c415b4d5f6
* 0.13 * z3 * capstone * fixer --------- Co-authored-by: Dominik Maier <domenukk@gmail.com>
Qemu systemmode with launcher
This folder contains an example fuzzer for the qemu systemmode, using LLMP for fast multi-process fuzzing and crash detection.
It comes in three flavours (can be set through features):
-classic: The low-level way to interact with QEMU.
-breakpoint: Interaction with QEMU using the command system, leveraging breakpoints.
-sync_exit: Interaction with QEMU using the command system, leveraging sync exits.
Prerequisite
You will need to have qemu-img and arm-none-eabi-gcc installed.
On Ubuntu and Debian, you will need to run
sudo apt update
sudo apt -y install qemu-utils gcc-arm-none-eabi
Build
cargo make build
Run
cargo make run
It is also possible to run the fuzzer with the other features:
cargo make <feature>
With feature being classic, breakpoint or sync_exit.
This will build the desired fuzzer (src/fuzzer_.rs) and a small example binary based on FreeRTOS, which can run under a qemu emulation target.
Since the instrumentation is based on snapshots, QEMU needs a virtual drive (even if it is unused...).
Thus, the makefile creates a dummy QCOW2 image dummy.qcow2 (can be found in the target directory).
Currently, the KERNEL variable is needed because the fuzzer does not parse QEMUs arguments to find the binary.
It is automatically set in the build script.