From 8e15942f5e222b3e6b745c39e2d919c3c311ab97 Mon Sep 17 00:00:00 2001 From: rliebig Date: Mon, 13 Apr 2026 11:25:08 +0200 Subject: [PATCH 1/4] feat(qemu): add usermode multithreading support --- .../src/bindings/x86_64_stub_bindings.rs | 3 ++ crates/libafl_qemu/src/qemu/usermode.rs | 49 +++++++++++++++++++ 2 files changed, 52 insertions(+) diff --git a/crates/libafl_qemu/libafl_qemu_sys/src/bindings/x86_64_stub_bindings.rs b/crates/libafl_qemu/libafl_qemu_sys/src/bindings/x86_64_stub_bindings.rs index d31dae9b21..a7a2dad579 100644 --- a/crates/libafl_qemu/libafl_qemu_sys/src/bindings/x86_64_stub_bindings.rs +++ b/crates/libafl_qemu/libafl_qemu_sys/src/bindings/x86_64_stub_bindings.rs @@ -8237,6 +8237,9 @@ unsafe extern "C" { unsafe extern "C" { pub fn libafl_qemu_run() -> ::std::os::raw::c_int; } +unsafe extern "C" { + pub fn libafl_qemu_run-single_cpu(cpu_index: ::std::os::raw::c_int) -> ::std::os::raw::c_int; +} unsafe extern "C" { pub fn libafl_set_qemu_env(env: *mut CPUArchState); } diff --git a/crates/libafl_qemu/src/qemu/usermode.rs b/crates/libafl_qemu/src/qemu/usermode.rs index 3e882f44f4..675d22a7b5 100644 --- a/crates/libafl_qemu/src/qemu/usermode.rs +++ b/crates/libafl_qemu/src/qemu/usermode.rs @@ -5,6 +5,9 @@ use std::{ str::from_utf8_unchecked_mut, }; +use crate::{QemuExitError, QemuExitReason, QemuShutdownCause}; +use crate::qemu::transmute; + use libafl_bolts::{Error, os::unix_signals::Signal}; #[cfg(not(feature = "systemmode"))] use libafl_qemu_sys::libafl_qemu_run; @@ -14,6 +17,7 @@ use libafl_qemu_sys::{ libafl_get_initial_brk, libafl_load_addr, libafl_maps_first, libafl_maps_next, libafl_set_brk, mmap_next_start, pageflags_get_root, read_self_maps, }; +use libafl_qemu_sys::{libafl_get_exit_reason, libafl_qemu_run_single_cpu}; use libc::{c_int, c_uchar, siginfo_t, strlen}; #[cfg(feature = "python")] use pyo3::{IntoPyObject, Py, PyRef, PyRefMut, Python, pyclass, pymethods}; @@ -491,6 +495,51 @@ impl Qemu { }, } } + + #[allow(dead_code)] + pub unsafe fn run_single_cpu(self, cpu_index: i32) -> Result { + unsafe { + libafl_qemu_run_single_cpu(cpu_index); + } + + let exit_reason = unsafe { libafl_get_exit_reason() }; + if exit_reason.is_null() { + Err(QemuExitError::UnexpectedExit) + } else { + let exit_reason: &mut libafl_qemu_sys::libafl_exit_reason = + unsafe { transmute(&mut *exit_reason) }; + Ok(match exit_reason.kind { + libafl_qemu_sys::libafl_exit_reason_kind_INTERNAL => unsafe { + let qemu_shutdown_cause: QemuShutdownCause = match exit_reason.data.internal.cause { + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_NONE => QemuShutdownCause::None, + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_HOST_ERROR => QemuShutdownCause::HostError, + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_HOST_QMP_QUIT => QemuShutdownCause::HostQmpQuit, + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_HOST_QMP_SYSTEM_RESET => QemuShutdownCause::HostQmpSystemReset, + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_HOST_SIGNAL => { + QemuShutdownCause::HostSignal( + Signal::try_from(exit_reason.data.internal.signal).unwrap(), + ) + } + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_HOST_UI => QemuShutdownCause::HostUi, + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_GUEST_SHUTDOWN => QemuShutdownCause::GuestShutdown, + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_GUEST_RESET => QemuShutdownCause::GuestReset, + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_GUEST_PANIC => QemuShutdownCause::GuestPanic, + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_SUBSYSTEM_RESET => QemuShutdownCause::SubsystemReset, + libafl_qemu_sys::ShutdownCause_SHUTDOWN_CAUSE_SNAPSHOT_LOAD => QemuShutdownCause::SnapshotLoad, + _ => panic!("shutdown cause not handled."), + }; + QemuExitReason::End(qemu_shutdown_cause) + }, + libafl_qemu_sys::libafl_exit_reason_kind_BREAKPOINT => unsafe { + let bp_addr = exit_reason.data.breakpoint.addr; + QemuExitReason::Breakpoint(bp_addr) + }, + libafl_qemu_sys::libafl_exit_reason_kind_CUSTOM_INSN => QemuExitReason::SyncExit, + libafl_qemu_sys::libafl_exit_reason_kind_CRASH => QemuExitReason::Crash, + _ => return Err(QemuExitError::UnknownKind), + }) + } + } } #[cfg(feature = "python")] From d56f601cffdf0c3f95c7c2b610abc2543610b423 Mon Sep 17 00:00:00 2001 From: Richard Liebig Date: Mon, 8 Jun 2026 14:11:24 +0200 Subject: [PATCH 2/4] fix: pass CPUState pointer to single CPU runner --- .../src/bindings/x86_64_stub_bindings.rs | 2 +- crates/libafl_qemu/src/qemu/hooks.rs | 226 +++++++++--------- crates/libafl_qemu/src/qemu/usermode.rs | 3 +- 3 files changed, 116 insertions(+), 115 deletions(-) diff --git a/crates/libafl_qemu/libafl_qemu_sys/src/bindings/x86_64_stub_bindings.rs b/crates/libafl_qemu/libafl_qemu_sys/src/bindings/x86_64_stub_bindings.rs index a7a2dad579..dc76182fa5 100644 --- a/crates/libafl_qemu/libafl_qemu_sys/src/bindings/x86_64_stub_bindings.rs +++ b/crates/libafl_qemu/libafl_qemu_sys/src/bindings/x86_64_stub_bindings.rs @@ -8238,7 +8238,7 @@ unsafe extern "C" { pub fn libafl_qemu_run() -> ::std::os::raw::c_int; } unsafe extern "C" { - pub fn libafl_qemu_run-single_cpu(cpu_index: ::std::os::raw::c_int) -> ::std::os::raw::c_int; + pub fn libafl_qemu_run_single_cpu(cpu_index: *mut CPUState) -> ::std::os::raw::c_int; } unsafe extern "C" { pub fn libafl_set_qemu_env(env: *mut CPUArchState); diff --git a/crates/libafl_qemu/src/qemu/hooks.rs b/crates/libafl_qemu/src/qemu/hooks.rs index 2318dfe8dc..fe22e50245 100644 --- a/crates/libafl_qemu/src/qemu/hooks.rs +++ b/crates/libafl_qemu/src/qemu/hooks.rs @@ -7,7 +7,7 @@ use core::{ffi::c_void, fmt::Debug, mem::transmute, ptr}; use libafl::executors::hooks::inprocess::inprocess_get_state; -use libafl_qemu_sys::{CPUArchStatePtr, CPUStatePtr, FatPtr, GuestAddr, GuestUlong, GuestUsize}; +use libafl_qemu_sys::{CPUArchStatePtr, CPUStatePtr, FatPtr, GuestAddr, GuestUsize}; use crate::{ HookData, HookId, @@ -96,7 +96,7 @@ pub enum SyscallHookResult { /// If you need to change the return value of the syscall, please use a post-syscall hook. Run, /// Skip the syscall, and make the syscall return the value provided in the field in the target. - Skip(GuestUlong), + Skip(GuestAddr), } impl Hook { @@ -467,14 +467,14 @@ create_hook_types!( &mut EmulatorModules, Option<&mut S>, sys_num: i32, - a0: GuestUlong, - a1: GuestUlong, - a2: GuestUlong, - a3: GuestUlong, - a4: GuestUlong, - a5: GuestUlong, - a6: GuestUlong, - a7: GuestUlong, + a0: GuestAddr, + a1: GuestAddr, + a2: GuestAddr, + a3: GuestAddr, + a4: GuestAddr, + a5: GuestAddr, + a6: GuestAddr, + a7: GuestAddr, ) -> SyscallHookResult, Box< dyn for<'a> FnMut( @@ -482,27 +482,27 @@ create_hook_types!( &'a mut EmulatorModules, Option<&'a mut S>, i32, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, ) -> SyscallHookResult, >, extern "C" fn( *const (), i32, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, ) -> SyscallHookResult ); #[cfg(feature = "usermode")] @@ -512,14 +512,14 @@ create_wrapper!( pre_syscall, ( sys_num: i32, - a0: GuestUlong, - a1: GuestUlong, - a2: GuestUlong, - a3: GuestUlong, - a4: GuestUlong, - a5: GuestUlong, - a6: GuestUlong, - a7: GuestUlong + a0: GuestAddr, + a1: GuestAddr, + a2: GuestAddr, + a3: GuestAddr, + a4: GuestAddr, + a5: GuestAddr, + a6: GuestAddr, + a7: GuestAddr ), SyscallHookResult ); @@ -532,47 +532,47 @@ create_hook_types!( Qemu, &mut EmulatorModules, Option<&mut S>, - res: GuestUlong, + res: GuestAddr, sys_num: i32, - a0: GuestUlong, - a1: GuestUlong, - a2: GuestUlong, - a3: GuestUlong, - a4: GuestUlong, - a5: GuestUlong, - a6: GuestUlong, - a7: GuestUlong, - ) -> GuestUlong, + a0: GuestAddr, + a1: GuestAddr, + a2: GuestAddr, + a3: GuestAddr, + a4: GuestAddr, + a5: GuestAddr, + a6: GuestAddr, + a7: GuestAddr, + ) -> GuestAddr, Box< dyn for<'a> FnMut( Qemu, &'a mut EmulatorModules, Option<&mut S>, - GuestUlong, + GuestAddr, i32, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - ) -> GuestUlong, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + ) -> GuestAddr, >, extern "C" fn( *const (), - GuestUlong, + GuestAddr, i32, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - ) -> GuestUlong + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + ) -> GuestAddr ); #[cfg(feature = "usermode")] create_hook_id!(PostSyscall, libafl_qemu_remove_post_syscall_hook, false); @@ -580,18 +580,18 @@ create_hook_id!(PostSyscall, libafl_qemu_remove_post_syscall_hook, false); create_wrapper!( post_syscall, ( - res: GuestUlong, + res: GuestAddr, sys_num: i32, - a0: GuestUlong, - a1: GuestUlong, - a2: GuestUlong, - a3: GuestUlong, - a4: GuestUlong, - a5: GuestUlong, - a6: GuestUlong, - a7: GuestUlong + a0: GuestAddr, + a1: GuestAddr, + a2: GuestAddr, + a3: GuestAddr, + a4: GuestAddr, + a5: GuestAddr, + a6: GuestAddr, + a7: GuestAddr ), - GuestUlong + GuestAddr ); // New thread hook wrappers @@ -703,7 +703,7 @@ create_hook_types!( create_hook_id!(Block, libafl_qemu_remove_block_hook, true); create_gen_wrapper!(block, (addr: GuestAddr), u64, 1, BlockHookId); -create_post_gen_wrapper!(block, (addr: GuestAddr, len: GuestAddr), 1, BlockHookId); +create_post_gen_wrapper!(block, (addr: GuestAddr, len: GuestUsize), 1, BlockHookId); create_exec_wrapper!(block, (id: u64), 0, 1, BlockHookId); // Read hook wrappers @@ -1074,14 +1074,14 @@ impl QemuHooks { &self, data: T, generator: Option u64>, - post_gen: Option, + post_gen: Option, exec: Option, ) -> BlockHookId { unsafe { let data: u64 = data.into().0; let generator: Option u64> = transmute(generator); - let post_gen: Option = + let post_gen: Option = transmute(post_gen); let exec: Option = transmute(exec); let num = libafl_qemu_sys::libafl_add_block_hook(generator, post_gen, exec, data); @@ -1270,14 +1270,14 @@ impl QemuHooks { callback: extern "C" fn( T, i32, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, ) -> SyscallHookResult, ) -> PreSyscallHookId { unsafe { @@ -1285,14 +1285,14 @@ impl QemuHooks { let callback: extern "C" fn( u64, i32, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, ) -> libafl_qemu_sys::libafl_syshook_ret = transmute(callback); let num = libafl_qemu_sys::libafl_add_pre_syscall_hook(Some(callback), data); PreSyscallHookId(num) @@ -1304,33 +1304,33 @@ impl QemuHooks { data: T, callback: extern "C" fn( T, - GuestUlong, + GuestAddr, i32, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - ) -> GuestUlong, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + ) -> GuestAddr, ) -> PostSyscallHookId { unsafe { let data: u64 = data.into().0; let callback: extern "C" fn( u64, - GuestUlong, + GuestAddr, i32, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - GuestUlong, - ) -> GuestUlong = transmute(callback); + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + GuestAddr, + ) -> GuestAddr = transmute(callback); let num = libafl_qemu_sys::libafl_add_post_syscall_hook(Some(callback), data); PostSyscallHookId(num) } diff --git a/crates/libafl_qemu/src/qemu/usermode.rs b/crates/libafl_qemu/src/qemu/usermode.rs index 675d22a7b5..ff5f96bb15 100644 --- a/crates/libafl_qemu/src/qemu/usermode.rs +++ b/crates/libafl_qemu/src/qemu/usermode.rs @@ -499,7 +499,8 @@ impl Qemu { #[allow(dead_code)] pub unsafe fn run_single_cpu(self, cpu_index: i32) -> Result { unsafe { - libafl_qemu_run_single_cpu(cpu_index); + let cpu_state: CPU = self.cpu_from_index(cpu_index.try_into().unwrap()).unwrap(); + libafl_qemu_run_single_cpu(cpu_state.raw_ptr()); } let exit_reason = unsafe { libafl_get_exit_reason() }; From 44ca8d10ccd957559f8b3d79f369d7b3efedc627 Mon Sep 17 00:00:00 2001 From: Richard Liebig Date: Mon, 8 Jun 2026 15:32:26 +0200 Subject: [PATCH 3/4] refactor: Use CPUState* instead of cpu_index for run_single_cpu --- crates/libafl_qemu/src/qemu/usermode.rs | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/crates/libafl_qemu/src/qemu/usermode.rs b/crates/libafl_qemu/src/qemu/usermode.rs index ff5f96bb15..261fd5cdaf 100644 --- a/crates/libafl_qemu/src/qemu/usermode.rs +++ b/crates/libafl_qemu/src/qemu/usermode.rs @@ -496,11 +496,16 @@ impl Qemu { } } + /// Run a single, caller-selected CPU until the next exit. + /// + /// # Safety + /// + /// The provided [`CPU`] must belong to this QEMU instance and remain valid for the duration of + /// the run. #[allow(dead_code)] - pub unsafe fn run_single_cpu(self, cpu_index: i32) -> Result { + pub unsafe fn run_single_cpu(&self, cpu: CPU) -> Result { unsafe { - let cpu_state: CPU = self.cpu_from_index(cpu_index.try_into().unwrap()).unwrap(); - libafl_qemu_run_single_cpu(cpu_state.raw_ptr()); + libafl_qemu_run_single_cpu(cpu.raw_ptr()); } let exit_reason = unsafe { libafl_get_exit_reason() }; From bf32b26227108e31aff804a51255dc89af5ffe55 Mon Sep 17 00:00:00 2001 From: Richard Liebig Date: Mon, 8 Jun 2026 18:01:57 +0200 Subject: [PATCH 4/4] Technical commit to remove unwanted changes --- crates/libafl_qemu/src/qemu/hooks.rs | 226 +++++++++++++-------------- 1 file changed, 113 insertions(+), 113 deletions(-) diff --git a/crates/libafl_qemu/src/qemu/hooks.rs b/crates/libafl_qemu/src/qemu/hooks.rs index fe22e50245..2318dfe8dc 100644 --- a/crates/libafl_qemu/src/qemu/hooks.rs +++ b/crates/libafl_qemu/src/qemu/hooks.rs @@ -7,7 +7,7 @@ use core::{ffi::c_void, fmt::Debug, mem::transmute, ptr}; use libafl::executors::hooks::inprocess::inprocess_get_state; -use libafl_qemu_sys::{CPUArchStatePtr, CPUStatePtr, FatPtr, GuestAddr, GuestUsize}; +use libafl_qemu_sys::{CPUArchStatePtr, CPUStatePtr, FatPtr, GuestAddr, GuestUlong, GuestUsize}; use crate::{ HookData, HookId, @@ -96,7 +96,7 @@ pub enum SyscallHookResult { /// If you need to change the return value of the syscall, please use a post-syscall hook. Run, /// Skip the syscall, and make the syscall return the value provided in the field in the target. - Skip(GuestAddr), + Skip(GuestUlong), } impl Hook { @@ -467,14 +467,14 @@ create_hook_types!( &mut EmulatorModules, Option<&mut S>, sys_num: i32, - a0: GuestAddr, - a1: GuestAddr, - a2: GuestAddr, - a3: GuestAddr, - a4: GuestAddr, - a5: GuestAddr, - a6: GuestAddr, - a7: GuestAddr, + a0: GuestUlong, + a1: GuestUlong, + a2: GuestUlong, + a3: GuestUlong, + a4: GuestUlong, + a5: GuestUlong, + a6: GuestUlong, + a7: GuestUlong, ) -> SyscallHookResult, Box< dyn for<'a> FnMut( @@ -482,27 +482,27 @@ create_hook_types!( &'a mut EmulatorModules, Option<&'a mut S>, i32, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, ) -> SyscallHookResult, >, extern "C" fn( *const (), i32, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, ) -> SyscallHookResult ); #[cfg(feature = "usermode")] @@ -512,14 +512,14 @@ create_wrapper!( pre_syscall, ( sys_num: i32, - a0: GuestAddr, - a1: GuestAddr, - a2: GuestAddr, - a3: GuestAddr, - a4: GuestAddr, - a5: GuestAddr, - a6: GuestAddr, - a7: GuestAddr + a0: GuestUlong, + a1: GuestUlong, + a2: GuestUlong, + a3: GuestUlong, + a4: GuestUlong, + a5: GuestUlong, + a6: GuestUlong, + a7: GuestUlong ), SyscallHookResult ); @@ -532,47 +532,47 @@ create_hook_types!( Qemu, &mut EmulatorModules, Option<&mut S>, - res: GuestAddr, + res: GuestUlong, sys_num: i32, - a0: GuestAddr, - a1: GuestAddr, - a2: GuestAddr, - a3: GuestAddr, - a4: GuestAddr, - a5: GuestAddr, - a6: GuestAddr, - a7: GuestAddr, - ) -> GuestAddr, + a0: GuestUlong, + a1: GuestUlong, + a2: GuestUlong, + a3: GuestUlong, + a4: GuestUlong, + a5: GuestUlong, + a6: GuestUlong, + a7: GuestUlong, + ) -> GuestUlong, Box< dyn for<'a> FnMut( Qemu, &'a mut EmulatorModules, Option<&mut S>, - GuestAddr, + GuestUlong, i32, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - ) -> GuestAddr, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + ) -> GuestUlong, >, extern "C" fn( *const (), - GuestAddr, + GuestUlong, i32, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - ) -> GuestAddr + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + ) -> GuestUlong ); #[cfg(feature = "usermode")] create_hook_id!(PostSyscall, libafl_qemu_remove_post_syscall_hook, false); @@ -580,18 +580,18 @@ create_hook_id!(PostSyscall, libafl_qemu_remove_post_syscall_hook, false); create_wrapper!( post_syscall, ( - res: GuestAddr, + res: GuestUlong, sys_num: i32, - a0: GuestAddr, - a1: GuestAddr, - a2: GuestAddr, - a3: GuestAddr, - a4: GuestAddr, - a5: GuestAddr, - a6: GuestAddr, - a7: GuestAddr + a0: GuestUlong, + a1: GuestUlong, + a2: GuestUlong, + a3: GuestUlong, + a4: GuestUlong, + a5: GuestUlong, + a6: GuestUlong, + a7: GuestUlong ), - GuestAddr + GuestUlong ); // New thread hook wrappers @@ -703,7 +703,7 @@ create_hook_types!( create_hook_id!(Block, libafl_qemu_remove_block_hook, true); create_gen_wrapper!(block, (addr: GuestAddr), u64, 1, BlockHookId); -create_post_gen_wrapper!(block, (addr: GuestAddr, len: GuestUsize), 1, BlockHookId); +create_post_gen_wrapper!(block, (addr: GuestAddr, len: GuestAddr), 1, BlockHookId); create_exec_wrapper!(block, (id: u64), 0, 1, BlockHookId); // Read hook wrappers @@ -1074,14 +1074,14 @@ impl QemuHooks { &self, data: T, generator: Option u64>, - post_gen: Option, + post_gen: Option, exec: Option, ) -> BlockHookId { unsafe { let data: u64 = data.into().0; let generator: Option u64> = transmute(generator); - let post_gen: Option = + let post_gen: Option = transmute(post_gen); let exec: Option = transmute(exec); let num = libafl_qemu_sys::libafl_add_block_hook(generator, post_gen, exec, data); @@ -1270,14 +1270,14 @@ impl QemuHooks { callback: extern "C" fn( T, i32, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, ) -> SyscallHookResult, ) -> PreSyscallHookId { unsafe { @@ -1285,14 +1285,14 @@ impl QemuHooks { let callback: extern "C" fn( u64, i32, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, ) -> libafl_qemu_sys::libafl_syshook_ret = transmute(callback); let num = libafl_qemu_sys::libafl_add_pre_syscall_hook(Some(callback), data); PreSyscallHookId(num) @@ -1304,33 +1304,33 @@ impl QemuHooks { data: T, callback: extern "C" fn( T, - GuestAddr, + GuestUlong, i32, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - ) -> GuestAddr, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + ) -> GuestUlong, ) -> PostSyscallHookId { unsafe { let data: u64 = data.into().0; let callback: extern "C" fn( u64, - GuestAddr, + GuestUlong, i32, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - GuestAddr, - ) -> GuestAddr = transmute(callback); + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + GuestUlong, + ) -> GuestUlong = transmute(callback); let num = libafl_qemu_sys::libafl_add_post_syscall_hook(Some(callback), data); PostSyscallHookId(num) }