SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rm README; /dev/null drive

Browse Source
This commit is contained in:
Alwin Berger 2025-05-21 08:25:13 +00:00
parent 08019ae94f
commit 794b617205
2 changed files with 1 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
fuzzers/FRET/README.md
View File

@ -1,26 +0,0 @@
# Qemu systemmode with launcher
This folder contains an example fuzzer for the qemu systemmode, using LLMP for fast multi-process fuzzing and crash detection.
## Build
To build this example, run
```bash
cargo build --release
cd example; sh build.sh; cd ..
```
This will build the the fuzzer (src/fuzzer.rs) and a small example binary based on FreeRTOS, which can run under a qemu emulation target.
## Run
Since the instrumentation is based on snapshtos QEMU needs a virtual drive (even if it is unused...).
Create on and then run the fuzzer:
```bash
# create an image
qemu-img create -f qcow2 dummy.qcow2 32M
# run the fuzzer
KERNEL=./example/example.elf target/release/qemu_systemmode -icount shift=auto,align=off,sleep=off -machine mps2-an385 -monitor null -kernel ./example/example.elf -serial null -nographic -snapshot -drive if=none,format=qcow2,file=dummy.qcow2 -S
```
Currently the ``KERNEL`` variable is needed because the fuzzer does not parse QEMUs arguments to find the binary.

2
fuzzers/FRET/src/fuzzer.rs
View File

@ -246,7 +246,7 @@ let run_client = |state: Option<_>, mut mgr, _core_id| {
#[cfg(not(feature = "snapshot_fast"))]
"-drive",
#[cfg(not(feature = "snapshot_fast"))]
"if=none,format=qcow2,file=dummy.qcow2",
"if=none,format=qcow2,file=/dev/null", // dummy drive to avoid qemu error
].into_iter().map(String::from).collect();
let env: Vec<(String, String)> = env::vars().collect();
let qemu = Qemu::init(&args).expect("Emulator creation failed");