AFLplusplus / qemu-libafl-bridge

A patched QEMU that exposes an interface for LibAFL-based fuzzers
Other
57 stars 29 forks source link

Fixed qemu usermode snapshot #66

Closed cube0x8 closed 4 months ago

cube0x8 commented 4 months ago

During the snapshot process, we used to traverse the proc self tree and match its intervals with those in pageflags_root using page_check_range. We would then snapshot only the memory ranges that overlapped between proc self and pageflags_root. However, if a range from proc self maps couldn't be located in pageflags_root, such as when an interval in pageflags_root was merged into a larger one in proc self maps, it would be skipped and not included in the snapshot. This omission led to bugs in the long run.

Now, during snapshotting (pub fn snapshot), we traverse only the pageflags_root tree. We use its intervals to query the proc self maps to gather additional information such as privileges, offset, path, etc. This approach ensures that we capture all memory segments of the emulated target, preventing any segments from being missed.