Remove unused shmem structs, update Nix (#1845)
* Remove unused shmem structs * More unused stuff * Unified crate versions, updated docker rust version * clean up nix 27 mess? * Windows? * Fix frida * Fix frida * fix fuzzers with nix
This commit is contained in:
parent
15c98de52f
commit
dede78159c
@ -1,5 +1,5 @@
|
|||||||
# syntax=docker/dockerfile:1.2
|
# syntax=docker/dockerfile:1.2
|
||||||
FROM rust:1.73.0 AS libafl
|
FROM rust:1.76.0 AS libafl
|
||||||
LABEL "maintainer"="afl++ team <afl@aflplus.plus>"
|
LABEL "maintainer"="afl++ team <afl@aflplus.plus>"
|
||||||
LABEL "about"="LibAFL Docker image"
|
LABEL "about"="LibAFL Docker image"
|
||||||
|
|
||||||
|
@ -22,7 +22,7 @@ which = { version = "4.4" }
|
|||||||
|
|
||||||
[dependencies]
|
[dependencies]
|
||||||
clap = { version = "4.0", features = ["derive"] }
|
clap = { version = "4.0", features = ["derive"] }
|
||||||
nix = "0.26"
|
nix = "0.27"
|
||||||
libafl = { path = "../../libafl/" }
|
libafl = { path = "../../libafl/" }
|
||||||
libafl_bolts = { path = "../../libafl_bolts/" }
|
libafl_bolts = { path = "../../libafl_bolts/" }
|
||||||
libafl_cc = { path = "../../libafl_cc/" }
|
libafl_cc = { path = "../../libafl_cc/" }
|
||||||
|
@ -19,4 +19,4 @@ opt-level = 3
|
|||||||
libafl = { path = "../../libafl/", features = ["std", "derive"] }
|
libafl = { path = "../../libafl/", features = ["std", "derive"] }
|
||||||
libafl_bolts = { path = "../../libafl_bolts/" }
|
libafl_bolts = { path = "../../libafl_bolts/" }
|
||||||
clap = { version = "4.0", features = ["derive"] }
|
clap = { version = "4.0", features = ["derive"] }
|
||||||
nix = "0.26"
|
nix = "0.27"
|
||||||
|
@ -31,7 +31,7 @@ libafl_targets = { path = "../../libafl_targets/", features = ["sancov_pcguard_h
|
|||||||
# TODO Include it only when building cc
|
# TODO Include it only when building cc
|
||||||
libafl_cc = { path = "../../libafl_cc/" }
|
libafl_cc = { path = "../../libafl_cc/" }
|
||||||
clap = { version = "4.0", features = ["default"] }
|
clap = { version = "4.0", features = ["default"] }
|
||||||
nix = "0.26"
|
nix = { version = "0.27", features = ["fs"] }
|
||||||
mimalloc = { version = "*", default-features = false }
|
mimalloc = { version = "*", default-features = false }
|
||||||
|
|
||||||
[lib]
|
[lib]
|
||||||
|
@ -25,4 +25,4 @@ libafl_bolts = { path = "../../libafl_bolts/" }
|
|||||||
libafl_qemu = { path = "../../libafl_qemu/", features = ["x86_64", "usermode"] }
|
libafl_qemu = { path = "../../libafl_qemu/", features = ["x86_64", "usermode"] }
|
||||||
|
|
||||||
clap = { version = "4.0", features = ["default"] }
|
clap = { version = "4.0", features = ["default"] }
|
||||||
nix = "0.26"
|
nix = { version = "0.27", features = ["fs"] }
|
||||||
|
@ -24,4 +24,4 @@ libafl = { path = "../../libafl/" }
|
|||||||
libafl_bolts = { path = "../../libafl_bolts/" }
|
libafl_bolts = { path = "../../libafl_bolts/" }
|
||||||
libafl_targets = { path = "../../libafl_targets/" }
|
libafl_targets = { path = "../../libafl_targets/" }
|
||||||
clap = { version = "4.0", features = ["default"] }
|
clap = { version = "4.0", features = ["default"] }
|
||||||
nix = "0.26"
|
nix = "0.27"
|
||||||
|
@ -24,4 +24,4 @@ libafl = { path = "../../libafl/" }
|
|||||||
libafl_bolts = { path = "../../libafl_bolts/" }
|
libafl_bolts = { path = "../../libafl_bolts/" }
|
||||||
libafl_targets = { path = "../../libafl_targets/" }
|
libafl_targets = { path = "../../libafl_targets/" }
|
||||||
clap = { version = "4.0", features = ["default"] }
|
clap = { version = "4.0", features = ["default"] }
|
||||||
nix = "0.26"
|
nix = "0.27"
|
@ -25,5 +25,5 @@ libafl_bolts = { path = "../../libafl_bolts/" }
|
|||||||
libafl_qemu = { path = "../../libafl_qemu/", features = ["x86_64", "usermode"] }
|
libafl_qemu = { path = "../../libafl_qemu/", features = ["x86_64", "usermode"] }
|
||||||
|
|
||||||
clap = { version = "4.0", features = ["default"] }
|
clap = { version = "4.0", features = ["default"] }
|
||||||
nix = "0.26"
|
nix = { version = "0.27", features = ["fs"] }
|
||||||
|
|
||||||
|
@ -26,7 +26,7 @@ libafl_targets = { path = "../../libafl_targets/", features = ["sancov_pcguard_h
|
|||||||
# TODO Include it only when building cc
|
# TODO Include it only when building cc
|
||||||
libafl_cc = { path = "../../libafl_cc/" }
|
libafl_cc = { path = "../../libafl_cc/" }
|
||||||
clap = { version = "4.0", features = ["default"] }
|
clap = { version = "4.0", features = ["default"] }
|
||||||
nix = "0.26"
|
nix = { version = "0.27", features = ["fs"] }
|
||||||
mimalloc = { version = "*", default-features = false }
|
mimalloc = { version = "*", default-features = false }
|
||||||
content_inspector = "0.2.4"
|
content_inspector = "0.2.4"
|
||||||
#log = "0.4"
|
#log = "0.4"
|
||||||
|
@ -41,7 +41,7 @@ libafl = { path = "../../libafl/" }
|
|||||||
libafl_bolts = { path = "../../libafl_bolts/" }
|
libafl_bolts = { path = "../../libafl_bolts/" }
|
||||||
libafl_qemu = { path = "../../libafl_qemu/", features = ["usermode"] }
|
libafl_qemu = { path = "../../libafl_qemu/", features = ["usermode"] }
|
||||||
log = {version = "0.4.20" }
|
log = {version = "0.4.20" }
|
||||||
nix = { version = "0.26" }
|
nix = { version = "0.27", features = ["fs"] }
|
||||||
rangemap = { version = "1.3" }
|
rangemap = { version = "1.3" }
|
||||||
readonly = { version = "0.2.10" }
|
readonly = { version = "0.2.10" }
|
||||||
typed-builder = { version = "0.15.1" }
|
typed-builder = { version = "0.15.1" }
|
||||||
|
@ -163,7 +163,7 @@ backtrace = {version = "0.3", optional = true} # Used to get the stacktrace in S
|
|||||||
typed-builder = { version = "0.16", optional = true } # Implement the builder pattern at compiletime
|
typed-builder = { version = "0.16", optional = true } # Implement the builder pattern at compiletime
|
||||||
|
|
||||||
serde_json = { version = "1.0", optional = true, default-features = false, features = ["alloc"] }
|
serde_json = { version = "1.0", optional = true, default-features = false, features = ["alloc"] }
|
||||||
nix = { version = "0.26", optional = true }
|
nix = { version = "0.27", optional = true }
|
||||||
regex = { version = "1", optional = true }
|
regex = { version = "1", optional = true }
|
||||||
uuid = { version = "1.4", optional = true, features = ["serde", "v4"] }
|
uuid = { version = "1.4", optional = true, features = ["serde", "v4"] }
|
||||||
libm = "0.2.2"
|
libm = "0.2.2"
|
||||||
|
@ -9,7 +9,10 @@ use core::{
|
|||||||
use std::{
|
use std::{
|
||||||
ffi::{OsStr, OsString},
|
ffi::{OsStr, OsString},
|
||||||
io::{self, prelude::*, ErrorKind},
|
io::{self, prelude::*, ErrorKind},
|
||||||
os::unix::{io::RawFd, process::CommandExt},
|
os::{
|
||||||
|
fd::{AsRawFd, BorrowedFd},
|
||||||
|
unix::{io::RawFd, process::CommandExt},
|
||||||
|
},
|
||||||
path::Path,
|
path::Path,
|
||||||
process::{Child, Command, Stdio},
|
process::{Child, Command, Stdio},
|
||||||
};
|
};
|
||||||
@ -439,11 +442,15 @@ impl Forkserver {
|
|||||||
)));
|
)));
|
||||||
};
|
};
|
||||||
|
|
||||||
|
// # Safety
|
||||||
|
// The FDs are valid as this point in time.
|
||||||
|
let st_read = unsafe { BorrowedFd::borrow_raw(st_read) };
|
||||||
|
|
||||||
let mut readfds = FdSet::new();
|
let mut readfds = FdSet::new();
|
||||||
readfds.insert(st_read);
|
readfds.insert(&st_read);
|
||||||
// We'll pass a copied timeout to keep the original timeout intact, because select updates timeout to indicate how much time was left. See select(2)
|
// We'll pass a copied timeout to keep the original timeout intact, because select updates timeout to indicate how much time was left. See select(2)
|
||||||
let sret = pselect(
|
let sret = pselect(
|
||||||
Some(readfds.highest().unwrap() + 1),
|
Some(readfds.highest().unwrap().as_raw_fd() + 1),
|
||||||
&mut readfds,
|
&mut readfds,
|
||||||
None,
|
None,
|
||||||
None,
|
None,
|
||||||
|
@ -103,9 +103,9 @@ serde_json = { version = "1.0", optional = true, default-features = false, featu
|
|||||||
miniz_oxide = { version = "0.7.1", optional = true}
|
miniz_oxide = { version = "0.7.1", optional = true}
|
||||||
hostname = { version = "^0.3", optional = true } # Is there really no gethostname in the stdlib?
|
hostname = { version = "^0.3", optional = true } # Is there really no gethostname in the stdlib?
|
||||||
rand_core = { version = "0.6", optional = true }
|
rand_core = { version = "0.6", optional = true }
|
||||||
nix = { version = "0.26", default-features = false, optional = true, features = ["signal", "socket", "poll"] }
|
nix = { version = "0.27", default-features = false, optional = true, features = ["signal", "socket", "poll"] }
|
||||||
uuid = { version = "1.4", optional = true, features = ["serde", "v4"] }
|
uuid = { version = "1.4", optional = true, features = ["serde", "v4"] }
|
||||||
clap = {version = "4.0", features = ["derive", "wrap_help"], optional = true} # CLI parsing, for libafl_bolts::cli / the `cli` feature
|
clap = {version = "4.5", features = ["derive", "wrap_help"], optional = true} # CLI parsing, for libafl_bolts::cli / the `cli` feature
|
||||||
log = "0.4.20"
|
log = "0.4.20"
|
||||||
|
|
||||||
pyo3 = { version = "0.18", optional = true, features = ["serde", "macros"] }
|
pyo3 = { version = "0.18", optional = true, features = ["serde", "macros"] }
|
||||||
|
@ -75,9 +75,6 @@ use core::{
|
|||||||
sync::atomic::{fence, AtomicU16, Ordering},
|
sync::atomic::{fence, AtomicU16, Ordering},
|
||||||
time::Duration,
|
time::Duration,
|
||||||
};
|
};
|
||||||
#[cfg(all(unix, feature = "std"))]
|
|
||||||
#[cfg(not(any(target_os = "solaris", target_os = "illumos")))]
|
|
||||||
use std::os::unix::io::AsRawFd;
|
|
||||||
#[cfg(feature = "std")]
|
#[cfg(feature = "std")]
|
||||||
use std::{
|
use std::{
|
||||||
env,
|
env,
|
||||||
@ -452,7 +449,7 @@ fn tcp_bind(port: u16) -> Result<TcpListener, Error> {
|
|||||||
|
|
||||||
#[cfg(unix)]
|
#[cfg(unix)]
|
||||||
#[cfg(not(any(target_os = "solaris", target_os = "illumos")))]
|
#[cfg(not(any(target_os = "solaris", target_os = "illumos")))]
|
||||||
socket::setsockopt(listener.as_raw_fd(), ReusePort, &true)?;
|
socket::setsockopt(&listener, ReusePort, &true)?;
|
||||||
|
|
||||||
Ok(listener)
|
Ok(listener)
|
||||||
}
|
}
|
||||||
|
@ -53,7 +53,7 @@ const UNIX_SERVER_NAME: &str = "./libafl_unix_shmem_server";
|
|||||||
/// Env variable. If set, we won't try to spawn the service
|
/// Env variable. If set, we won't try to spawn the service
|
||||||
const AFL_SHMEM_SERVICE_STARTED: &str = "AFL_SHMEM_SERVICE_STARTED";
|
const AFL_SHMEM_SERVICE_STARTED: &str = "AFL_SHMEM_SERVICE_STARTED";
|
||||||
|
|
||||||
/// Hands out served shared maps, as used on Android.
|
/// s out served shared maps, as used on Android.
|
||||||
#[derive(Debug)]
|
#[derive(Debug)]
|
||||||
pub struct ServedShMemProvider<SP>
|
pub struct ServedShMemProvider<SP>
|
||||||
where
|
where
|
||||||
@ -671,7 +671,7 @@ where
|
|||||||
};
|
};
|
||||||
|
|
||||||
let mut poll_fds: Vec<PollFd> = vec![PollFd::new(
|
let mut poll_fds: Vec<PollFd> = vec![PollFd::new(
|
||||||
listener.as_raw_fd(),
|
&listener,
|
||||||
PollFlags::POLLIN | PollFlags::POLLRDNORM | PollFlags::POLLRDBAND,
|
PollFlags::POLLIN | PollFlags::POLLRDNORM | PollFlags::POLLRDBAND,
|
||||||
)];
|
)];
|
||||||
|
|
||||||
@ -714,12 +714,20 @@ where
|
|||||||
};
|
};
|
||||||
|
|
||||||
log::info!("Received connection from {_addr:?}");
|
log::info!("Received connection from {_addr:?}");
|
||||||
|
|
||||||
let pollfd = PollFd::new(
|
let pollfd = PollFd::new(
|
||||||
stream.as_raw_fd(),
|
// # Safety
|
||||||
|
// This cast will make `PollFd::new` ignore the lifetime of our stream.
|
||||||
|
// As of nix 0.27, the `PollFd` is safer, in that it checks the lifetime of the given stream.
|
||||||
|
// We did not develop this server with that new constraint in mind, but it is upheld.
|
||||||
|
// The `new` function then gets the `raw_fd` from this stream, and operate on that int internally.
|
||||||
|
unsafe { &*(&stream as *const _) },
|
||||||
PollFlags::POLLIN | PollFlags::POLLRDNORM | PollFlags::POLLRDBAND,
|
PollFlags::POLLIN | PollFlags::POLLRDNORM | PollFlags::POLLRDBAND,
|
||||||
);
|
);
|
||||||
poll_fds.push(pollfd);
|
|
||||||
let client = SharedShMemClient::new(stream);
|
let client = SharedShMemClient::new(stream);
|
||||||
|
|
||||||
|
poll_fds.push(pollfd);
|
||||||
let client_id = client.stream.as_raw_fd();
|
let client_id = client.stream.as_raw_fd();
|
||||||
self.clients.insert(client_id, client);
|
self.clients.insert(client_id, client);
|
||||||
match self.handle_client(client_id) {
|
match self.handle_client(client_id) {
|
||||||
|
@ -593,8 +593,8 @@ pub mod unix_shmem {
|
|||||||
use std::{io::Write, process};
|
use std::{io::Write, process};
|
||||||
|
|
||||||
use libc::{
|
use libc::{
|
||||||
c_int, c_long, c_uchar, c_uint, c_ulong, c_ushort, close, ftruncate, mmap, munmap,
|
c_int, c_uchar, close, ftruncate, mmap, munmap, perror, shm_open, shm_unlink, shmat,
|
||||||
perror, shm_open, shm_unlink, shmat, shmctl, shmdt, shmget,
|
shmctl, shmdt, shmget,
|
||||||
};
|
};
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
@ -602,38 +602,6 @@ pub mod unix_shmem {
|
|||||||
shmem::{ShMem, ShMemId, ShMemProvider},
|
shmem::{ShMem, ShMemId, ShMemProvider},
|
||||||
AsMutSlice, AsSlice, Error,
|
AsMutSlice, AsSlice, Error,
|
||||||
};
|
};
|
||||||
#[cfg(unix)]
|
|
||||||
#[derive(Copy, Clone)]
|
|
||||||
#[repr(C)]
|
|
||||||
struct ipc_perm {
|
|
||||||
pub __key: c_int,
|
|
||||||
pub uid: c_uint,
|
|
||||||
pub gid: c_uint,
|
|
||||||
pub cuid: c_uint,
|
|
||||||
pub cgid: c_uint,
|
|
||||||
pub mode: c_ushort,
|
|
||||||
pub __pad1: c_ushort,
|
|
||||||
pub __seq: c_ushort,
|
|
||||||
pub __pad2: c_ushort,
|
|
||||||
pub __glibc_reserved1: c_ulong,
|
|
||||||
pub __glibc_reserved2: c_ulong,
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(unix)]
|
|
||||||
#[derive(Copy, Clone)]
|
|
||||||
#[repr(C)]
|
|
||||||
struct shmid_ds {
|
|
||||||
pub shm_perm: ipc_perm,
|
|
||||||
pub shm_segsz: c_ulong,
|
|
||||||
pub shm_atime: c_long,
|
|
||||||
pub shm_dtime: c_long,
|
|
||||||
pub shm_ctime: c_long,
|
|
||||||
pub shm_cpid: c_int,
|
|
||||||
pub shm_lpid: c_int,
|
|
||||||
pub shm_nattch: c_ulong,
|
|
||||||
pub __glibc_reserved4: c_ulong,
|
|
||||||
pub __glibc_reserved5: c_ulong,
|
|
||||||
}
|
|
||||||
|
|
||||||
// This is macOS's limit
|
// This is macOS's limit
|
||||||
// https://stackoverflow.com/questions/38049068/osx-shm-open-returns-enametoolong
|
// https://stackoverflow.com/questions/38049068/osx-shm-open-returns-enametoolong
|
||||||
|
@ -16,4 +16,4 @@ categories = ["development-tools::testing", "emulators", "embedded", "os", "no-s
|
|||||||
[dependencies]
|
[dependencies]
|
||||||
libafl = {path = "../../../libafl"}
|
libafl = {path = "../../../libafl"}
|
||||||
libafl_bolts = {path = "../../../libafl_bolts"}
|
libafl_bolts = {path = "../../../libafl_bolts"}
|
||||||
clap = { version = "4.0", features = ["derive"] }
|
clap = { version = "4.5", features = ["derive"] }
|
||||||
|
@ -51,7 +51,7 @@ libafl_targets = { path = "../libafl_targets", version = "0.11.2", features = [
|
|||||||
"sancov_cmplog",
|
"sancov_cmplog",
|
||||||
] }
|
] }
|
||||||
|
|
||||||
nix = "0.26"
|
nix = { version = "0.27", features = ["mman"] }
|
||||||
libc = "0.2"
|
libc = "0.2"
|
||||||
hashbrown = "0.14"
|
hashbrown = "0.14"
|
||||||
rangemap = "1.3"
|
rangemap = "1.3"
|
||||||
@ -85,5 +85,5 @@ yaxpeax-arch = "0.2.7"
|
|||||||
|
|
||||||
[dev-dependencies]
|
[dev-dependencies]
|
||||||
serial_test = { version = "2", default-features = false, features = ["logging"] }
|
serial_test = { version = "2", default-features = false, features = ["logging"] }
|
||||||
clap = {version = "4.0", features = ["derive"]}
|
clap = {version = "4.5", features = ["derive"]}
|
||||||
libloading = "0.7"
|
libloading = "0.7"
|
||||||
|
@ -1133,7 +1133,7 @@ impl AsanRuntime {
|
|||||||
.operands
|
.operands
|
||||||
.iter()
|
.iter()
|
||||||
.position(|item| *item == Operand::Nothing)
|
.position(|item| *item == Operand::Nothing)
|
||||||
.unwrap_or_else(|| 4);
|
.unwrap_or(4);
|
||||||
|
|
||||||
//the memory operand is always the last operand in aarch64
|
//the memory operand is always the last operand in aarch64
|
||||||
let (base_reg, index_reg, displacement) = match insn.operands[operands_len - 1] {
|
let (base_reg, index_reg, displacement) = match insn.operands[operands_len - 1] {
|
||||||
@ -1164,7 +1164,7 @@ impl AsanRuntime {
|
|||||||
actual_pc,
|
actual_pc,
|
||||||
(
|
(
|
||||||
Some(base_reg),
|
Some(base_reg),
|
||||||
Some(index_reg.unwrap_or_else(|| 0xffff)),
|
Some(index_reg.unwrap_or(0xffff)),
|
||||||
displacement as usize,
|
displacement as usize,
|
||||||
fault_address,
|
fault_address,
|
||||||
),
|
),
|
||||||
@ -1176,7 +1176,7 @@ impl AsanRuntime {
|
|||||||
actual_pc,
|
actual_pc,
|
||||||
(
|
(
|
||||||
Some(base_reg),
|
Some(base_reg),
|
||||||
Some(index_reg.unwrap_or_else(|| 0xffff)),
|
Some(index_reg.unwrap_or(0xffff)),
|
||||||
displacement as usize,
|
displacement as usize,
|
||||||
fault_address,
|
fault_address,
|
||||||
),
|
),
|
||||||
@ -1192,7 +1192,7 @@ impl AsanRuntime {
|
|||||||
pc: actual_pc,
|
pc: actual_pc,
|
||||||
fault: (
|
fault: (
|
||||||
Some(base_reg),
|
Some(base_reg),
|
||||||
Some(index_reg.unwrap_or_else(|| 0xffff)),
|
Some(index_reg.unwrap_or(0xffff)),
|
||||||
displacement as usize,
|
displacement as usize,
|
||||||
fault_address,
|
fault_address,
|
||||||
),
|
),
|
||||||
@ -1216,7 +1216,7 @@ impl AsanRuntime {
|
|||||||
actual_pc,
|
actual_pc,
|
||||||
(
|
(
|
||||||
Some(base_reg),
|
Some(base_reg),
|
||||||
Some(index_reg.unwrap_or_else(|| 0xffff)),
|
Some(index_reg.unwrap_or(0xffff)),
|
||||||
displacement as usize,
|
displacement as usize,
|
||||||
fault_address,
|
fault_address,
|
||||||
),
|
),
|
||||||
@ -1404,6 +1404,8 @@ impl AsanRuntime {
|
|||||||
#[allow(clippy::unused_self, clippy::identity_op)]
|
#[allow(clippy::unused_self, clippy::identity_op)]
|
||||||
#[allow(clippy::too_many_lines)]
|
#[allow(clippy::too_many_lines)]
|
||||||
fn generate_shadow_check_function(&mut self) {
|
fn generate_shadow_check_function(&mut self) {
|
||||||
|
use std::fs::File;
|
||||||
|
|
||||||
let shadow_bit = self.allocator.shadow_bit();
|
let shadow_bit = self.allocator.shadow_bit();
|
||||||
let mut ops = dynasmrt::VecAssembler::<dynasmrt::x64::X64Relocation>::new(0);
|
let mut ops = dynasmrt::VecAssembler::<dynasmrt::x64::X64Relocation>::new(0);
|
||||||
|
|
||||||
@ -1526,12 +1528,12 @@ impl AsanRuntime {
|
|||||||
);
|
);
|
||||||
let blob = ops.finalize().unwrap();
|
let blob = ops.finalize().unwrap();
|
||||||
unsafe {
|
unsafe {
|
||||||
let mapping = mmap(
|
let mapping = mmap::<File>(
|
||||||
None,
|
None,
|
||||||
NonZeroUsize::new_unchecked(0x1000),
|
NonZeroUsize::new_unchecked(0x1000),
|
||||||
ProtFlags::all(),
|
ProtFlags::all(),
|
||||||
MapFlags::MAP_ANON | MapFlags::MAP_PRIVATE,
|
MapFlags::MAP_ANON | MapFlags::MAP_PRIVATE,
|
||||||
-1,
|
None,
|
||||||
0,
|
0,
|
||||||
)
|
)
|
||||||
.unwrap();
|
.unwrap();
|
||||||
@ -1545,6 +1547,8 @@ impl AsanRuntime {
|
|||||||
// identity_op appears to be a false positive in ubfx
|
// identity_op appears to be a false positive in ubfx
|
||||||
#[allow(clippy::unused_self, clippy::identity_op, clippy::too_many_lines)]
|
#[allow(clippy::unused_self, clippy::identity_op, clippy::too_many_lines)]
|
||||||
fn generate_shadow_check_function(&mut self) {
|
fn generate_shadow_check_function(&mut self) {
|
||||||
|
use std::fs::File;
|
||||||
|
|
||||||
let shadow_bit = self.allocator.shadow_bit();
|
let shadow_bit = self.allocator.shadow_bit();
|
||||||
let mut ops = dynasmrt::VecAssembler::<dynasmrt::aarch64::Aarch64Relocation>::new(0);
|
let mut ops = dynasmrt::VecAssembler::<dynasmrt::aarch64::Aarch64Relocation>::new(0);
|
||||||
dynasm!(ops
|
dynasm!(ops
|
||||||
@ -1658,12 +1662,12 @@ impl AsanRuntime {
|
|||||||
let map_flags = MapFlags::MAP_ANON | MapFlags::MAP_PRIVATE;
|
let map_flags = MapFlags::MAP_ANON | MapFlags::MAP_PRIVATE;
|
||||||
|
|
||||||
unsafe {
|
unsafe {
|
||||||
let mapping = mmap(
|
let mapping = mmap::<File>(
|
||||||
None,
|
None,
|
||||||
NonZeroUsize::try_from(0x1000).unwrap(),
|
NonZeroUsize::try_from(0x1000).unwrap(),
|
||||||
ProtFlags::all(),
|
ProtFlags::all(),
|
||||||
map_flags,
|
map_flags,
|
||||||
-1,
|
None,
|
||||||
0,
|
0,
|
||||||
)
|
)
|
||||||
.unwrap();
|
.unwrap();
|
||||||
@ -2175,6 +2179,7 @@ impl AsanRuntime {
|
|||||||
#[cfg(target_arch = "aarch64")]
|
#[cfg(target_arch = "aarch64")]
|
||||||
#[must_use]
|
#[must_use]
|
||||||
#[inline]
|
#[inline]
|
||||||
|
#[allow(clippy::similar_names, clippy::type_complexity)]
|
||||||
pub fn asan_is_interesting_instruction(
|
pub fn asan_is_interesting_instruction(
|
||||||
decoder: InstDecoder,
|
decoder: InstDecoder,
|
||||||
_address: u64,
|
_address: u64,
|
||||||
@ -2218,7 +2223,7 @@ impl AsanRuntime {
|
|||||||
.operands
|
.operands
|
||||||
.iter()
|
.iter()
|
||||||
.position(|item| *item == Operand::Nothing)
|
.position(|item| *item == Operand::Nothing)
|
||||||
.unwrap_or_else(|| 4);
|
.unwrap_or(4);
|
||||||
if operands_len < 2 {
|
if operands_len < 2 {
|
||||||
return None;
|
return None;
|
||||||
}
|
}
|
||||||
@ -2237,6 +2242,7 @@ impl AsanRuntime {
|
|||||||
|
|
||||||
// println!("{:?} {}", instr, memory_access_size);
|
// println!("{:?} {}", instr, memory_access_size);
|
||||||
//abuse the fact that the last operand is always the mem operand
|
//abuse the fact that the last operand is always the mem operand
|
||||||
|
#[allow(clippy::let_and_return)]
|
||||||
match instr.operands[operands_len - 1] {
|
match instr.operands[operands_len - 1] {
|
||||||
Operand::RegRegOffset(reg1, reg2, size, shift, shift_size) => {
|
Operand::RegRegOffset(reg1, reg2, size, shift, shift_size) => {
|
||||||
let ret = Some((
|
let ret = Some((
|
||||||
@ -2247,27 +2253,25 @@ impl AsanRuntime {
|
|||||||
Some((shift, shift_size)),
|
Some((shift, shift_size)),
|
||||||
));
|
));
|
||||||
// log::trace!("Interesting instruction: {}, {:?}", instr.to_string(), ret);
|
// log::trace!("Interesting instruction: {}, {:?}", instr.to_string(), ret);
|
||||||
return ret;
|
ret
|
||||||
}
|
}
|
||||||
Operand::RegPreIndex(reg, disp, _) => {
|
Operand::RegPreIndex(reg, disp, _) => {
|
||||||
let ret = Some((reg, None, disp, instruction_width(&instr), None));
|
let ret = Some((reg, None, disp, instruction_width(&instr), None));
|
||||||
// log::trace!("Interesting instruction: {}, {:?}", instr.to_string(), ret);
|
// log::trace!("Interesting instruction: {}, {:?}", instr.to_string(), ret);
|
||||||
return ret;
|
ret
|
||||||
}
|
}
|
||||||
Operand::RegPostIndex(reg, _) => {
|
Operand::RegPostIndex(reg, _) => {
|
||||||
//in post index the disp is applied after so it doesn't matter for this memory access
|
//in post index the disp is applied after so it doesn't matter for this memory access
|
||||||
let ret = Some((reg, None, 0, instruction_width(&instr), None));
|
let ret = Some((reg, None, 0, instruction_width(&instr), None));
|
||||||
// log::trace!("Interesting instruction: {}, {:?}", instr.to_string(), ret);
|
// log::trace!("Interesting instruction: {}, {:?}", instr.to_string(), ret);
|
||||||
return ret;
|
ret
|
||||||
}
|
}
|
||||||
Operand::RegPostIndexReg(reg, _) => {
|
Operand::RegPostIndexReg(reg, _) => {
|
||||||
let ret = Some((reg, None, 0, instruction_width(&instr), None));
|
let ret = Some((reg, None, 0, instruction_width(&instr), None));
|
||||||
// log::trace!("Interesting instruction: {}, {:?}", instr.to_string(), ret);
|
// log::trace!("Interesting instruction: {}, {:?}", instr.to_string(), ret);
|
||||||
return ret;
|
ret
|
||||||
}
|
|
||||||
_ => {
|
|
||||||
return None;
|
|
||||||
}
|
}
|
||||||
|
_ => None,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -2597,9 +2601,9 @@ impl AsanRuntime {
|
|||||||
_ => -1,
|
_ => -1,
|
||||||
};
|
};
|
||||||
let (shift_encoding, shift_amount): (i32, u32) = match shift_type {
|
let (shift_encoding, shift_amount): (i32, u32) = match shift_type {
|
||||||
ShiftStyle::LSL => (0b00, amount as u32),
|
ShiftStyle::LSL => (0b00, u32::from(amount)),
|
||||||
ShiftStyle::LSR => (0b01, amount as u32),
|
ShiftStyle::LSR => (0b01, u32::from(amount)),
|
||||||
ShiftStyle::ASR => (0b10, amount as u32),
|
ShiftStyle::ASR => (0b10, u32::from(amount)),
|
||||||
_ => (-1, 0),
|
_ => (-1, 0),
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -510,7 +510,7 @@ where
|
|||||||
if let Some(rt) = runtimes.match_first_type_mut::<AsanRuntime>() {
|
if let Some(rt) = runtimes.match_first_type_mut::<AsanRuntime>() {
|
||||||
rt.emit_shadow_check(
|
rt.emit_shadow_check(
|
||||||
address,
|
address,
|
||||||
&output,
|
output,
|
||||||
basereg,
|
basereg,
|
||||||
indexreg,
|
indexreg,
|
||||||
displacement,
|
displacement,
|
||||||
@ -587,23 +587,25 @@ where
|
|||||||
// workaround frida's frida-gum-allocate-near bug:
|
// workaround frida's frida-gum-allocate-near bug:
|
||||||
#[cfg(unix)]
|
#[cfg(unix)]
|
||||||
fn workaround_gum_allocate_near() {
|
fn workaround_gum_allocate_near() {
|
||||||
|
use std::fs::File;
|
||||||
|
|
||||||
unsafe {
|
unsafe {
|
||||||
for _ in 0..512 {
|
for _ in 0..512 {
|
||||||
mmap(
|
mmap::<File>(
|
||||||
None,
|
None,
|
||||||
std::num::NonZeroUsize::new_unchecked(128 * 1024),
|
std::num::NonZeroUsize::new_unchecked(128 * 1024),
|
||||||
ProtFlags::PROT_NONE,
|
ProtFlags::PROT_NONE,
|
||||||
ANONYMOUS_FLAG | MapFlags::MAP_PRIVATE | MapFlags::MAP_NORESERVE,
|
ANONYMOUS_FLAG | MapFlags::MAP_PRIVATE | MapFlags::MAP_NORESERVE,
|
||||||
-1,
|
None,
|
||||||
0,
|
0,
|
||||||
)
|
)
|
||||||
.expect("Failed to map dummy regions for frida workaround");
|
.expect("Failed to map dummy regions for frida workaround");
|
||||||
mmap(
|
mmap::<File>(
|
||||||
None,
|
None,
|
||||||
std::num::NonZeroUsize::new_unchecked(4 * 1024 * 1024),
|
std::num::NonZeroUsize::new_unchecked(4 * 1024 * 1024),
|
||||||
ProtFlags::PROT_NONE,
|
ProtFlags::PROT_NONE,
|
||||||
ANONYMOUS_FLAG | MapFlags::MAP_PRIVATE | MapFlags::MAP_NORESERVE,
|
ANONYMOUS_FLAG | MapFlags::MAP_PRIVATE | MapFlags::MAP_NORESERVE,
|
||||||
-1,
|
None,
|
||||||
0,
|
0,
|
||||||
)
|
)
|
||||||
.expect("Failed to map dummy regions for frida workaround");
|
.expect("Failed to map dummy regions for frida workaround");
|
||||||
|
@ -83,11 +83,11 @@ pub fn instruction_width(instr: &Instruction) -> u32 {
|
|||||||
Operand::SIMDRegisterGroup(sizecode, _, _, num) => {
|
Operand::SIMDRegisterGroup(sizecode, _, _, num) => {
|
||||||
////This is used for cases such as ld4 {v1.2s, v2.2s, v3.2s, v4.2s}, [x0].
|
////This is used for cases such as ld4 {v1.2s, v2.2s, v3.2s, v4.2s}, [x0].
|
||||||
//the sizecode is the size of each simd structure (This can only be D or Q), num is the number of them (i.e. ld4 would be 4)
|
//the sizecode is the size of each simd structure (This can only be D or Q), num is the number of them (i.e. ld4 would be 4)
|
||||||
get_simd_size(*sizecode) * *num as u32
|
get_simd_size(*sizecode) * u32::from(*num)
|
||||||
}
|
}
|
||||||
Operand::SIMDRegisterGroupLane(_, sizecode, num, _) => {
|
Operand::SIMDRegisterGroupLane(_, sizecode, num, _) => {
|
||||||
//This is used for cases such as ld4 {v0.s, v1.s, v2.s, v3.s}[0], [x0]. In this case sizecode is the size of each lane, num is the number of them
|
//This is used for cases such as ld4 {v0.s, v1.s, v2.s, v3.s}[0], [x0]. In this case sizecode is the size of each lane, num is the number of them
|
||||||
get_simd_size(*sizecode) * *num as u32
|
get_simd_size(*sizecode) * u32::from(*num)
|
||||||
}
|
}
|
||||||
_ => {
|
_ => {
|
||||||
return 0;
|
return 0;
|
||||||
@ -104,10 +104,10 @@ pub fn writer_register(reg: u16, sizecode: SizeCode, zr: bool) -> Aarch64Registe
|
|||||||
//yaxpeax and arm both make it so that depending on the opcode reg=31 can be EITHER SP or XZR.
|
//yaxpeax and arm both make it so that depending on the opcode reg=31 can be EITHER SP or XZR.
|
||||||
match (reg, sizecode, zr) {
|
match (reg, sizecode, zr) {
|
||||||
(0..=28, SizeCode::X, _) => {
|
(0..=28, SizeCode::X, _) => {
|
||||||
Aarch64Register::from_u32(Aarch64Register::X0 as u32 + reg as u32).unwrap()
|
Aarch64Register::from_u32(Aarch64Register::X0 as u32 + u32::from(reg)).unwrap()
|
||||||
}
|
}
|
||||||
(0..=30, SizeCode::W, _) => {
|
(0..=30, SizeCode::W, _) => {
|
||||||
Aarch64Register::from_u32(Aarch64Register::W0 as u32 + reg as u32).unwrap()
|
Aarch64Register::from_u32(Aarch64Register::W0 as u32 + u32::from(reg)).unwrap()
|
||||||
}
|
}
|
||||||
(29, SizeCode::X, _) => Aarch64Register::Fp,
|
(29, SizeCode::X, _) => Aarch64Register::Fp,
|
||||||
(30, SizeCode::X, _) => Aarch64Register::Lr,
|
(30, SizeCode::X, _) => Aarch64Register::Lr,
|
||||||
@ -257,10 +257,8 @@ pub fn disas_count(decoder: &InstDecoder, data: &[u8], count: usize) -> Vec<Inst
|
|||||||
|
|
||||||
#[cfg(target_arch = "aarch64")]
|
#[cfg(target_arch = "aarch64")]
|
||||||
/// Disassemble "count" number of instructions
|
/// Disassemble "count" number of instructions
|
||||||
pub fn disas_count(decoder: &InstDecoder, data: &[u8], count: usize) -> Vec<Instruction> {
|
pub fn disas_count(decoder: &InstDecoder, data: &[u8], _count: usize) -> Vec<Instruction> {
|
||||||
let _counter = count;
|
|
||||||
let mut ret = vec![];
|
let mut ret = vec![];
|
||||||
let _start = 0;
|
|
||||||
|
|
||||||
let mut reader = ReaderBuilder::<u64, u8>::read_from(data);
|
let mut reader = ReaderBuilder::<u64, u8>::read_from(data);
|
||||||
|
|
||||||
|
@ -36,7 +36,7 @@ libafl_targets = { path = "../../libafl_targets", features = ["sancov_8bit", "sa
|
|||||||
|
|
||||||
ahash = { version = "0.8.3", default-features = false }
|
ahash = { version = "0.8.3", default-features = false }
|
||||||
libc = "0.2.139"
|
libc = "0.2.139"
|
||||||
log = "0.4.17"
|
log = "0.4.20"
|
||||||
mimalloc = { version = "0.1.34", default-features = false }
|
mimalloc = { version = "0.1.34", default-features = false }
|
||||||
num-traits = "0.2.15"
|
num-traits = "0.2.15"
|
||||||
rand = "0.8.5"
|
rand = "0.8.5"
|
||||||
|
@ -7,5 +7,5 @@ edition = "2021"
|
|||||||
vergen = { version = "8.1.1", features = ["build", "cargo", "git", "gitcl", "rustc", "si"] }
|
vergen = { version = "8.1.1", features = ["build", "cargo", "git", "gitcl", "rustc", "si"] }
|
||||||
|
|
||||||
[dependencies]
|
[dependencies]
|
||||||
anyhow = { version = "1.0.71", default-features = false }
|
anyhow = { version = "1.0", default-features = false }
|
||||||
clap = { version = "4.2.0", default-features = false, features = ["derive", "string", "std", "help"] }
|
clap = { version = "4.5", default-features = false, features = ["derive", "string", "std", "help"] }
|
||||||
|
@ -8,9 +8,9 @@ vergen = { version = "8.1.1", features = ["build", "cargo", "git", "gitcl", "rus
|
|||||||
|
|
||||||
[dependencies]
|
[dependencies]
|
||||||
anyhow = { version = "1.0", default-features = false }
|
anyhow = { version = "1.0", default-features = false }
|
||||||
clap = { version = "4.2", default-features = false, features = ["derive", "string", "std", "help", "derive", "error-context", "usage"] }
|
clap = { version = "4.5", default-features = false, features = ["derive", "string", "std", "help", "derive", "error-context", "usage"] }
|
||||||
libc = {version = "0.2", default-features = false }
|
libc = {version = "0.2", default-features = false }
|
||||||
log = { version = "0.4", default-features = false }
|
log = { version = "0.4.20", default-features = false }
|
||||||
nix = { version = "0.26", default-features = false, features = ["signal", "fs"] }
|
nix = { version = "0.27", default-features = false, features = ["signal", "fs"] }
|
||||||
readonly = { version = "0.2.8", default-features = false }
|
readonly = { version = "0.2.8", default-features = false }
|
||||||
simplelog = { version = "0.12.1", default-features = false }
|
simplelog = { version = "0.12.1", default-features = false }
|
||||||
|
@ -19,5 +19,5 @@ libafl = { path = "../../../libafl", default-features = false }
|
|||||||
serde_json = "1.0"
|
serde_json = "1.0"
|
||||||
regex = "1"
|
regex = "1"
|
||||||
postcard = { version = "1.0", features = ["alloc"], default-features = false } # no_std compatible serde serialization format
|
postcard = { version = "1.0", features = ["alloc"], default-features = false } # no_std compatible serde serialization format
|
||||||
clap = { version = "4.0", features = ["derive"] }
|
clap = { version = "4.5", features = ["derive"] }
|
||||||
# log = "0.4.20"
|
# log = "0.4.20"
|
||||||
|
@ -7,6 +7,6 @@ edition = "2021"
|
|||||||
vergen = { version = "8.1.1", features = ["build", "cargo", "git", "gitcl", "rustc", "si"] }
|
vergen = { version = "8.1.1", features = ["build", "cargo", "git", "gitcl", "rustc", "si"] }
|
||||||
|
|
||||||
[dependencies]
|
[dependencies]
|
||||||
anyhow = { version = "1.0.71", default-features = false }
|
anyhow = { version = "1.0", default-features = false }
|
||||||
clap = { version = "4.2.0", default-features = false, features = ["derive", "string", "std", "help"] }
|
clap = { version = "4.5", default-features = false, features = ["derive", "string", "std", "help"] }
|
||||||
readonly = { version = "0.2.8", default-features = false }
|
readonly = { version = "0.2.8", default-features = false }
|
||||||
|
@ -11,9 +11,9 @@ crate-type = ["dylib"]
|
|||||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||||
|
|
||||||
[dependencies]
|
[dependencies]
|
||||||
anyhow = { version = "1.0.71", default-features = false }
|
anyhow = { version = "1.0", default-features = false }
|
||||||
ctor = { version = "0.2", default-features = false }
|
ctor = { version = "0.2", default-features = false }
|
||||||
nix = { version = "0.26.2", default-features = false, features = ["process", "personality"] }
|
nix = { version = "0.27", default-features = false, features = ["process", "personality"] }
|
||||||
|
|
||||||
[target.'cfg(any(target_os = "freebsd", target_os = "netbsd"))'.dependencies]
|
[target.'cfg(any(target_os = "freebsd", target_os = "netbsd"))'.dependencies]
|
||||||
libc = "0.2"
|
libc = "0.2"
|
||||||
|
@ -7,10 +7,10 @@ edition = "2021"
|
|||||||
vergen = { version = "8.1.1", features = ["build", "cargo", "git", "gitcl", "rustc", "si"] }
|
vergen = { version = "8.1.1", features = ["build", "cargo", "git", "gitcl", "rustc", "si"] }
|
||||||
|
|
||||||
[dependencies]
|
[dependencies]
|
||||||
anyhow = { version = "1.0.71", default-features = false }
|
anyhow = { version = "1.0", default-features = false }
|
||||||
clap = { version = "4.2.0", default-features = false, features = ["derive", "string", "std", "help", "derive", "error-context", "usage"] }
|
clap = { version = "4.5", default-features = false, features = ["derive", "string", "std", "help", "derive", "error-context", "usage"] }
|
||||||
log = { version = "0.4.20", default-features = false }
|
log = { version = "0.4.20", default-features = false }
|
||||||
nix = { version = "0.26.2", default-features = false, features = ["process", "personality"] }
|
nix = { version = "0.27", default-features = false, features = ["process", "personality"] }
|
||||||
readonly = { version = "0.2.8", default-features = false }
|
readonly = { version = "0.2.8", default-features = false }
|
||||||
simplelog = { version = "0.12.1", default-features = false }
|
simplelog = { version = "0.12.1", default-features = false }
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user