A patched QEMU that exposes an interface for LibAFL-based fuzzers

Overview

QEMU LibAFL Bridge

This is a patched QEMU that exposes an interface for LibAFL-based fuzzers.

This raw interface is used in libafl_qemu that expose a more Rusty API.

License

This project extends the QEMU emulator, and our contributions to previously existing files adopt those files' respective licenses; the files that we have added are made available under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.
You might also like...
A test of judging code using qemu

QEMU Judger Test This project was done abandoned 2 months ago, and I can't remember everything very well, so the steps here may be wrong. Setup First,

This is an upgrade to the initial TerminalOS source, supporting real hardware other than just QEMU, using GRUB as a bootloader instead of the crappy one i wrote

Terminal OS Author: Maheswaran Date: 20th Nov 2021 PROGRESS Multiboot compilance achieved VGA driver from complete with print_hex, print_dec, printf f

Add tensilica esp32 cpu and a board to qemu and dump the rom to learn more about esp-idf

qemu_esp32 Add tensilica esp32 cpu and a board to qemu and dump the rom to learn more about esp-idf ESP32 in QEMU. This documents how to add an esp32

AVR-based frequency counter module with I2C interface.
AVR-based frequency counter module with I2C interface.

AVR-based Frequency Counter The AVR-based frequency counter is partly based on the project developed by Herbert Dingfelder with some extensions and mo

`lv_lib_100ask` is a reference for various out of the box schemes based on lvgl library or an enhanced interface for various components of lvgl library.

Introduction lv_lib_100ask is a reference for various out of the box schemes based on lvgl library or an enhanced interface for various components of

experiments with the Gameboy Advance serial interface
experiments with the Gameboy Advance serial interface

(I'm hedging my bets with this repo name. I'd want to add more serial setup tutorials. For example, I bought a bunch of Gameboy Advance wireless adapt

An implementation of a weak handle interface to a packed vector in C++

Experimental handle container in C++ Overview Following on from c-handle-container, this library builds on the same ideas but supports a dynamic numbe

A line follower simulation created in CoppeliaSim, with a C++ interface for CoppeliaSim's Remote API
A line follower simulation created in CoppeliaSim, with a C++ interface for CoppeliaSim's Remote API

Wall-E-Sim A line follower simulation created in CoppeliaSim, with a C++ interface for CoppeliaSim's Remote API This is a simuation of SRA's Wall-E bo

A graphical interface to set options on devices with coreboot firmware
A graphical interface to set options on devices with coreboot firmware

Corevantage A graphical interface to set options on devices with coreboot firmware. Introduction This is a utility that allows users to view and modif

Comments
  • Disable shared lib by default

    Disable shared lib by default

    QEMU meson detects all shared lib on the system which might be used by QEMU and links them. This is not a preferred behavior as it depends on the system which it is running on and its installed packages. As long as libafl_qemu does not detect all shared libs in its build_linux.rs, one needs to add them manually (https://github.com/AFLplusplus/LibAFL/blob/main/libafl_qemu/build_linux.rs#L299-L315). By disabling all features by default, this problem can be circumvented. If a specific feature is needed and present on a system, one can still enable it using the CLI flags --enable-{feature}.

    I already tested this change and it does not break the libafl fuzzer qemu_launcher.

    opened by TeumessianFox 1
  • [WIP] Fix build for ARM target

    [WIP] Fix build for ARM target

    Currently, does not seem to build for the ARM target, and probably also not aarch64, due to a copy-paste error:

    ../target/arm/translate.c: In function ‘op_s_rri_rot’:
    ../target/arm/translate.c:5543:40: error: ‘tmp2’ undeclared (first use in this function); did you mean ‘tmp1’?
     5543 |       libafl_gen_cmp(s->pc_curr, tmp1, tmp2, MO_32);
          |                                        ^~~~
          |                                        tmp1
    

    This seems to fix the build. However, I am not sure the current code makes sense, since it seems to be a comparison with a (possibly) rotated immediate value. Not sure there need to be cmplog hooks placed on that?

    opened by f0rki 1
  • Fixing wildcard in configure

    Fixing wildcard in configure

    Removing the wildcard for configuration flags, enabling QEMU meson flags.

    Problem: ./configure --help indicated that additional flags will be passed through to meson. ./configure --disable-tmp should be handled by meson, but throws an error due to the wildcard in front of it in the configure file. Probably a merge issue as the QEMU vanilla repo does not have this wildcard.

    opened by TeumessianFox 0
  • Fixing libafl_add_backdoor input type for 32-bit targets

    Fixing libafl_add_backdoor input type for 32-bit targets

    Works:

    ../configure --as-shared-lib --target-list=x86_64-linux-user --disable-blobs --disable-bsd-user --disable-fdt
    make -j
    

    Doesn't works:

    ../configure --as-shared-lib --target-list=arm-linux-user --disable-blobs --disable-bsd-user --disable-fdt
    make -j
    
    opened by TeumessianFox 0
Owner
Advanced Fuzzing League ++
We want to make fuzzing better and better
Advanced Fuzzing League ++
A collection of user-space Linux kernel specific guided fuzzers based on LKL

kBdysch kBdysch is a collection of fast Linux kernel specific fuzzing harnesses supposed to be run in userspace in a guided fuzzing manner. It was des

Anatoly Trosinenko 63 Nov 25, 2022
Companion repository to the Fuzzing101 with LibAFL series of blog posts.

fuzzing-101-solutions Companion repository to the Fuzzing101 with LibAFL series of blog posts. Tags are sync'd with blog post releases and can be used

epi 89 Dec 26, 2022
my personalized/patched dwm + st

personalized/patched dwm & st dwm patches * centeredmaster fibonacci uselessgap shiftview st patches * blinkingcursor font2 scrollback custom gruvbox

null 4 Mar 28, 2022
a patched version of fs2comma

fs2comma-linux-path This is a patched version of fs2comma to compile on Linux. It currently implements two diffs: 41d433a - patch readline.cpp to chec

Matt Hodges 1 Oct 23, 2021
A patched version of the VICE C64/VIC20/... emulator

VICE Emulator emitting bap-frames traces This is a patched version of the VICE C64/VIC20/... emulator that can emit traces in the bap-frames format, p

Rizin Organization 1 Jan 20, 2022
Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU.

Unicorn Engine Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU. Unicorn offers some unparalleled fe

lazymio 1 Nov 7, 2021
QEMU port for t8030

QEMU README QEMU is a generic and open source machine & userspace emulator and virtualizer. QEMU is capable of emulating a complete machine in softwar

null 1.7k Jan 4, 2023
runing qemu in Docker by BOA

myQemu runing qemu in Docker by BOA It currently only supports mipsel configuration, other architectures have not been added yet, please wait for subs

null 20 Nov 9, 2022
Sloth 🦥 is a coverage guided fuzzing framework for fuzzing Android Native libraries that makes use of libFuzzer and QEMU user-mode emulation

Sloth ?? Sloth is a fuzzing setup that makes use of libFuzzer and QEMU’s user-mode emulation (qemu/linux-user) on x86_64/aarch64 host to emulate aarch

Chaithu 82 Nov 29, 2022
Example virtual PCI devices for QEMU.

QEMU virtual device playground ?? UNDER CONSTRUCTION ?? Chicken or Egg? Development or Exploit..? Description Here are some example of QEMU virtual PC

smallkirby 2 Apr 5, 2022