QEMU LibAFL Bridge
This is a patched QEMU that exposes an interface for LibAFL-based fuzzers.
This raw interface is used in libafl_qemu
that expose a more Rusty API.
This is a patched QEMU that exposes an interface for LibAFL-based fuzzers.
This raw interface is used in libafl_qemu
that expose a more Rusty API.
QEMU Judger Test This project was done abandoned 2 months ago, and I can't remember everything very well, so the steps here may be wrong. Setup First,
Terminal OS Author: Maheswaran Date: 20th Nov 2021 PROGRESS Multiboot compilance achieved VGA driver from complete with print_hex, print_dec, printf f
qemu_esp32 Add tensilica esp32 cpu and a board to qemu and dump the rom to learn more about esp-idf ESP32 in QEMU. This documents how to add an esp32
AVR-based Frequency Counter The AVR-based frequency counter is partly based on the project developed by Herbert Dingfelder with some extensions and mo
Introduction lv_lib_100ask is a reference for various out of the box schemes based on lvgl library or an enhanced interface for various components of
(I'm hedging my bets with this repo name. I'd want to add more serial setup tutorials. For example, I bought a bunch of Gameboy Advance wireless adapt
Experimental handle container in C++ Overview Following on from c-handle-container, this library builds on the same ideas but supports a dynamic numbe
Wall-E-Sim A line follower simulation created in CoppeliaSim, with a C++ interface for CoppeliaSim's Remote API This is a simuation of SRA's Wall-E bo
Corevantage A graphical interface to set options on devices with coreboot firmware. Introduction This is a utility that allows users to view and modif
QEMU meson detects all shared lib on the system which might be used by QEMU and links them. This is not a preferred behavior as it depends on the system which it is running on and its installed packages. As long as libafl_qemu
does not detect all shared libs in its build_linux.rs
, one needs to add them manually (https://github.com/AFLplusplus/LibAFL/blob/main/libafl_qemu/build_linux.rs#L299-L315). By disabling all features by default, this problem can be circumvented. If a specific feature is needed and present on a system, one can still enable it using the CLI flags --enable-{feature}
.
I already tested this change and it does not break the libafl fuzzer qemu_launcher
.
Currently, does not seem to build for the ARM target, and probably also not aarch64, due to a copy-paste error:
../target/arm/translate.c: In function ‘op_s_rri_rot’:
../target/arm/translate.c:5543:40: error: ‘tmp2’ undeclared (first use in this function); did you mean ‘tmp1’?
5543 | libafl_gen_cmp(s->pc_curr, tmp1, tmp2, MO_32);
| ^~~~
| tmp1
This seems to fix the build. However, I am not sure the current code makes sense, since it seems to be a comparison with a (possibly) rotated immediate value. Not sure there need to be cmplog hooks placed on that?
Removing the wildcard for configuration flags, enabling QEMU meson flags.
Problem:
./configure --help
indicated that additional flags will be passed through to meson. ./configure --disable-tmp
should be handled by meson, but throws an error due to the wildcard in front of it in the configure file. Probably a merge issue as the QEMU vanilla repo does not have this wildcard.
Works:
../configure --as-shared-lib --target-list=x86_64-linux-user --disable-blobs --disable-bsd-user --disable-fdt
make -j
Doesn't works:
../configure --as-shared-lib --target-list=arm-linux-user --disable-blobs --disable-bsd-user --disable-fdt
make -j
kBdysch kBdysch is a collection of fast Linux kernel specific fuzzing harnesses supposed to be run in userspace in a guided fuzzing manner. It was des
fuzzing-101-solutions Companion repository to the Fuzzing101 with LibAFL series of blog posts. Tags are sync'd with blog post releases and can be used
personalized/patched dwm & st dwm patches * centeredmaster fibonacci uselessgap shiftview st patches * blinkingcursor font2 scrollback custom gruvbox
fs2comma-linux-path This is a patched version of fs2comma to compile on Linux. It currently implements two diffs: 41d433a - patch readline.cpp to chec
VICE Emulator emitting bap-frames traces This is a patched version of the VICE C64/VIC20/... emulator that can emit traces in the bap-frames format, p
Unicorn Engine Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU. Unicorn offers some unparalleled fe
QEMU README QEMU is a generic and open source machine & userspace emulator and virtualizer. QEMU is capable of emulating a complete machine in softwar
myQemu runing qemu in Docker by BOA It currently only supports mipsel configuration, other architectures have not been added yet, please wait for subs
Sloth ?? Sloth is a fuzzing setup that makes use of libFuzzer and QEMU’s user-mode emulation (qemu/linux-user) on x86_64/aarch64 host to emulate aarch
QEMU virtual device playground ?? UNDER CONSTRUCTION ?? Chicken or Egg? Development or Exploit..? Description Here are some example of QEMU virtual PC