Expand description
TFFS Module for SIMICS
§Overview
This crate provides a client and module loadable by SIMICS to enable fuzzing on the SIMICS
platform. The client is intended to be used by the simics-fuzz crate, but it can be used
manually to enable additional use cases.
§Capabilities
The Module can:
- Trace branch hits during an execution of a target on an x86_64 processor. These branches are traced into shared memory in the format understood by the AFL family of tools.
- Catch exception/fault events registered in an initial configuration or dynamically using a SIMICS Python script
- Catch timeout events registered in an initial configuration or dynamically using a SIMICS Python script
- Manage the state of a target under test by taking and restoring a snapshot of its state for deterministic snapshot fuzzing
Modules§
- arch 🔒
- Architecture specific data and definitions
- fuzzer 🔒
- Fuzzing engine implementation, configure and run LibAFL on a separate thread
- haps 🔒
- Handlers for HAPs in the simulator
- interfaces 🔒
- Interfaces accessible from Simics script and Python
- log 🔒
- Logging
- magic 🔒
- Magic number definitions
- os 🔒
- source_
cov 🔒 - state 🔒
- Definitions for tracking the state of the fuzzer
- tracer 🔒
- traits 🔒
- util 🔒
Structs§
- Manual
Start 🔒Info - Exactly the same as
StartInfoexcept with the semantic difference that the address may not always be stored as physical, the user may provide a virtual address for both the address and the size pointer (if there is one). - Start
Info 🔒 - Tsffs 🔒
- The main module class for the TSFFS fuzzer, stores state and configuration information
Enums§
- Manual
Start 🔒Address - Manual
Start 🔒Size - Start
Physical 🔒Address - An address that was formerly virtual or formerly physical. The actual address must be physical.
- Start
Size 🔒
Constants§
- CLASS_
NAME - The class name used for all operations interfacing with SIMICS
Statics§
- _module_
capabilities_ - The module capabilities list
- _module_
date - The module build date
Functions§
- Tsffs_
alloc ⚠ - FFI wrapper
- Tsffs_
dealloc - FFI wrapper
- Tsffs_
deinit - FFI wrapper
- Tsffs_
finalize - FFI wrapper
- Tsffs_
init - FFI wrapper
- Tsffs_
objects_ finalized - FFI wrapper
- _simics_
module_ init - Exported symbol called by simics when module is loaded
- init 🔒
- Initialize TSFFS