Skip to content

Commit 2748326

Browse files
riesentoasterdomenukkCowBoy4mH3LLjejuisland87654Marcondiro
committed
Make Launcher use ClientDescription instead of CoreId (AFLplusplus#2676)
* launcher now uses client_id instead of core_id * adding overcommit to an example fuzzer * Replace addr_of with &raw across the codebase (AFLplusplus#2669) * Replace addr_of with &raw across the codebase * fix fixes * more fix * undo clang fmt? * oops * fix? * allocator fix * more fix * more more * more docs * more fix * mas mas mas * hm * more * fix Frida * needed * more error * qemu * Introduce workspace (again) (AFLplusplus#2673) * Trying to redo workspace deps again after AFLplusplus#2672 * unused * clippy * Replace addr_of with &raw across the codebase (AFLplusplus#2669) * Replace addr_of with &raw across the codebase * fix fixes * more fix * undo clang fmt? * oops * fix? * allocator fix * more fix * more more * more docs * more fix * mas mas mas * hm * more * fix Frida * needed * more error * qemu * Introduce workspace (again) (AFLplusplus#2673) * Trying to redo workspace deps again after AFLplusplus#2672 * unused * clippy * fixing formatting issues * cloning values to make borrow checker happy * simplifying cfg constraints, removing excessive clippy allows * printing clang version that is used to find inconsistencies between CI and local formatting * some fixes according to the CI * Specifying types * improved logging for formatter * more attempts at logging for the CI formatting * fixing setting LLVM version in formatting in CI * fixing cippy allows * renaming launcher's ClientID to ClientDescription * Lower capped RAND generators (AFLplusplus#2671) * Lower capped rand generators * Updated all references to RAND generators * Formatting updates * New RAND bytes generator constructor * Revert "Updated all references to RAND generators" This reverts commit 9daad89. * Revert "Formatting updates" This reverts commit ff2a61a. * cargo nightly format * Added must_use to with_min_size * fix error '#' is not followed by a macro parameter (AFLplusplus#2678) * Use version.workspace (AFLplusplus#2682) * LibAFL_QEMU: Don't return a generic Address from Register reads (AFLplusplus#2681) * LibAFL_QEMU: Make ReadReg always return GuestReg type * Don't return a generic address * fix fuzzers * fix mips * Add DrCovReader to read DrCov files and DrCov dumper and merge utils (AFLplusplus#2680) * Add DrCov Reader * Removed libafl_jumper deps * Fix DrCovWriter, add dump_drcov_addrs * Taplo * Move frida from usize to u64 * DrCov usize=>u64 * Better error print * More u64 * ? * debug * clippy * clippy * Add Merge option to DrCovReader * Add drcov_merge tool * Move folder around * DrCov * More assert * fmt * Move around * Fix print * Add option to read multiple files/full folders * Fix build_all_fuzzers.sh for local runs (AFLplusplus#2686) * Add Intel PT tracing support (AFLplusplus#2471) * WIP: IntelPT qemu systemmode * use perf-event-open-sys instead of bindgen * intelPT Add enable and disable tracing, add test * Use static_assertions crate * Fix volatiles, finish test * Add Intel PT availability check * Use LibAFL errors in Result * Improve filtering * Add KVM pt_mode check * move static_assertions use * Check for perf_event_open support * Add (empty) IntelPT module * Add IntelPTModule POC * partial ideas to implement intel pt * forgot smth * trace decoding draft * add libipt decoder * use cpuid instead of reading /proc/cpuinfo * investigating nondeterministic behaviour * intel_pt module add thread creation hook * Fully identify deps versions Cargo docs: Although it looks like a specific version of the crate, it actually specifies a range of versions and allows SemVer compatible updates * Move mem image to module, output to file for debug * fixup! Use static_assertions crate * Exclude host kernel from traces * Bump libipt-rs * Callback to get memory as an alterantive to image * WIP Add bootloader fuzzer example * Split availability check: add availability_with_qemu * Move IntelPT to observer * Improve test docs * Clippy happy now * Taplo happy now * Add IntelPTObserver boilerplate * Hook instead of Observer * Clippy & Taplo * Add psb_freq setting * Extremely bad and dirty babyfuzzer stealing * Use thread local cell instead of mutex * Try a trace diff based naive feedback * fix perf aux buffer wrap handling * Use f64 for feedback score * Fix clippy for cargo test * Add config format tests * WIP intelpt babyfuzzer with fork * Fix not wrapped tail offset in split buffer * Baby PT with raw traces diff working * Cache nr_filters * Use Lazy_lock for perf_type * Add baby_fuzzer_intel_pt * restore baby fuzzer * baby_fuzzer with block decoder * instruction decoder instead of block * Fix after upstream merge * OwnedRefMut instead of Cow * Read mem directly instead of going through files * Fix cache lifetime and tail update * clippy * Taplo * Compile caps only on linux * clippy * Fail compilation on unsupported OSes * Add baby_fuzzer_intel_pt to CI * Cleanup * Move intel pt + linux check * fix baby pt * rollback forkexecutor * Remove unused dep * Cleanup * Lints * Compute an edge id instead of using only block ip * Binary only intelPT POC * put linux specific code behind target_os=linux * Clippy & Taplo * fix CI * Disable relocation * No unwrap in decode * No expect in decode * Better logging, smaller aux buffer * add IntelPTBuilder * some lints * Add exclude_hv config * Per CPU tracing and inheritance * Parametrize buffer size * Try not to break commandExecutor API pt.1 * Try not to break commandExecutor API pt.2 * Try not to break commandExecutor API pt.3 * fix baby PT * Support on_crash & on_timeout callbacks for libafl_qemu modules (AFLplusplus#2620) * support (unsafe) on_crash / on_timeout callbacks for modules * use libc types in bindgen * Move common code to bolts * Cleanup * Revert changes to backtrace_baby_fuzzers/command_executor * Move intel_pt in one file * Use workspace deps * add nr_addr_filter fallback * Cleaning * Improve decode * Clippy * Improve errors and docs * Impl from<PtError> for libafl::Error * Merge hooks * Docs * Clean command executor * fix baby PT * fix baby PT warnings * decoder fills the map with no vec alloc * WIP command executor intel PT * filter_map() instead of filter().map() * fix docs * fix windows? * Baby lints * Small cleanings * Use personality to disable ASLR at runtime * Fix nix dep * Use prc-maps in babyfuzzer * working ET_DYN elf * Cleanup Cargo.toml * Clean command executor * introduce PtraceCommandConfigurator * Fix clippy & taplo * input via stdin * libipt as workspace dep * Check kernel version * support Arg input location * Reorder stuff * File input * timeout support for PtraceExec * Lints * Move out method not needing self form IntelPT * unimplemented * Lints * Move intel_pt_baby_fuzzer * Move intel_pt_command_executor * Document the need for smp_rmb * Better comment * Readme and Makefile.toml instead of build.rs * Move out from libafl_bolts to libafl_intelpt * Fix hooks * (Almost) fix intel_pt command exec * fix intel_pt command exec debug * Fix baby_fuzzer * &raw over addr_of! * cfg(target_os = "linux") * bolts Cargo.toml leftover * minimum wage README.md * extract join_split_trace from decode * extract decode_block from decode * add 1 to `previous_block_ip` to avoid that all the recursive basic blocks map to 0 * More generic hook * fix windows * Update CI, fmt * No bitbybit * Fix docker? * Fix Apple silicon? * Use old libipt from crates.io --------- Co-authored-by: Romain Malmain <[email protected]> Co-authored-by: Dominik Maier <[email protected]> * libafl-fuzz: introduce nyx_mode (AFLplusplus#2503) * add nyx_mode * fix frida ci? * damn clippy * clippy * LibAFL: Remove `tui_monitor` from default features (AFLplusplus#2685) * No Usermode default * no tui * gg * try fix CI * fmt --------- Co-authored-by: Dominik Maier <[email protected]> * Actually make ConstMapObserver work, introduce `nonnull_raw_mut` macro (AFLplusplus#2687) * Actually make ConstMapObserver work * fixes * does that work? * mas * Feature: libafl-fuzzfuzzbench (AFLplusplus#2689) * fuzzbench * clippy * fmt * fix unicorn CI? * Move bitfields to bitbybit (AFLplusplus#2688) * move to bitbybit * Restore bitbybit dependent code * Clippy * Fix NautilusContext::from_file for python files (AFLplusplus#2690) * Bump to 0.14.0 (AFLplusplus#2692) * Fix versions in libafl and libafl_intelpt for crates.io (AFLplusplus#2693) * Fix versions in libafl and libafl_intelpt for crates * Add libafl_intelpt to publish * StdMOptMutator::new: remove unused type parameter (AFLplusplus#2695) `I` is unused in `::new` and thus requires callers to explicitly specify any type as it can't be determined by type inference. Clippy's `extra_unused_type_parameters` should pick this up, but is tuned a bit too conservative in order to avoid false positives AFAICT. * Move test_harness from source directory to OUT_DIR (AFLplusplus#2694) * remove test_harness from source directory * fmt * Add package.metadata.docs.rs for libafl_intelpt (AFLplusplus#2696) * libafl-fuzz: fix cmplog running on inputs more than once (AFLplusplus#2697) * libafl-fuzz: fix cmplog running on inputs more than once * fmt * fix afl++ cmplog header * update to latest afl stable commit * Libafl workspace internal deps in workspace Cargo.toml (AFLplusplus#2691) * Add internal deps to workspace * libafl: use workspace internal deps * libafl_bolts: use workspace internal deps * 0.14.0 * use workspace internal deps * Fix tui monitor for example fuzzers (AFLplusplus#2699) * Fix tui monitor for example fuzzers * New clippy lint * fix * Update pyo3-build-config requirement from 0.22.3 to 0.23.1 (AFLplusplus#2701) Updates the requirements on [pyo3-build-config](https://github.com/pyo3/pyo3) to permit the latest version. - [Release notes](https://github.com/pyo3/pyo3/releases) - [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md) - [Commits](PyO3/pyo3@v0.22.3...v0.23.1) --- updated-dependencies: - dependency-name: pyo3-build-config dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * bolts: fix build for tiers 3 platforms. (AFLplusplus#2700) cater to platforms knowingly support this feature instead. * Pre init module hooks (AFLplusplus#2704) * differenciate pre qemu init and post qemu init hooks * api breakage: Emulator::new_with_qemu is not public anymore. * Fix edge module generators (AFLplusplus#2702) * fix generators * fix metadata removal for ExecutionCountRestartHelper (AFLplusplus#2705) * Ignore pyo3 update (AFLplusplus#2709) * libafl-fuzz: feature-flag nyx mode (AFLplusplus#2712) * Bump ctor dependency to make nightly compile again (AFLplusplus#2713) * Batched timeout doc (AFLplusplus#2716) * timeout doc * clp * FMT * More batched timeout doc (AFLplusplus#2717) * timeout doc * clp * FMT * more * fixing an overexited cast * renaming variables * removing unnecessary brackets * fixing imports * fixing imports * renaming more variables * even more variable renaming * removing duplicate clap short options * reverting mistaken variable renaming * comparing the actual cores instead of an enumeration index --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Dominik Maier <[email protected]> Co-authored-by: Subhojeet Mukherjee, PhD <[email protected]> Co-authored-by: jejuisland87654 <[email protected]> Co-authored-by: Marco C. <[email protected]> Co-authored-by: Dongjia "toka" Zhang <[email protected]> Co-authored-by: Romain Malmain <[email protected]> Co-authored-by: Aarnav <[email protected]> Co-authored-by: Dominik Maier <[email protected]> Co-authored-by: Andrea Fioraldi <[email protected]> Co-authored-by: Mrmaxmeier <[email protected]> Co-authored-by: Sharad Khanna <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: David CARLIER <[email protected]> Co-authored-by: Henry Chu <[email protected]>
1 parent ee70c78 commit 2748326

File tree

27 files changed

+786
-608
lines changed

27 files changed

+786
-608
lines changed

.github/workflows/build_and_test.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ jobs:
194194
cargo-fmt:
195195
runs-on: ubuntu-24.04
196196
env:
197-
MAIN_LLVM_VERSION: 19
197+
MAIN_LLVM_VERSION: 19
198198
steps:
199199
- uses: actions/checkout@v4
200200
- uses: ./.github/workflows/ubuntu-prepare

fuzzers/binary_only/frida_executable_libpng/src/fuzzer.rs

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@ use std::{path::PathBuf, ptr::null};
55
use frida_gum::Gum;
66
use libafl::{
77
corpus::{CachedOnDiskCorpus, Corpus, OnDiskCorpus},
8-
events::{launcher::Launcher, llmp::LlmpRestartingEventManager, EventConfig},
8+
events::{
9+
launcher::Launcher, llmp::LlmpRestartingEventManager, ClientDescription, EventConfig,
10+
},
911
executors::{inprocess::InProcessExecutor, ExitKind, ShadowExecutor},
1012
feedback_or, feedback_or_fast,
1113
feedbacks::{CrashFeedback, MaxMapFeedback, TimeFeedback, TimeoutFeedback},
@@ -93,13 +95,17 @@ unsafe fn fuzz(
9395

9496
let shmem_provider = StdShMemProvider::new()?;
9597

96-
let mut run_client = |state: Option<_>, mgr: LlmpRestartingEventManager<_, _, _>, core_id| {
98+
let mut run_client = |state: Option<_>,
99+
mgr: LlmpRestartingEventManager<_, _, _>,
100+
client_description: ClientDescription| {
97101
// The restarting state will spawn the same process again as child, then restarted it each time it crashes.
98102

99103
// println!("{:?}", mgr.mgr_id());
100104

101-
if options.asan && options.asan_cores.contains(core_id) {
102-
(|state: Option<_>, mut mgr: LlmpRestartingEventManager<_, _, _>, _core_id| {
105+
if options.asan && options.asan_cores.contains(client_description.core_id()) {
106+
(|state: Option<_>,
107+
mut mgr: LlmpRestartingEventManager<_, _, _>,
108+
_client_description| {
103109
let gum = Gum::obtain();
104110

105111
let coverage = CoverageRuntime::new();
@@ -222,9 +228,11 @@ unsafe fn fuzz(
222228
fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)?;
223229

224230
Ok(())
225-
})(state, mgr, core_id)
226-
} else if options.cmplog && options.cmplog_cores.contains(core_id) {
227-
(|state: Option<_>, mut mgr: LlmpRestartingEventManager<_, _, _>, _core_id| {
231+
})(state, mgr, client_description)
232+
} else if options.cmplog && options.cmplog_cores.contains(client_description.core_id()) {
233+
(|state: Option<_>,
234+
mut mgr: LlmpRestartingEventManager<_, _, _>,
235+
_client_description| {
228236
let gum = Gum::obtain();
229237

230238
let coverage = CoverageRuntime::new();
@@ -356,9 +364,11 @@ unsafe fn fuzz(
356364
fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)?;
357365

358366
Ok(())
359-
})(state, mgr, core_id)
367+
})(state, mgr, client_description)
360368
} else {
361-
(|state: Option<_>, mut mgr: LlmpRestartingEventManager<_, _, _>, _core_id| {
369+
(|state: Option<_>,
370+
mut mgr: LlmpRestartingEventManager<_, _, _>,
371+
_client_description| {
362372
let gum = Gum::obtain();
363373

364374
let coverage = CoverageRuntime::new();
@@ -473,7 +483,7 @@ unsafe fn fuzz(
473483
fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)?;
474484

475485
Ok(())
476-
})(state, mgr, core_id)
486+
})(state, mgr, client_description)
477487
}
478488
};
479489

fuzzers/binary_only/frida_libpng/src/fuzzer.rs

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@ use std::path::PathBuf;
55
use frida_gum::Gum;
66
use libafl::{
77
corpus::{CachedOnDiskCorpus, Corpus, OnDiskCorpus},
8-
events::{launcher::Launcher, llmp::LlmpRestartingEventManager, EventConfig},
8+
events::{
9+
launcher::Launcher, llmp::LlmpRestartingEventManager, ClientDescription, EventConfig,
10+
},
911
executors::{inprocess::InProcessExecutor, ExitKind, ShadowExecutor},
1012
feedback_or, feedback_or_fast,
1113
feedbacks::{CrashFeedback, MaxMapFeedback, TimeFeedback, TimeoutFeedback},
@@ -73,7 +75,9 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
7375

7476
let shmem_provider = StdShMemProvider::new()?;
7577

76-
let mut run_client = |state: Option<_>, mgr: LlmpRestartingEventManager<_, _, _>, core_id| {
78+
let mut run_client = |state: Option<_>,
79+
mgr: LlmpRestartingEventManager<_, _, _>,
80+
client_description: ClientDescription| {
7781
// The restarting state will spawn the same process again as child, then restarted it each time it crashes.
7882

7983
// println!("{:?}", mgr.mgr_id());
@@ -90,8 +94,10 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
9094
ExitKind::Ok
9195
};
9296

93-
if options.asan && options.asan_cores.contains(core_id) {
94-
(|state: Option<_>, mut mgr: LlmpRestartingEventManager<_, _, _>, _core_id| {
97+
if options.asan && options.asan_cores.contains(client_description.core_id()) {
98+
(|state: Option<_>,
99+
mut mgr: LlmpRestartingEventManager<_, _, _>,
100+
_client_description| {
95101
let gum = Gum::obtain();
96102

97103
let coverage = CoverageRuntime::new();
@@ -214,9 +220,11 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
214220
fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)?;
215221

216222
Ok(())
217-
})(state, mgr, core_id)
218-
} else if options.cmplog && options.cmplog_cores.contains(core_id) {
219-
(|state: Option<_>, mut mgr: LlmpRestartingEventManager<_, _, _>, _core_id| {
223+
})(state, mgr, client_description)
224+
} else if options.cmplog && options.cmplog_cores.contains(client_description.core_id()) {
225+
(|state: Option<_>,
226+
mut mgr: LlmpRestartingEventManager<_, _, _>,
227+
_client_description| {
220228
let gum = Gum::obtain();
221229

222230
let coverage = CoverageRuntime::new();
@@ -349,9 +357,11 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
349357
fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)?;
350358

351359
Ok(())
352-
})(state, mgr, core_id)
360+
})(state, mgr, client_description)
353361
} else {
354-
(|state: Option<_>, mut mgr: LlmpRestartingEventManager<_, _, _>, _core_id| {
362+
(|state: Option<_>,
363+
mut mgr: LlmpRestartingEventManager<_, _, _>,
364+
_client_description| {
355365
let gum = Gum::obtain();
356366

357367
let coverage = CoverageRuntime::new();
@@ -466,7 +476,7 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
466476
fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)?;
467477

468478
Ok(())
469-
})(state, mgr, core_id)
479+
})(state, mgr, client_description)
470480
}
471481
};
472482

fuzzers/binary_only/frida_windows_gdiplus/src/fuzzer.rs

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,9 @@ use std::path::PathBuf;
2222
use frida_gum::Gum;
2323
use libafl::{
2424
corpus::{CachedOnDiskCorpus, Corpus, OnDiskCorpus},
25-
events::{launcher::Launcher, llmp::LlmpRestartingEventManager, EventConfig},
25+
events::{
26+
launcher::Launcher, llmp::LlmpRestartingEventManager, ClientDescription, EventConfig,
27+
},
2628
executors::{inprocess::InProcessExecutor, ExitKind, ShadowExecutor},
2729
feedback_and_fast, feedback_or, feedback_or_fast,
2830
feedbacks::{ConstFeedback, CrashFeedback, MaxMapFeedback, TimeFeedback, TimeoutFeedback},
@@ -82,7 +84,9 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
8284

8385
let shmem_provider = StdShMemProvider::new()?;
8486

85-
let mut run_client = |state: Option<_>, mgr: LlmpRestartingEventManager<_, _, _>, core_id| {
87+
let mut run_client = |state: Option<_>,
88+
mgr: LlmpRestartingEventManager<_, _, _>,
89+
client_description: ClientDescription| {
8690
// The restarting state will spawn the same process again as child, then restarted it each time it crashes.
8791

8892
// println!("{:?}", mgr.mgr_id());
@@ -99,8 +103,10 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
99103
ExitKind::Ok
100104
};
101105

102-
if options.asan && options.asan_cores.contains(core_id) {
103-
(|state: Option<_>, mut mgr: LlmpRestartingEventManager<_, _, _>, _core_id| {
106+
if options.asan && options.asan_cores.contains(client_description.core_id()) {
107+
(|state: Option<_>,
108+
mut mgr: LlmpRestartingEventManager<_, _, _>,
109+
_client_description| {
104110
let gum = Gum::obtain();
105111

106112
let coverage = CoverageRuntime::new();
@@ -212,9 +218,11 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
212218
fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)?;
213219

214220
Ok(())
215-
})(state, mgr, core_id)
216-
} else if options.cmplog && options.cmplog_cores.contains(core_id) {
217-
(|state: Option<_>, mut mgr: LlmpRestartingEventManager<_, _, _>, _core_id| {
221+
})(state, mgr, client_description)
222+
} else if options.cmplog && options.cmplog_cores.contains(client_description.core_id()) {
223+
(|state: Option<_>,
224+
mut mgr: LlmpRestartingEventManager<_, _, _>,
225+
_client_description| {
218226
let gum = Gum::obtain();
219227

220228
let coverage = CoverageRuntime::new();
@@ -340,9 +348,11 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
340348
fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)?;
341349

342350
Ok(())
343-
})(state, mgr, core_id)
351+
})(state, mgr, client_description)
344352
} else {
345-
(|state: Option<_>, mut mgr: LlmpRestartingEventManager<_, _, _>, _core_id| {
353+
(|state: Option<_>,
354+
mut mgr: LlmpRestartingEventManager<_, _, _>,
355+
_client_description| {
346356
let gum = Gum::obtain();
347357

348358
let coverage = CoverageRuntime::new();
@@ -454,7 +464,7 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
454464
.unwrap();
455465

456466
Ok(())
457-
})(state, mgr, core_id)
467+
})(state, mgr, client_description)
458468
}
459469
};
460470

0 commit comments

Comments
 (0)