UnicornAFL v3 #43
UnicornAFL v3 #43
Conversation
Make unicornafl more Rust-friendly and sync with newest unicorn-engine Rust crate
Fix cmp hook
Fix iter count if we have afl++
Migrate to newest libafl
Allow infinite iteration
Add cmplog
Add C header and several improvements
|
what the heck manylinux only has clang-3/5 =( |
|
Fixed up python bindings & CI! We need a python example as well to test it really works. Maybe just copy the same harness from the rust sample. @Evian-Zhang Would you like to do this? |
|
Sure, I have created a Python sample, but found out that the Python binding have many bugs... See #48 Maybe you could fix those bugs. ❤️ |
Co-Authored-by: Evian-Zhang <[email protected]>
|
Fixed and it works with: |
|
All unicorn mode does is set SKIP_BIN_CHECK IIRC. |
btw, check AFLplusplus/AFLplusplus#2468 |
|
*QEMU mode was used above because AFL++ explicity prevents us from using cmplog for unicorn mode. |
|
Ah, well, we should patch afl++ then |
python/unicornafl/__init__.py
Outdated
| ctypes.cast(cb2, ctypes.c_void_p).value, | ||
| always_validate, | ||
| persistent_iters, | ||
| ctypes.cast(idx, ctypes.c_void_p) |
There was a problem hiding this comment.
Sorry for intruding, but is it possible that is should be this:
| ctypes.cast(idx, ctypes.c_void_p) | |
| ctypes.cast(idx, ctypes.c_void_p).value |
| exits_array, ctypes.c_void_p), exits_len, cb2, always_validate, persistent_iters, ctypes.cast(idx, ctypes.c_void_p)) | ||
|
|
||
| if isinstance(input_file, str): | ||
| input_file = input_file.encode('utf-8') |
There was a problem hiding this comment.
| input_file = input_file.encode('utf-8') | |
| input_file = input_file.encode('utf-8') + b"\x00" |
This does not seem sufficient - python_str.encode does not garantee null termination of the string buffer. I believe that that we must manually add a single zero byte to ensure that the string can be decoded by CStr::from_ptr(). Another valid path would be ctypes.create_string_buffer but that would not improve readability.
|
Yeah correct. Admittedly, I made this mistake twice =/.
________________________________
From: Richard Liebig ***@***.***>
Sent: Friday, June 13, 2025 6:20:10 PM
To: AFLplusplus/unicornafl ***@***.***>
Cc: lazymio ***@***.***>; Author ***@***.***>
Subject: Re: [AFLplusplus/unicornafl] UnicornAFL v3 (PR #43)
@rliebig commented on this pull request.
________________________________
In python/unicornafl/__init__.py<#43 (comment)>:
@@ -191,9 +125,27 @@ def uc_afl_fuzz(uc: Uc,
cb2 = ctypes.cast(UC_AFL_VALIDATE_CRASH_CB(
_validate_crash_cb), UC_AFL_VALIDATE_CRASH_CB)
- err = _uc2afl.uc_afl_fuzz(uc._uch, input_file.encode("utf-8"), cb1, ctypes.cast(
- exits_array, ctypes.c_void_p), exits_len, cb2, always_validate, persistent_iters, ctypes.cast(idx, ctypes.c_void_p))
-
+ if isinstance(input_file, str):
+ input_file = input_file.encode('utf-8')
⬇️ Suggested change
- input_file = input_file.encode('utf-8')
+ input_file = input_file.encode('utf-8') + b"\x00"
This does not seem sufficient - python_str.encode does not garantee null termination of the string. I believe that that we must manually add a single zero byte to ensure that the string can be decoded by CStr::from_ptr(). Another valid path would be ctypes.create_string_buffer but that would not improve readability.
—
Reply to this email directly, view it on GitHub<#43 (review)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AHJULO7SHIVS2TGZ3H3ZS5L3DKQVVAVCNFSM6AAAAAB5KE66JGVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZDSMRUGIZDENJSHE>.
You are receiving this because you authored the thread.Message ID: ***@***.***>
|
It is almost there! I just added maturin support, and the API should be the same with previous versions. The only things we left are: