Functions — github.com/awslabs/snapchange

hub / github.com/awslabs/snapchange / functions

Functions430 in github.com/awslabs/snapchange

⨍ Functions 430◇ Types & classes 163

↓ 56 callersMethoditer

(&self)

src/page_table.rs:189

↓ 54 callersMethodcontains

Checks if the given address is in the module list. Returns the (`module_name`, `offset_in_module`) if found.

src/cmdline.rs:220

↓ 51 callersMethodcr3

(&self)

src/fuzzvm.rs:1009

↓ 43 callersMethodnext

(&mut self)

src/rng.rs:95

↓ 31 callersMethodget

Get the current data from `stream`

src/filesystem.rs:159

↓ 31 callersMethodwrite

Write the requested type from the given [`VirtAddr`] using given the [`Cr3`] page table # Example ```rust let mut fuzzvm = FuzzVm::create(..); let a

src/fuzzvm.rs:1201

↓ 24 callersMethodoffset

(self, offset: u64)

src/addrs.rs:23

↓ 21 callersFunctiongenerate

(rng: &mut Rng, data: &mut Vec<u8>)

examples/03_ffmpeg_custom_mutator/mov_generator.rs:438

↓ 20 callersFunctionrdtsc

()

src/utils.rs:94

↓ 18 callersMethodadd

Add the given cycles to the given [`PerfMark`]

src/stats.rs:207

↓ 17 callersMethodwrite_shellcode

Write the given `bytes` into the shellcode allocation in the fuzzvm

examples/04_syscall_fuzzer/fuzzer.rs:270

↓ 14 callersMethodread

Read the requested type from the given [`VirtAddr`] using the [`Cr3`] page table # Example ```rust let mut fuzzvm = FuzzVm::create(..); let addr = V

src/fuzzvm.rs:1174

↓ 13 callersMethodrip

Get the current RIP

src/stack_unwinder.rs:127

↓ 12 callersMethodfake_immediate_return

(&mut self)

src/fuzzvm.rs:2803

↓ 12 callersMethodget_symbol

(&self, addr: u64)

src/fuzzvm.rs:2159

↓ 12 callersMethodphys_addr

Get the [`PhysAddr`] for this translation

src/page_table.rs:272

↓ 12 callersMethodstart

Start the timer for the given [`PerfMark`]

src/stats.rs:191

↓ 11 callersMethodsregs

(&self)

src/fuzzvm.rs:974

↓ 11 callersMethodwrite_bytes_dirty

Write bytes in `buf` to the [`VirtAddr`] translating using [`Cr3`] while keeping track of that we manually dirtied these pages # Example ```rust let

src/fuzzvm.rs:1268

↓ 10 callersMethodread_bytes

Read bytes from the [`VirtAddr`] translating using [`Cr3`] into the given `buf` # Example ```rust let mut fuzzvm = FuzzVm::create(..); // Read from

src/fuzzvm.rs:1149

↓ 10 callersMethodtranslate

(&self, virt_addr: VirtAddr, cr3: Cr3)

src/memory.rs:204

↓ 10 callersMethodwrite_bytes

Write bytes in `buf` to the [`VirtAddr`] translating using [`Cr3`]. The bytes written this way are not considered dirty and will not be restored on re

src/fuzzvm.rs:1248

↓ 9 callersMethodfuzz_hash

Get the hash for this input

src/fuzz_input.rs:92

↓ 8 callersMethodaddress

(self)

src/page_table.rs:127

↓ 8 callersMethodhandle_breakpoint

Handle a breakpoint instruction Two conditions that are handled: Normal breakpoint - Checks if the current address is a breakpoint known by [`FuzzVm

src/fuzzvm.rs:2331

↓ 8 callersMethoditer_mut

(&mut self)

src/page_table.rs:195

↓ 8 callersMethodrun

Pass execution to the VM. Returns the `FuzzVmExit` along with the number of cycles in the KVM VM itself.

src/fuzzvm.rs:3755

↓ 7 callersFunctionget_symbol

Get the symbol for the given `addr` using the given `symbols`

src/symbols.rs:65

↓ 7 callersFunctionhandle_vmexit

Handle the given [`FuzzVmExit`]

src/lib.rs:353

↓ 7 callersMethodset_breakpoint

Set a breakpoint at the given [`VirtAddr`] using [`Cr3`] as the page table, returning the breakpoint index for the set breakpoint # Errors Attemptin

src/fuzzvm.rs:2171

↓ 7 callersMethodto_bytes

(&self, output: &mut Vec<u8>)

src/fuzz_input.rs:136

↓ 6 callersMethoddebug_regs

Get the current special register state of the VM # Example ``` let mut fuzzvm = FuzzVm::create(..); let dr6 = fuzzvm.debug_regs()?.dr6; ``` # Error

src/fuzzvm.rs:996

↓ 6 callersFunctionget_cmp_analysis_from_instr_mlil

Walk the MLIL graph looking for the memory or register values to read in preparation for CMP analysis

coverage_scripts/bn_snapchange.py:888

↓ 6 callersFunctionget_cmp_analysis_from_instr_mlil

Walk the MLIL graph looking for the memory or register values to read in preparation for CMP analysis

fuzzer_template/coverage_scripts/bn_snapchange.py:888

↓ 6 callersFunctioninit_environment

Perform KVM initialization routines and common project setup steps for all subcommands

src/lib.rs:905

↓ 6 callersMethodreset_fuzzer_state

Reset the state of the current fuzzer

src/fuzzer.rs:132

↓ 6 callersMethodreset_guest_state

Reset the guest state back to the original snapshot and return the performance counters of each step # Errors If the snapshot MSRs fail to be set by

src/fuzzvm.rs:3274

↓ 6 callersMethodset_input

(&mut self, input: &Self::Input, fuzzvm: &mut FuzzVm<Self>)

src/fuzzer/template.rs:26

↓ 6 callersFunctionunblock_sigalrm

Unblock SIGALRM for this thread

src/lib.rs:289

↓ 5 callersMethod_get_index

Get the internal index for this file desscriptor

src/filesystem.rs:87

↓ 5 callersFunctionijon_simple_hash

shamelessly plucked from the ijon project

examples/05_redqueen/harness/test_redqueen.c:30

↓ 5 callersMethodpage

(self)

src/addrs.rs:37

↓ 5 callersMethodprint_context

Print the context of the current state of the guest. This is a debugging tool used for getting an idea of the state of the guest during a breakpoint

src/fuzzvm.rs:1986

↓ 5 callersMethodrand_u64

(&mut self)

src/rng.rs:160

↓ 5 callersMethodregs

(&self)

src/fuzzvm.rs:947

↓ 5 callersMethodreset_and_run_with_redqueen

( &mut self, input: &FUZZER::Input, fuzzer: &mut FUZZER, vm_timeout: Duration,

src/fuzzvm.rs:4310

↓ 5 callersFunctionrestore_terminal

Restore the state of the terminal pub fn restore_terminal(mut terminal: Terminal<CrosstermBackend<Stdout>>) -> Result<()> {

src/stats_tui.rs:123

↓ 5 callersMethodset_page_boundaries

(&mut self, virt_addr: VirtAddr, mut size: u64)

src/memory.rs:1016

↓ 4 callersMethodget_instruction_string_at

Print the [`Instruction`] at the given [`VirtAddr`] using the given [`Cr3`] # Errors If getting the current instruction at `virt_addr` fails

src/memory.rs:979

↓ 4 callersMethodhandle_crash

Fuzzer specific handling of a crashing `input` bytes with the [`FuzzVm`] that originally will write to `crash_file`. Defaults to nothing. # Errors T

src/fuzzer.rs:238

↓ 4 callersFunctionis_instr_const

Returns True if this instruction is not dynamic for the purposes of compare analysis

coverage_scripts/bn_snapchange.py:872

↓ 4 callersFunctionis_instr_const

Returns True if this instruction is not dynamic for the purposes of compare analysis

fuzzer_template/coverage_scripts/bn_snapchange.py:872

↓ 4 callersFunctionparse_cli_symbol

Parse the given `argument` as a `VirtAddr` Examples: ``` deadbeef 0xdeadbeef main main+123 main+0x123 ``` # Errors Attempted to parse an unknown s

src/utils.rs:166

↓ 4 callersMethodread_c_string

(&mut self, virt_addr: VirtAddr, cr3: Cr3)

src/fuzzvm.rs:2772

↓ 4 callersMethodset_rip

Set the current RIP

src/stack_unwinder.rs:132

↓ 4 callersMethodwrite_phys_bytes

Write the bytes in `buf` to the [`PhysAddr`] # Errors Write to an unmapped virtual address Translated physical address is outside the bounds of gues

src/memory.rs:802

↓ 4 callersFunctionwrite_register

(apic: &mut kvm_lapic_state, reg: Register, value: u32)

src/apic.rs:251

↓ 3 callersFunction_dump

Helper function to create prompt to configur exports and then launch the respective tasks.

coverage_scripts/bn_snapchange.py:659

↓ 3 callersFunction_dump

Helper function to create prompt to configur exports and then launch the respective tasks.

fuzzer_template/coverage_scripts/bn_snapchange.py:659

↓ 3 callersMethodalloc_scratch

Allocate a shellcode address

examples/04_syscall_fuzzer/fuzzer.rs:305

↓ 3 callersMethodbacking

(&self)

src/memory.rs:195

↓ 3 callersMethodenable_single_step

(&mut self)

src/fuzzvm.rs:880

↓ 3 callersMethodfinish

Create the `u32` from the current [`SpuriousInterrupt`]

src/apic.rs:149

↓ 3 callersMethodflags

(self)

src/page_table.rs:121

↓ 3 callersMethodget_current_verbose_instruction_string

Get decoded instruction at the given [`VirtAddr`] using the given [`Cr3`] with additional information about the operands from the instruction # Examp

src/fuzzvm.rs:1426

↓ 3 callersMethodget_iced_reg

(&self, reg: Register)

src/regs/x86.rs:284

↓ 3 callersMethodget_instruction_at

Get the [`Instruction`] at the given instruction pointer using the given [`Cr3`] # Errors Error during `read` of the given `virt_addr`

src/memory.rs:959

↓ 3 callersMethodget_module_range

Returns the address range of the given module name

src/cmdline.rs:239

↓ 3 callersFunctionget_project_state

Get the [`ProjectState`] from the given project directory # Errors Parsing of the register state files, coverage breakpoints, or modules file Error

src/cmdline.rs:523

↓ 3 callersMethodget_redqueen_rule_candidates

(&self, rule: &RedqueenRule)

src/fuzz_input.rs:349

↓ 3 callersFunctionhexdump

Prints a hexdump representation of the given `data` assuming the data starts at `starting_address`

src/utils.rs:29

↓ 3 callersFunctionname

Get the name of the given gimli Register

src/stack_unwinder.rs:86

↓ 3 callersMethodpresent

Returns `true` if the `present` bit is set in the [`EntryFlags`]

src/page_table.rs:57

↓ 3 callersMethodread_bytes

Read bytes from the [`VirtAddr`] translating using [`Cr3`] into the given `buf` # Errors Read from an unmapped virtual address # Panics If the `si

src/memory.rs:631

↓ 3 callersMethodread_phys_bytes

Read bytes from the [`PhysAddr`] into the given `buf` # Errors The given physical address is out of bounds of the allocated physical memory

src/memory.rs:483

↓ 3 callersFunctionsave_input_in_dir

Save the [`FuzzInput`] into the directory using the hash of input as the filename # Errors Given `input.to_bytes()` failed Failed to write the bytes

src/utils.rs:117

↓ 3 callersMethodset_writable

Set the writable bit in the given entry

src/page_table.rs:147

↓ 3 callersMethodsyscall_blacklist

Set of syscalls the fuzzer will manually NOT handle, while handling all others. Cannot be used with `syscall_whitelist`

src/fuzzer.rs:144

↓ 3 callersMethodsyscall_whitelist

Set of syscalls the fuzzer will manually handle, while ignoring all others. Cannot be used with `syscall_blacklist`

src/fuzzer.rs:138

↓ 3 callersFunctionwrite_crash_input

Write the given `input` into `crash_dir`/`path`, allowing the given [`Fuzzer`] to handle the crash as well. # Returns Path to input file written

src/lib.rs:315

↓ 3 callersMethodwrite_scratch

Write `bytes` into a scratch memory allocation and return the address of the written to memory

examples/04_syscall_fuzzer/fuzzer.rs:294

↓ 2 callersFunctionasm_syscall

The syscall assembly instructions

examples/04_syscall_fuzzer/fuzzer.rs:53

↓ 2 callersFunctionblock_sigalrm

Block SIGALRM for this thread

src/lib.rs:811

↓ 2 callersFunctioncalculate_hash

Returns the hash of the given input using [`DefaultHasher`]

src/utils.rs:99

↓ 2 callersMethodcreate

Create a [`FuzzVm`] using the given [`VmFd`] and snapshot registers from [`VbCpu`] with a memory backing at address `memory_backing` # Errors If KVM

src/fuzzvm.rs:608

↓ 2 callersMethoddisable_single_step

(&mut self)

src/fuzzvm.rs:932

↓ 2 callersFunctionenable_manual_dirty_log_protect

Enable manual dirty log protect in the given VM. According to the KVM Documentation, "At the cost of a slightly more complicated operation, this prov

src/lib.rs:831

↓ 2 callersMethodexecutable

Returns `true` if the `execute_disable` bit is not set in the [`EntryFlags`]

src/page_table.rs:77

↓ 2 callersMethodfill_bytes

(&mut self, dest: &mut [u8])

src/rng.rs:47

↓ 2 callersMethodget

Get the given gimli register

src/stack_unwinder.rs:147

↓ 2 callersFunctionget_cmp_analysis_from_instr_llil

(curr_instr, address, iters)

coverage_scripts/bn_snapchange.py:758

↓ 2 callersFunctionget_cmp_analysis_from_instr_llil

(curr_instr, address, iters)

fuzzer_template/coverage_scripts/bn_snapchange.py:758

↓ 2 callersMethodget_module_start_containing

Returns the loaded address of the module containing `addr`, `None` otherwise

src/cmdline.rs:250

↓ 2 callersMethodget_symbol_address

(&self, subsymbol: &str)

src/fuzzvm.rs:2251

↓ 2 callersMethodget_symbols_containing

(&self, subsymbol: &str)

src/fuzzvm.rs:2295

↓ 2 callersFunctionhexdigest

Returns the formatted hash of the given input as hexadecimal digits

src/utils.rs:106

↓ 2 callersMethodinit_files

Initialize files available to the guest # Errors The target specific fuzzer failed to initialize a filesystem

src/fuzzer.rs:262

↓ 2 callersMethodinit_guest

Initialize guest state using the [`VbCpu`] for this [`FuzzVm`] # Errors If the snapshot MSRs fail to be set by KVM

↓ 2 callersFunctionmov_mem_r15_from_rax

mov [r15], rax

examples/04_syscall_fuzzer/fuzzer.rs:58

next →1–100 of 430, ranked by callers