Qemu tmin (#3118)

* Start on qemu_tmin

* WIP

* qemu_tmin working for single testcase.
Also some comment improvements.

* Add env_logger to baby_fuzzer

* Remove old reference.

* Added comment doc for qemu_tmin.

* Slight reorder for parallelisation

* Finished single-thread qemu_tmin

* Finishing touches to single thread version.

* A pre_commit.sh change I didn't notice.

* Duplicate to attempt multi-threaded version

* Fix taplo whine.
Mark "fork" mode as broken.

* Launcher for parallelisation implemented, but for one core.

* Running in parallel. Now need tidy up.

* Parallel version complete.

* Add comment

* Merged single-core/multi-core qemu_tmin into one crate

* Removed forkexecutor mode.

* Precommit fixes

* Add qemu_tmin to build_and_test.yml

* Clippy fixes

* Change tmin test cores to 0.

Author: forky2

.github/workflows/build_and_test.yml

@@ -384,6 +384,7 @@ jobs:
         fuzzer:
           # Binary only
           - ./fuzzers/binary_only/qemu_cmin
+          - ./fuzzers/binary_only/qemu_tmin
           - ./fuzzers/binary_only/qemu_coverage
           - ./fuzzers/binary_only/qemu_launcher
         arch:

fuzzers/baby/baby_fuzzer/Cargo.toml

@@ -23,6 +23,7 @@ opt-level = 3
 debug = true
 
 [dependencies]
+env_logger = "0.11.7"
 libafl = { path = "../../../libafl", features = ["tui_monitor"] }
 libafl_bolts = { path = "../../../libafl_bolts" }
 log = { version = "0.4.22", features = ["release_max_level_info"] }

fuzzers/baby/baby_fuzzer/src/main.rs

@@ -35,6 +35,7 @@ fn signals_set(idx: usize) {
 
 #[expect(clippy::manual_assert)]
 pub fn main() {
+    env_logger::init();
     // The closure that we want to fuzz
     let mut harness = |input: &BytesInput| {
         let target = input.target_bytes();

fuzzers/binary_only/qemu_cmin/src/fuzzer.rs

@@ -1,4 +1,4 @@
-//! A libfuzzer-like fuzzer using qemu for binary-only coverage
+//! A binary-only corpus minimizer using qemu, similar to AFL++ afl-cmin
 #[cfg(feature = "i386")]
 use core::mem::size_of;
 #[cfg(feature = "snapshot")]

fuzzers/binary_only/qemu_cmin/src/main.rs

@@ -1,4 +1,4 @@
-//! A libfuzzer-like fuzzer using qemu for binary-only coverage
+//! A binary-only corpus minimizer using qemu, similar to AFL++ afl-cmin
 #[cfg(target_os = "linux")]
 mod fuzzer;
 

fuzzers/binary_only/qemu_coverage/src/fuzzer.rs

@@ -1,4 +1,4 @@
-//! A libfuzzer-like fuzzer using qemu for binary-only coverage
+//! A qemu test case runner to generate drcov coverage outputs
 #[cfg(feature = "i386")]
 use core::mem::size_of;
 use core::time::Duration;

fuzzers/binary_only/qemu_coverage/src/main.rs

@@ -1,4 +1,4 @@
-//! A libfuzzer-like fuzzer using qemu for binary-only coverage
+//! A qemu test case runner to generate drcov coverage outputs
 #[cfg(target_os = "linux")]
 mod fuzzer;
 

fuzzers/binary_only/qemu_tmin/.gitignore

@@ -0,0 +1,8 @@
+libpng-*
+libpng_harness
+libpng_harness_crashing
+zlib-*
+crashes
+target
+output
+corpus/