search

aerosec / jetset

GNU General Public License v2.0
49 stars 6 forks source link

Update to Latest QEMU+Refactor #2

Open maxwell-bland opened 2 years ago

maxwell-bland commented 2 years ago

Ideally the taint tracking/symexec would be implemented in a more robust manner, without a dependency on angr/claripy, and with support for intermediate state tracking.

Below is a git diff for the current master branch of qemu with an outline of changes to the code-base:

commits_start.txt

maxwell-bland commented 2 years ago

Update:

There was really no need to do taint tracking on TCG IR ops, as this could all be handled via the Z3 C API. Attached are some files outlining an implementation on modern qemu with Z3 libraries. Ideally in the future the code changes in this tarball are integrated and patched in with control over branching / constraint recording.

modular_se_jetset.tar.gz