update libnyx API

- various changes to the API (both Rust and FFI) to enable more
  control over the fuzzing process
- fixed and updated C-API sample (test.c)

libnyx/src/ffi.rs

@@ -1,3 +1,20 @@
+/* 
+    libnyx FFI API
+
+    Copyright (C) 2021 Sergej Schumilo
+    This file is part of libnyx.
+
+    libnyx is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 2 of the License, or
+    (at your option) any later version.
+    libnyx is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+    You should have received a copy of the GNU General Public License
+    along with libnyx.  If not, see <http://www.gnu.org/licenses/>.
+ */
 use libc::c_char;
 use std::ffi::CStr;
 use std::ffi::c_void;
@@ -5,16 +22,34 @@ use std::ffi::c_void;
 use fuzz_runner::nyx::aux_buffer::{NYX_CRASH, NYX_HPRINTF, NYX_ABORT};
 use super::*;
 
-#[no_mangle]
+/* Helper function to load a C string pointer and return a Rust string. */
-pub extern "C" fn nyx_load_config(sharedir: *const c_char) -> *mut c_void {
+fn __load_c_string_ptr(pointer: *const c_char) -> String {
-    let sharedir_c_str = unsafe {
+    let c_str = unsafe {
-        assert!(!sharedir.is_null());
+        assert!(!pointer.is_null());
-        CStr::from_ptr(sharedir)
+        CStr::from_ptr(pointer)
     };
 
-    let sharedir_r_str = sharedir_c_str.to_str().unwrap();
+    c_str.to_str().unwrap().to_string()
+}
 
-    let cfg: NyxConfig = match NyxConfig::load(sharedir_r_str){
+/* Helper function to check if the config pointer is valid.
+ * Turns the pointer into a reference to a config object.
+ */
+fn __nyx_config_check_ptr(config: * mut c_void) -> *mut NyxConfig {
+    assert!(!config.is_null());
+    assert!((config as usize) % std::mem::align_of::<NyxConfig>() == 0);
+
+    config as *mut NyxConfig
+}
+
+/* Loads a given Nyx share-dir and returns a raw pointer to the Nyx config object.
+ * The pointer is later used to access the config object in other FFI config functions. 
+ */
+#[no_mangle]
+pub extern "C" fn nyx_config_load(sharedir: *const c_char) -> *mut c_void {
+    let sharedir_r_str = __load_c_string_ptr(sharedir);
+
+    let cfg: NyxConfig = match NyxConfig::load(&sharedir_r_str){
         Ok(x) => x,
         Err(msg) => {
             println!("[!] libnyx config reader error: {}", msg);
@@ -25,32 +60,93 @@ pub extern "C" fn nyx_load_config(sharedir: *const c_char) -> *mut c_void {
     Box::into_raw(Box::new(cfg)) as *mut c_void
 }
 
+/* Simple debug function to print the entire config object to stdout. */
 #[no_mangle]
-pub extern "C" fn nyx_print_config(config: * mut c_void) {
+pub extern "C" fn nyx_config_debug(config: * mut c_void) {
-    unsafe{
+    let cfg = __nyx_config_check_ptr(config);
-        assert!(!config.is_null());
-        assert!((config as usize) % std::mem::align_of::<NyxConfig>() == 0);
 
-        let cfg = config as *mut NyxConfig;
+    unsafe{
         println!("{}", *cfg);
     }
 }
 
-fn nyx_process_start(sharedir: *const c_char, workdir: *const c_char, worker_id: u32, cpu_id: u32, create_snapshot: bool, input_buffer_size: Option<u32>, input_buffer_write_protection: bool) -> * mut NyxProcess {
+/* Simple debug function to print a subset of configurable options to stdout. */
-    let sharedir_c_str = unsafe {
+#[no_mangle]
-        assert!(!sharedir.is_null());
+pub extern "C" fn nyx_config_print(config: * mut c_void) {
-        CStr::from_ptr(sharedir)
+    unsafe{
-    };
+        NyxConfig::print(&*__nyx_config_check_ptr(config));
+    }
+}
 
-    let workdir_c_str = unsafe {
+/* FFI function to set the workdir path in the config object. */
-        assert!(!workdir.is_null());
+#[no_mangle]
-        CStr::from_ptr(workdir)
+pub extern "C" fn nyx_config_set_workdir_path(config: * mut c_void, workdir: *const c_char) {
-    };
+    let workidr_r_str = __load_c_string_ptr(workdir);
+    let cfg = __nyx_config_check_ptr(config);
 
-    let sharedir_r_str = sharedir_c_str.to_str().unwrap();
+    unsafe{
-    let workdir_r_str = workdir_c_str.to_str().unwrap();
+        NyxConfig::set_workdir_path(&mut *cfg, workidr_r_str.to_string());
+    }
+}
 
-    match NyxProcess::process_start(sharedir_r_str, workdir_r_str, worker_id, cpu_id, create_snapshot, input_buffer_size, input_buffer_write_protection) {
+/* FFI function to set the input buffer size in the config object. */
+#[no_mangle]
+pub extern "C" fn nyx_config_set_input_buffer_size(config: * mut c_void, input_buffer_size: u32) {
+    let cfg = __nyx_config_check_ptr(config);
+
+    assert_eq!(input_buffer_size > 0, true);
+    unsafe{
+        NyxConfig::set_input_buffer_size(&mut *cfg, input_buffer_size as usize);
+    }
+}
+
+/* FFI function to set the input buffer write protection in the config object. */
+#[no_mangle]
+pub extern "C" fn nyx_config_set_input_buffer_write_protection(config: * mut c_void, input_buffer_write_protection: bool) {
+    let cfg = __nyx_config_check_ptr(config);
+
+    unsafe{
+        NyxConfig::set_input_buffer_write_protection(&mut *cfg, input_buffer_write_protection);
+    }
+}
+
+/* FFI function to set the hprintf file descriptor in the config object. */
+#[no_mangle]
+pub extern "C" fn nyx_config_set_hprintf_fd(config: * mut c_void, hprintf_fd: i32) {
+    let cfg = __nyx_config_check_ptr(config);
+
+    unsafe{
+        NyxConfig::set_hprintf_fd(&mut *cfg, hprintf_fd);
+    }
+}
+
+/* FFI function to set the fuzz runner role in the config object. */
+#[no_mangle]
+pub extern "C" fn nyx_config_set_process_role(config: * mut c_void, role: NyxProcessRole) {
+    let cfg = __nyx_config_check_ptr(config);
+
+    unsafe{
+        NyxConfig::set_process_role(&mut *cfg, role);
+    }
+}
+
+/* Enable snapshot reuse by setting the path to the snapshot folder. */
+#[no_mangle]
+pub extern "C" fn nyx_config_set_reuse_snapshot_path(config: * mut c_void, reuse_snapshot_path: *const c_char) {
+    let reuse_snapshot_path_r_str = __load_c_string_ptr(reuse_snapshot_path);
+    let cfg = __nyx_config_check_ptr(config);
+
+    unsafe{
+        NyxConfig::set_reuse_snapshot_path(&mut *cfg, reuse_snapshot_path_r_str.to_string());
+    }
+}
+
+#[no_mangle]
+pub extern "C" fn nyx_new(config: * mut c_void, worker_id: u32) -> * mut NyxProcess {
+    
+    let cfg = __nyx_config_check_ptr(config);
+
+    match NyxProcess::new(unsafe {&mut *(cfg)}, worker_id as usize) {
         Ok(x) => Box::into_raw(Box::new(x)),
         Err(msg) => {
             println!("[!] libnyx failed to initialize QEMU-Nyx: {}", msg);
@@ -59,106 +155,68 @@ fn nyx_process_start(sharedir: *const c_char, workdir: *const c_char, worker_id:
     }
 }
 
-#[no_mangle]
+/* Helper function to check if the NyxProcess pointer is valid.
-pub extern "C" fn nyx_new(sharedir: *const c_char, workdir: *const c_char, cpu_id: u32, input_buffer_size: u32, input_buffer_write_protection: bool) -> * mut NyxProcess {
+ * Turns the pointer into a reference to the NyxProcess object.
-    nyx_process_start(sharedir, workdir, 0, cpu_id, false, Some(input_buffer_size), input_buffer_write_protection)
+ */
+fn __nyx_process_check_ptr(nyx_process: * mut NyxProcess) -> *mut NyxProcess {
+    assert!(!nyx_process.is_null());
+    assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
+    nyx_process as *mut NyxProcess
 } 
 
-
-#[no_mangle]
-pub extern "C" fn nyx_new_parent(sharedir: *const c_char, workdir: *const c_char, cpu_id: u32, input_buffer_size: u32, input_buffer_write_protection: bool) -> * mut NyxProcess {
-    nyx_process_start(sharedir, workdir, 0, cpu_id, true, Some(input_buffer_size), input_buffer_write_protection)
-}
-
-#[no_mangle]
-pub extern "C" fn nyx_new_child(sharedir: *const c_char, workdir: *const c_char, cpu_id: u32, worker_id: u32) -> * mut NyxProcess {
-    if worker_id == 0 {
-        println!("[!] libnyx failed -> worker_id=0 cannot be used for child processes");
-        std::ptr::null_mut() as *mut NyxProcess
-    }
-    else{
-        nyx_process_start(sharedir, workdir, worker_id, cpu_id, true, None, false)
-    }
-}
- 
-
 #[no_mangle]
 pub extern "C" fn nyx_get_aux_buffer(nyx_process: * mut NyxProcess) -> *mut u8 {
     unsafe{
-        assert!(!nyx_process.is_null());
+        return (*__nyx_process_check_ptr(nyx_process)).aux_buffer_as_mut_ptr();
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
-
-        return (*nyx_process).aux_buffer_as_mut_ptr();
     }
 }
 
 #[no_mangle]
 pub extern "C" fn nyx_get_input_buffer(nyx_process: * mut NyxProcess) -> *mut u8 {
     unsafe{
-        assert!(!nyx_process.is_null());
+        return (*__nyx_process_check_ptr(nyx_process)).input_buffer_mut().as_mut_ptr();
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
-
-        return (*nyx_process).input_buffer_mut().as_mut_ptr();
     }
 }
 
 #[no_mangle]
 pub extern "C" fn nyx_get_bitmap_buffer(nyx_process: * mut NyxProcess) -> *mut u8 {
     unsafe{
-        assert!(!nyx_process.is_null());
+        return (*__nyx_process_check_ptr(nyx_process)).bitmap_buffer_mut().as_mut_ptr();
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
-
-        return (*nyx_process).bitmap_buffer_mut().as_mut_ptr();
     }
 }
 
 #[no_mangle]
 pub extern "C" fn nyx_get_bitmap_buffer_size(nyx_process: * mut NyxProcess) -> usize {
     unsafe{
-        assert!(!nyx_process.is_null());
+        return (*__nyx_process_check_ptr(nyx_process)).bitmap_buffer_size();
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
-        //return (*nyx_process).process.bitmap.len();
-        return (*nyx_process).bitmap_buffer_size();
     }
 }
 
 #[no_mangle]
 pub extern "C" fn nyx_shutdown(nyx_process: * mut NyxProcess) {
     unsafe{
-        assert!(!nyx_process.is_null());
+        (*__nyx_process_check_ptr(nyx_process)).shutdown();
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
-
-        (*nyx_process).shutdown();
     }
 }
 
 #[no_mangle]
 pub extern "C" fn nyx_option_set_reload_mode(nyx_process: * mut NyxProcess, enable: bool) {
     unsafe{
-        assert!(!nyx_process.is_null());
+        (*__nyx_process_check_ptr(nyx_process)).option_set_reload_mode(enable);
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
-
-        (*nyx_process).option_set_reload_mode(enable);
     }
 }
 
 #[no_mangle]
 pub extern "C" fn nyx_option_set_timeout(nyx_process: * mut NyxProcess, timeout_sec: u8, timeout_usec: u32) {
     unsafe{
-        assert!(!nyx_process.is_null());
+        (*__nyx_process_check_ptr(nyx_process)).option_set_timeout(timeout_sec, timeout_usec);
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
-
-        (*nyx_process).option_set_timeout(timeout_sec, timeout_usec);
     }
 }
 
 #[no_mangle]
 pub extern "C" fn nyx_option_apply(nyx_process: * mut NyxProcess) {
     unsafe{
-        assert!(!nyx_process.is_null());
+        (*__nyx_process_check_ptr(nyx_process)).option_apply();
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
-
-        (*nyx_process).option_apply();
     }
 }
 
@@ -166,10 +224,7 @@ pub extern "C" fn nyx_option_apply(nyx_process: * mut NyxProcess) {
 pub extern "C" fn nyx_exec(nyx_process: * mut NyxProcess) -> NyxReturnValue {
     
     unsafe{
-        assert!(!nyx_process.is_null());
+        (*__nyx_process_check_ptr(nyx_process)).exec()
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
-
-        (*nyx_process).exec()
     }
 }
 
@@ -177,11 +232,8 @@ pub extern "C" fn nyx_exec(nyx_process: * mut NyxProcess) -> NyxReturnValue {
 pub extern "C" fn nyx_set_afl_input(nyx_process: * mut NyxProcess, buffer: *mut u8, size: u32) {
 
     unsafe{
-        assert!(!nyx_process.is_null());
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
         assert!((buffer as usize) % std::mem::align_of::<u8>() == 0);
-
+        (*__nyx_process_check_ptr(nyx_process)).set_input_ptr(buffer, size);
-        (*nyx_process).set_input_ptr(buffer, size);
    }
 }
 
@@ -189,14 +241,14 @@ pub extern "C" fn nyx_set_afl_input(nyx_process: * mut NyxProcess, buffer: *mut
 #[no_mangle]
 pub extern "C" fn nyx_print_aux_buffer(nyx_process: * mut NyxProcess) {
     unsafe{
-        assert!(!nyx_process.is_null());
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
 
-        print!("{}", format!("{:#?}", (*nyx_process).process.aux.result));
+        let nyx_process = __nyx_process_check_ptr(nyx_process);
 
-        match (*nyx_process).process.aux.result.exec_result_code {
+        print!("{}", format!("{:#?}", (*nyx_process).process.aux_buffer().result));
+
+        match (*nyx_process).process.aux_buffer().result.exec_result_code {
             NYX_CRASH | NYX_ABORT | NYX_HPRINTF => {
-                println!("{}", std::str::from_utf8(&(*nyx_process).process.aux.misc.data).unwrap());
+                println!("{}", std::str::from_utf8(&(*nyx_process).process.aux_buffer().misc.data).unwrap());
             },
             _ => {},
         }
@@ -207,12 +259,19 @@ pub extern "C" fn nyx_print_aux_buffer(nyx_process: * mut NyxProcess) {
 pub extern "C" fn nyx_get_aux_string(nyx_process: * mut NyxProcess, buffer: *mut u8, size: u32) -> u32 {
 
     unsafe{
-        assert!(!nyx_process.is_null());
+        let nyx_process = __nyx_process_check_ptr(nyx_process);
-        assert!((nyx_process as usize) % std::mem::align_of::<NyxProcess>() == 0);
         assert!((buffer as usize) % std::mem::align_of::<u8>() == 0);
 
-        let len = std::cmp::min( (*nyx_process).process.aux.misc.len as usize, size as usize);
+        let len = std::cmp::min( (*nyx_process).process.aux_buffer().misc.len as usize, size as usize);
-        std::ptr::copy((*nyx_process).process.aux.misc.data.as_mut_ptr(), buffer, len);
+        std::ptr::copy((*nyx_process).process.aux_buffer_mut().misc.data.as_mut_ptr(), buffer, len);
         len as u32
     }
 }
+
+
+#[no_mangle]
+pub extern "C" fn nyx_set_hprintf_fd(nyx_process: * mut NyxProcess, fd: i32) {
+    unsafe{
+        (*__nyx_process_check_ptr(nyx_process)).process.set_hprintf_fd(fd);
+    }
+}

libnyx/src/lib.rs

@@ -1,11 +1,27 @@
+/* 
+    libnyx Rust API
+
+    Copyright (C) 2021 Sergej Schumilo
+    This file is part of libnyx.
+
+    libnyx is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 2 of the License, or
+    (at your option) any later version.
+    libnyx is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+    You should have received a copy of the GNU General Public License
+    along with libnyx.  If not, see <http://www.gnu.org/licenses/>.
+ */
 extern crate libc;
 
-use config::{Config, FuzzRunnerConfig};
+use config::{Config, FuzzRunnerConfig, QemuNyxRole};
 
-use fuzz_runner::nyx::qemu_process_new_from_kernel;
-use fuzz_runner::nyx::qemu_process_new_from_snapshot;
 use fuzz_runner::nyx::qemu_process::QemuProcess;
 use fuzz_runner::nyx::aux_buffer::{NYX_SUCCESS, NYX_CRASH, NYX_TIMEOUT, NYX_INPUT_WRITE, NYX_ABORT};
+use libc::fcntl;
 
 use std::fmt;
 
@@ -24,6 +40,14 @@ pub enum NyxReturnValue {
     Abort,      // Abort hypercall called
 }
 
+#[repr(C)]
+#[derive(Debug)]
+pub enum NyxProcessRole {
+    StandAlone,
+    Parent,
+    Child,
+}
+
 impl fmt::Display for NyxReturnValue {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
 
@@ -48,18 +72,42 @@ pub struct NyxProcess {
 #[derive(Clone, Debug)]
 pub struct NyxConfig {
     config: Config,
+    sharedir_path: String,
 }
 
 impl NyxConfig {
+
+    /* Loads a given Nyx share-dir and returns a result object containing the config object.
+     * The config object is later used to access the config object via specific config functions.
+     */
     pub fn load(sharedir: &str) -> Result<NyxConfig, String> {
+        /* TODO: perform some additional sanity checks on the sharedir (such as checking if the bootstrap scripts exist) */
         match Config::new_from_sharedir(&sharedir){
             Ok(x) => Ok(NyxConfig{
-                config: x
+                config: x,
+                sharedir_path: sharedir.to_string()
             }),
             Err(x) => Err(x),
         }
     }
 
+    /* Simple debug function to print the entire config object to stdout. */
+    pub fn print(&self){
+        println!("[*] Nyx config (share-dir: {}):", self.sharedir_path());
+        println!("  - workdir_path                  -> {}", self.workdir_path());
+        println!("  - input_buffer_size             -> {}", self.input_buffer_size());
+        println!("  - input_buffer_write_protection -> {}", self.input_buffer_write_protection());
+        println!("  - hprintf_fd                    -> {}", self.hprintf_fd());
+        println!("  - process_role:                 -> {:?}", self.process_role());         
+
+    }
+
+    /* Returns the path to the actual sharedir. */
+    pub fn sharedir_path(&self) -> String {
+        self.sharedir_path.clone()
+    }
+
+    /* Returns the path to the configured qemu binary. */
     pub fn qemu_binary_path(&self) -> Option<String>{
         let process_cfg= match self.config.runner.clone() {
             FuzzRunnerConfig::QemuKernel(cfg) => cfg,
@@ -68,6 +116,7 @@ impl NyxConfig {
         return Some(process_cfg.qemu_binary);
     }
 
+    /* Returns the path to the configured kernel image (if Nyx is configured to run in kernel mode). */
     pub fn kernel_image_path(&self) -> Option<String>{
         let process_cfg= match self.config.runner.clone() {
             FuzzRunnerConfig::QemuKernel(cfg) => cfg,
@@ -76,6 +125,7 @@ impl NyxConfig {
         return Some(process_cfg.kernel);
     }
 
+    /* Returns the path to the configured initrd image (if Nyx is configured to run in kernel mode). */
     pub fn ramfs_image_path(&self) -> Option<String>{
         let process_cfg= match self.config.runner.clone() {
             FuzzRunnerConfig::QemuKernel(cfg) => cfg,
@@ -84,26 +134,100 @@ impl NyxConfig {
         return Some(process_cfg.ramfs);
     }
 
+    /* Returns the configured timeout threshold as a std::time::Duration object. */
     pub fn timeout(&self) -> std::time::Duration {
         self.config.fuzz.time_limit
     }
 
+    /* Returns the configured spec path (deprecated). */
     pub fn spec_path(&self) -> String{
         self.config.fuzz.spec_path.clone()
     }
 
+    /* Returns the configured trace bitmap size (might be reconfigured later by the agent). */
     pub fn bitmap_size(&self) -> usize{
         self.config.fuzz.bitmap_size
     }
 
+    /* Returns the configured workdir path. */
     pub fn workdir_path(&self) -> &str {
         &self.config.fuzz.workdir_path
     }
 
+    /* Returns the actual size of the input buffer. */
+    pub fn input_buffer_size(&self) -> usize {
+        self.config.fuzz.input_buffer_size
+    }
+
+    /* Returns the config value of the input buffer write protection of the agent (guest). */
+    pub fn input_buffer_write_protection(&self) -> bool {
+        self.config.fuzz.write_protected_input_buffer
+    }
+
+    /* Sets the path to the workdir. */
     pub fn set_workdir_path(&mut self, path: String) {
         self.config.fuzz.workdir_path = path;
     }
 
+    /* Set the size of the input buffer (must be a multiple of x86_64_PAGE_SIZE -> 4096). */
+    pub fn set_input_buffer_size(&mut self, size: usize) {
+        if size % 0x1000 != 0 {
+            /* TODO: return error */
+            panic!("[ ] Input buffer size must be a multiple of x86_64_PAGE_SIZE (4096)!");
+        }
+        self.config.fuzz.input_buffer_size = size;
+    }
+
+    /* Set the input buffer write protection of the agent (guest). */
+    pub fn set_input_buffer_write_protection(&mut self, write_protected: bool) {
+        self.config.fuzz.write_protected_input_buffer = write_protected;
+    }
+
+    /* Returns the current configured FD to redirect hprintf() calls to (returns -1 if None is set). */
+    pub fn hprintf_fd(&self) -> i32 {
+        /* TODO: fix me */
+        match self.config.runtime.hprintf_fd() {
+            Some(fd) => fd,
+            None => -1,
+        }
+    }
+
+    /* Sets the FD to redirect hprintf() calls to (must be a valid FD and must not be closed after this call). */
+    pub fn set_hprintf_fd(&mut self, fd: i32) {
+        self.config.runtime.set_hpintf_fd(fd);
+    }
+
+    /* Sets the process role of the fuzz runner */
+    pub fn set_process_role(&mut self, role: NyxProcessRole) {
+        let _role = match role {
+            NyxProcessRole::Parent => QemuNyxRole::Parent,
+            NyxProcessRole::Child => QemuNyxRole::Child,
+            NyxProcessRole::StandAlone => QemuNyxRole::StandAlone,
+        };
+
+        self.config.runtime.set_process_role(_role);
+    }
+    
+    /* Configures the path to the snapshot file to be reused (optional). */
+    pub fn set_reuse_snapshot_path(&mut self, path: String) {
+        self.config.runtime.set_reuse_snapshot_path(path);
+    }
+
+    /* Returns the currently configured process role of the fuzz runner. */
+    pub fn process_role(&self) -> &QemuNyxRole {
+        self.config.runtime.process_role()
+    }
+
+    /* Returns the current QEMU-Nyx worker ID. */
+    pub fn worker_id(&self) -> usize {
+        self.config.runtime.worker_id()
+    }
+
+    /* Sets the QEMU-Nyx worker ID. */
+    pub fn set_worker_id(&mut self, worker_id: usize) {
+        self.config.runtime.set_worker_id(worker_id);
+    }
+
     pub fn dict(&self) -> Vec<Vec<u8>> {
         self.config.fuzz.dict.clone()
     }
@@ -117,56 +241,12 @@ impl fmt::Display for NyxConfig {
 
 impl NyxProcess {
 
-    fn start_process(sharedir: &str, workdir: &str, fuzzer_config: Config,  worker_id: u32) -> Result<QemuProcess, String> {
+    pub fn new(config: &mut NyxConfig, worker_id: usize) -> Result<NyxProcess, String> {
 
-        let mut config = fuzzer_config.fuzz;
+        let sharedir = config.sharedir_path();
-        let runner_cfg = fuzzer_config.runner;
+        config.set_worker_id(worker_id);
 
-        config.workdir_path = format!("{}", workdir);
+        match fuzz_runner::nyx::qemu_process_new(sharedir.to_string(), &config.config){
-    
-        let sdir = sharedir.clone();
-    
-        if worker_id == 0 {
-            QemuProcess::prepare_workdir(&config.workdir_path, config.seed_path.clone());
-        }
-        else{
-            QemuProcess::wait_for_workdir(&config.workdir_path);
-        }
-    
-        match runner_cfg.clone() {
-            FuzzRunnerConfig::QemuSnapshot(cfg) => {
-                qemu_process_new_from_snapshot(sdir.to_string(), &cfg, &config)            
-            },
-            FuzzRunnerConfig::QemuKernel(cfg) => {
-                qemu_process_new_from_kernel(sdir.to_string(), &cfg, &config)
-            }
-        }
-    }
-
-    fn process_start(sharedir: &str, workdir: &str, worker_id: u32, cpu_id: u32, create_snapshot: bool, input_buffer_size: Option<u32>, input_buffer_write_protection: bool) -> Result<NyxProcess, String> {
-        let mut cfg: Config = match Config::new_from_sharedir(&sharedir){
-            Ok(x) => x,
-            Err(msg) => {
-                return Err(format!("[!] libnyx config reader error: {}", msg));
-            }
-        };
-    
-        cfg.fuzz.write_protected_input_buffer = input_buffer_write_protection;
-    
-        /* todo: add sanity check */
-        cfg.fuzz.cpu_pin_start_at = cpu_id as usize;
-    
-        match input_buffer_size{
-            Some(x) => { cfg.fuzz.input_buffer_size = x as usize; },
-            None => {},
-        }
-    
-        cfg.fuzz.thread_id = worker_id as usize;
-        cfg.fuzz.threads = if create_snapshot { 2 as usize } else { 1 as usize };
-            
-        cfg.fuzz.workdir_path = format!("{}", workdir);
-
-        match Self::start_process(sharedir, workdir, cfg,  worker_id){
             Ok(x) => Ok(NyxProcess{
                 process: x,
             }),
@@ -174,41 +254,9 @@ impl NyxProcess {
         }
     }
 
-    pub fn from_config(sharedir: &str, config: &NyxConfig, worker_id: u32, create_snapshot: bool) -> Result<NyxProcess, String>{
-        let workdir = config.config.fuzz.workdir_path.clone();
-
-        let mut config= config.clone();
-        config.config.fuzz.threads = if create_snapshot { 2 as usize } else { 1 as usize };
-        config.config.fuzz.thread_id = worker_id as usize;
-
-        match Self::start_process(sharedir, &workdir, config.config.clone(), worker_id) {
-            Ok(x) => Ok(NyxProcess{
-                process: x,
-            }),
-            Err(x) => Err(x),
-        }
-    }
-
-    pub fn new(sharedir: &str, workdir: &str, cpu_id: u32, input_buffer_size: u32, input_buffer_write_protection: bool) -> Result<NyxProcess, String> {
-        Self::process_start(sharedir, workdir, 0, cpu_id, false, Some(input_buffer_size), input_buffer_write_protection)
-    }
-    
-    pub fn new_parent(sharedir: &str, workdir: &str, cpu_id: u32, input_buffer_size: u32, input_buffer_write_protection: bool) -> Result<NyxProcess, String> {
-        Self::process_start(sharedir, workdir, 0, cpu_id, true, Some(input_buffer_size), input_buffer_write_protection)
-    }
-    
-    pub fn new_child(sharedir: &str, workdir: &str, cpu_id: u32, worker_id: u32) -> Result<NyxProcess, String> {
-        if worker_id == 0 {
-            println!("[!] libnyx failed -> worker_id=0 cannot be used for child processes");
-            Err("worker_id=0 cannot be used for child processes".to_string())
-        }
-        else{
-            Self::process_start(sharedir, workdir, worker_id, cpu_id, true, None, false)
-        }
-    }
 
     pub fn aux_buffer_as_mut_ptr(&self) -> *mut u8 {
-        std::ptr::addr_of!(self.process.aux.header.magic) as *mut u8
+        std::ptr::addr_of!(self.process.aux_buffer().header.magic) as *mut u8
     }
     
     pub fn input_buffer(&self) -> &[u8] {
@@ -244,48 +292,48 @@ impl NyxProcess {
     }
     
     pub fn option_set_reload_mode(&mut self, enable: bool) {
-        self.process.aux.config.reload_mode = if enable {1} else {0};
+        self.process.aux_buffer_mut().config.reload_mode = if enable {1} else {0};
     }
 
     pub fn option_set_redqueen_mode(&mut self, enable: bool) {
-        self.process.aux.config.redqueen_mode = if enable {1} else {0};
+        self.process.aux_buffer_mut().config.redqueen_mode = if enable {1} else {0};
     }
 
     pub fn option_set_trace_mode(&mut self, enable: bool) {
-        self.process.aux.config.trace_mode = if enable {1} else {0};
+        self.process.aux_buffer_mut().config.trace_mode = if enable {1} else {0};
     }
 
     pub fn option_set_delete_incremental_snapshot(&mut self, enable: bool) {
-        self.process.aux.config.discard_tmp_snapshot = if enable {1} else {0};
+        self.process.aux_buffer_mut().config.discard_tmp_snapshot = if enable {1} else {0};
     }
 
     pub fn option_set_timeout(&mut self, timeout_sec: u8, timeout_usec: u32) {
-        self.process.aux.config.timeout_sec = timeout_sec;
+        self.process.aux_buffer_mut().config.timeout_sec = timeout_sec;
-        self.process.aux.config.timeout_usec = timeout_usec;
+        self.process.aux_buffer_mut().config.timeout_usec = timeout_usec;
     }
     
     pub fn option_apply(&mut self) {
-        self.process.aux.config.changed = 1;
+        self.process.aux_buffer_mut().config.changed = 1;
     }
 
     pub fn aux_misc(&self) -> Vec<u8>{
-        self.process.aux.misc.as_slice().to_vec()
+        self.process.aux_buffer().misc.as_slice().to_vec()
     }
 
     pub fn aux_tmp_snapshot_created(&self) -> bool {
-        self.process.aux.result.tmp_snapshot_created != 0
+        self.process.aux_buffer().result.tmp_snapshot_created != 0
     }
 
     pub fn aux_string(&self) -> String {
-        let len = self.process.aux.misc.len;
+        let len = self.process.aux_buffer().misc.len;
-        String::from_utf8_lossy(&self.process.aux.misc.data[0..len as usize]).to_string()
+        String::from_utf8_lossy(&self.process.aux_buffer().misc.data[0..len as usize]).to_string()
     }
      
     pub fn exec(&mut self) -> NyxReturnValue {
         match self.process.send_payload(){
             Err(_) =>  NyxReturnValue::IoError,
             Ok(_) => {
-                match self.process.aux.result.exec_result_code {
+                match self.process.aux_buffer().result.exec_result_code {
                     NYX_SUCCESS     => NyxReturnValue::Normal,
                     NYX_CRASH       => NyxReturnValue::Crash,
                     NYX_TIMEOUT     => NyxReturnValue::Timeout,
@@ -307,4 +355,15 @@ impl NyxProcess {
     pub fn set_input(&mut self, buffer: &[u8], size: u32) {
         self.set_input_ptr(buffer.as_ptr(), size);
     }
+
+    pub fn set_hprintf_fd(&mut self, fd: i32) {
+
+        /* sanitiy check to prevent invalid file descriptors via F_GETFD */
+        unsafe { 
+            assert!(fcntl(fd, libc::F_GETFD) != -1); 
+        };
+
+        self.process.set_hprintf_fd(fd);
+    }
+
 }

libnyx/test.c

@@ -1,3 +1,4 @@
+/* Simple test program to test the C-API */
 
 #include <stdio.h>
 #include "libnyx.h"
@@ -5,96 +6,111 @@
 #include <stdio.h>
 #include <ctype.h>
 
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+ 
 #ifndef HEXDUMP_COLS
 #define HEXDUMP_COLS 16
 #endif
  
 void hexdump(void *mem, unsigned int len)
 {
-        unsigned int i, j;
+    unsigned int i, j;
     
-        for(i = 0; i < len + ((len % HEXDUMP_COLS) ? (HEXDUMP_COLS - len % HEXDUMP_COLS) : 0); i++)
+    for(i = 0; i < len + ((len % HEXDUMP_COLS) ? (HEXDUMP_COLS - len % HEXDUMP_COLS) : 0); i++)
+    {
+        /* print offset */
+        if(i % HEXDUMP_COLS == 0)
         {
-                /* print offset */
+            printf("0x%06x: ", i);
-                if(i % HEXDUMP_COLS == 0)
-                {
-                        printf("0x%06x: ", i);
-                }
- 
-                /* print hex data */
-                if(i < len)
-                {
-                        printf("%02x ", 0xFF & ((char*)mem)[i]);
-                }
-                else /* end of block, just aligning for ASCII dump */
-                {
-                        printf("   ");
-                }
-                
-                /* print ASCII dump */
-                if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1))
-                {
-                        for(j = i - (HEXDUMP_COLS - 1); j <= i; j++)
-                        {
-                                if(j >= len) /* end of block, not really printing */
-                                {
-                                        putchar(' ');
-                                }
-                                else if(isprint(((char*)mem)[j])) /* printable char */
-                                {
-                                        putchar(0xFF & ((char*)mem)[j]);        
-                                }
-                                else /* other char */
-                                {
-                                        putchar('.');
-                                }
-                        }
-                        putchar('\n');
-                }
         }
+
+        /* print hex data */
+        if(i < len)
+        {
+            printf("%02x ", 0xFF & ((char*)mem)[i]);
+        }
+        else /* end of block, just aligning for ASCII dump */
+        {
+            printf("   ");
+        }
+        
+        /* print ASCII dump */
+        if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1))
+        {
+            for(j = i - (HEXDUMP_COLS - 1); j <= i; j++)
+            {
+                if(j >= len) /* end of block, not really printing */
+                {
+                    putchar(' ');
+                }
+                else if(isprint(((char*)mem)[j])) /* printable char */
+                {
+                    putchar(0xFF & ((char*)mem)[j]);        
+                }
+                else /* other char */
+                {
+                    putchar('.');
+                }
+            }
+            putchar('\n');
+        }
+    }
 }
  
 
 int main(int argc, char** argv){
-  printf("YO\n");
+
+    void* aux_buffer; 
 
 
-  void* aux_buffer; 
+    void* nyx_config = nyx_config_load("/tmp/nyx_libxml2/");
 
-  void* ptr = nyx_new("/tmp/nyx_bash/");
+    //nyx_config_debug(nyx_config);
 
-  printf("QEMU Rust Object Pointer: %p\n", ptr);
+    nyx_config_set_workdir_path(nyx_config, "/tmp/wdir");
+    nyx_config_set_input_buffer_size(nyx_config, 0x2000);
 
-  void* aux = nyx_get_aux_buffer(ptr);
+    int fd = open("/tmp/nyx_test_output.log", O_WRONLY | O_CREAT | O_TRUNC, 0644);
+    printf("Log output FD: %d\n", fd);
+    nyx_config_set_hprintf_fd(nyx_config, fd);
 
-  printf("QEMU Rust Aux Pointer: %p\n", aux);
+    nyx_config_set_process_role(nyx_config, StandAlone);
     
-  hexdump(aux, 16);
+    //nyx_config_set_reuse_snapshot_path(nyx_config, "/tmp/wdir/snapshot/");
 
-  void* payload = nyx_get_payload_buffer(ptr);
+    nyx_config_print(nyx_config);
+    nyx_config_debug(nyx_config);
 
-  nyx_set_afl_input(ptr, "HALLO", 5);
+    void* nyx_runner = nyx_new(nyx_config, 0);
 
+    printf("Nyx runner object pointer: %p\n", nyx_runner);
 
-  printf("QEMU Rust Payload Pointer: %p\n", payload);
+    void* aux = nyx_get_aux_buffer(nyx_runner);
 
-  nyx_option_set_reload_mode(ptr, true);
+    printf("QEMU rust aux pointer: %p\n", aux);
-  nyx_option_apply(ptr);
+    hexdump(aux, 16);
 
-  hexdump(payload, 16);
+    void* nyx_input = nyx_get_input_buffer(nyx_runner);
 
-  printf("About to run init\n");
+    nyx_set_afl_input(nyx_runner, "INPUT", 5);
-  printf("INIT -> %d\n", nyx_exec(ptr));
+    printf("QEMU Rust Payload Pointer: %p\n", nyx_input);
-  printf("Init done\n");
 
+    nyx_option_set_reload_mode(nyx_runner, true);
+    nyx_option_apply(nyx_runner);
 
-  for(int i = 0; i < 32; i++){
+    hexdump(nyx_input, 16);
-        nyx_set_afl_input(ptr, "HALLO", 5);
-        printf("nyx_exec -> %d\n", nyx_exec(ptr));
-        //nyx_print_aux_buffer(ptr);
-  }
 
-  nyx_shutdown(ptr);
+    printf("About to run init\n");
+    printf("INIT -> %d\n", nyx_exec(nyx_runner));
+    printf("Init done\n");
 
+    for(int i = 0; i < 4; i++){
+        nyx_set_afl_input(nyx_runner, "INPUT", 5);
+        printf("nyx_exec -> %d\n", nyx_exec(nyx_runner));
+        nyx_print_aux_buffer(nyx_runner);
+    }
 
+    nyx_shutdown(nyx_runner);
 }