIR}/output/log.txt",
-  "--cores",
-  "0",
-  "--",
-  "${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}",
-]
-dependencies = ["harness", "fuzzer"]
-
-[tasks.asan]
-linux_alias = "asan_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.asan_unix]
-command = "${TARGET_DIR}/${PROFILE_DIR}/qemu_launcher-${CARGO_MAKE_PROFILE}"
-args = [
-  "--input",
-  "./corpus",
-  "--output",
-  "${TARGET_DIR}/output/",
-  "--log",
-  "${TARGET_DIR}/output/log.txt",
-  "--cores",
-  "0",
-  "--asan-cores",
-  "0",
-  "--",
-  "${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}",
-]
-dependencies = ["harness", "fuzzer"]
-
-[tasks.asan_guest]
-linux_alias = "asan_guest_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.asan_guest_unix]
-command = "${TARGET_DIR}/${PROFILE_DIR}/qemu_launcher-${CARGO_MAKE_PROFILE}"
-args = [
-  "--input",
-  "./corpus",
-  "--output",
-  "${TARGET_DIR}/output/",
-  "--log",
-  "${TARGET_DIR}/output/log.txt",
-  "--cores",
-  "0",
-  "--asan-guest-cores",
-  "0",
-  "--",
-  "${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}",
-]
-dependencies = ["harness", "fuzzer"]
-
-[tasks.test]
-linux_alias = "test_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.test_unix]
-script_runner = "@shell"
-script = '''
-echo "Profile: ${PROFILE}"
-
-export QEMU_LAUNCHER=${TARGET_DIR}/${PROFILE_DIR}/qemu_launcher
-
-./tests/injection/test.sh || exit 1
-
-# complie again with simple mgr
-cargo build --profile=${PROFILE} --features="simplemgr" --target-dir=${TARGET_DIR}
-./tests/qasan/test.sh || exit 1
-'''
-dependencies = ["build_unix"]
-
-[tasks.clean]
-linux_alias = "clean_unix"
-mac_alias = "clean_unix"
-windows_alias = "unsupported"
-
-[tasks.clean_unix]
-# Disable default `clean` definition
-clear = true
-script_runner = "@shell"
-script = '''
-rm -rf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
-cargo clean
-'''
-
-[tasks.arm]
-command = "cargo"
-args = ["make", "-p", "arm", "run"]
-
-[tasks.aarch64]
-command = "cargo"
-args = ["make", "-p", "aarch64", "run"]
-
-[tasks.x86_64]
-command = "cargo"
-args = ["make", "-p", "x86_64", "run"]
-
-[tasks.i386]
-command = "cargo"
-args = ["make", "-p", "i386", "run"]
-
-[tasks.mips]
-command = "cargo"
-args = ["make", "-p", "mips", "run"]
-
-[tasks.ppc]
-command = "cargo"
-args = ["make", "-p", "ppc", "run"]
-
-[tasks.all]
-dependencies = ["arm", "aarch64", "x86_64", "i386", "mips", "ppc"]

fuzzers/binary_only/tinyinst_simple/Justfile

@@ -0,0 +1,40 @@
+import "../../../just/libafl.just"
+FUZZER_NAME := "tinyinst_simple"
+
+set windows-shell := ["cmd.exe", "/c"]
+set unstable
+
+[linux]
+harness:
+    clang test/test.cpp -o test.exe
+
+[windows]
+harness:
+    cl test\test.cpp -o test.exe
+
+
+fuzzer: 
+    cargo build --profile {{PROFILE}}
+
+run: harness fuzzer
+    cargo run --profile {{PROFILE}}
+
+[linux]
+test: harness fuzzer
+    #!/bin/bash
+    cp {{TARGET_DIR}}/{{PROFILE_DIR}}/tinyinst_simple .
+    echo "Running tests"
+    timeout 5s ./tinyinst_simple || true
+    # corpus_discovered folder exists and is not empty
+    if [ -d "corpus_discovered" ] && [ -n "$(ls -A corpus_discovered)" ]; then
+        echo "Fuzzer works!"
+    else
+        exit 1
+    fi
+
+[windows]
+test: harness fuzzer
+    copy .\target\{{PROFILE_DIR}}\tinyinst_simple.exe .
+    start .\tinyinst_simple.exe
+    ping -n 10 127.0.0.1>NUL && taskkill /im tinyinst_simple.exe /F
+    dir /a-d corpus_discovered && (echo Files exist) || (exit /b 1337)

fuzzers/binary_only/tinyinst_simple/Makefile.toml

@@ -1,95 +0,0 @@
-[env]
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-PROFILE_DIR = { source = "${PROFILE}", default_value = "release", mapping = { "release" = "release", "dev" = "debug" }, condition = { env_not_set = [
-  "PROFILE_DIR",
-] } }
-CARGO_TARGET_DIR = { value = "target", condition = { env_not_set = [
-  "CARGO_TARGET_DIR",
-] } }
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Cargo-make not integrated yet on this"
-'''
-
-# Harness
-[tasks.harness]
-linux_alias = "harness_linux"
-mac_alias = "unsupported"
-windows_alias = "harness_windows"
-
-[tasks.harness_linux]
-script = '''
-clang test/test.cpp -o test.exe
-'''
-
-[tasks.harness_windows]
-script = '''
-cl test\test.cpp -o test.exe
-'''
-
-# Fuzzer
-[tasks.fuzzer]
-linux_alias = "fuzzer_linux"
-mac_alias = "unsupported"
-windows_alias = "fuzzer_windows"
-
-[tasks.fuzzer_linux]
-dependencies = ["harness"]
-command = "cargo"
-args = ["build", "--profile", "${PROFILE}"]
-
-[tasks.fuzzer_windows]
-dependencies = ["harness"]
-command = "cargo"
-args = ["build", "--profile", "${PROFILE}"]
-
-# Run the fuzzer
-[tasks.run]
-linux_alias = "run_linux"
-mac_alias = "unsupported"
-windows_alias = "run_windows"
-
-[tasks.run_linux]
-dependencies = ["harness", "fuzzer"]
-command = "cargo"
-args = ["run", "--profile", "${PROFILE}"]
-
-[tasks.run_windows]
-dependencies = ["harness", "fuzzer"]
-command = "cargo"
-args = ["run", "--profile", "${PROFILE}"]
-
-
-# Run the fuzzer
-[tasks.test]
-linux_alias = "test_linux"
-mac_alias = "unsupported"
-windows_alias = "test_windows"
-
-[tasks.test_linux]
-script_runner = "@shell"
-script = '''
-cp ${CARGO_TARGET_DIR}/${PROFILE_DIR}/tinyinst_simple .
-echo running tests
-timeout 5s ./tinyinst_simple || true
-# corpus_discovered folder exists and is not empty
-if [ -d "corpus_discovered" ] && [ -n "$(ls -A corpus_discovered)" ]; then
-    echo "Fuzzer works!"
-else
-    exit 1
-fi
-'''
-dependencies = ["harness", "fuzzer"]
-
-[tasks.test_windows]
-script_runner = "@shell"
-script = '''
-copy .\target\${PROFILE_DIR}\tinyinst_simple.exe .
-start "" "tinyinst_simple.exe"
-#ping is for timeout
-ping -n 10 127.0.0.1>NUL && taskkill /im tinyinst_simple.exe /F
->nul 2>nul dir /a-d "corpus_discovered\*" && (echo Files exist) || (exit /b 1337)
-'''
-dependencies = ["harness", "fuzzer"]

fuzzers/full_system/nyx_libxml2_parallel/Justfile

@@ -0,0 +1,32 @@
+import "../../../just/libafl.just"
+FUZZER_NAME := "nyx_libxml2_parallel"
+
+[unix]
+libxml2:
+    ./setup_libxml2.sh
+
+[unix]
+enable_kvm_vmware_hypercall:
+    #!/bin/bash
+    if [ ! -e /sys/module/kvm/parameters/enable_vmware_backdoor ] ||
+      ! grep -qF Y /sys/module/kvm/parameters/enable_vmware_backdoor; then
+        sudo modprobe -r kvm-intel # or kvm-amd for AMD
+        sudo modprobe -r kvm
+        sudo modprobe kvm enable_vmware_backdoor=y
+        sudo modprobe kvm-intel
+    fi;
+
+[unix]
+build: libxml2
+
+[unix]
+run: libxml2 enable_kvm_vmware_hypercall
+    cargo run
+
+[unix]
+test: build
+
+[unix]
+clean:
+    make -C libxml2 clean
+    cargo clean

fuzzers/full_system/nyx_libxml2_parallel/Makefile.toml

@@ -1,69 +0,0 @@
-
-# Variables
-[env]
-FUZZER_NAME = 'nyx_libxml2_parallel'
-PROJECT_DIR = { script = ["pwd"] }
-
-[config]
-skip_core_tasks = true # skip `cargo test` to avoid error
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Cargo-make not integrated yet on this platform"
-'''
-
-[tasks.build]
-dependencies = ["libxml2"]
-
-[tasks.libxml2]
-linux_alias = "libxml2_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.libxml2_unix]
-# condition = { files_not_exist = ["./libxml2"]}
-script_runner = "@shell"
-script = '''
-./setup_libxml2.sh
-'''
-
-[tasks.enable_kvm_vmware_hypercall]
-script_runner = "@shell"
-script = '''
-if [ ! -e /sys/module/kvm/parameters/enable_vmware_backdoor ] ||
-  ! grep -qF Y /sys/module/kvm/parameters/enable_vmware_backdoor; then
-  sudo modprobe -r kvm-intel # or kvm-amd for AMD
-  sudo modprobe -r kvm
-  sudo modprobe kvm enable_vmware_backdoor=y
-  sudo modprobe kvm-intel
-fi;
-'''
-
-# Run the fuzzer
-[tasks.run]
-linux_alias = "run_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.run_unix]
-script_runner = "@shell"
-script = '''
-cargo run
-'''
-dependencies = ["libxml2", "enable_kvm_vmware_hypercall"]
-
-# Clean up
-[tasks.clean]
-linux_alias = "clean_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.clean_unix]
-# Disable default `clean` definition
-clear = true
-script_runner = "@shell"
-script = '''
-make -C ./libxml2 clean
-cargo clean
-'''

fuzzers/full_system/nyx_libxml2_standalone/Justfile

@@ -0,0 +1,32 @@
+import "../../../just/libafl.just"
+FUZZER_NAME := "nyx_libxml2_parallel"
+
+[unix]
+libxml2:
+    ./setup_libxml2.sh
+
+[unix]
+enable_kvm_vmware_hypercall:
+    #!/bin/bash
+    if [ ! -e /sys/module/kvm/parameters/enable_vmware_backdoor ] ||
+      ! grep -qF Y /sys/module/kvm/parameters/enable_vmware_backdoor; then
+        sudo modprobe -r kvm-intel # or kvm-amd for AMD
+        sudo modprobe -r kvm
+        sudo modprobe kvm enable_vmware_backdoor=y
+        sudo modprobe kvm-intel
+    fi;
+
+[unix]
+build: libxml2
+
+[unix]
+run: libxml2 enable_kvm_vmware_hypercall
+    cargo run
+
+[unix]
+test: build
+
+[unix]
+clean:
+    make -C libxml2 clean
+    cargo clean

fuzzers/full_system/nyx_libxml2_standalone/Makefile.toml

@@ -1,69 +0,0 @@
-
-# Variables
-[env]
-FUZZER_NAME = 'nyx_libxml2_standalone'
-PROJECT_DIR = { script = ["pwd"] }
-
-[config]
-skip_core_tasks = true # skip `cargo test` to avoid error
-
-[tasks.unsupported]
-script_runner = "@shell"
-script = '''
-echo "Cargo-make not integrated yet on this platform"
-'''
-
-[tasks.build]
-dependencies = ["libxml2"]
-
-[tasks.libxml2]
-linux_alias = "libxml2_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.libxml2_unix]
-# condition = { files_not_exist = ["./libxml2"]}
-script_runner = "@shell"
-script = '''
-./setup_libxml2.sh
-'''
-
-[tasks.enable_kvm_vmware_hypercall]
-script_runner = "@shell"
-script = '''
-if [ ! -e /sys/module/kvm/parameters/enable_vmware_backdoor ] ||
-  ! grep -qF Y /sys/module/kvm/parameters/enable_vmware_backdoor; then
-  sudo modprobe -r kvm-intel # or kvm-amd for AMD
-  sudo modprobe -r kvm
-  sudo modprobe kvm enable_vmware_backdoor=y
-  sudo modprobe kvm-intel
-fi;
-'''
-
-# Run the fuzzer
-[tasks.run]
-linux_alias = "run_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.run_unix]
-script_runner = "@shell"
-script = '''
-cargo run
-'''
-dependencies = ["libxml2", "enable_kvm_vmware_hypercall"]
-
-# Clean up
-[tasks.clean]
-linux_alias = "clean_unix"
-mac_alias = "unsupported"
-windows_alias = "unsupported"
-
-[tasks.clean_unix]
-# Disable default `clean` definition
-clear = true
-script_runner = "@shell"
-script = '''
-make -C ./libxml2 clean
-cargo clean
-'''

fuzzers/full_system/qemu_baremetal/Justfile

@@ -0,0 +1,69 @@
+import "../../../just/libafl-qemu.just"
+FUZZER_NAME := "qemu_baremetal"
+
+KERNEL := TARGET_DIR / "example.elf"
+DUMMY_IMG := TARGET_DIR / "dummy.qcow2"
+
+target_dir:
+    mkdir -p "{{TARGET_DIR}}"
+
+image: target_dir
+    qemu-img create -f qcow2 {{DUMMY_IMG}} 32M
+
+target flavor: image target_dir
+    arm-none-eabi-gcc -ggdb -ffreestanding -nostartfiles -lgcc \
+        -T example/mps2_m3.ld \
+        -mcpu=cortex-m3 \
+        -D "TARGET_{{ uppercase(flavor) }}" \
+        -I {{BUILD_DIR / "include"}} \
+        example/main.c \
+        example/startup.c \
+        -o {{TARGET_DIR}}/example.elf
+
+build flavor="breakpoint": target_dir
+    cargo build \
+        --profile {{PROFILE}} \
+        --no-default-features \
+        --features std,{{flavor}} \
+        --target-dir {{TARGET_DIR}}
+
+run flavor="breakpoint": (target flavor) (build flavor)
+    {{BUILD_DIR / "qemu_baremetal"}} \
+        -icount shift=auto,align=off,sleep=off \
+        -machine mps2-an385 \
+        -monitor null \
+        -kernel {{KERNEL}} \
+        -drive if=none,format=qcow2,file={{DUMMY_IMG}} \
+        -serial null \
+        -nographic \
+        -snapshot \
+        -S
+
+test_flavor flavor: (target flavor) (build flavor)
+    #!/bin/bash
+    export KERNEL={{ KERNEL }}
+    export TARGET_DIR={{ TARGET_DIR }}
+
+    TMP_DIR=$(mktemp -d)
+
+    timeout 20s {{ FUZZER }} \
+        -icount shift=auto,align=off,sleep=off \
+        -machine mps2-an385 \
+        -monitor null \
+        -kernel {{ KERNEL }} -serial null \
+        -drive if=none,format=qcow2,file={{ DUMMY_IMG }} \
+        -nographic \
+        -snapshot \
+        -S | tee "$TMP_DIR/fuzz.log" 2>&1 || true
+
+    if [ -z "$(grep 'Objective' $TMP_DIR/fuzz.log)" ]; then
+        echo "qemu_baremetal ${FEATURE}: Fuzzer did not find the objective in $TMP_DIR/fuzz.log"
+        exit 1
+    else
+        echo "qemu_baremetal ${FEATURE}: Objective found."
+    fi
+
+test: (test_flavor "low_level") (test_flavor "breakpoint") (test_flavor "sync_exit")
+
+clean:
+    cargo clean

fuzzers/full_system/qemu_baremetal/Makefile.toml

@@ -1,234 +0,0 @@
-env_scripts = ['''
-#!@duckscript
-profile = get_env PROFILE
-
-if eq ${profile} "dev"
-    set_env PROFILE_DIR debug
-else
-    set_env PROFILE_DIR ${profile}
-end
-''', '''
-#!@duckscript
-runs_on_ci = get_env RUN_ON_CI
-
-if ${runs_on_ci}
-    cargo_target_dir = get_env CARGO_MAKE_CRATE_TARGET_DIRECTORY
-    set_env TARGET_DIR ${cargo_target_dir}
-    set_env KERNEL ${cargo_target_dir}/example.elf
-end
-''']
-
-[env]
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/${FEATURE}"
-LIBAFL_QEMU_CLONE_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge"
-KERNEL = "${TARGET_DIR}/example.elf"
-
-[tasks.target_dir]
-condition = { files_not_exist = ["${TARGET_DIR}"] }
-script_runner = "@shell"
-script = '''
-mkdir -p ${TARGET_DIR}
-'''
-
-[tasks.image]
-dependencies = ["target_dir"]
-condition = { files_not_exist = ["${TARGET_DIR}/dummy.qcow2"] }
-script_runner = "@shell"
-script = '''
-qemu-img create -f qcow2 ${TARGET_DIR}/dummy.qcow2 32M
-'''
-
-[tasks.target]
-dependencies = ["target_dir"]
-condition = { env_set = ["TARGET_DEFINE"] }
-command = "arm-none-eabi-gcc"
-args = [
-  "-ggdb",
-  "-ffreestanding",
-  "-nostartfiles",
-  "-lgcc",
-  "-T",
-  "${CARGO_MAKE_WORKING_DIRECTORY}/example/mps2_m3.ld",
-  "-mcpu=cortex-m3",
-  "${CARGO_MAKE_WORKING_DIRECTORY}/example/main.c",
-  "${CARGO_MAKE_WORKING_DIRECTORY}/example/startup.c",
-  "-D",
-  "${TARGET_DEFINE}",
-  "-I",
-  "${TARGET_DIR}/${PROFILE_DIR}/include",
-  "-o",
-  "${TARGET_DIR}/example.elf",
-]
-
-[tasks.build_fuzzer]
-condition = { env_set = ["FEATURE"] }
-command = "cargo"
-args = [
-  "build",
-  "--profile",
-  "${PROFILE}",
-  "--no-default-features",
-  "--features",
-  "std,${FEATURE}",
-  "--target-dir",
-  "${TARGET_DIR}",
-]
-dependencies = ["image"]
-
-[tasks.run_fuzzer]
-command = "${TARGET_DIR}/${PROFILE_DIR}/qemu_baremetal"
-args = [
-  "-icount",
-  "shift=auto,align=off,sleep=off",
-  "-machine",
-  "mps2-an385",
-  "-monitor",
-  "null",
-  "-kernel",
-  "${TARGET_DIR}/example.elf",
-  "-serial",
-  "null",
-  "-nographic",
-  "-snapshot",
-  "-drive",
-  "if=none,format=qcow2,file=${TARGET_DIR}/dummy.qcow2",
-  "-S",
-]
-dependencies = ["target"]
-
-[tasks.test_fuzzer]
-condition = { env_set = ["FEATURE"] }
-script_runner = "@shell"
-script = '''
-TMP_DIR=$(mktemp -d)
-
-cargo make build_$FEATURE
-timeout 20s ${TARGET_DIR}/${PROFILE_DIR}/qemu_baremetal -icount shift=auto,align=off,sleep=off -machine mps2-an385 -monitor null -kernel ${TARGET_DIR}/example.elf -serial null -nographic -snapshot -drive if=none,format=qcow2,file=${TARGET_DIR}/dummy.qcow2 -S | tee $TMP_DIR/fuzz.log 2>&1 || true
-
-if [ -z "$(grep 'Objective' $TMP_DIR/fuzz.log)" ]; then
-    echo "qemu_baremetal ${FEATURE}: Fuzzer did not find the objective in $TMP_DIR/fuzz.log"
-    exit 1
-else
-    echo "qemu_baremetal ${FEATURE}: Objective found."
-fi
-'''
-dependencies = ["target"]
-
-[tasks.build_low_level]
-command = "cargo"
-args = [
-  "make",
-  "-e",
-  "FEATURE=low_level",
-  "-e",
-  "TARGET_DEFINE=TARGET_CLASSIC",
-  "build_fuzzer",
-]
-
-[tasks.test_low_level]
-command = "cargo"
-args = [
-  "make",
-  "-e",
-  "FEATURE=low_level",
-  "-e",
-  "TARGET_DEFINE=TARGET_CLASSIC",
-  "test_fuzzer",
-]
-
-[tasks.build_breakpoint]
-command = "cargo"
-args = [
-  "make",
-  "-e",
-  "FEATURE=breakpoint",
-  "-e",
-  "TARGET_DEFINE=TARGET_BREAKPOINT",
-  "build_fuzzer",
-]
-
-[tasks.test_breakpoint]
-command = "cargo"
-args = [
-  "make",
-  "-e",
-  "FEATURE=breakpoint",
-  "-e",
-  "TARGET_DEFINE=TARGET_BREAKPOINT",
-  "test_fuzzer",
-]
-
-[tasks.build_sync_exit]
-command = "cargo"
-args = [
-  "make",
-  "-e",
-  "FEATURE=sync_exit",
-  "-e",
-  "TARGET_DEFINE=TARGET_SYNC_EXIT",
-  "build_fuzzer",
-]
-
-[tasks.test_sync_exit]
-command = "cargo"
-args = [
-  "make",
-  "-e",
-  "FEATURE=sync_exit",
-  "-e",
-  "TARGET_DEFINE=TARGET_SYNC_EXIT",
-  "test_fuzzer",
-]
-
-[tasks.low_level]
-command = "cargo"
-args = [
-  "make",
-  "-e",
-  "FEATURE=low_level",
-  "-e",
-  "TARGET_DEFINE=TARGET_CLASSIC",
-  "run_fuzzer",
-]
-
-[tasks.breakpoint]
-command = "cargo"
-args = [
-  "make",
-  "-e",
-  "FEATURE=breakpoint",
-  "-e",
-  "TARGET_DEFINE=TARGET_BREAKPOINT",
-  "run_fuzzer",
-]
-
-[tasks.sync_exit]
-command = "cargo"
-args = [
-  "make",
-  "-e",
-  "FEATURE=sync_exit",
-  "-e",
-  "TARGET_DEFINE=TARGET_SYNC_EXIT",
-  "run_fuzzer",
-]
-
-[tasks.test]
-clear = true
-run_task = { name = ["test_low_level", "test_breakpoint", "test_sync_exit"] }
-
-[tasks.build]
-clear = true
-run_task = { name = ["build_low_level", "build_breakpoint", "build_sync_exit"] }
-
-[tasks.run]
-alias = "low_level"
-
-[tasks.clean]
-clear = true
-script_runner = "@shell"
-script = '''
-rm -rf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
-cargo clean
-'''

fuzzers/full_system/qemu_baremetal/README.md

@@ -21,24 +21,20 @@ sudo apt -y install qemu-utils gcc-arm-none-eabi
 
 ## Build
 
+Build one of the flavors (breakpoint by default):
+
 ```bash
-cargo make build
+just build
 ```
 
 ## Run
 
-```bash
+Run one of the flavors (breakpoint by default):
-cargo make run
-```
-
-It is also possible to run the fuzzer with the other features:
 
 ```bash
-cargo make <feature>
+just run
 ```
 
-With feature being `low_level`, `breakpoint` or `sync_exit`.
-
 This will build the desired fuzzer (src/fuzzer_<feature>.rs) and a small example binary based on FreeRTOS, which can run under a qemu emulation target.
 Since the instrumentation is based on snapshots, QEMU needs a virtual drive (even if it is unused...).
 Thus, the makefile creates a dummy QCOW2 image `dummy.qcow2` (can be found in the `target directory`).

fuzzers/full_system/qemu_linux_kernel/Justfile

@@ -0,0 +1,69 @@
+import "../../../just/libafl-qemu.just"
+FUZZER_NAME := "qemu_linux_kernel"
+
+LINUX_BUILDER_URL := "git@github.com:AFLplusplus/linux-qemu-image-builder.git"
+LINUX_BUILDER_DIR := TARGET_DIR / "linux_builder"
+LINUX_BUILDER_OUT := LINUX_BUILDER_DIR / "output"
+
+target_dir:
+    mkdir -p "{{TARGET_DIR}}"/runtime
+    mkdir -p "{{TARGET_DIR}}"/setup
+
+linux_builder_dir: target_dir
+    #!/bin/bash
+
+    if [ ! -d {{ LINUX_BUILDER_DIR }} ]; then
+        git clone {{ LINUX_BUILDER_URL }} {{ LINUX_BUILDER_DIR }}
+    else
+        git -C {{ LINUX_BUILDER_DIR }} pull
+    fi
+
+update_files api="": target_dir linux_builder_dir (build api)
+    cp -r setup/* "{{ LINUX_BUILDER_DIR }}/setup/"
+    cp -r runtime/* "{{ LINUX_BUILDER_DIR }}/runtime/"
+
+    cp {{ BUILD_DIR }}/include/* "{{ LINUX_BUILDER_DIR }}/setup/"
+
+target api="": linux_builder_dir update_files
+    {{LINUX_BUILDER_DIR}}/build.sh
+
+build api="":
+    cargo build \
+      --profile {{ PROFILE }} \
+      --target-dir {{ TARGET_DIR }} \
+      --features "{{ api }}"
+
+run api="": (build api)
+    #!/bin/bash
+
+    rm -rf corpus_gen
+
+    # Find the bios dir of LibAFL QEMU
+    if [ ! -z "${LIBAFL_QEMU_DIR}" ]; then
+      LIBAFL_QEMU_BIOS_DIR=${LIBAFL_QEMU_DIR}/build/qemu-bundle/usr/local/share/qemu
+    else
+      LIBAFL_QEMU_BIOS_DIR={{ LIBAFL_QEMU_DIR_DEFAULT }}/build/qemu-bundle/usr/local/share/qemu
+    fi
+
+    qemu-img create -f qcow2 -o backing_file={{ LINUX_BUILDER_OUT }}/OVMF_CODE.4m.fd -F raw {{ LINUX_BUILDER_OUT }}/OVMF_CODE.4m.qcow2
+    qemu-img create -f qcow2 -o backing_file={{ LINUX_BUILDER_OUT }}/OVMF_VARS.4m.fd -F raw {{ LINUX_BUILDER_OUT }}/OVMF_VARS.4m.qcow2
+    qemu-img create -f qcow2 -o backing_file={{ LINUX_BUILDER_OUT }}/linux.qcow2 -F qcow2 {{ LINUX_BUILDER_OUT }}/linux.tmp.qcow2
+
+    {{FUZZER}} \
+      -accel tcg \
+      -m 4G \
+      -drive if=pflash,format=qcow2,file="{{ LINUX_BUILDER_OUT }}/OVMF_CODE.4m.qcow2" `# OVMF code pflash` \
+      -drive if=pflash,format=qcow2,file="{{ LINUX_BUILDER_OUT }}/OVMF_VARS.4m.qcow2" `# OVMF vars pflash` \
+      -device ahci,id=ahci,bus=pci.0,addr=4 \
+      -device ide-hd,bus=ahci.0,drive=disk,bootindex=1 \
+      -blockdev driver=file,filename="{{ LINUX_BUILDER_OUT }}/linux.tmp.qcow2",node-name=storage `# Backend file of "disk"` \
+      -blockdev driver=qcow2,file=storage,node-name=disk `# QCOW2 "disk"` \
+      -L "${LIBAFL_QEMU_BIOS_DIR}" \
+      -nographic \
+      -monitor null \
+      -serial null
+
+test: build (build "nyx")
+
+clean:
+    cargo clean

fuzzers/full_system/qemu_linux_kernel/Makefile.toml

@@ -1,223 +0,0 @@
-env_scripts = ['''
-#!@duckscript
-profile = get_env PROFILE
-harness_api = get_env HARNESS_API
-
-if eq ${profile} "dev"
-    set_env PROFILE_DIR debug
-else
-    set_env PROFILE_DIR ${profile}
-end
-
-if eq ${harness_api} "nyx"
-    set_env FEATURE nyx
-elseif eq ${harness_api} "lqemu"
-    set_env FEATURE ""
-else
-    echo "Unknown harness API: ${harness_api}"
-    exit 1
-end
-''', '''
-#!@duckscript
-runs_on_ci = get_env RUN_ON_CI
-
-if ${runs_on_ci}
-    cargo_target_dir = get_env CARGO_MAKE_CRATE_TARGET_DIRECTORY
-    set_env TARGET_DIR ${cargo_target_dir}
-end
-''']
-
-[env]
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-WORKING_DIR = "${CARGO_MAKE_WORKING_DIRECTORY}"
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}"
-LIBAFL_QEMU_CLONE_DIR = { value = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge", condition = { env_not_set = [
-  "LIBAFL_QEMU_DIR",
-] } }
-HARNESS_API = { value = "lqemu", condition = { env_not_set = ["HARNESS_API"] } }
-
-LINUX_BUILDER_URL = "git@github.com:AFLplusplus/linux-qemu-image-builder.git"
-LINUX_BUILDER_DIR = { value = "${TARGET_DIR}/linux_builder", condition = { env_not_set = [
-  "LINUX_BUILDER_DIR",
-] } }
-LINUX_BUILDER_OUT = "${LINUX_BUILDER_DIR}/output"
-
-[tasks.target_dir]
-condition = { files_not_exist = [
-  "${TARGET_DIR}",
-  "${TARGET_DIR}/runtime",
-  "${TARGET_DIR}/setup",
-] }
-script_runner = "@shell"
-script = '''
-mkdir -p ${TARGET_DIR}/runtime
-mkdir -p ${TARGET_DIR}/setup
-'''
-
-[tasks.linux_builder_dir]
-condition = { files_not_exist = ["${LINUX_BUILDER_DIR}"] }
-script_runner = "@shell"
-script = '''
-git clone ${LINUX_BUILDER_URL} ${LINUX_BUILDER_DIR}
-'''
-
-[tasks.target]
-dependencies = ["build", "linux_builder_dir"]
-script_runner = "@shell"
-script = '''
-git -C ${LINUX_BUILDER_DIR} pull
-
-# Copy setup & runtime fixed files
-cp -r ${WORKING_DIR}/setup/* ${LINUX_BUILDER_DIR}/setup/
-cp -r ${WORKING_DIR}/runtime/* ${LINUX_BUILDER_DIR}/runtime/
-
-# Copy generated libafl qemu header files to setup
-cp ${TARGET_DIR}/${PROFILE_DIR}/include/* ${LINUX_BUILDER_DIR}/setup/
-
-${LINUX_BUILDER_DIR}/build.sh
-'''
-
-[tasks.target_update]
-dependencies = ["build", "linux_builder_dir"]
-script_runner = "@shell"
-script = '''
-git -C ${LINUX_BUILDER_DIR} pull
-
-# Copy setup & runtime fixed files
-cp -r ${WORKING_DIR}/setup/* ${LINUX_BUILDER_DIR}/setup/
-cp -r ${WORKING_DIR}/runtime/* ${LINUX_BUILDER_DIR}/runtime/
-
-# Copy generated libafl qemu header files to setup
-cp ${TARGET_DIR}/${PROFILE_DIR}/include/* ${LINUX_BUILDER_DIR}/setup/
-
-${LINUX_BUILDER_DIR}/update.sh
-'''
-
-[tasks.build]
-dependencies = ["target_dir"]
-command = "cargo"
-args = [
-  "build",
-  "--profile",
-  "${PROFILE}",
-  "--target-dir",
-  "${TARGET_DIR}",
-  "--features",
-  "${FEATURE}",
-]
-
-[tasks.run]
-dependencies = ["build"]
-script_runner = "@shell"
-script = '''
-rm -rf "${WORKING_DIR}/corpus_gen"
-
-# Find the bios dir of LibAFL QEMU
-if [ ! -z "${LIBAFL_QEMU_DIR}" ]; then
-  LIBAFL_QEMU_BIOS_DIR=${LIBAFL_QEMU_DIR}/build/qemu-bundle/usr/local/share/qemu
-else
-  LIBAFL_QEMU_BIOS_DIR=${LIBAFL_QEMU_CLONE_DIR}/build/qemu-bundle/usr/local/share/qemu
-fi
-
-qemu-img create -f qcow2 -o backing_file=${LINUX_BUILDER_OUT}/OVMF_CODE.4m.fd -F raw ${LINUX_BUILDER_OUT}/OVMF_CODE.4m.qcow2
-qemu-img create -f qcow2 -o backing_file=${LINUX_BUILDER_OUT}/OVMF_VARS.4m.fd -F raw ${LINUX_BUILDER_OUT}/OVMF_VARS.4m.qcow2
-qemu-img create -f qcow2 -o backing_file=${LINUX_BUILDER_OUT}/linux.qcow2 -F qcow2 ${LINUX_BUILDER_OUT}/linux.tmp.qcow2
-
-${TARGET_DIR}/${PROFILE_DIR}/qemu_linux_kernel \
-  -accel tcg \
-  -m 4G \
-  -drive if=pflash,format=qcow2,file="${LINUX_BUILDER_OUT}/OVMF_CODE.4m.qcow2" `# OVMF code pflash` \
-  -drive if=pflash,format=qcow2,file="${LINUX_BUILDER_OUT}/OVMF_VARS.4m.qcow2" `# OVMF vars pflash` \
-  -device ahci,id=ahci,bus=pci.0,addr=4 \
-  -device ide-hd,bus=ahci.0,drive=disk,bootindex=1 \
-  -blockdev driver=file,filename="${LINUX_BUILDER_OUT}/linux.tmp.qcow2",node-name=storage `# Backend file of "disk"` \
-  -blockdev driver=qcow2,file=storage,node-name=disk `# QCOW2 "disk"` \
-  -L "${LIBAFL_QEMU_BIOS_DIR}" \
-  -nographic \
-  -monitor null \
-  -serial null
-'''
-
-[tasks.test_unix]
-script_runner = "@shell"
-script = '''
-# TODO: Run real test, not only building.
-
-# LibAFL QEMU API
-HARNESS_API=lqemu cargo make build
-
-# Nyx API
-HARNESS_API=nyx cargo make build
-'''
-
-[tasks.test]
-description = "Run a test"
-linux_alias = "test_unix"
-mac_alias = "test_unix"
-windows_alias = "unsupported"
-
-[tasks.debug]
-dependencies = ["build"]
-command = "time"
-args = [
-  "${TARGET_DIR}/${PROFILE_DIR}/qemu_systemmode_linux_kernel",
-  "-accel",
-  "kvm",
-  "-m",
-  "4G",
-  "-drive",
-  "if=pflash,format=raw,readonly=on,file=${LINUX_BUILDER_OUT}/OVMF_CODE.fd",
-  "-drive",
-  "if=pflash,format=raw,snapshot=off,file=${LINUX_BUILDER_OUT}/OVMF_VARS.fd",
-  "-blockdev",
-  "filename=${LINUX_BUILDER_OUT}/linux.qcow2,node-name=storage,driver=file",
-  "-blockdev",
-  "driver=qcow2,file=storage,node-name=disk",
-  "-device",
-  "virtio-scsi-pci,id=scsi0",
-  "-device",
-  "scsi-hd,bus=scsi0.0,drive=disk,id=virtio-disk0,bootindex=1",
-  "-L",
-  "${LIBAFL_QEMU_DIR}/build/qemu-bundle/usr/local/share/qemu",
-  "-snapshot",
-]
-
-[tasks.perf]
-command = "perf"
-args = [
-  "record",
-  "--call-graph",
-  "dwarf",
-  "${TARGET_DIR}/${PROFILE_DIR}/qemu_systemmode_linux_kernel",
-  "-accel",
-  "tcg",
-  "-m",
-  "4G",
-  "-drive",
-  "if=pflash,format=raw,readonly=on,file=${LINUX_BUILDER_OUT}/OVMF_CODE.fd",
-  "-drive",
-  "if=pflash,format=raw,snapshot=off,file=${LINUX_BUILDER_OUT}/OVMF_VARS.fd",
-  "-blockdev",
-  "filename=${LINUX_BUILDER_OUT}/linux.qcow2,node-name=storage,driver=file",
-  "-blockdev",
-  "driver=qcow2,file=storage,node-name=disk",
-  "-device",
-  "virtio-scsi-pci,id=scsi0",
-  "-device",
-  "scsi-hd,bus=scsi0.0,drive=disk,id=virtio-disk0,bootindex=1",
-  "-L",
-  "${LIBAFL_QEMU_DIR}/build/qemu-bundle/usr/local/share/qemu",
-  "-snapshot",
-  # "-icount", "shift=auto,align=off,sleep=off",
-  # "-monitor", "null",
-  # "-serial", "null",
-  # "-nographic",
-]
-
-[tasks.clean]
-clear = true
-script_runner = "@shell"
-script = '''
-rm -rf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
-cargo clean
-'''

fuzzers/full_system/qemu_linux_process/Cargo.toml

@@ -5,10 +5,14 @@ authors = ["Romain Malmain <rmalmain@pm.me>"]
 edition = "2021"
 
 [features]
+default = ["lqemu"]
 
 ## Build and run the target with the Nyx API instead of the built-in LibAFL QEMU API.
 nyx = []
 
+## Build and run the target with the LibAFL QEMU API.
+lqemu = []
+
 shared = ["libafl_qemu/shared"]
 
 [profile.release]

fuzzers/full_system/qemu_linux_process/Justfile

@@ -0,0 +1,74 @@
+import "../../../just/libafl-qemu.just"
+FUZZER_NAME := "qemu_linux_kernel"
+
+LINUX_BUILDER_URL := "git@github.com:AFLplusplus/linux-qemu-image-builder.git"
+LINUX_BUILDER_DIR := TARGET_DIR / "linux_builder"
+LINUX_BUILDER_OUT := LINUX_BUILDER_DIR / "output"
+
+target_dir:
+    mkdir -p "{{TARGET_DIR}}"
+
+linux_builder_dir: target_dir
+    #!/bin/bash
+
+    if [ ! -d {{ LINUX_BUILDER_DIR }} ]; then
+        git clone {{ LINUX_BUILDER_URL }} {{ LINUX_BUILDER_DIR }}
+    else
+        git -C {{ LINUX_BUILDER_DIR }} pull
+    fi
+
+compile_target api="lqemu": (build api)
+    clang -O0 -static -I {{ BUILD_DIR }}/include \
+      example/harness_{{ api }}.c \
+      -o {{ LINUX_BUILDER_DIR }}/runtime/harness
+
+update_files api="lqemu": target_dir linux_builder_dir (build api)
+    cp -r setup/* "{{ LINUX_BUILDER_DIR }}/setup/"
+    cp -r runtime/* "{{ LINUX_BUILDER_DIR }}/runtime/"
+
+    cp {{ BUILD_DIR }}/include/* "{{ LINUX_BUILDER_DIR }}/setup/"
+
+target api="lqemu": linux_builder_dir update_files
+    {{LINUX_BUILDER_DIR}}/build.sh
+
+build api="lqemu":
+    cargo build \
+      --no-default-features \
+      --profile {{ PROFILE }} \
+      --target-dir {{ TARGET_DIR }} \
+      --features "{{ api }}"
+
+run api="lqemu": (build api)
+    #!/bin/bash
+
+    rm -rf corpus_gen
+
+    # Find the bios dir of LibAFL QEMU
+    if [ ! -z "${LIBAFL_QEMU_DIR}" ]; then
+      LIBAFL_QEMU_BIOS_DIR=${LIBAFL_QEMU_DIR}/build/qemu-bundle/usr/local/share/qemu
+    else
+      LIBAFL_QEMU_BIOS_DIR={{ LIBAFL_QEMU_DIR_DEFAULT }}/build/qemu-bundle/usr/local/share/qemu
+    fi
+
+    qemu-img create -f qcow2 -o backing_file={{ LINUX_BUILDER_OUT }}/OVMF_CODE.4m.fd -F raw {{ LINUX_BUILDER_OUT }}/OVMF_CODE.4m.qcow2
+    qemu-img create -f qcow2 -o backing_file={{ LINUX_BUILDER_OUT }}/OVMF_VARS.4m.fd -F raw {{ LINUX_BUILDER_OUT }}/OVMF_VARS.4m.qcow2
+    qemu-img create -f qcow2 -o backing_file={{ LINUX_BUILDER_OUT }}/linux.qcow2 -F qcow2 {{ LINUX_BUILDER_OUT }}/linux.tmp.qcow2
+
+    {{FUZZER}} \
+      -accel tcg \
+      -m 4G \
+      -drive if=pflash,format=qcow2,file="{{ LINUX_BUILDER_OUT }}/OVMF_CODE.4m.qcow2" `# OVMF code pflash` \
+      -drive if=pflash,format=qcow2,file="{{ LINUX_BUILDER_OUT }}/OVMF_VARS.4m.qcow2" `# OVMF vars pflash` \
+      -device ahci,id=ahci,bus=pci.0,addr=4 \
+      -device ide-hd,bus=ahci.0,drive=disk,bootindex=1 \
+      -blockdev driver=file,filename="{{ LINUX_BUILDER_OUT }}/linux.tmp.qcow2",node-name=storage `# Backend file of "disk"` \
+      -blockdev driver=qcow2,file=storage,node-name=disk `# QCOW2 "disk"` \
+      -L "${LIBAFL_QEMU_BIOS_DIR}" \
+      -nographic \
+      -monitor null \
+      -serial null
+
+test: build (build "nyx")
+
+clean:
+    cargo clean

fuzzers/full_system/qemu_linux_process/Makefile.toml

@@ -1,257 +0,0 @@
-env_scripts = ['''
-#!@duckscript
-profile = get_env PROFILE
-harness_api = get_env HARNESS_API
-
-if eq ${profile} "dev"
-    set_env PROFILE_DIR debug
-else
-    set_env PROFILE_DIR ${profile}
-end
-
-if eq ${harness_api} "nyx"
-    set_env FEATURE nyx
-elseif eq ${harness_api} "lqemu"
-    set_env FEATURE ""
-else
-    echo "Unknown harness API: ${harness_api}"
-    exit 1
-end
-
-''', '''
-#!@duckscript
-runs_on_ci = get_env RUN_ON_CI
-
-if ${runs_on_ci}
-    cargo_target_dir = get_env CARGO_MAKE_CRATE_TARGET_DIRECTORY
-    set_env TARGET_DIR ${cargo_target_dir}
-    set_env KERNEL ${cargo_target_dir}/example.elf
-end
-''']
-
-[env]
-PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
-WORKING_DIR = "${CARGO_MAKE_WORKING_DIRECTORY}"
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}"
-LIBAFL_QEMU_CLONE_DIR = { value = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/qemu-libafl-bridge", condition = { env_not_set = [
-  "LIBAFL_QEMU_DIR",
-] } }
-LINUX_BUILDER_URL = "git@github.com:AFLplusplus/linux-qemu-image-builder.git"
-LINUX_BUILDER_DIR = { value = "${TARGET_DIR}/linux_builder", condition = { env_not_set = [
-  "LINUX_BUILDER_DIR",
-] } }
-LINUX_BUILDER_OUT = "${LINUX_BUILDER_DIR}/output"
-HARNESS_API = { value = "lqemu", condition = { env_not_set = ["HARNESS_API"] } }
-
-[tasks.target_dir]
-condition = { files_not_exist = [
-  "${TARGET_DIR}",
-  "${TARGET_DIR}/runtime",
-  "${TARGET_DIR}/setup",
-] }
-script_runner = "@shell"
-script = '''
-mkdir -p ${TARGET_DIR}/runtime
-mkdir -p ${TARGET_DIR}/setup
-'''
-
-[tasks.linux_builder_dir]
-condition = { files_not_exist = ["${LINUX_BUILDER_DIR}"] }
-script_runner = "@shell"
-script = '''
-git clone ${LINUX_BUILDER_URL} ${LINUX_BUILDER_DIR}
-'''
-
-[tasks.compile_target_nyx]
-condition = { env = { "HARNESS_API" = "nyx" } }
-dependencies = ["target_dir", "linux_builder_dir"]
-command = "clang"
-args = [
-  "-O0",
-  "-static",
-  "${WORKING_DIR}/example/harness_nyx.c",
-  "-o",
-  "${TARGET_DIR}/runtime/harness",
-  "-I",
-  "${TARGET_DIR}/${PROFILE_DIR}/include",
-]
-
-[tasks.compile_target_native]
-condition = { env = { "HARNESS_API" = "lqemu" } }
-dependencies = ["target_dir", "linux_builder_dir"]
-command = "clang"
-args = [
-  "-O0",
-  "-static",
-  "${WORKING_DIR}/example/harness.c",
-  "-o",
-  "${TARGET_DIR}/runtime/harness",
-  "-I",
-  "${TARGET_DIR}/${PROFILE_DIR}/include",
-]
-
-[tasks.compile_target]
-dependencies = ["compile_target_native", "compile_target_nyx"]
-
-[tasks.target]
-dependencies = ["build", "compile_target"]
-script_runner = "@shell"
-script = '''
-git -C ${LINUX_BUILDER_DIR} pull
-
-# Copy generated harness
-cp -r ${TARGET_DIR}/runtime/* ${LINUX_BUILDER_DIR}/runtime/
-
-# Copy setup & runtime fixed files
-cp -r ${WORKING_DIR}/setup/* ${LINUX_BUILDER_DIR}/setup/
-cp -r ${WORKING_DIR}/runtime/* ${LINUX_BUILDER_DIR}/runtime/
-
-${LINUX_BUILDER_DIR}/build.sh
-'''
-
-[tasks.target_update]
-dependencies = ["build", "compile_target"]
-script_runner = "@shell"
-script = '''
-# Copy generated harness
-cp -r ${TARGET_DIR}/runtime/* ${LINUX_BUILDER_DIR}/runtime/
-
-# Copy setup & runtime fixed files
-cp -r ${WORKING_DIR}/runtime/* ${LINUX_BUILDER_DIR}/runtime/
-
-${LINUX_BUILDER_DIR}/update.sh
-'''
-
-[tasks.build]
-dependencies = ["target_dir"]
-command = "cargo"
-args = [
-  "build",
-  "--profile",
-  "${PROFILE}",
-  "--target-dir",
-  "${TARGET_DIR}",
-  "--features",
-  "${FEATURE}",
-]
-
-[tasks.test_unix]
-script_runner = "@shell"
-script = '''
-# TODO: Run real test, not only building.
-
-# LibAFL QEMU API
-HARNESS_API=lqemu cargo make build
-
-# Nyx API
-HARNESS_API=nyx cargo make build
-'''
-
-[tasks.test]
-description = "Run a test"
-linux_alias = "test_unix"
-mac_alias = "test_unix"
-windows_alias = "unsupported"
-
-[tasks.run]
-dependencies = ["build"]
-script_runner = "@shell"
-script = '''
-rm -rf "${WORKING_DIR}/corpus_gen"
-
-# Find the bios dir of LibAFL QEMU
-if [ ! -z "${LIBAFL_QEMU_DIR}" ]; then
-  LIBAFL_QEMU_BIOS_DIR=${LIBAFL_QEMU_DIR}/build/qemu-bundle/usr/local/share/qemu
-else
-  LIBAFL_QEMU_BIOS_DIR=${LIBAFL_QEMU_CLONE_DIR}/build/qemu-bundle/usr/local/share/qemu
-fi
-
-qemu-img create -f qcow2 -o backing_file=${LINUX_BUILDER_OUT}/OVMF_CODE.4m.fd -F raw ${LINUX_BUILDER_OUT}/OVMF_CODE.4m.qcow2
-qemu-img create -f qcow2 -o backing_file=${LINUX_BUILDER_OUT}/OVMF_VARS.4m.fd -F raw ${LINUX_BUILDER_OUT}/OVMF_VARS.4m.qcow2
-qemu-img create -f qcow2 -o backing_file=${LINUX_BUILDER_OUT}/linux.qcow2 -F qcow2 ${LINUX_BUILDER_OUT}/linux.tmp.qcow2
-
-${TARGET_DIR}/${PROFILE_DIR}/qemu_linux_process \
-  -accel tcg \
-  -m 4G \
-  -drive if=pflash,format=qcow2,file="${LINUX_BUILDER_OUT}/OVMF_CODE.4m.qcow2" `# OVMF code pflash` \
-  -drive if=pflash,format=qcow2,file="${LINUX_BUILDER_OUT}/OVMF_VARS.4m.qcow2" `# OVMF vars pflash` \
-  -device ahci,id=ahci,bus=pci.0,addr=4 \
-  -device ide-hd,bus=ahci.0,drive=disk,bootindex=1 \
-  -blockdev driver=file,filename="${LINUX_BUILDER_OUT}/linux.tmp.qcow2",node-name=storage `# Backend file of "disk"` \
-  -blockdev driver=qcow2,file=storage,node-name=disk `# QCOW2 "disk"` \
-  -L "${LIBAFL_QEMU_BIOS_DIR}" \
-  -nographic \
-  -monitor null \
-  -serial null
-
-  # -snapshot
-  #-blockdev driver=syx-cow-cache,file=storage,node-name=storage-syx \
-# gdb --args
-'''
-
-[tasks.debug]
-dependencies = ["build"]
-command = "time"
-args = [
-  "${TARGET_DIR}/${PROFILE_DIR}/qemu_linux_process",
-  "-accel",
-  "tcg",
-  "-m",
-  "4G",
-  "-drive",
-  "if=pflash,format=raw,file=${LINUX_BUILDER_OUT}/OVMF_CODE.fd",
-  "-drive",
-  "if=pflash,format=raw,file=${LINUX_BUILDER_OUT}/OVMF_VARS.fd",
-  "-blockdev",
-  "filename=${LINUX_BUILDER_OUT}/linux.qcow2,node-name=storage,driver=file",
-  "-blockdev",
-  "driver=qcow2,file=storage,node-name=disk",
-  "-device",
-  "virtio-scsi-pci,id=scsi0",
-  "-device",
-  "scsi-hd,bus=scsi0.0,drive=disk,id=virtio-disk0,bootindex=1",
-  "-L",
-  "${LIBAFL_QEMU_DIR}/build/qemu-bundle/usr/local/share/qemu",
-
-  #"-snapshot",
-]
-
-[tasks.perf]
-command = "perf"
-args = [
-  "record",
-  "--call-graph",
-  "dwarf",
-  "${TARGET_DIR}/${PROFILE_DIR}/qemu_linux_process",
-  "-accel",
-  "tcg",
-  "-m",
-  "4G",
-  "-drive",
-  "if=pflash,format=raw,readonly=on,file=${LINUX_BUILDER_OUT}/OVMF_CODE.fd",
-  "-drive",
-  "if=pflash,format=raw,snapshot=off,file=${LINUX_BUILDER_OUT}/OVMF_VARS.fd",
-  "-blockdev",
-  "filename=${LINUX_BUILDER_OUT}/linux.qcow2,node-name=storage,driver=file",
-  "-blockdev",
-  "driver=qcow2,file=storage,node-name=disk",
-  "-device",
-  "virtio-scsi-pci,id=scsi0",
-  "-device",
-  "scsi-hd,bus=scsi0.0,drive=disk,id=virtio-disk0,bootindex=1",
-  "-L",
-  "${LIBAFL_QEMU_DIR}/build/qemu-bundle/usr/local/share/qemu",
-  "-snapshot",
-  # "-icount", "shift=auto,align=off,sleep=off",
-  # "-monitor", "null",
-  # "-serial", "null",
-  # "-nographic",
-]
-
-[tasks.clean]
-clear = true
-script_runner = "@shell"
-script = '''
-rm -rf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
-cargo clean
-'''

fuzzers/inprocess/libfuzzer_stb_image/Justfile

@@ -29,7 +29,7 @@ run: fuzzer
 
 [windows]
 run: fuzzer
-    echo "Not integrated into cargo-make yet."
+    echo "Not integrated into just yet."
 
 [linux]
 [macos]

fuzzers/inprocess/libfuzzer_stb_image_sugar/Justfile

@@ -29,7 +29,7 @@ run: fuzzer
 
 [windows]
 run: fuzzer
-    echo "Not integrated into cargo-make yet."
+    echo "Not integrated into just yet."
 
 [linux]
 [macos]

just/README.md

@@ -0,0 +1,6 @@
+# LibAFL Just Library
+
+Here is stored the common library used by our example fuzzers.
+It mainly consists of boilerplate definitions and convenient functions.
+
+One of these files should always be included in final `Justfile`s.

just/envs/.env.aarch64

@@ -0,0 +1,3 @@
+CROSS_CC="aarch64-linux-gnu-gcc"
+CROSS_CXX="aarch64-linux-gnu-g++"
+CROSS_CFLAGS=""

just/envs/.env.arm

@@ -0,0 +1,3 @@
+CROSS_CC="arm-linux-gnueabi-gcc"
+CROSS_CXX="arm-linux-gnueabi-g++"
+CROSS_CFLAGS=""

just/envs/.env.i386

@@ -0,0 +1,3 @@
+CROSS_CC="x86_64-linux-gnu-gcc"
+CROSS_CXX="x86_64-linux-gnu-g++"
+CROSS_CFLAGS="-m32"

just/envs/.env.mips

@@ -0,0 +1,3 @@
+CROSS_CC="mipsel-linux-gnu-gcc"
+CROSS_CXX="mipsel-linux-gnu-g++"
+CROSS_CFLAGS=""

just/envs/.env.ppc

@@ -0,0 +1,3 @@
+CROSS_CC="powerpc-linux-gnu-gcc"
+CROSS_CXX="powerpc-linux-gnu-gcc"
+CROSS_CFLAGS=""

just/envs/.env.x86_64

@@ -0,0 +1,3 @@
+CROSS_CC="x86_64-linux-gnu-gcc"
+CROSS_CXX="x86_64-linux-gnu-g++"
+CROSS_CFLAGS=""

just/libafl-qemu-libpng.just

@@ -0,0 +1,84 @@
+import "libafl-qemu.just"
+
+# Useful rules to build libpng for multiple architecture.
+
+ARCH := env("ARCH", "x86_64")
+OPTIMIZATIONS := env("OPTIMIZATIONS", "yes")
+
+DEPS_DIR := TARGET_DIR / "deps"
+
+DOTENV := source_directory() / "envs" / ".env." + ARCH
+
+[unix]
+target_dir:
+    mkdir -p {{ TARGET_DIR }}
+
+[unix]
+deps_dir:
+    mkdir -p {{ DEPS_DIR }}
+
+[unix]
+arch_dir:
+    mkdir -p {{ ARCH }}
+
+[unix]
+zlib_wget: deps_dir
+    #!/bin/bash
+
+    wget \
+        -O "{{ DEPS_DIR }}/zlib-1.2.13.tar.gz" \
+        https://zlib.net/fossils/zlib-1.2.13.tar.gz
+
+    tar \
+        zxvf {{ DEPS_DIR }}/zlib-1.2.13.tar.gz \
+        -C {{ DEPS_DIR }}
+
+[unix]
+zlib: zlib_wget
+    #!/bin/bash
+
+    source {{ DOTENV }}
+
+    rm -rf {{ TARGET_DIR }}/build-zlib/
+
+    mkdir {{ TARGET_DIR }}/build-zlib/
+
+    cd {{ TARGET_DIR }}/build-zlib/ && \
+        CC=$CROSS_CC \
+        CFLAGS=$CROSS_CFLAGS \
+        {{ DEPS_DIR }}/zlib-1.2.13/configure \
+            --prefix=./zlib
+
+    make -j install
+
+[unix]
+libpng_wget: deps_dir
+    wget \
+        -O "{{ DEPS_DIR }}/v1.6.37.tar.gz" \
+        https://github.com/glennrp/libpng/archive/refs/tags/v1.6.37.tar.gz
+
+    tar \
+        -xvf "{{ DEPS_DIR }}/v1.6.37.tar.gz" \
+        -C {{ DEPS_DIR }}
+
+[unix]
+libpng: arch_dir zlib libpng_wget
+    #!/bin/bash
+
+    source {{ DOTENV }}
+
+    rm -rf {{ TARGET_DIR }}/build-png/
+
+    mkdir {{TARGET_DIR}}/build-png/
+
+    cd {{ TARGET_DIR }}/build-png/ && \
+        CC=$CROSS_CC \
+        CFLAGS="$CROSS_CFLAGS -I"{{ TARGET_DIR }}/build-zlib/zlib/lib"" \
+        LDFLAGS=-L"{{ TARGET_DIR }}/build-zlib/zlib/lib" \
+        {{ DEPS_DIR }}/libpng-1.6.37/configure \
+            --enable-shared=no \
+            --with-pic=yes \
+            --enable-hardware-optimizations={{ OPTIMIZATIONS }} \
+            --host={{ ARCH }} \
+
+    make -j -C {{ TARGET_DIR }}/build-png/

just/libafl-qemu.just

@@ -0,0 +1,3 @@
+import "libafl.just"
+
+export LIBAFL_QEMU_DIR_DEFAULT := BUILD_DIR / "qemu-libafl-bridge"

just/libafl.just

@@ -0,0 +1,41 @@
+# Main Justfile for LibAFL
+# Provides multiple useful variables.
+#
+# Must be set:
+#   - `FUZZER_NAME`: Name of the executable.
+#
+# Provides:
+#   - `PROFILE`: Profile (either `dev` or `release`). Default is `release`.
+#   - `PROFILE_DIR`: Profile directory (either `debug` or `release`).
+#   - `TARGET_DIR`: target directry. Defaults to `target`.
+#   - `BUILD_DIR`: Root directory in which the program is compiled.
+#   - `FUZZER`: Executable path.
+
+PROFILE := env("PROFILE", "release")
+PROFILE_DIR := if PROFILE == "dev" { "debug" } else { "release" }
+TARGET_DIR := absolute_path(env("TARGET_DIR", "target"))
+BUILD_DIR := TARGET_DIR / PROFILE_DIR
+FUZZER_EXTENSION := if os_family() == "windows" { ".exe" } else { "" }
+FUZZER := BUILD_DIR / FUZZER_NAME + FUZZER_EXTENSION
+
+JUSTHASHES := ".justhashes"
+
+buildfile fpath:
+    #!/bin/bash
+
+    # Init hash files if does not exit
+    if [ ! -f {{ JUSTHASHES }} ]; then
+        touch {{ JUSTHASHES }}
+    fi
+
+    if [ -d {{ fpath }}]
+        echo "{{ fpath }} already exists as dir."
+        exit 1
+    fi
+
+    # Run the file recipe if it changed or was not built before
+    if [ ! -f {{ fpath }} ] || [ ! "$(md5sum {{ fpath }} | head -c 32)" == "$(grep " {{ fpath }}" {{ JUSTHASHES }} | head -c 32)" ]; then
+        just {{ fpath }}
+        echo "$(grep -v "{{ fpath }}" {{ JUSTHASHES }})" > {{ JUSTHASHES }}
+        md5sum {{ fpath }} >> {{ JUSTHASHES }}
+    fi

libafl_qemu/libafl_qemu_build/src/build.rs

@@ -11,7 +11,7 @@ use crate::cargo_add_rpath;
 
 pub const QEMU_URL: &str = "https://github.com/AFLplusplus/qemu-libafl-bridge";
 pub const QEMU_DIRNAME: &str = "qemu-libafl-bridge";
-pub const QEMU_REVISION: &str = "695657e4f3f408c34b146d5191b102d5eb99b74b";
+pub const QEMU_REVISION: &str = "06c738f64a4a92d5fc8184c9b5a9fe9340f4a63f";
 
 pub struct BuildResult {
     pub qemu_path: PathBuf,

libafl_qemu/src/modules/drcov.rs

@@ -152,23 +152,16 @@ where
     match DRCOV_MAP.lock().unwrap().as_mut().unwrap().entry(pc) {
         Entry::Occupied(entry) => {
             let id = *entry.get();
-            if drcov_module.full_trace {
             Some(id)
-            } else {
-                None
-            }
         }
         Entry::Vacant(entry) => {
             let id = meta.current_id;
+
             entry.insert(id);
             meta.current_id = id + 1;
-            if drcov_module.full_trace {
+
-                // GuestAddress is u32 for 32 bit guests
             #[expect(clippy::unnecessary_cast)]
             Some(id as u64)
-            } else {
-                None
-            }
         }
     }
 }
@@ -201,7 +194,7 @@ pub fn gen_block_lengths<ET, F, I, S>(
 #[allow(clippy::needless_pass_by_value)] // no longer a problem with nightly
 pub fn exec_trace_block<ET, F, I, S>(
     _qemu: Qemu,
-    emulator_modules: &mut EmulatorModules<ET, I, S>,
+    _emulator_modules: &mut EmulatorModules<ET, I, S>,
     _state: Option<&mut S>,
     id: u64,
 ) where
@@ -210,9 +203,7 @@ pub fn exec_trace_block<ET, F, I, S>(
     I: Unpin,
     S: Unpin + HasMetadata,
 {
-    if emulator_modules.get::<DrCovModule<F>>().unwrap().full_trace {
     DRCOV_IDS.lock().unwrap().as_mut().unwrap().push(id);
-    }
 }
 
 impl<F, I, S> EmulatorModule<I, S> for DrCovModule<F>
@@ -395,9 +386,7 @@ impl<F> DrCovModule<F> {
                         unsafe {
                             for module in self.module_mapping.as_ref().unwrap_unchecked().iter() {
                                 let (range, (_, _)) = module;
-                                if *pc >= range.start.try_into().unwrap()
+                                if range.contains(&u64::try_from(*pc).unwrap()) {
-                                    && *pc <= range.end.try_into().unwrap()
-                                {
                                     module_found = true;
                                     break;
                                 }

scripts/test_fuzzer.sh

@@ -54,11 +54,11 @@ do
     
     if [ -e ./Makefile.toml ] && grep -qF "skip_core_tasks = true" Makefile.toml; then
         echo "[*] Building $fuzzer (running tests is not supported in this context)"
-        cargo make build || exit 1
+        just build || exit 1
         echo "[+] Done building $fuzzer"
     elif [ -e ./Makefile.toml ]; then
         echo "[*] Testing $fuzzer"
-        cargo make test || exit 1
+        just test || exit 1
         echo "[+] Done testing $fuzzer"
     elif [ -e ./Justfile ]; then
         echo "[*] Testing $fuzzer"

utils/gdb_qemu/Justfile

@@ -0,0 +1,31 @@
+import "../../just/libafl.just"
+
+
+DEMO_TARGET := "powerpc-unknown-linux-gnu"
+HOST_TARGET := "x86_64-unknown-linux-gnu"
+DEMO_DIR := {{TARGET_DIR}}/{{DEMO_TARGET}}/"debug"
+TARGET_DIR := {{TARGET_DIR}}/{{HOST_TARGET}}/"debug"
+FUZZER_NAME := ""
+
+clean:
+    cargo clean
+
+format:
+    cargo fmt -- --emit=files
+
+demo: format
+    cargo build -p gdb_demo --profile {{PROFILE}} --target powerpc-unknown-linux-gnu
+
+run_demo: demo
+    cargo run -p gdb_demo --target powerpc-unknown-linux-gnu
+
+build: format
+    cargo build -p gdb_qemu --profile {{PROFILE}}
+
+run: demo
+    cargo run -p gdb_qemu --profile {{PROFILE}} -- -p 1234 -L trace -- qemu-ppc -L /usr/powerpc-linux-gnu -g 1234 {{DEMO_DIR}}/gdb_demo
+
+gdb:
+    gdb-multiarch -ex "set architecture powerpc:MPC8XX" -ex "set pagination off" -ex "set confirm off" -ex "file {{DEMO_DIR}}/gdb_demo" -ex "target remote | {{TARGET_DIR}}/gdb_qemu -p 1234 -L trace qemu-ppc -- -L /usr/powerpc-linux-gnu -g 1234 {{DEMO_DIR}}/gdb_demo"
+
+all: demo build

utils/gdb_qemu/Makefile.toml

@@ -1,88 +0,0 @@
-[config]
-default_to_workspace = false
-
-[env]
-DEMO_TARGET = "powerpc-unknown-linux-gnu"
-HOST_TARGET = "x86_64-unknown-linux-gnu"
-PROFILE = "dev"
-DEMO_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/${DEMO_TARGET}/debug"
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/${HOST_TARGET}/debug"
-
-[env.release]
-PROFILE = "release"
-DEMO_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/${DEMO_TARGET}/release"
-TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/${HOST_TARGET}/release"
-
-[tasks.clean]
-command = "cargo"
-args = ["clean"]
-
-[tasks.format]
-install_crate = "rustfmt"
-command = "cargo"
-args = ["fmt", "--", "--emit=files"]
-
-[tasks.demo]
-dependencies = ["format", "clippy"]
-command = "cargo"
-args = [
-  "build",
-  "-p",
-  "gdb_demo",
-  "--profile",
-  "${PROFILE}",
-  "--target",
-  "powerpc-unknown-linux-gnu",
-]
-
-[tasks.run_demo]
-dependencies = ["demo"]
-command = "cargo"
-args = ["run", "-p", "gdb_demo", "--target", "powerpc-unknown-linux-gnu"]
-
-[tasks.build]
-dependencies = ["format", "clippy"]
-command = "cargo"
-args = ["build", "-p", "gdb_qemu", "--profile", "${PROFILE}"]
-
-[tasks.run]
-command = "cargo"
-dependencies = ["demo"]
-args = [
-  "run",
-  "-p",
-  "gdb_qemu",
-  "--profile",
-  "${PROFILE}",
-  "--",
-  "-p",
-  "1234",
-  "-L",
-  "trace",
-  "--",
-  "qemu-ppc",
-  "-L",
-  "/usr/powerpc-linux-gnu",
-  "-g",
-  "1234",
-  "${DEMO_DIR}/gdb_demo",
-]
-
-[tasks.gdb]
-command = "gdb-multiarch"
-dependencies = ["demo", "build"]
-args = [
-  "-ex",
-  "set architecture powerpc:MPC8XX",
-  "-ex",
-  "set pagination off",
-  "-ex",
-  "set confirm off",
-  "-ex",
-  "file ${DEMO_DIR}/gdb_demo",
-  "-ex",
-  "target remote | ${TARGET_DIR}/gdb_qemu -p 1234 -L trace qemu-ppc -- -L /usr/powerpc-linux-gnu -g 1234 ${DEMO_DIR}/gdb_demo",
-]
-
-[tasks.all]
-dependencies = ["demo", "build"]

utils/noaslr/Justfile

@@ -0,0 +1,29 @@
+import "../../just/libafl.just"
+FUZZER_NAME := ""
+
+clean:
+    cargo clean
+
+format:
+    cargo fmt -- --emit=files
+
+demo: format
+    cargo build -p noaslr_demo --profile {{PROFILE}}
+
+run_demo: demo
+    cargo run -p noaslr_demo
+
+build: format
+    cargo build -p noaslr --profile {{PROFILE}}
+
+buildlib: format
+    cargo build -p libnoaslr --profile {{PROFILE}}
+
+run: demo
+    cargo run -p noaslr --profile {{PROFILE}} -- {{BUILD_DIR}}/demo -- -f /proc/self/maps -- test
+
+
+runlib: demo buildlib
+    LD_PRELOAD={{BUILD_DIR}}/libnoaslr.so cargo run -p noaslr_demo --profile {{PROFILE}} -- -f /proc/self/maps -- test
+
+all: demo build buildlib

utils/noaslr/Makefile.toml

@@ -1,78 +0,0 @@
-[config]
-default_to_workspace = false
-
-[env]
-PROFILE = "dev"
-BUILD_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/debug"
-
-[env.release]
-PROFILE = "release"
-BUILD_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/release"
-
-[tasks.clean]
-command = "cargo"
-args = ["clean"]
-
-[tasks.format]
-install_crate = "rustfmt"
-command = "cargo"
-args = ["fmt", "--", "--emit=files"]
-
-[tasks.demo]
-dependencies = ["format", "clippy"]
-command = "cargo"
-args = ["build", "-p", "demo", "--profile", "${PROFILE}"]
-
-[tasks.run_demo]
-dependencies = ["demo"]
-command = "cargo"
-args = ["run", "-p", "demo"]
-
-[tasks.build]
-dependencies = ["format", "clippy"]
-command = "cargo"
-args = ["build", "-p", "noaslr", "--profile", "${PROFILE}"]
-
-[tasks.buildlib]
-dependencies = ["format", "clippy"]
-command = "cargo"
-args = ["build", "-p", "libnoaslr", "--profile", "${PROFILE}"]
-
-[tasks.run]
-command = "cargo"
-dependencies = ["demo"]
-env = { "ZZZ_TEST_ZZZ" = "ZZZ TEST ZZZ" }
-args = [
-  "run",
-  "-p",
-  "noaslr",
-  "--profile",
-  "${PROFILE}",
-  "--",
-  "${BUILD_DIR}/demo",
-  "--",
-  "-f",
-  "/proc/self/maps",
-  "--",
-  "test",
-]
-
-[tasks.runlib]
-command = "cargo"
-dependencies = ["demo", "buildlib"]
-env = { "LD_PRELOAD" = "${BUILD_DIR}/libnoaslr.so", "ZZZ_TEST_ZZZ" = "ZZZ TEST ZZZ" }
-args = [
-  "run",
-  "-p",
-  "demo",
-  "--profile",
-  "${PROFILE}",
-  "--",
-  "-f",
-  "/proc/self/maps",
-  "--",
-  "test",
-]
-
-[tasks.all]
-dependencies = ["demo", "build", "buildlib"]