search

HexHive / ViDeZZo

ViDeZZo source code.
30 stars 4 forks source link

How to add a new virtual device？ #8

Closed Yu3H0 closed 1 year ago

Yu3H0 commented 1 year ago

I want to add a new virtual device in videzzo_qemu, how could I achieve it?

cyruscyliu commented 1 year ago

Simply, you can add a config to https://github.com/HexHive/ViDeZZo/blob/4b14c11b666f5f2feeb5cf8bd0fda3ffb728a1d0/videzzo_qemu/videzzo_qemu.c#L76 and then recompile.

Let me know what specific device you want to add and then I can show you how.

Yu3H0 commented 1 year ago

When I use the default fuzzer of qemu, I run the following command:

export AFL_DEFER_FORKSRV=1
export QEMU_FUZZ_ARGS="-machine type=q35,accel=qtest -device tulip -qtest stdio -nodefaults -nographic"
export QEMU_FUZZ_OBJECTS="tulip*"
qemu-fuzz-i386 --fuzz-target=generic-fuzz

By the way, I would like to know if using executable files in the videzzo_qemu/out-san directory has the same effect as using videzzo_qemu/qemu/out-san/qemu-videzzo-i386

cyruscyliu commented 1 year ago

I try to support tulip quickly and you can check out to branch add-tulip and see the commit: https://github.com/HexHive/ViDeZZo/commit/04c8a6c66a1826790eb5542c14bd9390f37410d1.

With this commit, make qemu qemu-coverage and this should recompile hw/net/tulip.c. If it doesn't work, please delete the old object file videzzo_qemu/qemu/out-san/libcommon.fa.p/hw_net_tulip.c.o.

To fine-tune the coverage, try ./videzzo_tool/04-quick-cov.sh i386 qemu tulip 60, double check the generated htmls, and then update the intra-message annotation in videzzo_types_gen_vmm.py.

The executables in videzzo_qemu/out-san and videzzo_qemu/qemu/out-san/qemu-videzzo-i386 are the same.

Please don't hesitate to let me know if there are any issues.

Yu3H0 commented 1 year ago

I appreciate it very much, nice work!