Skip to content

Make unicornafl more Rust-friendly and sync with newest unicorn-engine Rust crate #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 22, 2025

Conversation

Evian-Zhang
Copy link
Contributor

In this PR, there are two closely-related changes (it should be noted that the functionality and logic are never changed and everything would just work fine, no breaking changes.):

  • Current code is synced with newest unicorn-engine Rust crate.

    Since the unicorn-engine binding and wrapper have been greatly refactored and improved.

  • Some APIs and internal structures are refactored to be more Rust-friendly.

    The ultimate entrypoint is refactored into four functions in lib.rs: afl_fuzz_custom, afl_fuzz, uc_afl_fuzz, uc_afl_fuzz_custom. The first two are for Rust-users, and the last two are for FFI users (The real implementation is still the child_fuzz in target.rs, those four are just some wrappers).

    Since we can only expose fuzzing entrypoint to FFI users, the internal design, as a result, can be pure Rust, and no extern "C", no c_void, no *mut. This could not only improve the maintenance of this library, but also potentially improve the performance for both Rust users and FFI users.

@wtdcode
Copy link
Member

wtdcode commented Apr 21, 2025

Could you try cargo miri on the sample?

*I should also add a CI for that.

@Evian-Zhang
Copy link
Contributor Author

Sure, I'll test it tomorrow.

@wtdcode
Copy link
Member

wtdcode commented Apr 21, 2025

Also we now further depend on unicorn@dev. We should reflect that in the Cargo.toml

@Evian-Zhang
Copy link
Contributor Author

Could you trycargo miri on the sample?

I tried cargo +nightly miri run --example sample, but it does not support FFI function calls (BTW, the compilation for libafl_targets took forever):

error: unsupported operation: can't call foreign function `uc_open` on OS `linux`
   --> /home/aota/.cargo/git/checkouts/unicorn-a201e6327e516c06/89a1422/bindings/rust/src/lib.rs:191:18
    |
191 |         unsafe { uc_open(arch, mode, &mut handle) }.and_then(|| {
    |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ can't call foreign function `uc_open` on OS `linux`
    |
    = help: if this is a basic API commonly used on this target, please report an issue with Miri
    = help: however, note that Miri does not aim to support every FFI function out there; for instance, we will not support APIs for things such as GUIs, scripting languages, or databases
    = note: BACKTRACE:
    = note: inside `unicorn_engine::Unicorn::<'_, unicornafl::executor::UnicornFuzzData<()>>::new_with_data` at /home/aota/.cargo/git/checkouts/unicorn-a201e6327e516c06/89a1422/bindings/rust/src/lib.rs:191:18: 191:50
note: inside `main`
   --> examples/sample.rs:27:18
    |
27  |     let mut uc = Unicorn::new_with_data(Arch::X86, Mode::MODE_64, UnicornFuzzData::default())
    |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

And you should also patch your libafl to add not(miri) here. (BTW, would you mind telling why maintaining a separate fork instead of pushing to LibAFL mainstream repo?)

Also we now further depend on unicorn@dev. We should reflect that in the Cargo.toml

Currently in Cargo.toml, it has already in there:

unicorn-engine = { git = "https://github.com/unicorn-engine/unicorn", branch = "dev"}

@wtdcode
Copy link
Member

wtdcode commented Apr 22, 2025

Could you trycargo miri on the sample?

I tried cargo +nightly miri run --example sample, but it does not support FFI function calls (BTW, the compilation for libafl_targets took forever):

error: unsupported operation: can't call foreign function `uc_open` on OS `linux`
   --> /home/aota/.cargo/git/checkouts/unicorn-a201e6327e516c06/89a1422/bindings/rust/src/lib.rs:191:18
    |
191 |         unsafe { uc_open(arch, mode, &mut handle) }.and_then(|| {
    |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ can't call foreign function `uc_open` on OS `linux`
    |
    = help: if this is a basic API commonly used on this target, please report an issue with Miri
    = help: however, note that Miri does not aim to support every FFI function out there; for instance, we will not support APIs for things such as GUIs, scripting languages, or databases
    = note: BACKTRACE:
    = note: inside `unicorn_engine::Unicorn::<'_, unicornafl::executor::UnicornFuzzData<()>>::new_with_data` at /home/aota/.cargo/git/checkouts/unicorn-a201e6327e516c06/89a1422/bindings/rust/src/lib.rs:191:18: 191:50
note: inside `main`
   --> examples/sample.rs:27:18
    |
27  |     let mut uc = Unicorn::new_with_data(Arch::X86, Mode::MODE_64, UnicornFuzzData::default())
    |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I use MIRIFLAGS="-Zmiri-disable-isolation" locally.

And you should also patch your libafl to add not(miri) here. (BTW, would you mind telling why maintaining a separate fork instead of pushing to LibAFL mainstream repo?)

It is just not ready and the code need some cleanup

AFLplusplus/LibAFL#3087

Also we now further depend on unicorn@dev. We should reflect that in the Cargo.toml

Currently in Cargo.toml, it has already in there:

unicorn-engine = { git = "https://github.com/unicorn-engine/unicorn", branch = "dev"}

Okay I see.

@Evian-Zhang
Copy link
Contributor Author

Setting MIRIFLAGS="-Zmiri-disable-isolation" still turns out the same error in my local machine (latest rustc nightly in Ubuntu).

wtdcode added a commit to wtdcode/LibAFL that referenced this pull request Apr 22, 2025
@wtdcode
Copy link
Member

wtdcode commented Apr 22, 2025

I see, miri always fails =(.

@wtdcode wtdcode merged commit a782a26 into AFLplusplus:v3 Apr 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants