Support system mode - Githubissues

eurecom-s3 / symqemu

SymQEMU: Compilation-based symbolic execution for binaries

http://www.s3.eurecom.fr/tools/symbolic_execution/symqemu.html

Other

323 stars 42 forks source link

Support system mode #32

Open Kalvin2077 opened 11 months ago

Kalvin2077 commented 11 months ago

Dear maintainers, the tool is awesome.

I've been analyzing ARM firmware recently. If I want to enable symbolic execution in ARM full-system mode, what modifications and support do we need for symqemu?

aurelf commented 11 months ago

Hi, thank you for the feedback. We are working on this. Hopefully publishing this in a few weeks or months.

Kalvin2077 commented 11 months ago

Okay. I'm looking forward to it!

In addition, I‘ve read the relevant paper on symqemu, and I guess that in principle it supports

the transfer of symbolic data between general registers and memory
the free switching of symbolic execution and concrete execution

If this is true, can you give me a rough guide as to which specific part of the code to explore for more details?

aurelf commented 11 months ago

Hi, that's an unrelated question, but for the register to memory check calls to gen_helper_sym_store_host_i32 for example in tcg-op.c Not sure I understand the second question, SymQemu executes in concolic mode so both concrete and symbolic (when needed) along one path.

jiliguluss commented 9 months ago

It would be great if symqemu could support arm. I am looking forward to this feature coming online. When can I expect to see this new feature?

aurelf commented 8 months ago

ARM 32/64 should be already working for arm user linux target. Full system will come at some point too but not immediately (we have something internally but will need more work for merging here).