iris
00cc9309cb
de6e324bdseparate emu thread10d3daf86Roms List improvements95d202f37Let's make the rom list process on a separate thread so the emulator doesnt take ages to load.fc306967fWow the ROM Header was just completely busted. Game list view works nowbad1691eefuck this shit2b59e5f46game list in progressd26417b83remappable inputs in progressac4af8106inpute72abc240update readme430139dc9Qt6 frontend3080d4d45Fix this small bug too08cd13b85Cop0 unused functions do not actually pose a threat (as per manual). They don't do anything, so shall we.61bb4fb44make idle loop detection a little more specific with where the load goesb037de4c3SAZDFsdff12e81e73eneed to figure out why n64-systemtest loops indefinitely at some address that appears to be valid (i think it's me not invalidating the cache properly)204f0e13bidle skipping seems to work!cb8bb634asdkfjlasdf58e5c89c1Fix compilation issue on my machine (no idea)24fb2898eattempting more serious idle skipping214719577Place rsp.Step inside cached interpreter. Gains about 3 more fpsbb97dcc23mmmmm920b77d38wjkhasdfjhkasdf430ccdab4it's a start...4f42a673aCached interpreter plays Mario 64. Start looking into RSP as wellc9a030787idle skipping works!5fbda03cenew idea366637abaIdle skipping... maybe?609fa2fb0Cache instructions implemented but broken lmao. Commented out for nowe140a6d12- Stop using inheritance for CPU, instead use composition. - Introduce KAIZEN_JIT_ENABLED optional define instead of relying on __aarch64__ and the like. - More cache work68e613057prep cache impl811b4d809fix clang formatfda755f7didkd5024ebbfsmall MI refactor in preparation of (eventually) implementing the RDRAM interface properly694b45341Merge commit '206dcdedf195fb320913584180edb12c7731e396' as 'external/SDL'206dcdedfSquashed 'external/SDL/' content from commit 4d17b99d0a4d16e1cb4need to update sdl848b19920Fix compilation errordb61b5299Merge commit 'e94a94559f28e49678fbcf72199a5258137b0fe9' as 'external/imgui'e94a94559Squashed 'external/imgui/' content from commit 02e9b8cac52edb3757need to update imguic1a705e86Emulate weird JALR behaviour4b4c32f4bFix exception for "unusable COP1" in 4 instructions i missed accidentally (again)df5828142Bug putting 0s in the log everywheref8b580048Make isviewer a sink to file8241e9735Fix exception for "unusable COP1" in 4 instructions i missed accidentallyb29715f20small changesd9a620bc1make use of my new small utility library0d1aa938eAdd 'external/ircolib/' from commit 'ce3cd726c8df8388d554abf8bb55d55020eb4450'e64eb40b3Fuck git git-subtree-dir: external/ircolib git-subtree-split:de6e324bde
81 lines
2.7 KiB
Markdown
81 lines
2.7 KiB
Markdown
Fuzzing
|
||
===============
|
||
|
||
|
||
Build the fuzz target
|
||
-------
|
||
|
||
To build the fuzz target, you can simply run `make` with appropriate flags set :
|
||
```
|
||
ASAN_OPTIONS=detect_leaks=0 CXXFLAGS="-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize=fuzzer-no-link" CFLAGS="-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize=fuzzer-no-link" LDFLAGS="-fsanitize=address" make
|
||
```
|
||
You can replace `address` with another sanitizer : `memory` or `undefined`
|
||
The fuzz target is then `suite/fuzz/fuzz_bindisasm2`
|
||
|
||
You can find this in travis configuration `.travis.yml`
|
||
|
||
Another way is to use oss-fuzz, see https://github.com/google/oss-fuzz/blob/master/projects/capstone/build.sh
|
||
|
||
Troubleshooting
|
||
------
|
||
|
||
If you get `cc: error: unrecognized argument to ‘-fsanitize=’ option: ‘fuzzer’` check if you have a workable
|
||
version of `libfuzz` installed. Also try to build with `CC=clang make`
|
||
|
||
Interpret OSS-Fuzz report
|
||
------
|
||
|
||
A reported bug by OSS-fuzz looks usually like this:
|
||
|
||
```
|
||
...
|
||
#20 0x7f3a42062082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)
|
||
#21 0x55ad814876dd in _start (build-out/fuzz_disasmnext+0x5246dd)
|
||
|
||
DEDUP_TOKEN: raise--abort--
|
||
AddressSanitizer can not provide additional info.
|
||
SUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x4300b) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e) in raise
|
||
==62==ABORTING
|
||
MS: 0 ; base unit: 0000000000000000000000000000000000000000
|
||
0x7,0xe8,0x3,0x4e,0xc0,0xf8,
|
||
\007\350\003N\300\370
|
||
```
|
||
|
||
It emits the bytes fed to Capstone in the last two lines.
|
||
|
||
The first byte determines the `arch+mode`. The following bytes the actual data producing the crash.
|
||
|
||
You can run `./fuzz_decode_platform` to get the `arch+mode` used:
|
||
|
||
```
|
||
./fuzz_decode_platform 0x7
|
||
cstool arch+mode = aarch64
|
||
```
|
||
|
||
And reproduce the bug with `cstool`:
|
||
|
||
```bash
|
||
# Make sureevery hex number has two digits!
|
||
cstool -d aarch64 0xe8,0x03,0x4e,0xc0,0xf8,
|
||
```
|
||
|
||
Make sure the every hex number has two digits (`0x3 -> 0x03`)!
|
||
`cstool` won't parse it correctly otherwise.
|
||
|
||
Fuzz drivers
|
||
------
|
||
|
||
There are custom drivers :
|
||
- driverbin.c : prints cstool command before running one input
|
||
- drivermc.c : converts MC test data to raw binary data before running as many inputs as there are lines in a file
|
||
- onefile.c : simple one file driver
|
||
|
||
For libfuzzer, the preferred main function is now to use linker option `-fsanitize=fuzzer`
|
||
|
||
Fuzzit integration
|
||
------
|
||
|
||
Travis will build the fuzz target with the different sanitizers.
|
||
Then, Travis will launch sanity fuzzit jobs as part of continuous integration (for each of the sanitizers)
|
||
The fuzzit target ids are stored in a configuration file fuzzitid.txt and used by fuzzit.sh
|