diff --git a/dump/dump.c b/dump/dump.c index 6fb6e1245a..e1e6aed3db 100644 --- a/dump/dump.c +++ b/dump/dump.c @@ -31,6 +31,10 @@ #include "qemu/main-loop.h" #include "hw/misc/vmcoreinfo.h" +#ifdef QEMU_NYX +#include "nyx/state/state.h" +#endif + #ifdef TARGET_X86_64 #include "win_dump.h" #endif @@ -1663,8 +1667,17 @@ static void dump_init(DumpState *s, int fd, bool has_format, } if (runstate_is_running()) { +#ifdef QEMU_NYX + if(GET_GLOBAL_STATE()->in_fuzzing_mode){ + s->resume = false; + } + else { +#endif vm_stop(RUN_STATE_SAVE_VM); s->resume = true; +#ifdef QEMU_NYX + } +#endif } else { s->resume = false; } @@ -1997,7 +2010,11 @@ void qmp_dump_guest_memory(bool paging, const char *file, #endif if (strstart(file, "file:", &p)) { +#ifdef QEMU_NYX + fd = qemu_open(p, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, S_IRUSR | S_IWRITE); +#else fd = qemu_open(p, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, S_IRUSR); +#endif if (fd < 0) { error_setg_file_open(errp, errno, p); return; diff --git a/nyx/hypercall/debug.c b/nyx/hypercall/debug.c index d1b302ce15..5e55252380 100644 --- a/nyx/hypercall/debug.c +++ b/nyx/hypercall/debug.c @@ -2,13 +2,18 @@ #include "sysemu/kvm.h" #include +#include "qapi/error.h" #include "nyx/fast_vm_reload.h" #include "nyx/hypercall/debug.h" #include "nyx/state/state.h" #include "nyx/synchronization.h" +#include "qapi/qapi-commands-dump.h" + +#ifdef NYX_DEBUG +#define NYX_ENABLE_DEBUG_HYPERCALLS +#endif -// #define NYX_ENABLE_DEBUG_HYPERCALLS #ifdef NYX_ENABLE_DEBUG_HYPERCALLS static double get_time(void) @@ -52,6 +57,7 @@ void handle_hypercall_kafl_debug_tmp_snapshot(struct kvm_run *run, uint64_t hypercall_arg) { static bool first = true; + Error *err = NULL; switch (hypercall_arg & 0xFFF) { case 0: /* create root snapshot */ @@ -99,6 +105,17 @@ void handle_hypercall_kafl_debug_tmp_snapshot(struct kvm_run *run, REQUEST_LOAD_SNAPSHOT_ROOT); break; } + case 6: + nyx_warn_once("%s: perform kcore_dump!\n", __func__); + bool in_fuzzing_mode_state = GET_GLOBAL_STATE()->in_fuzzing_mode; + GET_GLOBAL_STATE()->in_fuzzing_mode = true; + qmp_dump_guest_memory(false, "file:/tmp/vmcore_test.img", true, 0, 0, 0, + 0, 0, false, DUMP_GUEST_MEMORY_FORMAT_ELF, &err); + if (err) { + nyx_abort("(qmp_dump_guest_memory): %s\n", error_get_pretty(err)); + } + GET_GLOBAL_STATE()->in_fuzzing_mode = in_fuzzing_mode_state; + break; default: abort(); }