* qemu: Return errors from Emulator::new instead of asserting
Libraries should not `assert!` except in cases of unrecoverable (library)
programmer error. These errors are all potentially recoverable, and aren't
internal errors in `libafl_qemu` itself.
* Respond to review comments
* emu::current_cpu() is now kept after vm stop and it is the CPU that hitted the breakpoint
* clippy
* uninit
* clippy
* clippy
* clippy
* clippy
* nightly override in CI
* nightly override in CI
* components
* components
* targets
* targets
* clippy
* clippy
* clippy
* clippy
* clippy (again)
* MaybeUninit
Co-authored-by: Dominik Maier <dmnk@google.com>
* libafl_qemu: fix systemmode with slirp dependency
libslirp will be dropped from future QEMU releases (see https://wiki.qemu.org/ChangeLog/7.0).
This change adds the "slirp" feature,
which links with the host-systems libslirp.
* libafl_qemu: enable systemmode snapshots, vm_start
Re-enable snapshot functions.
Start the VM before qemu_main_loop.
* libafl_qemu: allow synchronous snapshotting
Add a flag to take snapshots synchronosly.
This should be used to take or load snapshots while the emulator is not
running.
* libafl_qemu: fallback cpu for read-/write_mem
In systemmode, current_cpu may not be set.
In such cases use the first cpus memory access methods.
* fuzzers: add example for libafl_qemu in systemmode
* libafl_qemu: update libafl-qemu-bridge revision
* libafl_qemu: add memory access by physcial address
* fix liabfl_qemu example
Use GuestAddr and physical memory access
* ci: install libslirp-dev for libafl_qemu
* fuzzers/qemu_systemmode: clean up example
* libafl_qemu: remove obsolete functions
emu::libafl_cpu_thread_fn
emu::libafl_start_vcpu
emu::start
* fuzzers/qemu_systemmode: simplify example
* improve build_linux.rs
* Update qemu_systemmode fuzzer
* upd
* clippy
* Save and restore CPU state in libafl_qemu
* clippy
* Clone
* upd
* upd
Co-authored-by: Alwin Berger <alwin.berger@tu-dortmund.de>
* libafl_qemu: fix systemmode with slirp dependency
libslirp will be dropped from future QEMU releases (see https://wiki.qemu.org/ChangeLog/7.0).
This change adds the "slirp" feature,
which links with the host-systems libslirp.
* libafl_qemu: enable systemmode snapshots, vm_start
Re-enable snapshot functions.
Start the VM before qemu_main_loop.
* libafl_qemu: allow synchronous snapshotting
Add a flag to take snapshots synchronosly.
This should be used to take or load snapshots while the emulator is not
running.
* libafl_qemu: fallback cpu for read-/write_mem
In systemmode, current_cpu may not be set.
In such cases use the first cpus memory access methods.
* fuzzers: add example for libafl_qemu in systemmode
* libafl_qemu: update libafl-qemu-bridge revision
* libafl_qemu: add memory access by physcial address
* fix liabfl_qemu example
Use GuestAddr and physical memory access
* ci: install libslirp-dev for libafl_qemu
* fuzzers/qemu_systemmode: clean up example
* libafl_qemu: remove obsolete functions
emu::libafl_cpu_thread_fn
emu::libafl_start_vcpu
emu::start
* fuzzers/qemu_systemmode: simplify example
* improve build_linux.rs
* Update qemu_systemmode fuzzer
* upd
* clippy
Co-authored-by: Alwin Berger <alwin.berger@tu-dortmund.de>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
* Associated types for Corpus, State
* cleanup
* fix no_std
* drop unused clauses
* Corpus
* cleanup
* adding things
* fixed fuzzer
* remove phantom data
* python
* progress?
* more more
* oof
* wow it builds?
* python fixes, tests
* fix python fun
* black fmt for python
* clippy, added Nop things
* fixes
* fix merge
* make it compile (#836)
* doc-test fixes, prelude-b-gone for cargo-hack compat
* fixes for windows, concolic
* really fix windows, maybe
* imagine using windows
* ...
* elide I generic when used with S: State
* Elide many, many generics, but at what cost?
* progress on push
* Constraint HasCorpus, HasSolutions at trait definition
* remove unused feature
* remove unstable usage since we constrained HasCorpus at definition
* compiled, but still no type inference for MaxMapFeedback
* cleanup inprocess
* resolve some std conflicts
* simplify map
* undo unnecessary cfg specification
* fix breaking test case for CI on no-std
* fix concolic build failures
* fix macos build
* fixes for windows build
* timeout fixes for windows build
* fix pybindings issues
* fixup qemu
* fix outstanding local build issues
* maybe fix windows inprocess
* doc fixes
* unbridled fury
* de-associate State from Feedback, replace with generic as AT inference is not sufficient to derive specialisation for MapFeedback
* merge update
* refactor + speed up fuzzer builds by sharing build work
* cleanup lingering compiler errors
* lol missed one
* revert QEMU-Nyx change, not sure how I did that
* move HasInput to inputs
* HasInput => KnowsInput
* update bounds to enforce via associated types
* disentangle observers with fuzzer
* revert --target; update some fuzzers to match new API
* resolve outstanding fuzzer build blockers (that I can run on my system)
* fixes for non-linux unixes
* fix for windows
* Knows => Uses, final fixes for windows
* <guttural screaming>
* fixes for concolic
* loosen bound for frida executor so windows builds correctly
* cleanup generics for eventmanager/eventprocessor to drop observers requirement
* improve inference over fuzz_one and friends
* update migration notes
* fixes for python bindings
* fixes for generic counts in event managers
* finish migration notes
* post-merge fix
Co-authored-by: Addison Crump <addison.crump@cispa.de>
* autofix
* you're just asking for a clamping
* autofmt on linux
* fix nits
* change back nit
* unfixing as u64 for GuestAddr
* fix
* ignoring clippy for GuestAddress
Guest addresses now represented by correct sized integers.
Previously u64 was used to represent guest addresses. This is great for
64-bit targets, but clunky for other architectures. This introduces a
GuestAddr type alias that is defined based on the selected emulation
architecture.
Note: This changes only the user-facing Rust interface. Before
traversing the FFI boundary, all GuestAddrs are sized back to u64.
Another Note: Guest addresses _from_ the FFI boundary are completely
trusted. Values that are too large are truncated to fit into a GuestAddr
using the `as GuestAddr` cast. This may not be ideal, as errors could be
masked. If desired and the performance is ok, a non-breaking update
could change all `as` casts to `.try_into().unwrap()` so that critical
failures in FFI are always checked.
Methods read_mem and write_mem now operate on &[u8], not &[T]
The generic T slice interface was prone to various footguns:
* i32 is the default Rust integer type, but buffers are often expected
to hold u8. This means the following code writes 16 bytes to the
guest, not 4:
let buf = [0; 4];
emu.write_mem(addr, &buf);
* If a buffer of 16-bit or larger integers (&[u64] for example) is
needed to read/write, the user will need to consider host/guest
endianness. The byte array methods in std are a good, explicit
alternative.
Perhaps libafl_qemu could expose/define "to/from guest endianness"
helper functions or extension traits using the established cfg flags,
so that guest endianness is always right by default.
* emu::read_mem causes insta-UB if a user did something like:
let mut my_bool = false;
emu.read_mem(addr, &mut my_bool);
It's less surprising for users to just operate on plain-ol' bytes,
which they can explicitly transmute if they wish.
* documentation, warnings
* fixed docs
* docs
* no_std
* test
* windows
* nautilus docs
* more fixes
* more docs
* nits
* windows clippy
* docs, windows
* nits
* debug all the things
* derive debug for all core library components
* Docu for libafl_targets
* nits
* reordered generics
* add docs to frida, debug
* nits
* fixes
* more docu for frida, nits
* more docu
* more docu
* Sugar docs
* debug for qemu
* more debug
* import debug
* fmt
* debug
* anyap_debug feature no longer needed
* tidy up unused fn
* indicate if we left out values for struct debug
* implement Debug for sugar
* debug allthethings
* ci
* store executor_ptr
* QemuHelpers
* working hooks and snapshot helper
* walk only the list of dirty pages on restore()
* mem hooks for snpashot
* brk snapshot
* snapshot method
* macos shit
* sugar and clippy
* clippy
* clippy on windows
* clippy fixes on windows
* clippy, fmt
* fixed testcases for windows
* fixing workspace.yml
* testcase no longer fails without clang
* fix github dependencies to specific revisions
* fix qemu without python
* cleanup HookResult
