Implement CanTrack - tracking enforcement through rust types #1886

addisoncrump · 2024-02-27T02:38:43Z

This comes from a suggestion in the discord to type-enforce whether indices/novelties should be tracked.

It turns out that you cannot infer whether it needs to be or not based purely on usage. This is a limitation of Rust -- I have tried many, many different ways of doing this now with no avail (pure type encoding, GAT encoding, associated constant encoding, even this nightmare-fuel syntax), but we can encode the metadata -- it just has to be manually performed by the user.

I added some docs and only modified MapFeedback and MinimizerScheduler for the sake of demonstration. Play around with libfuzzer_stb_image to see how the compiler output feels and such when intentionally disabling index tracking.

addisoncrump · 2024-02-27T02:41:05Z

cc @sadeli413 as you were the one who mentioned this

addisoncrump · 2024-02-28T13:21:25Z

I've improved this a bit s.t. it dumps a helpful compiler message if you've done it wrong.

addisoncrump · 2024-02-28T14:36:10Z

I've improved this further by integrating with the existing pattern:

addisoncrump · 2024-02-28T14:40:31Z

Is this something we want to pursue? I'm happy to make the remaining changes, but it's a lot of work and I don't want to get started without a preliminary review.

fuzzers/libfuzzer_stb_image/src/main.rs

addisoncrump · 2024-02-28T15:49:11Z

Unless there are any complaints I'll start implementing this March 1st.

libafl/src/observers/map.rs

fuzzers/libfuzzer_stb_image/src/main.rs

libafl/src/observers/map.rs

addisoncrump · 2024-02-29T16:23:34Z

@domenukk So, now the only new onus on implementors of MapObserver is to impl AsRef<Self>. Making things that accept MapObservers is now a little more complicated (because it needs to accept an AsRef<O> where O is the map observer).

The reason is that now, there's a wrapper type ("ExplicitTracking") which just wraps the map observer and forwards its observer implementation. But we can impl TrackingHinted for all map observers now with a default without them needing to do any type-fu at the definition and ExplicitTracking carries the tracking information if it needs to be specified. This works because now A: AsRef<O> can now be A = O when no tracking information is specified => we fall back to the "no tracking default". If we had specialisation, we could drop the need for this AsRef nonsense and just impl MapObserver for ExplicitTracking, but sadly we need it because we define TrackingHinted over all MapObservers and we end up with a conflict.

domenukk · 2024-03-04T22:26:36Z

fuzzers/baby_fuzzer_grimoire/src/main.rs

@@ -15,7 +15,7 @@ use libafl::{
        GrimoireRandomDeleteMutator, GrimoireRecursiveReplacementMutator,
        GrimoireStringReplacementMutator, Tokens,
    },
-    observers::StdMapObserver,
+    observers::{StdMapObserver, TrackingHinted},


I think Hinted isn't a great name, it's the how not the what, right? Maybe EnableTracking or something?

Or CanTrack lol

MaybeTracks? :p

HintsTracking also feels gross.

I like CanTrack, sounds like CanBus (and is in line with HasXYZ)

CanTrack seems the best out of these options. I'll do a mass rename once CI is clear.

Maybe even a CanTrackX for each individual trackable feature?

Hm, I don't think this is desirable. Splitting this trait further doesn't help us, since map observers will always implement both.

Ok, I was just thinking we might have a CanTrackfor something else later

libafl_frida/build.rs

addisoncrump · 2024-03-06T16:31:06Z

There is a difference between formatting in stable and nightly... not optimal

addisoncrump · 2024-03-06T16:33:52Z

See:

It seems we are inconsistently using rustfmt somehow. I'll fix this later.

domenukk · 2024-03-08T23:47:58Z

I think we can always use nightly fmt then

addisoncrump · 2024-03-11T12:56:43Z

Okay, I forced the formatter version and for some reason it continues to format differently.

domenukk · 2024-03-13T00:38:56Z

[*] Checking fmt for ./fuzzers/libfuzzer_stb_image_concolic/fuzzer
Warning: can't set `imports_granularity = Crate`, unstable features are only available in nightly channel.
Warning: can't set `group_imports = StdExternalCrate`, unstable features are only available in nightly channel.
Warning: can't set `imports_granularity = Crate`, unstable features are only available in nightly channel.
Warning: can't set `group_imports = StdExternalCrate`, unstable features are only available in nightly channel.
Diff in /home/runner/work/LibAFL/LibAFL/fuzzers/libfuzzer_stb_image_concolic/fuzzer/src/main.rs at line 3:
Warning: can't set `imports_granularity = Crate`, unstable features are only available in nightly channel.
Warning: can't set `group_imports = StdExternalCrate`, unstable features are only available in nightly channel.

-> It's not using nightly here as you can see in the Warnings. We should probably fmt everything with nightly for the time being

fuzzers/frida_executable_libpng/src/fuzzer.rs

addisoncrump · 2024-03-13T12:04:04Z

Rebased, that was a doozy.

domenukk · 2024-03-13T12:45:11Z

Oooh sorry I had already merged main into this guy locally, but forgot to push 🙈

domenukk · 2024-03-15T16:42:41Z

Needs more .scripts/fmt-all.sh

domenukk · 2024-04-12T12:22:46Z

Rebasing is way more work than merging, you have to touch the same line multiple times... Will merge again in the future

mkravchik · 2024-04-17T09:03:33Z

It seems that this change broke fuzzers/forkserver_libafl_cc. It builds, but the run fails. It first fails because the map size is smaller then the default. If I fix this, it fails because it does not find the observer:
if let Some(dynamic_map_size) = executor.coverage_map_size() {
executor
.observers_mut()
.match_name_mut::<HitcountsMapObserver<StdMapObserver<'_, u8, false>>>("shared_mem")
.unwrap()
.truncate(dynamic_map_size);
}
When I print the type_name of the observer, it tells me it is ExplicitTracking<HitcountsMapObserver... and not just <HitcountsMapObserver...

tokatoka · 2024-04-17T09:33:16Z

libafl/src/executors/forkserver.rs

@@ -636,13 +636,14 @@ impl<'a, SP> ForkserverExecutorBuilder<'a, SP> {

    /// Builds `ForkserverExecutor` downsizing the coverage map to fit exaclty the AFL++ map size.
    #[allow(clippy::pedantic)]
-    pub fn build_dynamic_map<MO, OT, S>(
+    pub fn build_dynamic_map<A, MO, OT, S>(


i guess this part didn't have to be changed

addisoncrump requested review from domenukk and tokatoka February 27, 2024 02:38

domenukk reviewed Feb 28, 2024

View reviewed changes

fuzzers/libfuzzer_stb_image/src/main.rs Outdated Show resolved Hide resolved

addisoncrump force-pushed the enforced-tracking branch from 8e15033 to d33db5d Compare February 28, 2024 15:12

domenukk reviewed Feb 28, 2024

View reviewed changes

addisoncrump force-pushed the enforced-tracking branch 2 times, most recently from 94f6fa2 to ff33d7a Compare March 4, 2024 13:17

domenukk reviewed Mar 4, 2024

View reviewed changes

addisoncrump force-pushed the enforced-tracking branch from 2628ead to cea4817 Compare March 5, 2024 14:57

addisoncrump marked this pull request as ready for review March 5, 2024 14:57

addisoncrump commented Mar 5, 2024

View reviewed changes

libafl_frida/build.rs Outdated Show resolved Hide resolved

addisoncrump force-pushed the enforced-tracking branch from a83c907 to 93a89de Compare March 6, 2024 11:11

addisoncrump mentioned this pull request Mar 6, 2024

Language: replace indices with indexes #1914

Closed

domenukk reviewed Mar 13, 2024

View reviewed changes

fuzzers/frida_executable_libpng/src/fuzzer.rs Show resolved Hide resolved

addisoncrump commented Mar 13, 2024

View reviewed changes

fuzzers/frida_executable_libpng/src/fuzzer.rs Show resolved Hide resolved

addisoncrump force-pushed the enforced-tracking branch from 890a530 to 9936d08 Compare March 13, 2024 12:03

addisoncrump and others added 17 commits April 12, 2024 14:16

fix remaining fuzzers

b9bcab4

fix windows build, maybe

f649819

fixup libafl_libfuzzer

8c25c19

fmt nighlty all the things

d95c573

attempt to fix some broken additions

df5abb0

fix fmt

4868c6e

oops

8a9501d

fix new invocation

45d7c9b

minimizer scheduler fixes

d418cba

fix accounting

9b1fcf9

rename

d10237e

fix

b4cdb82

Fix build

6d3cdbd

Sort generics

7673144

Move more generics into the right place

39399ed

Rename A -> C

565c3d9

Fix test

6d37e59

domenukk force-pushed the enforced-tracking branch from 4f9fad6 to 6d37e59 Compare April 12, 2024 12:22

domenukk added 5 commits April 12, 2024 14:31

Fix test some more

8bbcba3

Fix doc some more

8aade5c

critical formatting

b0fdeba

More A->C

b6ffb90

CanTrack harder

5940a44

domenukk merged commit 3d702f4 into main Apr 12, 2024
78 checks passed

domenukk deleted the enforced-tracking branch April 12, 2024 16:33

tokatoka reviewed Apr 17, 2024

View reviewed changes

This was referenced Apr 17, 2024

Fix some missing tracking hints #2058

Merged

Implement "ObserverRef" to avoid explicitly referring to observer types #2064

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement CanTrack - tracking enforcement through rust types #1886

Implement CanTrack - tracking enforcement through rust types #1886

addisoncrump commented Feb 27, 2024

addisoncrump commented Feb 27, 2024

addisoncrump commented Feb 28, 2024

addisoncrump commented Feb 28, 2024

addisoncrump commented Feb 28, 2024 •

edited

Loading

addisoncrump commented Feb 28, 2024

addisoncrump commented Feb 29, 2024 •

edited

Loading

domenukk Mar 4, 2024

domenukk Mar 4, 2024

addisoncrump Mar 5, 2024

addisoncrump Mar 5, 2024

domenukk Mar 13, 2024

addisoncrump Mar 13, 2024

domenukk Mar 20, 2024

addisoncrump Mar 20, 2024

domenukk Mar 21, 2024

domenukk Apr 6, 2024

addisoncrump commented Mar 6, 2024

addisoncrump commented Mar 6, 2024

domenukk commented Mar 8, 2024

addisoncrump commented Mar 11, 2024

domenukk commented Mar 13, 2024

addisoncrump commented Mar 13, 2024

domenukk commented Mar 13, 2024 •

edited

Loading

domenukk commented Mar 15, 2024

domenukk commented Apr 12, 2024

mkravchik commented Apr 17, 2024

tokatoka Apr 17, 2024

Implement CanTrack - tracking enforcement through rust types #1886

Implement CanTrack - tracking enforcement through rust types #1886

Conversation

addisoncrump commented Feb 27, 2024

addisoncrump commented Feb 27, 2024

addisoncrump commented Feb 28, 2024

addisoncrump commented Feb 28, 2024

addisoncrump commented Feb 28, 2024 • edited Loading

addisoncrump commented Feb 28, 2024

addisoncrump commented Feb 29, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

addisoncrump commented Mar 6, 2024

addisoncrump commented Mar 6, 2024

domenukk commented Mar 8, 2024

addisoncrump commented Mar 11, 2024

domenukk commented Mar 13, 2024

addisoncrump commented Mar 13, 2024

domenukk commented Mar 13, 2024 • edited Loading

domenukk commented Mar 15, 2024

domenukk commented Apr 12, 2024

mkravchik commented Apr 17, 2024

Choose a reason for hiding this comment

addisoncrump commented Feb 28, 2024 •

edited

Loading

addisoncrump commented Feb 29, 2024 •

edited

Loading

domenukk commented Mar 13, 2024 •

edited

Loading