106 Commits

Author SHA1 Message Date
Dominik Maier
96e24d1c8b
Move Input loading and dumping APIs from Testcase to Corpus (#1201)
* Less allocatiosn for filenames

* clippy for wasm fuzzer

* Reworked filename and rename APIs

* python, clippy

* fmt

* More cleanup, fixed metadata location

* clippy

* fix fuzzbench_text / cached len, invert parameters (state first)

* clippy

* oops

* Caching for paths

* simplified, fixed

* no_std

* cached_len

* Nider API for input getting
2023-04-18 12:14:49 +02:00
Langston Barrett
863a6b8b7c
Mark buffer_{self_,}copy as unsafe, don't export them (#1207) 2023-04-12 17:42:16 +02:00
Andrea Fioraldi
a01863696e
Implement restarting without serializing the corpus (#1182)
* Restart without serializing state option

* libfuzzer libpng example

* clippy

* libfuzzer_libpng_norestart

* fix
2023-03-30 14:35:58 +02:00
Dominik Maier
f4f23de32b
Fix fuzzers after HasTestcase (#1123) (#1162)
* Fix fuzzers after HasTestcase (#1123)

* Make the trait a trait

* Implement HasTestcase for Corpora

* fix

* fix

* a

* a

* fix

* wasm32

* a

* f

* f

* aa

---------

Co-authored-by: tokatoka <tokazerkje@outlook.com>
2023-03-19 11:58:32 +09:00
Matheus Baptistella
104c170ade
Use the new metadata() function in more places (#1155) 2023-03-17 16:03:57 +01:00
Dongjia "toka" Zhang
08fe6ab791 Fix mutator slowdown (#1138)
* perf stat

* fix except swap

* swap

* fix

* reveral-based byte swap

* Revert "reveral-based byte swap"

This reverts commit 2bc9609ece47fd4e8f6d96862f8ad3fb77f11aec.

* no introspection

* clp fmt

* change rand_range to have at least 1 length

* don't use modulo

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
2023-03-16 15:58:03 +01:00
Matheus Baptistella
c38405ef83
Shorthand functions to get typed metadata, renamed metatdata -> metadata_map (#1123)
* Created macro to get the metadata form State and Testcase

* Expanded the macros for mutable, or not, State and Testcase metadata

* Created functions on traits HasMetadata and HasNamedMetadatato get, mutable or not, metadata

* Created the functions to get metadata

* Added #[inline] attribute and renamed the functions

* Renamed the functions and added #[inline] attribute

* Temporarily added testcase() function

* Added testcase() function

* Changed Ref import to core::cell:Ref

* Added testcase_mut() and renamed occurences of metadata() and metadata_mut()

* Renamed more occurences

* Renamed the metadata() on impl HasMetadata for NopState

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-03-14 14:24:33 +01:00
Dongjia "toka" Zhang
44b798c07e
AFL++ RedQueen (#1087)
* step 1

* step 2

* Vec

* comment

* Observer

* tmp

* TaintedTracingStage

* more

* more

* more

* Idea

* more

* more

* mmmmmore

* moremoremore

* more

* all

* clp

* comment

* core

* push temporary debug change

* note for myself

* working

* rename to AFLCmplogTracingStage

* rename

* revert fuzzers' change
2023-03-13 17:34:16 +01:00
Dominik Maier
2ed6583041
CI: Run miri tests (#1130)
* Fixes/ignores for miri support

* linux

* fix doctest for miri

* fix docs

* fix UB in baby_fuzzer

* no custom allocator in miri
2023-03-08 19:21:17 +01:00
Dominik Maier
31357aa7e2
Track parent testcase id, tuneable stage probabilistic settings (#1081)
* Added local event handlers

* clippy

* move tuned mutator to pow2

* Tunable updates

* parent ids

* no_std, etc

* windows

* remove local event manager handler

* maybe fix win

* win:

* win docs

* docs

* ASAN -> ASan
2023-02-28 16:36:04 +01:00
Mrmaxmeier
ff4e2f4192
Fix max input size for {CrossOverInsert,BytesInsertCopy}Mutator (#1097) 2023-02-24 00:07:54 +01:00
Addison Crump
bdac876dd4
Mutator sampling probability fixes (#1030)
* fixes for standard mutations

* more mutation updates for sampling probability, tests

* slight doc fix

* clippy gripe

* clippy fixes

---------

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-02-16 17:29:57 +01:00
Addison Crump
26aace6073
Fix grimoire when used with on_replace/on_remove (#1075) 2023-02-16 00:14:26 +01:00
Fabian Freyer
53dba5f49d
Use the log facade instead of println (#1060)
* switched a couple of println / dbg statements to use log crate
* Use pyo3-log for logging in python bindings
2023-02-14 10:01:51 +01:00
Dominik Maier
33ddce2cea
Introduce MutatorId, Tuneable fixes (#1022)
* Add simpler APIs for TunableStage

* Make API usable

* Add TunableScheduledMutator APIs

* Introduce MutatorId

* More API

* Cleanup

* add sampling-based mutation scheduling

* reduce precision for sampling

* clippy
2023-01-30 18:04:42 +01:00
Addison Crump
ebc886032f
Fixes for multiple subtle bugs with grimoire, mutators, and state (#1001)
* fix multiple subtle bugs with grimoire, mutators, and state

* obey the clippy overlord

* grimoire: skip over token after splice

* remove extraneous length check
2023-01-18 13:53:31 +01:00
van Hauser
15c1c0fb5e
Avoid no-op in ByteRandMutator (#999) 2023-01-17 11:07:50 +01:00
Addison Crump
28786c943a
Grimoire fixes (#993)
* fixup grimoire/generalisation, remove GeneralizedInput in favour of metadata

* additional cleanup

* transformable inputs to solve the grimoire problem

* explicit use of 'transforming' to keep typing compatible with normal usage

* clippy fix

* fixes for nautilus, python

* explicit inlining for reflexive impl

* fix for tutorial

Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
2023-01-13 01:07:21 +01:00
Andrea Fioraldi
ec84c71eae
Corpus maps (#947)
* hashmap corpus for inmemory

* corpus_btreemap feature

* CorpusId

* queue

* MinimizerScheduler::remove

* fixes

* continue

* keys

* working corpus

* ok

* weighted left

* wip

* port weighted scheduler

* it compiles

* doc

* fix mutators

* fix queue

* fix iter

* tests

* fix

* fix

* fix

* py

* clippy

* clippy

* clippy

* cmin

* fix

* fix

* fix

* clippy

* remove Corpus::random_id
2023-01-09 14:15:07 +01:00
Dominik Maier
75f12bd0eb
Remodelling Observers/Examples that rely on UB, API cleanups (#950)
* Tackling UB

* PtrMut -> MutPtr, moved mapobservers to non-UB

* QEMU fixes

* test fixes

* qemu

* Change all interfaces, fix all fuzzers

* fixes

* fix more fixes

* fmt

* fix qemu sugar

* fix some qemus

* atheris

* fmt

* more fmt

* most fmt

* more fix

* nyx fyx

* fix qemu

* clippy, fixes

* more fixes

* no unfix, only fix

* fix

* fix

* more clippy

* fixes

* ListObserver

* fmt, clippy

* fix qemu on arm

* update zlib target

* fix?

* fix

* added migration guide

* ignore doc

* fix symcc

* fix new win fuzzer

* Fixes, rename PTR_SIZE to PTR_NUM

* Try fix linking on win

* Trying to fix win linking

* more cov

* trying to fix win some more

* trying to fix mac

* trying to fix mac

* Fix tests

* Fix tests

* trying to fix win

* more mac

* giving up for windows

* fmt

* python3

* mac?

* undo windows tests
2022-12-24 14:20:44 +01:00
Dominik Maier
68fbfc8914
Fix Clippy (#926)
* Fix clippy

* undo comment fmt

* add unstracked nyx files to gitignore

* fix

* windows, no_std

* fix

* fix

* more

* macos

* remove doctest

Co-authored-by: Dongjia "toka" Zhang <tokazerkje@outlook.com>
2022-12-06 00:05:42 +09:00
Andrea Fioraldi
c2776e117a
emu::current_cpu() is now the CPU that hitted the breakpoint in fullsystem (#910)
* emu::current_cpu() is now kept after vm stop and it is the CPU that hitted the breakpoint

* clippy

* uninit

* clippy

* clippy

* clippy

* clippy

* nightly override in CI

* nightly override in CI

* components

* components

* targets

* targets

* clippy

* clippy

* clippy

* clippy

* clippy (again)

* MaybeUninit

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-11-25 11:57:08 +01:00
Mrmaxmeier
ff2971068f
mopt: seed from state rand instead of current_nanos (#902) 2022-11-20 09:21:16 +01:00
Dominik Maier
e5aaf85d3c
Tuneable Stage, Scheduler, ScheduledMutator (#874)
* Tuneable Stage, Scheduler, and Mutators

* rename

* fix build

* get rid of prelude

* fmt

* Reworked tunable, fixed stuff, add testcase

* clippy

* further fixes

* fix typo, fmt
2022-11-12 03:02:54 +01:00
Dominik Maier
6b6570ae5f
Use Associated Types for Has* traits and AsSlice (#881)
* More Associated Types

* AsSlice associated-ified

* added script to find unused files

* fixes for python

* build all the things

* windows fixes
2022-11-10 09:31:04 +01:00
Dominik Maier
663a33168e
Associated types for Corpus, State (#767)
* Associated types for Corpus, State

* cleanup

* fix no_std

* drop unused clauses

* Corpus

* cleanup

* adding things

* fixed fuzzer

* remove phantom data

* python

* progress?

* more more

* oof

* wow it builds?

* python fixes, tests

* fix python fun

* black fmt for python

* clippy, added Nop things

* fixes

* fix merge

* make it compile (#836)

* doc-test fixes, prelude-b-gone for cargo-hack compat

* fixes for windows, concolic

* really fix windows, maybe

* imagine using windows

* ...

* elide I generic when used with S: State

* Elide many, many generics, but at what cost?

* progress on push

* Constraint HasCorpus, HasSolutions at trait definition

* remove unused feature

* remove unstable usage since we constrained HasCorpus at definition

* compiled, but still no type inference for MaxMapFeedback

* cleanup inprocess

* resolve some std conflicts

* simplify map

* undo unnecessary cfg specification

* fix breaking test case for CI on no-std

* fix concolic build failures

* fix macos build

* fixes for windows build

* timeout fixes for windows build

* fix pybindings issues

* fixup qemu

* fix outstanding local build issues

* maybe fix windows inprocess

* doc fixes

* unbridled fury

* de-associate State from Feedback, replace with generic as AT inference is not sufficient to derive specialisation for MapFeedback

* merge update

* refactor + speed up fuzzer builds by sharing build work

* cleanup lingering compiler errors

* lol missed one

* revert QEMU-Nyx change, not sure how I did that

* move HasInput to inputs

* HasInput => KnowsInput

* update bounds to enforce via associated types

* disentangle observers with fuzzer

* revert --target; update some fuzzers to match new API

* resolve outstanding fuzzer build blockers (that I can run on my system)

* fixes for non-linux unixes

* fix for windows

* Knows => Uses, final fixes for windows

* <guttural screaming>

* fixes for concolic

* loosen bound for frida executor so windows builds correctly

* cleanup generics for eventmanager/eventprocessor to drop observers requirement

* improve inference over fuzz_one and friends

* update migration notes

* fixes for python bindings

* fixes for generic counts in event managers

* finish migration notes

* post-merge fix

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2022-10-24 03:22:26 +02:00
Mrmaxmeier
f5cc354102
Token mutations: set MutationResult for CmpValues::Bytes (#838)
* token mutations: set MutationResult for CmpValues::Bytes

I haven't measured this and am not even sure if CmpValues::Bytes is
currently populated by any executor, but this seems like an oversight.

* replace dead zlib-1.2.12.tar.gz URL

See https://zlib.net/fossils/OBSOLETE
2022-10-14 13:03:57 +02:00
Dominik Maier
94f0c7f56e
Moving to named parameters in format strings (#827)
* autofix

* you're just asking for a clamping

* autofmt on linux

* fix nits

* change back nit

* unfixing as u64 for GuestAddr

* fix

* ignoring clippy for GuestAddress
2022-10-11 13:45:01 +02:00
Andrea Fioraldi
c0bb1bc1e6
Fix len miscalculation in grimoire string replace (#794)
* Fix len miscalculation in grimoire string replace

* ok Rust i was writing JS these days

Co-authored-by: Andrea Fioraldi <andrea.fioraldi@trellix.com>
2022-09-21 14:19:54 +02:00
Andrea Fioraldi
74955d5376
Extend gramatron recursive mutator (#783) 2022-09-14 10:24:50 +02:00
Dongjia "toka" Zhang
7aadf31246
Add track_stability option to CalibrationStage (#781)
* add

* Update gramatron.rs

* Update emu.rs

* try

* clp
2022-09-13 09:39:17 +02:00
Dominik Maier
5823320206
Fixes for new Clippy (#755) 2022-09-02 16:21:06 +02:00
Dongjia Zhang
5d9a19f955
Mac OS Autotokens (#723)
* mac_tokens

* more

* win fix

* fmt

* fmt c
2022-08-13 02:58:22 +02:00
syheliel
2504b6dae3
Add rustfmt.toml (#722)
* add `rustfmt.toml`

* format fix

Co-authored-by: syheliel <syheliel@gmail.com>
2022-08-12 02:28:32 +02:00
Dongjia Zhang
7870a6e699
Fix #675 (#691)
* fix

* wrapping
2022-07-04 20:11:28 +02:00
Tobias Scharnowski
be3d1d588f
Make ByteNegMutator negate, not flip (#675)
Change the ByteNegMutator to negate a byte, not flip it. Flipping a byte is already implemented in ByteFlipMutator.

See issue: https://github.com/AFLplusplus/LibAFL/issues/674
2022-07-04 16:37:36 +02:00
z2_
fbcfc9fe20
Removed unused trait bounds from BytesSwapMutator (#688) 2022-07-01 07:58:58 +02:00
Dominik Maier
763ed9a3e5
Moved to no_std preamble (#643)
* Moved to no_std preamble

* fixed use

* no_std targets

* derive no_std

* fix yml

* ci

* alf

* gitignore

* fix python build

* import cleanup

* nostd

* linux fix
2022-05-27 01:04:29 +02:00
Andrea Fioraldi
28edbad618
Refactor libafl Python bindings (#632)
* SerdeAny MapFeedbackState

* Fix macro syntax

* alloc

* fix

* Metadata calibrate and map feedback

* metadata feedback states

* compile

* fmt

* Register common generic types

* tests

* sugar

* no_std

* fix book

* alloc

* fix fuzzers

* fix

* fmt

* disable python bindings for libafl

* clippy

* fmt

* fixes

* fmt

* compiling python bindings

* no uaf in python observer

* working python observer, feedback and executor

* mutators

* fmt

* nits

* added autofix script

* clippy

* clippy

* more clippy

* fix

* ignore clippy for deserialization

* newlines

* nits

* fmt

* feedbacks

* generators

* methods

* feedbacks

* pyerr

* fix

* fix

* fmt

* python bindings in CI

* fix

* fix

* fix

* autofix

* clippy

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-05-25 16:56:06 +02:00
Andrea Fioraldi
da537aae83
FeedbackState as metadata (#627)
* SerdeAny MapFeedbackState

* Fix macro syntax

* alloc

* fix

* Metadata calibrate and map feedback

* metadata feedback states

* compile

* fmt

* Register common generic types

* tests

* sugar

* no_std

* fix book

* alloc

* fix fuzzers

* fix

* fmt

* disable python bindings for libafl

* clippy

* fmt

* fixes

* fmt

* fix

* fix

* fix

* fix

* fix

* release autofix

* fix

* fix

* fix

* fmt

* fix

* fix

* name

* fix

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-05-24 16:05:22 +02:00
Dominik Maier
fa839bb08d
More docs and less pub types (#646)
* more docs

* nits

* fixes

* win fix

* fmt
2022-05-23 13:42:51 +02:00
Dominik Maier
c404825fb8
More clippy (#641)
* Even more libafl_frida clippy

* Eq

* addr_of_mut cleanup

* fmt
2022-05-22 13:01:55 +02:00
Dominik Maier
eb70c8025b
Clippy nightly fixes (#624) 2022-05-07 15:35:37 +02:00
Andrea Fioraldi
e513b86df0
Backtrace in libafl::Error (#617)
* backtrace errors

* qemu

* remove mopt-specific error

* fixes

* fixes

* duh

* clap

* clippy

* clippy

* clippy

Co-authored-by: Dominik Maier <dmnk@google.com>
2022-05-05 15:52:37 +02:00
Dongjia Zhang
6b76e53bfa
C(pp) formatting & autotokens fix (#614)
* fix

* a

* format

* .clang-format
2022-05-04 03:42:43 +09:00
Dongjia Zhang
034a4870e2
Set the number of stacked mutations in MOpt mutator (#587)
* max_stack_pow

* fix

* fix

* fmt

* rename
2022-04-03 09:25:59 +09:00
Toka
1167389149
Fix metadata loss across state-restore. (#582)
* bug fix

* fix

* fix

* remove getter
2022-03-30 12:00:49 +09:00
Dongjia Zhang
c72f773ca0
Weighted corpus entry selection (#570)
* rework aflfast

* more

* move fuzz_Mu

* weighted

* fix

* borrow checker fix

* compute_weight

* alias_table

* fmt

* fix & rename

* fix & less mut

* no_std

* no_std

* clippy

* 32bit clippy fix

* top_rated for compute_weight

* fix

* clippy & metadata Init

* fix

* fix

* fix

* clippy & fmt

* change fuzzers

* fuzzbench_selected

* fmt
2022-03-23 02:01:00 +09:00
Dominik Maier
7dad2153e2
Clippy for Cargo (#532)
* Clippy for Cargo

* clippy fixes

* clippy fixes

* edition

* fix

* wrong self hidden

* fix

* more clippy
2022-02-11 14:34:01 +01:00
Dongjia Zhang
9d38fff662
Autodict forkserver (#525)
* Builder for ForkserverExecutor

* add

* clippy warnings

* comment

* stash

* tmp

* change

* revert

* use_shmem_feature field

* change the harness back

* wip

* wip

* revert

* works

* clippy

* Makefile fix

* doc

* clippy

* rename to program

* rename, fix, envs

* lifetime

* arg_input_file

* stash

* read autodict from forkserver

* works

* clippy & fmt

* fmt

* fix

* fix

* fmt

* better harness

* arg_input_file_std

* rename

* fix
2022-02-10 10:27:51 +01:00