Functions — github.com/awslabs/snapchange

hub / github.com/awslabs/snapchange / functions

Functions430 in github.com/awslabs/snapchange

⨍ Functions 430◇ Types & classes 163

↓ 1 callersMethodrun

(self)

fuzzer_template/coverage_scripts/bn_snapchange.py:167

↓ 1 callersFunctionrun_cmp_analysis

(bv, cmpfile, ignore=None)

coverage_scripts/bn_snapchange.py:326

↓ 1 callersFunctionrun_cmp_analysis

(bv, cmpfile, ignore=None)

fuzzer_template/coverage_scripts/bn_snapchange.py:326

↓ 1 callersMethodrun_until_reset_redqueen

( &mut self, fuzzer: &mut FUZZER, input: &FUZZER::Input, vm_timeout: Duration,

src/fuzzvm.rs:4134

↓ 1 callersFunctionsanity_check_kvm

Sanity check that needed features are enabled in KVM # Panics Required `KVM_SYNC` regs, sregs, or events is missing If any of the following capabilit

src/lib.rs:756

↓ 1 callersMethodsave_state

Save the current [`CoverageAnalysis`] state to the given `save_path`

src/coverage_analysis.rs:132

↓ 1 callersMethodset_address

(&mut self, addr: PhysAddr)

src/page_table.rs:133

↓ 1 callersMethodset_present

Set the `present` bit in the [`EntryFlags`] to the given `present` flag

src/page_table.rs:62

↓ 1 callersMethodstart_address

(&self)

src/page_table.rs:171

↓ 1 callersFunctionsum

Return the sum of `len` bytes starting at `buffer`

examples/05_redqueen/harness/test_redqueen.c:19

↓ 1 callersMethodsymbolized_backtrace

Get the symbolized backtrace for the current VM state

src/fuzzvm.rs:4541

↓ 1 callersMethodsyscall_2

Write a `syscall` with two arguments to the shellcode buffer Arg1 - rdi

examples/04_syscall_fuzzer/fuzzer.rs:325

↓ 1 callersMethodsyscall_5

Write a `syscall` with five arguments to the shellcode buffer returning the memory address holding the return value

examples/04_syscall_fuzzer/fuzzer.rs:348

↓ 1 callersMethodtest_trace

Fuzzer specific handling of `snapchange -p <PROJECT> trace testcase` # Errors The target specific fuzzer failed to execute a testcase

src/fuzzer.rs:253

↓ 1 callersMethodto_c

Return a C file of the syscalls

examples/04_syscall_fuzzer/fuzzer.rs:186

↓ 1 callersFunctionui

Draw the given [`StatsApp`] into the provided [`Frame`]

src/stats_tui.rs:577

↓ 1 callersMethodused_phys_pages

Get all of the physical pages used by the given [`Cr3`]

src/memory.rs:434

↓ 1 callersMethodvcpu_events

(&self)

src/fuzzvm.rs:1015

↓ 1 callersMethodvector

Set the `vector` for the spurious interrupt

src/apic.rs:177

↓ 1 callersFunctionworker

( stats: Arc<Vec<Arc<Mutex<Stats<FUZZER>>>>>, modules: &Modules, project_dir: &Path, prev_cove

src/stats.rs:604

↓ 1 callersMethodwrite

( &mut self, virt_addr: VirtAddr, cr3: Cr3, val: T, dirty: WriteMem,

src/memory.rs:701

↓ 1 callersMethodwrite

Write the current syscalls into the fuzzvm

examples/04_syscall_fuzzer/fuzzer.rs:136

↓ 1 callersFunctionwrite_symbols

Write the found symbols from the process to the given `symbols_file`

qemu_snapshot/gdbsnapshot.py:241

↓ 1 callersFunctionwrite_symbols

Write the found symbols from the process to the given `symbols_file`

fuzzer_template/qemu_snapshot/gdbsnapshot.py:241

Method__init__

bv: binaryview to work on - provided by the GUI or needs to be manually opened location: file location to sa

coverage_scripts/bn_snapchange.py:42

Method__init__

bv: binaryview to work on - provided by the GUI or needs to be manually opened location: file location to sa

fuzzer_template/coverage_scripts/bn_snapchange.py:42

Function_enable_retired_instruction_counter

Enable LVT Performance Monitoring to trigger an SMI. This is how we can poll a VM for execution points without having to worry about specific breakpoi

src/apic.rs:265

Method_generate

(rng: &mut Rng, _count: &mut usize)

examples/03_ffmpeg_custom_mutator/fuzzer.rs:501

Methodapply_redqueen_rule

( &mut self, _rule: &RedqueenRule, _candidate: &Self::RuleCandidate, )

src/fuzz_input.rs:103

Methodbacktrace

Get the backtrace from the current RIP in the given [`FuzzVm`]

src/stack_unwinder.rs:297

Functionbit_flip

Flip a random bit in the input

src/mutators.rs:8

Methodbreakpoints

(&self)

src/fuzzer/template.rs:53

Methodbreakpoints

(&self)

examples/01_getpid/fuzzer.rs:36

Methodbreakpoints

(&self)

examples/05_redqueen/fuzzer.rs:35

Methodbreakpoints

(&self)

examples/02_libtiff/fuzzer.rs:58

Methodbreakpoints

(&self)

examples/03_ffmpeg_custom_mutator/fuzzer.rs:41

bench/src/fuzzer.rs:50

Methodbreakpoints

(&self)

fuzzer_template/src/fuzzer.rs:55

Functionbyte_dec

Decrement a random byte

src/mutators.rs:202

Functionbyte_delete

Delete a random byte in the input

src/mutators.rs:83

Functionbyte_flip

Replace a random byte in the input with a new byte

src/mutators.rs:39

Functionbyte_inc

Increment a random byte

src/mutators.rs:181

Functionbyte_insert

Insert a random byte into the input with a new byte

src/mutators.rs:61

Methodclear_dirty_logs

Clear the dirty logs # Errors `KVM_CLEAR_DIRTY_LOG` failed # Panics Somehow the `core_id` doesn't fit in a usize

src/kvm.rs:184

Methodclear_resume_flag

Clear the resume flag from [`RFlags`]

src/fuzzvm.rs:1326

Methodclose

Get the current data from `stream`

src/filesystem.rs:175

Methodcrash_breakpoints

(&self)

src/fuzzer/template.rs:43

Methodcrash_breakpoints

(&self)

examples/02_libtiff/fuzzer.rs:48

Methodcrash_breakpoints

(&self)

fuzzer_template/src/fuzzer.rs:45

Functiondeserialize_vec_u64_from_hex

Custom deserialize for Vec<u64>

src/fuzz_input.rs:645

Functiondump_both

Plugin command registered with the GUI to start both snapchange analysis tasks at once. This only queries the rebase address and ignorelist f

coverage_scripts/bn_snapchange.py:724

Functiondump_both

Plugin command registered with the GUI to start both snapchange analysis tasks at once. This only queries the rebase address and ignorelist f

fuzzer_template/coverage_scripts/bn_snapchange.py:724

Functiondump_covanalyis

Coverage analysis plugin command - registered with the GUI and exposes launching the coverage analysis task.

coverage_scripts/bn_snapchange.py:710

Functiondump_covanalyis

Coverage analysis plugin command - registered with the GUI and exposes launching the coverage analysis task.

fuzzer_template/coverage_scripts/bn_snapchange.py:710

Functiondump_covbps

Coverage breakpoint plugin command - registered with the GUI and exposes launching the task for dumping the coverage breakpoints.

coverage_scripts/bn_snapchange.py:717

Functiondump_covbps

Coverage breakpoint plugin command - registered with the GUI and exposes launching the task for dumping the coverage breakpoints.

fuzzer_template/coverage_scripts/bn_snapchange.py:717

Functionenable_timer

(apic: &mut kvm_lapic_state)

src/apic.rs:277

Methodenable_trap_flag

( fuzzvm: &mut FuzzVm<FUZZER>, _input: &FUZZER::Input, _fuzzer: &mut FUZZE

src/fuzzvm.rs:883

Methodentry_address

(&self, index: usize)

src/page_table.rs:177

Methodeoi_broadcast_suppression

(mut self, val: bool)

src/apic.rs:158

Methodexpensive_mutators

()

src/fuzz_input.rs:71

Methodexpensive_mutators

Current expensive mutators available for mutation (typically those which allocate)

src/fuzz_input.rs:502

Methodfmt

(&self, f: &mut std::fmt::Formatter<'_>)

src/stack_unwinder.rs:539

Methodfmt

(&self, f: &mut std::fmt::Formatter<'_>)

src/memory.rs:111

Methodfocus_processor_checking

(mut self, val: bool)

src/apic.rs:165

Methodfpu

Get the current [`kvm_fpu`] from the guest # Errors Failed to get fpu from KVM

(memory_backing: u64)

src/memory.rs:182

Methodfrom_binary_ninja

Read in the JSON coverage analysis file from Binary Ninja

src/coverage_analysis.rs:121

Methodfrom_bytes

(bytes: &[u8])

src/fuzz_input.rs:132

Methodfrom_bytes

Read the input bytes as the implemented type # Errors Failed to convert the given bytes to `Self`

examples/04_syscall_fuzzer/fuzzer.rs:434

Methodfrom_bytes

(bytes: &[u8])

examples/03_ffmpeg_custom_mutator/fuzzer.rs:525

Methodfrom_fuzzvm

Create a tracked state initialized using the given [`FuzzVm`]

src/stack_unwinder.rs:107

Methodfrom_kvm_segment

(seg: &kvm_segment)

src/segment.rs:151

Methodfrom_phys_addr

Get a [`PageTable`] from the given `address`

src/page_table.rs:161

Methodfrom_seed

Create an [`Rng`] seeded with the given seed value

Methodgather_coverage

Get the coverage breakpoints hit by the given `input`

src/fuzzvm.rs:4210

Methodgather_redqueen

( &mut self, input: &FUZZER::Input, fuzzer: &mut FUZZER, vm_timeout: Duration,

src/fuzzvm.rs:4337

Methodgenerate

Generate a random `Vec<u8>` of `max_length` size

src/fuzz_input.rs:507

Methodgenerate

Generate a random version of this type

examples/04_syscall_fuzzer/fuzzer.rs:466

Methodgenerate

(rng: &mut Rng, count: &mut usize)

examples/03_ffmpeg_custom_mutator/mov_generator.rs:17

Methodgenerate

(rng: &mut Rng, count: &mut usize)

examples/03_ffmpeg_custom_mutator/fuzzer.rs:99

Methodget_access_rights

(&self)

src/vbcpu.rs:47

Functionget_cmp_analysis_from_instr

(instr)

coverage_scripts/bn_snapchange.py:732

Functionget_cmp_analysis_from_instr

(instr)

fuzzer_template/coverage_scripts/bn_snapchange.py:732

Methodget_current_instruction_string

Get decoded instruction at the given [`VirtAddr`] using the given [`Cr3`] # Errors If getting the current instruction at `virt_addr` fails

src/fuzzvm.rs:1386

← previous next →201–300 of 430, ranked by callers