Skip to content

Commit cc1ebb2

Browse files
andreafioraldiandreafioraldi
authored
Add CmpLog routines to LibAFL QEMU and various fixes (#1664)
* Add CmpLog routines to LibAFL QEMU and various fixes * format * fix * fix read_function_argument * fix * multithread * fix qemu fork * fix * clippy * fix systemmode * unused imports
1 parent d606d9f commit cc1ebb2

36 files changed

+3471
-791
lines changed

‎libafl/src/executors/inprocess.rs

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ where
171171
H: FnMut(&<S as UsesInput>::Input) -> ExitKind + ?Sized,
172172
HB: BorrowMut<H>,
173173
OT: ObserversTuple<S>,
174-
S: HasSolutions + HasClientPerfMonitor + HasCorpus,
174+
S: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
175175
{
176176
/// Create a new in mem executor.
177177
/// Caution: crash and restart in one of them will lead to odd behavior if multiple are used,
@@ -255,7 +255,7 @@ where
255255
H: FnMut(&<S as UsesInput>::Input) -> ExitKind + ?Sized,
256256
HB: BorrowMut<H>,
257257
OT: ObserversTuple<S>,
258-
S: HasSolutions + HasClientPerfMonitor + HasCorpus,
258+
S: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
259259
{
260260
/// the timeout handler
261261
#[inline]
@@ -350,7 +350,7 @@ impl InProcessHandlers {
350350
E: Executor<EM, Z> + HasObservers,
351351
EM: EventFirer<State = E::State> + EventRestarter<State = E::State>,
352352
OF: Feedback<E::State>,
353-
E::State: HasSolutions + HasClientPerfMonitor + HasCorpus,
353+
E::State: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
354354
Z: HasObjective<Objective = OF, State = E::State>,
355355
{
356356
#[cfg(unix)]
@@ -380,7 +380,7 @@ impl InProcessHandlers {
380380
E: Executor<EM, Z> + HasObservers + HasInProcessHandlers,
381381
EM: EventFirer<State = E::State> + EventRestarter<State = E::State>,
382382
OF: Feedback<E::State>,
383-
E::State: HasSolutions + HasClientPerfMonitor + HasCorpus,
383+
E::State: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
384384
Z: HasObjective<Objective = OF, State = E::State>,
385385
{
386386
unsafe {
@@ -591,7 +591,7 @@ pub fn run_observers_and_save_state<E, EM, OF, Z>(
591591
E: HasObservers,
592592
EM: EventFirer<State = E::State> + EventRestarter<State = E::State>,
593593
OF: Feedback<E::State>,
594-
E::State: HasSolutions + HasClientPerfMonitor + HasCorpus,
594+
E::State: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
595595
Z: HasObjective<Objective = OF, State = E::State>,
596596
{
597597
let observers = executor.observers_mut();
@@ -606,7 +606,7 @@ pub fn run_observers_and_save_state<E, EM, OF, Z>(
606606
.expect("In run_observers_and_save_state objective failure.");
607607

608608
if interesting {
609-
let mut new_testcase = Testcase::new(input.clone());
609+
let mut new_testcase = Testcase::with_executions(input.clone(), *state.executions());
610610
new_testcase.add_metadata(exitkind);
611611
new_testcase.set_parent_id_optional(*state.corpus().current());
612612
fuzzer
@@ -657,7 +657,7 @@ pub mod unix_signal_handler {
657657
feedbacks::Feedback,
658658
fuzzer::HasObjective,
659659
inputs::UsesInput,
660-
state::{HasClientPerfMonitor, HasCorpus, HasSolutions},
660+
state::{HasClientPerfMonitor, HasCorpus, HasExecutions, HasSolutions},
661661
};
662662

663663
pub(crate) type HandlerFuncPtr = unsafe fn(
@@ -727,7 +727,7 @@ pub mod unix_signal_handler {
727727
E: HasObservers,
728728
EM: EventFirer<State = E::State> + EventRestarter<State = E::State>,
729729
OF: Feedback<E::State>,
730-
E::State: HasSolutions + HasClientPerfMonitor + HasCorpus,
730+
E::State: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
731731
Z: HasObjective<Objective = OF, State = E::State>,
732732
{
733733
let old_hook = panic::take_hook();
@@ -775,7 +775,7 @@ pub mod unix_signal_handler {
775775
E: HasObservers,
776776
EM: EventFirer<State = E::State> + EventRestarter<State = E::State>,
777777
OF: Feedback<E::State>,
778-
E::State: HasSolutions + HasClientPerfMonitor + HasCorpus,
778+
E::State: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
779779
Z: HasObjective<Objective = OF, State = E::State>,
780780
{
781781
if !data.timeout_executor_ptr.is_null()
@@ -825,7 +825,7 @@ pub mod unix_signal_handler {
825825
E: Executor<EM, Z> + HasObservers,
826826
EM: EventFirer<State = E::State> + EventRestarter<State = E::State>,
827827
OF: Feedback<E::State>,
828-
E::State: HasSolutions + HasClientPerfMonitor + HasCorpus,
828+
E::State: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
829829
Z: HasObjective<Objective = OF, State = E::State>,
830830
{
831831
#[cfg(all(target_os = "android", target_arch = "aarch64"))]
@@ -937,7 +937,7 @@ pub mod windows_asan_handler {
937937
feedbacks::Feedback,
938938
fuzzer::HasObjective,
939939
inputs::UsesInput,
940-
state::{HasClientPerfMonitor, HasCorpus, HasSolutions},
940+
state::{HasClientPerfMonitor, HasCorpus, HasExecutions, HasSolutions},
941941
};
942942

943943
/// # Safety
@@ -947,7 +947,7 @@ pub mod windows_asan_handler {
947947
E: Executor<EM, Z> + HasObservers,
948948
EM: EventFirer<State = E::State> + EventRestarter<State = E::State>,
949949
OF: Feedback<E::State>,
950-
E::State: HasSolutions + HasClientPerfMonitor + HasCorpus,
950+
E::State: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
951951
Z: HasObjective<Objective = OF, State = E::State>,
952952
{
953953
let data = &mut GLOBAL_STATE;
@@ -1050,7 +1050,7 @@ pub mod windows_exception_handler {
10501050
feedbacks::Feedback,
10511051
fuzzer::HasObjective,
10521052
inputs::UsesInput,
1053-
state::{HasClientPerfMonitor, HasCorpus, HasSolutions},
1053+
state::{HasClientPerfMonitor, HasCorpus, HasExecutions, HasSolutions},
10541054
};
10551055

10561056
pub(crate) type HandlerFuncPtr =
@@ -1094,7 +1094,7 @@ pub mod windows_exception_handler {
10941094
E: HasObservers,
10951095
EM: EventFirer<State = E::State> + EventRestarter<State = E::State>,
10961096
OF: Feedback<E::State>,
1097-
E::State: HasSolutions + HasClientPerfMonitor + HasCorpus,
1097+
E::State: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
10981098
Z: HasObjective<Objective = OF, State = E::State>,
10991099
{
11001100
let old_hook = panic::take_hook();
@@ -1158,7 +1158,7 @@ pub mod windows_exception_handler {
11581158
E: HasObservers + HasInProcessHandlers,
11591159
EM: EventFirer<State = E::State> + EventRestarter<State = E::State>,
11601160
OF: Feedback<E::State>,
1161-
E::State: HasSolutions + HasClientPerfMonitor + HasCorpus,
1161+
E::State: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
11621162
Z: HasObjective<Objective = OF, State = E::State>,
11631163
{
11641164
let data: &mut InProcessExecutorHandlerData =
@@ -1225,7 +1225,7 @@ pub mod windows_exception_handler {
12251225
E: Executor<EM, Z> + HasObservers,
12261226
EM: EventFirer<State = E::State> + EventRestarter<State = E::State>,
12271227
OF: Feedback<E::State>,
1228-
E::State: HasSolutions + HasClientPerfMonitor + HasCorpus,
1228+
E::State: HasExecutions + HasSolutions + HasClientPerfMonitor + HasCorpus,
12291229
Z: HasObjective<Objective = OF, State = E::State>,
12301230
{
12311231
// Have we set a timer_before?

‎libafl_frida/src/executor.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,7 @@ impl<'a, 'b, 'c, H, OT, RT, S> HasInProcessHandlers
231231
for FridaInProcessExecutor<'a, 'b, 'c, H, OT, RT, S>
232232
where
233233
H: FnMut(&S::Input) -> ExitKind,
234-
S: UsesInput + HasClientPerfMonitor + HasSolutions + HasCorpus,
234+
S: UsesInput + HasClientPerfMonitor + HasSolutions + HasCorpus + HasExecutions,
235235
S::Input: HasTargetBytes,
236236
OT: ObserversTuple<S>,
237237
RT: FridaRuntimeTuple,

‎libafl_qemu/build_linux.rs

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,11 @@ pub fn build() {
8282
.status()
8383
.expect("make failed")
8484
.success());
85-
assert!(Command::new("make")
85+
let mut make = Command::new("make");
86+
if cfg!(debug_assertions) {
87+
make.env("CFLAGS", "-DDEBUG=1");
88+
}
89+
assert!(make
8690
.current_dir(out_dir_path)
8791
.env("CC", &cross_cc)
8892
.env("OUT_DIR", &target_dir)
@@ -91,5 +95,6 @@ pub fn build() {
9195
.status()
9296
.expect("make failed")
9397
.success());
98+
println!("cargo:rerun-if-changed={}/libqasan.so", target_dir.display());
9499
}
95100
}

‎libafl_qemu/libafl_qemu_build/src/bindings.rs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ const WRAPPER_HEADER: &str = r#"
6161
#endif
6262
6363
#include "exec/cpu-common.h"
64+
#include "exec/cpu-all.h"
6465
#include "exec/exec-all.h"
6566
#include "exec/translate-all.h"
6667
#include "exec/log.h"
@@ -111,6 +112,7 @@ pub fn generate(
111112
.allowlist_function("target_mmap")
112113
.allowlist_function("target_mprotect")
113114
.allowlist_function("target_munmap")
115+
.allowlist_function("page_check_range")
114116
.allowlist_function("cpu_memory_rw_debug")
115117
.allowlist_function("cpu_physical_memory_rw")
116118
.allowlist_function("cpu_reset")

‎libafl_qemu/libafl_qemu_build/src/build.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ use which::which;
88

99
const QEMU_URL: &str = "https://github.com/AFLplusplus/qemu-libafl-bridge";
1010
const QEMU_DIRNAME: &str = "qemu-libafl-bridge";
11-
const QEMU_REVISION: &str = "e42124c0c8363184ef286fde43dce1d5c607699b";
11+
const QEMU_REVISION: &str = "b0c827246517e36b480ad501cba5ac6e2c3f26f5";
1212

1313
fn build_dep_check(tools: &[&str]) {
1414
for tool in tools {

0 commit comments

Comments
 (0)