History

Langston Barrett aa3f126100

LibAFL_qemu: Return errors from Emulator::new instead of asserting (#1197 )

* qemu: Return errors from Emulator::new instead of asserting

Libraries should not `assert!` except in cases of unrecoverable (library)
programmer error. These errors are all potentially recoverable, and aren't
internal errors in `libafl_qemu` itself.

* Respond to review comments

2023-04-09 21:27:27 +02:00

corpus

Fix QEMU systemmode fuzzing (#883 )

2022-11-21 17:57:06 +01:00

example

Save and restore CPU state in libafl_qemu (#907 )

2022-11-22 16:29:43 +01:00

src

LibAFL_qemu: Return errors from Emulator::new instead of asserting (#1197 )

2023-04-09 21:27:27 +02:00

.gitignore

Fix QEMU systemmode fuzzing (#883 )

2022-11-21 17:57:06 +01:00

Cargo.toml

Bump to 0.10.0 (#1156 )

2023-04-05 17:49:53 +02:00

README.md

Fix QEMU systemmode fuzzing (#883 )

2022-11-21 17:57:06 +01:00

README.md

Qemu systemmode with launcher

This folder contains an example fuzzer for the qemu systemmode, using LLMP for fast multi-process fuzzing and crash detection.

Build

To build this example, run

cargo build --release
cd example; sh build.sh; cd ..

This will build the the fuzzer (src/fuzzer.rs) and a small example binary based on FreeRTOS, which can run under a qemu emulation target.

Run

Since the instrumentation is based on snapshtos QEMU needs a virtual drive (even if it is unused...). Create on and then run the fuzzer:

# create an image
qemu-img create -f qcow2 dummy.qcow2 32M
# run the fuzzer
KERNEL=./example/example.elf target/release/qemu_systemmode -icount shift=auto,align=off,sleep=off -machine mps2-an385 -monitor null -kernel ./example/example.elf -serial null -nographic -snapshot -drive if=none,format=qcow2,file=dummy.qcow2 -S

Currently the KERNEL variable is needed because the fuzzer does not parse QEMUs arguments to find the binary.