diff --git a/Cargo.lock b/Cargo.lock index 34fb651..0a2c835 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -659,7 +659,7 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55" [[package]] name = "libafl" version = "0.13.1" -source = "git+https://github.com/AFLplusplus/LibAFL.git?tag=0.13.1#bb579e624e907b6488f019a6f0bb0634aa0f81da" +source = "git+https://github.com/dergoegge/LibAFL.git?branch=semsan#56bbb0f0a7c700e5bac66d8a5c7a385fcdc1b261" dependencies = [ "ahash", "backtrace", @@ -694,7 +694,7 @@ dependencies = [ [[package]] name = "libafl_bolts" version = "0.13.1" -source = "git+https://github.com/AFLplusplus/LibAFL.git?tag=0.13.1#bb579e624e907b6488f019a6f0bb0634aa0f81da" +source = "git+https://github.com/dergoegge/LibAFL.git?branch=semsan#56bbb0f0a7c700e5bac66d8a5c7a385fcdc1b261" dependencies = [ "ahash", "backtrace", @@ -726,7 +726,7 @@ dependencies = [ [[package]] name = "libafl_derive" version = "0.13.1" -source = "git+https://github.com/AFLplusplus/LibAFL.git?tag=0.13.1#bb579e624e907b6488f019a6f0bb0634aa0f81da" +source = "git+https://github.com/dergoegge/LibAFL.git?branch=semsan#56bbb0f0a7c700e5bac66d8a5c7a385fcdc1b261" dependencies = [ "quote", "syn 2.0.71", @@ -735,7 +735,7 @@ dependencies = [ [[package]] name = "libafl_qemu" version = "0.13.1" -source = "git+https://github.com/AFLplusplus/LibAFL.git?tag=0.13.1#bb579e624e907b6488f019a6f0bb0634aa0f81da" +source = "git+https://github.com/dergoegge/LibAFL.git?branch=semsan#56bbb0f0a7c700e5bac66d8a5c7a385fcdc1b261" dependencies = [ "addr2line 0.23.0", "bindgen", @@ -775,7 +775,7 @@ dependencies = [ [[package]] name = "libafl_qemu_build" version = "0.13.1" -source = "git+https://github.com/AFLplusplus/LibAFL.git?tag=0.13.1#bb579e624e907b6488f019a6f0bb0634aa0f81da" +source = "git+https://github.com/dergoegge/LibAFL.git?branch=semsan#56bbb0f0a7c700e5bac66d8a5c7a385fcdc1b261" dependencies = [ "bindgen", "cc", @@ -791,7 +791,7 @@ dependencies = [ [[package]] name = "libafl_qemu_sys" version = "0.13.1" -source = "git+https://github.com/AFLplusplus/LibAFL.git?tag=0.13.1#bb579e624e907b6488f019a6f0bb0634aa0f81da" +source = "git+https://github.com/dergoegge/LibAFL.git?branch=semsan#56bbb0f0a7c700e5bac66d8a5c7a385fcdc1b261" dependencies = [ "libafl_qemu_build", "libc", @@ -805,7 +805,7 @@ dependencies = [ [[package]] name = "libafl_targets" version = "0.13.1" -source = "git+https://github.com/AFLplusplus/LibAFL.git?tag=0.13.1#bb579e624e907b6488f019a6f0bb0634aa0f81da" +source = "git+https://github.com/dergoegge/LibAFL.git?branch=semsan#56bbb0f0a7c700e5bac66d8a5c7a385fcdc1b261" dependencies = [ "bindgen", "cc", diff --git a/Cargo.toml b/Cargo.toml index d2d98bd..8343376 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -16,9 +16,9 @@ qemu_arm = ["qemu", "libafl_qemu/arm", "dep:libafl_qemu"] [dependencies] clap = { version = "4.3.0", features = ["derive", "string"] } -libafl = { git = "https://github.com/AFLplusplus/LibAFL.git", tag = "0.13.1" } -libafl_bolts = { git = "https://github.com/AFLplusplus/LibAFL.git", tag = "0.13.1" } -libafl_qemu = { git = "https://github.com/AFLplusplus/LibAFL.git", tag = "0.13.1", features = ["usermode"], optional = true } +libafl = { git = "https://github.com/dergoegge/LibAFL.git", branch = "semsan" } +libafl_bolts = { git = "https://github.com/dergoegge/LibAFL.git", branch = "semsan" } +libafl_qemu = { git = "https://github.com/dergoegge/LibAFL.git", branch = "semsan", features = ["usermode"], optional = true } libc = "0.2.155" serde = "1.0.200" diff --git a/src/main.rs b/src/main.rs index 027e6a3..7c1b987 100644 --- a/src/main.rs +++ b/src/main.rs @@ -14,9 +14,10 @@ use libafl::{ corpus::{Corpus, HasTestcase, InMemoryCorpus, OnDiskCorpus, Testcase}, events::{ProgressReporter, SimpleEventManager}, executors::{DiffExecutor, ExitKind, ForkserverExecutor}, + feedback_and, feedback_and_fast, feedback_not, feedback_or, feedbacks::{ differential::{DiffFeedback, DiffResult}, - MaxMapFeedback, + ConstFeedback, DiffExitKindFeedback, MaxMapFeedback, }, inputs::{BytesInput, HasMutatorBytes, HasTargetBytes, Input}, monitors::SimplePrintingMonitor, @@ -187,11 +188,8 @@ fn main() -> std::process::ExitCode { // Both observers are combined into a `DiffFeedback` that compares the retrieved values from // the two observers described above. - let mut objective = DiffFeedback::new( - "diff-value-feedback", - &primary_diff_value_observer, - &secondary_diff_value_observer, - |o1, o2| { + let compare_characterization_values = + |o1: &ShMemDifferentialValueObserver, o2: &ShMemDifferentialValueObserver| { if opts.debug { println!( "Observed characterization values: v1={:?} v2={:?}", @@ -220,9 +218,39 @@ fn main() -> std::process::ExitCode { DiffResult::Diff } - }, - ) - .unwrap(); + }; + + let mut objective = feedback_or!( + feedback_and_fast!( + ConstFeedback::new(opts.ignore_exit_kind), + // Only report differences in the characterization value as behavioral differences. + feedback_and!( + feedback_not!(DiffExitKindFeedback::new()), + DiffFeedback::new( + "diff-value-feedback-0", + &primary_diff_value_observer, + &secondary_diff_value_observer, + compare_characterization_values, + ) + .unwrap() + ) + ), + feedback_and_fast!( + ConstFeedback::new(!opts.ignore_exit_kind), + // Report differences in exit kind or differences in the characterization value as + // behavioral differences. + feedback_or!( + DiffExitKindFeedback::new(), + DiffFeedback::new( + "diff-value-feedback-1", + &primary_diff_value_observer, + &secondary_diff_value_observer, + compare_characterization_values, + ) + .unwrap() + ) + ) + ); let mut primary_coverage_shmem = shmem_provider.new_shmem(MAX_MAP_SIZE).unwrap(); let mut secondary_coverage_shmem = shmem_provider.new_shmem(MAX_MAP_SIZE).unwrap(); @@ -446,6 +474,7 @@ fn main() -> std::process::ExitCode { } if !fuzz_opts.ignore_solutions && state.solutions().count() != 0 { + eprintln!("EXIT: semantic difference found"); return std::process::ExitCode::from(opts.solution_exit_code); } } diff --git a/src/options.rs b/src/options.rs index 731bd93..59844ad 100644 --- a/src/options.rs +++ b/src/options.rs @@ -137,6 +137,13 @@ pub struct Options { )] pub shared_args: Vec, + #[arg( + long = "ignore-exit-kind", + help = "Don't report differences in exit kind (e.g. crashes or timeouts) as behavioral differences", + default_value_t = false + )] + pub ignore_exit_kind: bool, + #[command(subcommand)] pub command: Command, #[arg(