Closed KA2010 closed 2 years ago
1) Jetset uses xterm to display the firmware's output during symbolic execution. That error makes it seem like you don't have xterm installed. If it is and I forgot to add some config info to the makefile, let me know and I will fix it.
2) The output of run_drone_concrete looks correct. Jetset, by default, prints all length-1 MMIO writes to terminal. This ensures that we can view the serial text output of the firmware, but it also prints out junk when the firmware writes non-text to MMIO. The Drone target hit!
message lets you know that the execution succeeded, and that address b174
was the target, which, in this case, is the start of the Drone's main communication loop.
Thank you for replay, yes adding config info to the makefile, like how to download xterm with Jetset, will be helpful. but my question now that I do not know what to do with output, What is the next step. Is there any guide can help with that. thanks
One thing that you can do with the generated emulator is fuzz it: the fuzzer we used is located here https://github.com/aerosec/jetset_fuzzer .
yes I already look at it, but how I can use it. Is there is any guide that can help
The fuzzing repo README is pretty detailed, but we don't have anything like a quick start guide. The fuzzer just relies on AFL, so if you're familiar with AFL, it shouldn't be too hard to get started.
Adding to this, there is an example for how to perform syscall fuzzing at: https://github.com/aerosec/jetset_fuzzer/blob/320b00f3982eb279568157c6213ee00b448f7707/example/cpu-exec.c#L162
At a high level, the steps to fuzzing are:
As Evan suggested, reading through the fuzzer's readme (and hopefully the code!) to make sure you understand how the system is working is strongly suggested. After reading the README, if there is still confusion, reading through https://github.com/aerosec/jetset_fuzzer/blob/master/accel/tcg/afl-qemu-cpu-inl.c can help significantly, or shoot me an email at mb28@illinois.edu
that what I got
and when I run concrete file, I got