Functions — github.com/awslabs/snapchange

CodeHub MCPcopy Create free account

hub / github.com/awslabs/snapchange / functions

Functions430 in github.com/awslabs/snapchange

⨍ Functions 430◇ Types & classes 163

↓ 2 callersMethodnext_u64

↓ 2 callersFunctionparse_cmp_operand

Parse the cmp line given by the binja plugin and return how to retrieve the information from a `fuzzvm`. Example: BP Address,Size,Operand 1,Operatio

examples/05_redqueen/build.rs:554

↓ 2 callersFunctionparse_cmp_operand

Parse the cmp line given by the binja plugin and return how to retrieve the information from a `fuzzvm`. Example: BP Address,Size,Operand 1,Operatio

fuzzer_template/.build.rs:554

↓ 2 callersFunctionparse_symbols

Parse the symbols handed to the hypervisor into the form or a fuzzer to take. This returns the symbols sorted in ascending order as well as the found

src/cmdline.rs:767

↓ 2 callersMethodpop_stack

src/fuzzvm.rs:2992

↓ 2 callersFunctionrdtsc

Wrapper around `rdtsc`

src/commands/minimize.rs:374

↓ 2 callersMethodread

Read the requested type from the given [`VirtAddr`] using the [`Cr3`] page table # Errors Read from an unmapped virtual address # Panics If the `s

src/memory.rs:557

↓ 2 callersMethodset

Set the given gimli register with the given value

src/stack_unwinder.rs:137

↓ 2 callersMethodset_executable

(&mut self, executable: bool)

src/page_table.rs:329

↓ 2 callersMethodtable_indexes

src/addrs.rs:84

↓ 2 callersMethodto_bytes

(&self, data: &mut Vec<u8>)

examples/03_ffmpeg_custom_mutator/mov_generator.rs:31

↓ 2 callersMethodto_bytes

(&self, data: &mut Vec<u8>)

examples/03_ffmpeg_custom_mutator/fuzzer.rs:113

↓ 2 callersMethodtranslate

(&self, virt_addr: VirtAddr, cr3: Cr3)

src/fuzzvm.rs:1321

↓ 2 callersMethodwritable

Returns `true` if the `writable` bit is set in the [`EntryFlags`]

src/page_table.rs:72

↓ 2 callersMethodwrite_breakpoint

Writes a breakpoint byte `0xcc` at the given [`VirtAddr`] optionally setting the written memory as dirty or not. The `BreakpointMemory` option is pri

src/fuzzvm.rs:1284

↓ 1 callersFunctionadd_nm_output

Parse `nm` output of `module` and add the resulting symbols to the symbol database using the `start_addr` as the starting address

qemu_snapshot/gdbsnapshot.py:214

↓ 1 callersFunctionadd_nm_output

Parse `nm` output of `module` and add the resulting symbols to the symbol database using the `start_addr` as the starting address

fuzzer_template/qemu_snapshot/gdbsnapshot.py:214

↓ 1 callersMethodalloc_shellcode

Allocate a shellcode address

examples/04_syscall_fuzzer/fuzzer.rs:277

↓ 1 callersMethodallocate_phys_page

Allocate an unused physical page # Panics Attempted to allocate a physical page without calling `memory.identify_used_phys_pages`.

src/memory.rs:340

↓ 1 callersMethodapic_software_enable

Set the APIC Software Enable flag to the given `val`

src/apic.rs:171

↓ 1 callersMethodapply_fuzzer_breakpoints

Apply the breakpoints from a [`Fuzzer`] to the VM. This will cache the original byte where the breakpoint

src/fuzzvm.rs:3036

↓ 1 callersMethodapply_redqueen_breakpoints

(&mut self, fuzzer: &FUZZER)

src/fuzzvm.rs:3147

↓ 1 callersMethodapply_redqueen_rule

( &mut self, _rule: &RedqueenRule, candidate: &Self::RuleCandidate, )

src/fuzz_input.rs:185

↓ 1 callersMethodapply_reset_breakpoints

Apply the reset breakpoints to the VM

src/fuzzvm.rs:3003

↓ 1 callersMethodbacktrace

Get the list of addresses of the backtrace for the current VM state

src/fuzzvm.rs:4529

↓ 1 callersMethodbest_options

Get the nodes sorted by best current score. The score for each node is the score of all of its unhit children nodes.

src/coverage_analysis.rs:330

↓ 1 callersFunctionbranchless

Returns 1 if found hash, 0 otherwise

examples/05_redqueen/harness/test_redqueen.c:39

↓ 1 callersMethodbreakpoints

Addresses or symbols that, if hit, trigger execution of a callback function. All symbols are checked to see if they contain the given symbol substrin

src/fuzzer.rs:199

↓ 1 callersFunctioncheck_extension_int

Wrapper over `KVM_CHECK_EXTENSION`. Returns 0 if the capability is not available and a positive integer otherwise.

↓ 1 callersFunctioncollect_kernel_symbols

Attempt to dump the kernel symbols. Fails if GDB is not ran as root

qemu_snapshot/gdbsnapshot.py:11

↓ 1 callersFunctioncollect_kernel_symbols

Attempt to dump the kernel symbols. Fails if GDB is not ran as root

fuzzer_template/qemu_snapshot/gdbsnapshot.py:11

↓ 1 callersFunctioncollect_process_memory_map

Dump the process memory map

qemu_snapshot/gdbsnapshot.py:43

↓ 1 callersFunctioncollect_process_memory_map

Dump the process memory map

fuzzer_template/qemu_snapshot/gdbsnapshot.py:43

↓ 1 callersMethodcoverage_left

src/cmdline.rs:131

↓ 1 callersMethodcrash_breakpoints

Breakpoints that, if hit, will cause the VM to be reset while saving input and state

src/fuzzer.rs:210

↓ 1 callersFunctioncreate_guest_memory_backing

Create the guest memory backing for the VM using the given snapshot file descriptor. # Errors Guest memory size is too small to fit in a `usize`

↓ 1 callersMethodcreate_unwinder

Attempt to create a [`StackUnwinder`] from the given binary # Errors Failed to create a [`StackUnwinder`] for the given binary

src/stack_unwinder.rs:228

↓ 1 callersMethodcurrent_address

src/fuzzvm.rs:1105

↓ 1 callersMethoddelivery_mode

Set the [`DeliveryMode`] for the current [`InterruptRegister`]

src/apic.rs:220

↓ 1 callersMethoddepth_first_search

Perform a depth-first search over the nodes to find all nodes reachable from any other node.

src/coverage_analysis.rs:266

↓ 1 callersFunctionderef_r15_into_rdi

examples/04_syscall_fuzzer/fuzzer.rs:63

↓ 1 callersMethoddisplay

Display the stats in a tabular format

src/stats.rs:339

↓ 1 callersFunctiondraw_coverage

Draw the `coverage` tab

src/stats_tui.rs:462

↓ 1 callersFunctiondraw_crashes

Draw the `crashes` tab

src/stats_tui.rs:508

↓ 1 callersFunctiondraw_log

Draw the `log` tab

src/stats_tui.rs:443

↓ 1 callersFunctiondraw_main

Draw the `main` tab

src/stats_tui.rs:140

↓ 1 callersFunctiondraw_tabs

Draw the tabs into the given [`Rect`]

src/stats_tui.rs:558

↓ 1 callersFunctiondraw_usage

Draw the usage of the TUI into the given [`Rect`]

src/stats_tui.rs:540

↓ 1 callersMethodeh_frame

Get an [`EhFrame`] from the current `eh_frame_data`

src/stack_unwinder.rs:439

↓ 1 callersFunctionenable_spurious_interrupt

(apic: &mut kvm_lapic_state, vector: u8)

src/apic.rs:185

↓ 1 callersMethodforced_signal

Get the signal during the `.force_sig_fault` call # Errors Failed to get a symbol at the current RIP. We should only attempt to parse the signal dur

src/linux.rs:160

↓ 1 callersFunctionfuzzme

examples/01_getpid/harness/example1.c:13

↓ 1 callersFunctionfuzzme

examples/05_redqueen/harness/test_redqueen.c:68

↓ 1 callersFunctiongather_data

(entry: PathBuf)

bench/gather_data/src/main.rs:17

↓ 1 callersFunctiongather_files

Gather files recursively from the given directory and write the paths to `out`

src/commands/find_input.rs:176

↓ 1 callersFunctionget_binary_contexts

( project_dir: &Path, )

src/stats.rs:567

↓ 1 callersFunctionget_config

Helper method to get relocation address and ignorelist via the binary ninja GUI interaction components.

coverage_scripts/bn_snapchange.py:614

↓ 1 callersFunctionget_config

Helper method to get relocation address and ignorelist via the binary ninja GUI interaction components.

fuzzer_template/coverage_scripts/bn_snapchange.py:614

↓ 1 callersMethodget_current_instruction

src/fuzzvm.rs:1399

↓ 1 callersFunctionget_elf_entry_point

Find the entry point of an ELF binary data slice # Panics Failed to create the needed slices for `from_le_bytes`

src/stack_unwinder.rs:193

↓ 1 callersFunctionget_instr_containing

Get the address of the instruction containing the `starting_addr` such that it is one instruciton behind the `next_instr` address

src/stack_unwinder.rs:347

↓ 1 callersMethodget_kasan_crash_path

Return the KASAN line (any WRITE found or first READ found). Used for getting a directory for a crash triggered by KASAN.

src/fuzzvm.rs:2926

↓ 1 callersFunctionget_register_alias

Get the register alias for the given register based on the requested size

coverage_scripts/bn_snapchange.py:1098

↓ 1 callersFunctionget_register_alias

Get the register alias for the given register based on the requested size

fuzzer_template/coverage_scripts/bn_snapchange.py:1098

↓ 1 callersFunctionget_subdirs

Recursively search the given path for other directories. Returns `true` if the directory has file children and `false` if it only has other directorie

src/stats_tui.rs:485

↓ 1 callersFunctionget_supported_cpuids

↓ 1 callersMethodget_unwind_info

Get the unwind info for the given address # Errors No unwinder was found for the current address

src/stack_unwinder.rs:270

↓ 1 callersMethodget_verbose_instruction_string_at

Get decoded instruction at the given [`VirtAddr`] using the given [`Cr3`] with additional information about the operands from the instruction # Examp

src/fuzzvm.rs:1457

↓ 1 callersMethodhandle_syscall

Handle a syscall with the given [`FuzzVm`] # Errors The fuzzer requested to handle syscalls, but did not implement the syscall handler

src/fuzzer.rs:220

↓ 1 callersMethodhexdump

Print a hexdump of `count` bytes at the given [`VirtAddr`] [`Cr3`] # Example ```rust let fuzzvm = FuzzVm::create(...); fuzzvm.hexdump(VirtAddr(fuzzv

src/fuzzvm.rs:2829

↓ 1 callersMethodhit

Set the node with `address` as being hit

src/coverage_analysis.rs:308

↓ 1 callersMethodid

src/fuzzvm.rs:304

↓ 1 callersMethodidentify_used_phys_pages

Set the internal used physical pages using the list of [`Cr3`]s given

src/memory.rs:310

↓ 1 callersMethodinc_vmexit

Increment the hit count for the given [`FuzzVmExit`]

src/stats.rs:121

↓ 1 callersMethodincrease_redqueen_entropy

(&mut self, rule: &RedqueenRule, rng: &mut Rng)

src/fuzz_input.rs:283

↓ 1 callersFunctioninit

Initialize the APIC to send an NMI on the overflow of retired instruction

src/apic.rs:300

↓ 1 callersMethodinit_guest_memory_backing

Register the guest memory to KVM and create the re-usable allocations used to query the dirty page bitmaps in [`FuzzVm::get_dirty_logs`]. # Errors F

src/fuzzvm.rs:2608

↓ 1 callersFunctioninit_kick_timer

Initialize the kick timer to periodically kick the `vCPU` out of the guest

src/timer.rs:106

↓ 1 callersFunctioninit_terminal

Initialize the terminal for displaying the stats TUI

src/stats_tui.rs:104

↓ 1 callersMethodinit_vm

Initialize the VM before starting any fuzz case # Errors The target specific fuzzer failed to initialize the VM

src/fuzzer.rs:193

↓ 1 callersFunctionkick_cores

Kick cores when triggered by a signal

↓ 1 callersMethodmark

Mark the current elapsed time for the given [`PerfMark`]

src/stats.rs:199

↓ 1 callersMethodmemory

Open the physical memory as writable to make changes # Errors Fail to open physical memory file

src/memory.rs:127

↓ 1 callersMethodpage_size

Returns `true` if the `page_size` bit is set in the [`EntryFlags`]

src/page_table.rs:67

↓ 1 callersFunctionparse_coverage_breakpoints

Parse the coverage breakpoints command line argument. This will read the given path and create a [`BTreeSet`] of the found coverage breakpoints # Err

src/cmdline.rs:873

↓ 1 callersFunctionparse_hex_bytes

Parse the given input string into bytes Example: ``` let res = parse_hex_bytes("41424344")?; assert_eq!(res, vec![0x41, 0x42, 0x43, 0x44]) ``` # Er

src/cmdline.rs:476

↓ 1 callersFunctionparse_kallsyms

Parse the /proc/kallsyms output and return the symbol addresses

qemu_snapshot/gdbsnapshot.py:24

↓ 1 callersFunctionparse_kallsyms

Parse the /proc/kallsyms output and return the symbol addresses

fuzzer_template/qemu_snapshot/gdbsnapshot.py:24

↓ 1 callersFunctionparse_qemu_regs

src/cmdline.rs:942

↓ 1 callersMethodpointer_chain

Attempt to perform a pointer walk from the given [`VirtAddr`] [`Cr3`]

src/memory.rs:1100

↓ 1 callersMethodpointer_chain_str

Attempt to perform a pointer walk from the given [`VirtAddr`] [`Cr3`] (used predominately for [`FuzzVm::print_context`]) # Example ```rust let chain

src/fuzzvm.rs:2845

↓ 1 callersMethodread_c_string

(&mut self, virt_addr: VirtAddr, cr3: Cr3)

src/memory.rs:1154

↓ 1 callersMethodread_phys

(&self, phys_addr: PhysAddr)

src/memory.rs:523

↓ 1 callersMethodredqueen_breakpoints

src/fuzzer.rs:273

↓ 1 callersFunctionregister_guest_memory

Register the memory allocation given to the [`FuzzVm`] to KVM as the physical memory of the VM, excluding the APIC page. Returns the (physical address

↓ 1 callersMethodregs_mut

src/fuzzvm.rs:961

↓ 1 callersMethodreset_breakpoints

Breakpoints that, if hit, will cause the VM to be reset without saving state

src/fuzzer.rs:204

↓ 1 callersFunctionreset_guest

bench/bench_harness/src/main.rs:2

↓ 1 callersFunctionrun

Execute the fuzz subcommand to fuzz the given project

src/commands/fuzz.rs:57

↓ 1 callersMethodrun

coverage_scripts/bn_snapchange.py:167

← previous next →101–200 of 430, ranked by callers