search

IntelLabs / kAFL

A fuzzer for full VM kernel/driver targets
https://intellabs.github.io/kAFL/
MIT License
641 stars 85 forks source link

Generate VM dumps for offline debugging with crash util #147

Open il-steffen opened 1 year ago

il-steffen commented 1 year ago

Save VM image on crash/kasan event to help with debugging (in particular w.r.t. TDX/SDV setup).

Background: https://linux.die.net/man/8/crash File format: https://listman.redhat.com/archives/crash-utility/2008-August/001591.html Qemu gdb/python plugin: https://github.com/qemu/qemu/blob/master/scripts/dump-guest-memory.py

Qemu also has a native VM dump feature that can be triggered via QMP API: https://wiki.ubuntu.com/DebuggingKernelWithQEMU#QMP

We can trigger this on kAFL crash event, but crash(8) fails to load the resulting image.

@schumilo confirmed that qmp dump-guest-memory + crash util are working fine for vanilla qemu/kafl setup before and after snapshot. In that case, looks like the bug is caused by TDX/SDV-specific modifications to Qemu, Linux guest, or host KVM?

schumilo commented 1 year ago

WIP patch (code is only reachable via debug hypercall, crash handler integration is missing):

https://github.com/il-steffen/QEMU-Nyx/pull/1 https://github.com/il-steffen/QEMU-Nyx/pull/1/commits/ff1acd7033825593e609a7a52569dca5a8c1b1d7