Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Match by Ref fix #2105

Merged
merged 32 commits into from
Apr 27, 2024
Merged

Match by Ref fix #2105

Show file tree
Hide file tree
Changes from 31 commits
Commits
Show all changes
32 commits
Select commit Hold shift + click to select a range
c1be658
match by ref fix
addisoncrump Apr 25, 2024
d154b02
impl Named for Reference
addisoncrump Apr 25, 2024
ae65fd9
rename
addisoncrump Apr 25, 2024
120a260
magic indexing
addisoncrump Apr 25, 2024
ce95f2d
whoops
addisoncrump Apr 25, 2024
f575cc1
docs, clippy
addisoncrump Apr 25, 2024
0b30f6c
some additional CI complaints
addisoncrump Apr 25, 2024
8431d6a
other libafl_qemu fixes
addisoncrump Apr 25, 2024
8ea16ed
missed an alloc feature
addisoncrump Apr 25, 2024
c5708f8
a smattering of fixes
addisoncrump Apr 25, 2024
e52a68c
use from not direct construction
addisoncrump Apr 25, 2024
0afa904
tinyinst fix
addisoncrump Apr 25, 2024
74a0ab0
horrible double-mutability things
addisoncrump Apr 25, 2024
2649119
fixup nyx
addisoncrump Apr 25, 2024
01b126b
from not new
addisoncrump Apr 25, 2024
32de86d
forkserver_simple fixes
addisoncrump Apr 25, 2024
59e3a77
dogfood: forkserver
addisoncrump Apr 25, 2024
1909b12
mmmm yummy dogfood
addisoncrump Apr 25, 2024
00f7671
round one CI fixes
addisoncrump Apr 25, 2024
279e57c
clippy appeasement
addisoncrump Apr 25, 2024
883de68
deref generic impl to simplify usage
addisoncrump Apr 25, 2024
7a8a2a3
adaptive serialization (ouch)
addisoncrump Apr 26, 2024
b2f7c49
remaining clippy items
addisoncrump Apr 26, 2024
20df384
I am tired
addisoncrump Apr 26, 2024
0eb7c18
new not with
addisoncrump Apr 26, 2024
fe063b8
fixup: aflpp tracing was not actually constructable
addisoncrump Apr 26, 2024
8a3b236
fix tmin
addisoncrump Apr 26, 2024
095f8e3
reduce complexity of map feedback now that we do not need to constrain
addisoncrump Apr 26, 2024
06b74a2
frida fixes
addisoncrump Apr 26, 2024
06b956c
Merge branch 'main' into match-by-ref-ref
addisoncrump Apr 26, 2024
46788a9
fix concolic
addisoncrump Apr 26, 2024
92a4d67
type_ref => reference
addisoncrump Apr 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion fuzzers/baby_fuzzer_minimizing/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ pub fn main() -> Result<(), Error> {
// Create an observation channel using the signals map
let observer = unsafe { StdMapObserver::from_mut_ptr("signals", SIGNALS_PTR, SIGNALS.len()) };

let factory = MapEqualityFactory::with_observer(&observer);
let factory = MapEqualityFactory::new(&observer);

// Feedback to rate the interestingness of an input
let mut feedback = MaxMapFeedback::new(&observer);
Expand Down
7 changes: 2 additions & 5 deletions fuzzers/forkserver_libafl_cc/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ pub fn main() {
// New maximization map feedback linked to the edges observer and the feedback state
MaxMapFeedback::new(&edges_observer),
// Time feedback, this one does not need a feedback state
TimeFeedback::with_observer(&time_observer)
TimeFeedback::new(&time_observer)
);

// A feedback to choose if an input is a solution or not
Expand Down Expand Up @@ -183,10 +183,7 @@ pub fn main() {
.unwrap();

if let Some(dynamic_map_size) = executor.coverage_map_size() {
executor
.observers_mut()
.match_by_ref_mut(observer_ref)
.unwrap()
executor.observers_mut()[&observer_ref]
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👻

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Definitely increases the WTF/line 🤣

.as_mut()
.truncate(dynamic_map_size);
}
Expand Down
13 changes: 6 additions & 7 deletions fuzzers/forkserver_simple/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ use libafl::{
inputs::BytesInput,
monitors::SimpleMonitor,
mutators::{scheduled::havoc_mutations, tokens_mutations, StdScheduledMutator, Tokens},
observers::{CanTrack, ExplicitTracking, HitcountsMapObserver, StdMapObserver, TimeObserver},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
schedulers::{IndexesLenTimeMinimizerScheduler, QueueScheduler},
stages::mutational::StdMutationalStage,
state::{HasCorpus, StdState},
Expand All @@ -22,7 +22,7 @@ use libafl_bolts::{
current_nanos,
rands::StdRand,
shmem::{ShMem, ShMemProvider, UnixShMemProvider},
tuples::{tuple_list, MatchName, Merge},
tuples::{tuple_list, Merge, Referenceable},
AsSliceMut, Truncate,
};
use nix::sys::signal::Signal;
Expand Down Expand Up @@ -114,7 +114,7 @@ pub fn main() {
// New maximization map feedback linked to the edges observer and the feedback state
MaxMapFeedback::new(&edges_observer),
// Time feedback, this one does not need a feedback state
TimeFeedback::with_observer(&time_observer)
TimeFeedback::new(&time_observer)
);

// A feedback to choose if an input is a solution or not
Expand Down Expand Up @@ -163,6 +163,8 @@ pub fn main() {
// Create the executor for the forkserver
let args = opt.arguments;

let observer_ref = edges_observer.type_ref();

let mut tokens = Tokens::new();
let mut executor = ForkserverExecutor::builder()
.program(opt.executable)
Expand All @@ -177,10 +179,7 @@ pub fn main() {
.unwrap();

if let Some(dynamic_map_size) = executor.coverage_map_size() {
executor
.observers_mut()
.match_name_mut::<ExplicitTracking<HitcountsMapObserver<StdMapObserver<'_, u8, false>>, true, false>>("shared_mem")
.unwrap()
executor.observers_mut()[&observer_ref]
.as_mut()
.truncate(dynamic_map_size);
}
Expand Down
45 changes: 27 additions & 18 deletions fuzzers/frida_executable_libpng/src/fuzzer.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ use libafl_bolts::{
#[cfg(unix)]
use libafl_frida::asan::{
asan_rt::AsanRuntime,
errors::{AsanErrorsFeedback, AsanErrorsObserver, ASAN_ERRORS},
errors::{AsanErrorsFeedback, AsanErrorsObserver},
};
use libafl_frida::{
cmplog_rt::CmpLogRuntime,
Expand Down Expand Up @@ -123,14 +123,16 @@ unsafe fn fuzz(

// Create an observation channel to keep track of the execution time
let time_observer = TimeObserver::new("time");
#[cfg(unix)]
let asan_observer = AsanErrorsObserver::from_static_asan_errors();

// Feedback to rate the interestingness of an input
// This one is composed by two Feedbacks in OR
let mut feedback = feedback_or!(
// New maximization map feedback linked to the edges observer and the feedback state
MaxMapFeedback::new(&edges_observer),
// Time feedback, this one does not need a feedback state
TimeFeedback::with_observer(&time_observer)
TimeFeedback::new(&time_observer)
);

// Feedbacks to recognize an input as solution
Expand All @@ -139,7 +141,10 @@ unsafe fn fuzz(
CrashFeedback::new(),
TimeoutFeedback::new(),
// true enables the AsanErrorFeedback
feedback_and_fast!(ConstFeedback::from(true), AsanErrorsFeedback::new())
feedback_and_fast!(
ConstFeedback::from(true),
AsanErrorsFeedback::new(&asan_observer)
)
);
#[cfg(windows)]
let mut objective = feedback_or_fast!(CrashFeedback::new(), TimeoutFeedback::new());
Expand Down Expand Up @@ -185,9 +190,7 @@ unsafe fn fuzz(
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);

#[cfg(unix)]
let observers = tuple_list!(edges_observer, time_observer, unsafe {
AsanErrorsObserver::from_static_asan_errors()
});
let observers = tuple_list!(edges_observer, time_observer, asan_observer);
#[cfg(windows)]
let observers = tuple_list!(edges_observer, time_observer);

Expand Down Expand Up @@ -240,21 +243,26 @@ unsafe fn fuzz(

// Create an observation channel to keep track of the execution time
let time_observer = TimeObserver::new("time");
#[cfg(unix)]
let asan_observer = AsanErrorsObserver::from_static_asan_errors();

// Feedback to rate the interestingness of an input
// This one is composed by two Feedbacks in OR
let mut feedback = feedback_or!(
// New maximization map feedback linked to the edges observer and the feedback state
MaxMapFeedback::new(&edges_observer),
// Time feedback, this one does not need a feedback state
TimeFeedback::with_observer(&time_observer)
TimeFeedback::new(&time_observer)
);

#[cfg(unix)]
let mut objective = feedback_or_fast!(
CrashFeedback::new(),
TimeoutFeedback::new(),
feedback_and_fast!(ConstFeedback::from(false), AsanErrorsFeedback::new())
feedback_and_fast!(
ConstFeedback::from(false),
AsanErrorsFeedback::new(&asan_observer)
)
);
#[cfg(windows)]
let mut objective = feedback_or_fast!(CrashFeedback::new(), TimeoutFeedback::new());
Expand Down Expand Up @@ -300,11 +308,9 @@ unsafe fn fuzz(
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);

#[cfg(unix)]
let observers = tuple_list!(edges_observer, time_observer, unsafe {
AsanErrorsObserver::from_static_asan_errors()
});
let observers = tuple_list!(edges_observer, time_observer, asan_observer);
#[cfg(windows)]
let observers = tuple_list!(edges_observer, time_observer,);
let observers = tuple_list!(edges_observer, time_observer);

// Create the executor for an in-process function with just one observer for edge coverage
let mut executor = FridaInProcessExecutor::new(
Expand Down Expand Up @@ -370,21 +376,26 @@ unsafe fn fuzz(

// Create an observation channel to keep track of the execution time
let time_observer = TimeObserver::new("time");
#[cfg(unix)]
let asan_observer = AsanErrorsObserver::from_static_asan_errors();

// Feedback to rate the interestingness of an input
// This one is composed by two Feedbacks in OR
let mut feedback = feedback_or!(
// New maximization map feedback linked to the edges observer and the feedback state
MaxMapFeedback::new(&edges_observer),
// Time feedback, this one does not need a feedback state
TimeFeedback::with_observer(&time_observer)
TimeFeedback::new(&time_observer)
);

#[cfg(unix)]
let mut objective = feedback_or_fast!(
CrashFeedback::new(),
TimeoutFeedback::new(),
feedback_and_fast!(ConstFeedback::from(false), AsanErrorsFeedback::new())
feedback_and_fast!(
ConstFeedback::from(false),
AsanErrorsFeedback::new(&asan_observer)
)
);
#[cfg(windows)]
let mut objective = feedback_or_fast!(CrashFeedback::new(), TimeoutFeedback::new());
Expand Down Expand Up @@ -430,11 +441,9 @@ unsafe fn fuzz(
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);

#[cfg(unix)]
let observers = tuple_list!(edges_observer, time_observer, unsafe {
AsanErrorsObserver::from_static_asan_errors()
});
let observers = tuple_list!(edges_observer, time_observer, asan_observer);
#[cfg(windows)]
let observers = tuple_list!(edges_observer, time_observer,);
let observers = tuple_list!(edges_observer, time_observer);

// Create the executor for an in-process function with just one observer for edge coverage
let mut executor = FridaInProcessExecutor::new(
Expand Down
45 changes: 28 additions & 17 deletions fuzzers/frida_gdiplus/src/fuzzer.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {

let coverage = CoverageRuntime::new();
#[cfg(unix)]
let asan = AsanRuntime::new(&options);
let asan = AsanRuntime::new(options);

#[cfg(unix)]
let mut frida_helper =
Expand All @@ -119,13 +119,16 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
// Create an observation channel to keep track of the execution time
let time_observer = TimeObserver::new("time");

#[cfg(unix)]
let asan_observer = AsanErrorsObserver::from_static_asan_errors();

// Feedback to rate the interestingness of an input
// This one is composed by two Feedbacks in OR
let mut feedback = feedback_or!(
// New maximization map feedback linked to the edges observer and the feedback state
MaxMapFeedback::new(&edges_observer),
// Time feedback, this one does not need a feedback state
TimeFeedback::with_observer(&time_observer)
TimeFeedback::new(&time_observer)
);

// Feedbacks to recognize an input as solution
Expand All @@ -134,7 +137,10 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
CrashFeedback::new(),
TimeoutFeedback::new(),
// true enables the AsanErrorFeedback
feedback_and_fast!(ConstFeedback::from(true), AsanErrorsFeedback::new())
feedback_and_fast!(
ConstFeedback::from(true),
AsanErrorsFeedback::new(&asan_observer)
)
);
#[cfg(windows)]
let mut objective = feedback_or_fast!(CrashFeedback::new(), TimeoutFeedback::new());
Expand Down Expand Up @@ -179,9 +185,7 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);

#[cfg(unix)]
let observers = tuple_list!(edges_observer, time_observer, unsafe {
AsanErrorsObserver::from_static_asan_errors()
});
let observers = tuple_list!(edges_observer, time_observer, asan_observer);
#[cfg(windows)]
let observers = tuple_list!(edges_observer, time_observer);

Expand Down Expand Up @@ -234,21 +238,26 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {

// Create an observation channel to keep track of the execution time
let time_observer = TimeObserver::new("time");
#[cfg(unix)]
let asan_observer = AsanErrorsObserver::from_static_asan_errors();

// Feedback to rate the interestingness of an input
// This one is composed by two Feedbacks in OR
let mut feedback = feedback_or!(
// New maximization map feedback linked to the edges observer and the feedback state
MaxMapFeedback::new(&edges_observer),
// Time feedback, this one does not need a feedback state
TimeFeedback::with_observer(&time_observer)
TimeFeedback::new(&time_observer)
);

#[cfg(unix)]
let mut objective = feedback_or_fast!(
CrashFeedback::new(),
TimeoutFeedback::new(),
feedback_and_fast!(ConstFeedback::from(false), AsanErrorsFeedback::new())
feedback_and_fast!(
ConstFeedback::from(false),
AsanErrorsFeedback::new(&asan_observer)
)
);
#[cfg(windows)]
let mut objective = feedback_or_fast!(CrashFeedback::new(), TimeoutFeedback::new());
Expand Down Expand Up @@ -294,9 +303,7 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);

#[cfg(unix)]
let observers = tuple_list!(edges_observer, time_observer, unsafe {
AsanErrorsObserver::from_static_asan_errors()
});
let observers = tuple_list!(edges_observer, time_observer, asan_observer);
#[cfg(windows)]
let observers = tuple_list!(edges_observer, time_observer,);

Expand Down Expand Up @@ -366,20 +373,26 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
// Create an observation channel to keep track of the execution time
let time_observer = TimeObserver::new("time");

#[cfg(unix)]
let asan_observer = AsanErrorsObserver::from_static_asan_errors();

// Feedback to rate the interestingness of an input
// This one is composed by two Feedbacks in OR
let mut feedback = feedback_or!(
// New maximization map feedback linked to the edges observer and the feedback state
MaxMapFeedback::new(&edges_observer),
// Time feedback, this one does not need a feedback state
TimeFeedback::with_observer(&time_observer)
TimeFeedback::new(&time_observer)
);

#[cfg(unix)]
let mut objective = feedback_or_fast!(
CrashFeedback::new(),
TimeoutFeedback::new(),
feedback_and_fast!(ConstFeedback::from(false), AsanErrorsFeedback::new())
feedback_and_fast!(
ConstFeedback::from(false),
AsanErrorsFeedback::new(&asan_observer)
)
);
#[cfg(windows)]
let mut objective = feedback_or_fast!(CrashFeedback::new(), TimeoutFeedback::new());
Expand Down Expand Up @@ -425,11 +438,9 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);

#[cfg(unix)]
let observers = tuple_list!(edges_observer, time_observer, unsafe {
AsanErrorsObserver::from_static_asan_errors()
});
let observers = tuple_list!(edges_observer, time_observer, asan_observer);
#[cfg(windows)]
let observers = tuple_list!(edges_observer, time_observer,);
let observers = tuple_list!(edges_observer, time_observer);

// Create the executor for an in-process function with just one observer for edge coverage
let mut executor = FridaInProcessExecutor::new(
Expand Down
Loading
Loading