Andrea Fioraldi
5571a03641
Implement thread-safe AsanGiovese in Rust with snapshots support ( #851 )
...
* Purge C impl of asan-giovese
* Compiling
* reset asan
* Restore asan state in qemu
* clippy
* upd
* Asan snapshots
* fuzzbench_qemu
* fix snap mmap limit
* fix
* compiles again
* clippy
* update meminterval
* autofix
* fix 32 bit targets
* try to clean intermediate builds
Co-authored-by: Dominik Maier <dmnk@google.com>
2022-10-25 09:48:59 +02:00
Dominik Maier
e8b3d33bf4
Update dependencies, removed unused deps, CI fixes ( #839 )
...
* update clap, remove unused deps
* update grammartek
* update pyo3
* update pyo3
* undid clap update
* not changing nyx
* updated deps
* Update more deps, fixes
* not needed clippy
* fix windows
* try to enable deprecated pyproto for pyo3
* unused
* moving some things to clap4 after all
* initial move to clap 4
* fix clap
* more clap4, removed accidental file
* fixes, fmt
* fix
* all fix no play
* fix
2022-10-18 20:36:43 +02:00
syheliel
2504b6dae3
Add rustfmt.toml ( #722 )
...
* add `rustfmt.toml`
* format fix
Co-authored-by: syheliel <syheliel@gmail.com>
2022-08-12 02:28:32 +02:00
Andrea Fioraldi
7147170240
New hooks for libafl_qemu ( #673 )
...
* new block and edge hooks
* Wrking new hooks
* no Pin, just box
* working call tracing
* invalidate_block flag
* working call stack tracking helper
* callstack push
* fixes
* py
* fixes
* clippy
* clippy
* gdb api
* kill introspection
* fix
* upd qemu
* upd qemu
2022-06-16 11:09:07 +02:00
Andrea Fioraldi
da537aae83
FeedbackState as metadata ( #627 )
...
* SerdeAny MapFeedbackState
* Fix macro syntax
* alloc
* fix
* Metadata calibrate and map feedback
* metadata feedback states
* compile
* fmt
* Register common generic types
* tests
* sugar
* no_std
* fix book
* alloc
* fix fuzzers
* fix
* fmt
* disable python bindings for libafl
* clippy
* fmt
* fixes
* fmt
* fix
* fix
* fix
* fix
* fix
* release autofix
* fix
* fix
* fix
* fmt
* fix
* fix
* name
* fix
Co-authored-by: Dominik Maier <dmnk@google.com>
2022-05-24 16:05:22 +02:00
Dongjia Zhang
283ceaac9b
Make weigthed scheduler independent of powersheduler stage ( #599 )
...
* rename & add metadata in scheduler, not stage
* Update testcase_score
* rename
* fix
* update handicap in scheduler
* fmt
* update fuzzers
* doc
* fmt
* fix
* fmt
* more
* fix
* fix
* fix
* fmt
2022-05-08 16:43:02 +02:00
Dongjia Zhang
034a4870e2
Set the number of stacked mutations in MOpt mutator ( #587 )
...
* max_stack_pow
* fix
* fix
* fmt
* rename
2022-04-03 09:25:59 +09:00
Toka
abf1a66028
Rename FavFactor to TestcaseScore; More TestcaseScores ( #574 )
...
* rework aflfast
* more
* move fuzz_Mu
* weighted
* fix
* borrow checker fix
* compute_weight
* alias_table
* fmt
* fix & rename
* fix & less mut
* no_std
* no_std
* clippy
* 32bit clippy fix
* top_rated for compute_weight
* fix
* clippy & metadata Init
* fix
* fix
* fix
* clippy & fmt
* change fuzzers
* fuzzbench_selected
* fmt
* compute() has state
* use favfactor for powerschedules also
* fix merge
* rename
* fmt & clippy
* no_std
* fmt
* clippy
* rename
* fmt
* rename
* fmt
* fix
* fix
* fmt
* fix
* fix
2022-03-27 04:04:46 +09:00
Dongjia Zhang
c72f773ca0
Weighted corpus entry selection ( #570 )
...
* rework aflfast
* more
* move fuzz_Mu
* weighted
* fix
* borrow checker fix
* compute_weight
* alias_table
* fmt
* fix & rename
* fix & less mut
* no_std
* no_std
* clippy
* 32bit clippy fix
* top_rated for compute_weight
* fix
* clippy & metadata Init
* fix
* fix
* fix
* clippy & fmt
* change fuzzers
* fuzzbench_selected
* fmt
2022-03-23 02:01:00 +09:00
Andrea Fioraldi
a56f4af7da
CorpusScheduler -> Scheduler and move them to the schedulers folder ( #560 )
...
* CorpusScheduler -> Scheduler
* fix book
* update fuzzers
* fix tests
* fix sugar
* fix
* fix tutorial
* fix tutorial
* fmt
* fix
* fmt
* fmt
2022-03-03 14:27:37 +01:00
Andrea Fioraldi
a03d733cf9
libafl_qemu decouple hooks from the executor and QemuForkExecutor ( #528 )
...
* QemuHooks
* option state hooks
* QemuForkExecutor
* enforce no side effects in QemuForkExecutor
* child hooks fixes
* fixes
* qemu_launcher
* examples and fixes
* fix sugar
* clippy
* fmt
* no timeout for fuzzbench_fork_qemu
* Update libafl_qemu/src/hooks.rs
Co-authored-by: Alwin Berger <50980804+alwinber@users.noreply.github.com>
* clippy
Co-authored-by: Alwin Berger <50980804+alwinber@users.noreply.github.com>
2022-02-15 22:11:24 +01:00
Dominik Maier
6810e6085b
Builder for CommandExecutor & Tokens Refactoring ( #508 )
...
* builder for CommandExecutor
* tokens api cleanup, clippy
* fix doctest
* cleanup
* added testcase, remodelled
* command executor builder fix
* fix fuzzer(?)
* implemented From for configurator
* nits
* clippy
* unused
* autotokens
* cleanup
* nits
* Err instead of empty tokens
* fix tokens fn
* fix err
* more error fixing
* tokens remodelling
* typo
* recoverable fail on missing autotokens
* clippy, nostd
* asslice, into_iter, etc. for tokens
* adapt fuzzers
* iter
* fixes, clippy
* fix
* more clippy
* no_std
* more fix
* fixed typo
* cmd_executor builds again
* bring back ASAN stuff to Command Executor
* forkserver speedup
* no need to static
* back to earlier
2022-02-01 10:10:47 +01:00
Evan Richter
4a6616bdfe
[libafl_qemu] simplify emu::{read,write}_mem ( #496 )
...
Methods read_mem and write_mem now operate on &[u8], not &[T]
The generic T slice interface was prone to various footguns:
* i32 is the default Rust integer type, but buffers are often expected
to hold u8. This means the following code writes 16 bytes to the
guest, not 4:
let buf = [0; 4];
emu.write_mem(addr, &buf);
* If a buffer of 16-bit or larger integers (&[u64] for example) is
needed to read/write, the user will need to consider host/guest
endianness. The byte array methods in std are a good, explicit
alternative.
Perhaps libafl_qemu could expose/define "to/from guest endianness"
helper functions or extension traits using the established cfg flags,
so that guest endianness is always right by default.
* emu::read_mem causes insta-UB if a user did something like:
let mut my_bool = false;
emu.read_mem(addr, &mut my_bool);
It's less surprising for users to just operate on plain-ol' bytes,
which they can explicitly transmute if they wish.
2022-01-27 09:05:33 +01:00
Dominik Maier
77e5965e97
Add AsSlice, AsMutSlice traits, refactor MapObservers to be iterable, and have associated types ( #477 )
...
* from warning
* fix latest clippy
* clippy fixes++
* renamed shmem parameters
* renamed map to shmem
* make forkserver executor work for any (non-system) shmem
* Mem -> ShMem
* rework windows
* fix nit
* fix symbolic
* refacctor map observers
* iterator for map observers
* removed unused ownedptr, added asslice trait to most functions
* make map entry type an associated type
* fix fuzzers
* fix docs
* typo fix
* fix windows, add try_from_slice to shmid
* missing import
* fix fuzzbench
* cleanup
* fmt
* more asslice
* fmt
* added doc link about token-level fuzzing
* cods
2022-01-19 00:02:33 +01:00
Andrea Fioraldi
6274ad4594
Refactor libafl_qemu creating the Emulator struct and post syscall hooks ( #430 )
...
* working without asan.rs
* working asan
* update fuzzers
* mremap in snapshot
* sugar
* python
* fix python
* clippy
* fmt
* fuck you loader
2021-12-23 09:10:13 +01:00
Andrea Fioraldi
0cce1e2b91
Update fuzzbench and fuzzbench_qemu, delete fuzzbench_gsoc
2021-12-21 11:26:04 +01:00
Dongjia Zhang
4aa6550bf2
Clap: use help instead of about ( #417 )
2021-12-10 05:04:32 +01:00
Andrea Fioraldi
fd5e793e57
libafl_qemu cpu_target cfg ( #383 )
...
* cpu_target
* report
* track mmap in x64 snapshots
2021-11-17 12:50:10 +01:00
Andrea Fioraldi
00d38dc535
AddressSanitizer for libafl_qemu ( #378 )
...
* build libqasan
* asan runtime
* working simple asan
* init_with_asan
* fmt
* incomplete instr filter
* harden dealloc
* clippy
2021-11-16 13:53:28 +01:00
Dominik Maier
62afed61e2
Renamed Stats to Monitors ( #373 )
...
* renamed stats to monitors
* added depreciation notices
* resorted generics alphaabetically
* added monitors
* fmt fuzzers
* added depreciation note for usermonitor
* fmt all fuzzers script
* more fmt
* renamed some monitor things back to stats
* fixed rename
2021-11-12 11:01:08 +01:00
Andrea Fioraldi
f2929b8253
Allowlist and denylist for QEMU edges and cmps ( #311 )
...
* fix edges hashtable query bug in hook
* fmt
2021-10-01 14:28:24 +02:00
Andrea Fioraldi
90928d3d97
Qemu Helpers and basic snapshotting ( #310 )
...
* store executor_ptr
* QemuHelpers
* working hooks and snapshot helper
* walk only the list of dirty pages on restore()
* mem hooks for snpashot
* brk snapshot
* snapshot method
* macos shit
* sugar and clippy
2021-10-01 12:17:28 +02:00
Andrea Fioraldi
1fde608145
Qemu as lib ( #301 )
...
* linking problems
* use shared lib
* ci
* clippy, ci fixegit pushs
* ingoring distclean result
* clippy
* clippy
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2021-09-24 13:22:33 +02:00
Dominik Maier
bb21ab7a63
Autolaunch ShMemService, add MacOS fuzzers to CI, various fixes ( #246 )
...
* starting to fix macos linker bugs
* mdetailed error prints
* start shmem service manually
* not a doc comment
* Some fixes
* only send exit msg to shmemservice when start was successful
* incorporated shmem service into provider
* removed unused imports
* trying to fix fuzzers
* fixed build
* check if join_handle is_some
* more debug prints
* fixed shmem service autolaunch
* fixed macos linker
* ignoring broken libpng testcase on macos for now (see #252 )
* fmt
* try to fix missing llvm_config (see #253 )
* empty issue template added
* Mmanually look for llvm-config on MacOS
* fixing CI
* fixed docs
* ignoring libmozjpg for CI, see #254
2021-08-09 01:10:29 +02:00
Dominik Maier
16c3a07be7
ShMem Server for MacOS ( #238 )
...
* generalized ashmem server
* fixed macos testcases
* added StdShMemService
* no_st
* fmt
* added testcase, fixed some bugs (not all)
* solidified unix shmem
* initial impl for MmapShMem
* Added shmem service start to more testcases
* clippy
* fixed tetcases
* added frida_libpng makefile for easy use
* trying to fix build on ubuntu
* fixed ubuntu build for libpng
* no_std
* fixed testcase
2021-08-05 17:08:01 +02:00
Andrea Fioraldi
2faf1d24c8
Hook syscalls in QemuBytesCoverageSugar ( #233 )
...
* add x64 syscalls numbers
* syscall hook
* update commit
* read guest mappings
* clippy
* read write hooks
* automerge fix
* type fix
* hooks syscalls in sugar
2021-07-21 12:29:46 +02:00
Andrea Fioraldi
42b7c6d7e7
Qemu CmpLog ( #223 )
...
* empty libafl_qemu crate
* fuzzbench qemu fuzzer skeleton
* emu.run() works without bp
* working emu loop
* resolve elf symbols
* running Qemu fuzzer without coverage
* qemu fuzzer with edge coverage
* merge into inprocess::GLOBAL_STATE
* create QemuExecutor and remove QemuEmulator
* qemu hooks and persist edges mapping storing them in State
* windows fix
* add libafl_qemu to workspace
* windows fix
* some clippy
* clippy
* fix fuzzbench_qemu
* fix fuzzbench_qemu makefile
* fuck you macos
* resolve PIC symbols
* cmp hooks
* cmplog hooks
* qemu cmplog
* clippy
2021-07-13 16:02:53 +02:00
Dominik Maier
a0ba0f0251
clippy
2021-07-12 10:30:41 +02:00
Andrea Fioraldi
badf3f0e6e
Resolve symbols in PIC binaries in libafl_qemu ( #216 )
...
* empty libafl_qemu crate
* fuzzbench qemu fuzzer skeleton
* emu.run() works without bp
* working emu loop
* resolve elf symbols
* running Qemu fuzzer without coverage
* qemu fuzzer with edge coverage
* merge into inprocess::GLOBAL_STATE
* create QemuExecutor and remove QemuEmulator
* qemu hooks and persist edges mapping storing them in State
* windows fix
* add libafl_qemu to workspace
* windows fix
* some clippy
* clippy
* fix fuzzbench_qemu
* fix fuzzbench_qemu makefile
* fuck you macos
* resolve PIC symbols
2021-07-09 15:17:57 +02:00
Andrea Fioraldi
d472a1242a
libafl_qemu ( #211 )
...
* empty libafl_qemu crate
* fuzzbench qemu fuzzer skeleton
* emu.run() works without bp
* working emu loop
* resolve elf symbols
* running Qemu fuzzer without coverage
* qemu fuzzer with edge coverage
* merge into inprocess::GLOBAL_STATE
* create QemuExecutor and remove QemuEmulator
* qemu hooks and persist edges mapping storing them in State
* windows fix
* add libafl_qemu to workspace
* windows fix
* some clippy
* clippy
* fix fuzzbench_qemu
* fix fuzzbench_qemu makefile
* fuck you macos
2021-07-08 15:21:14 +02:00
