QEMU-Native Hooking Bridge for Binary Fuzzing
summary
A QEMU-native hooking bridge for AFLplusplus implements hook functions as a TCG plugin with only a six-line GDB change inside QEMU, installs a small trampoline to invoke hooks, avoids deep QEMU edits, and uses DLopen-named hooks plus single-stepping to prevent recursive reentry. Example: emulating a CAN peripheral via a hook turns a stalled AFLplusplus run into one that finds a stack overflow. Benchmarks show roughly 10x speed over the UNICORN/python overlay.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 1:04Traditional binary testing challenges
- 3:53Limitations of existing solutions
- 4:36QEMU-Native Hooking Bridge concept
- 7:02Hook implementation details
- 7:23Demo: Buffer overflow detection
- 8:46Demo results and performance
- 9:49Future improvements and conclusion
- 10:51Q&A and closing
related talks
20mAFL++ : Combining Incremental Steps of Fuzzing Research
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
29mVirtual Device Fuzzing Support in QEMU
32mFuzzing Zephyr Apps - Struggles of Dynamic Analysis on Embedded Applications
58mFuzzing Embedded (Trusted) Operating Systems Using AFL
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
24mQSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing
50mWhat the Fuzz