Jevin Sweval jevinskie

Integrate Intel PT tracing into LibAFL QEMU

A Google Summer of Code 2024 Project with the AFLplusplus Organization
Mentor: @rmalmain
Project repository: https://github.com/AFLplusplus/LibAFL/

Note: This report is not intended to be purely technical documentation of the developed code. Instead, its goal is to describe my GSoC 2024 contributor experience, link to the developed code, summarize the current state of the project, and outline the challenges and lessons learned.

Project Description

Custom Boot Objects in Virtualization Framework macOS Guest VMs

By default, "custom boot objects" (created using kmutil create) can't be used in macOS Virtualization framework guest VMs. Here I show how to get around this Apple design flaw. Note that Virtualization framework macOS guests can only be created on Apple Silicon Macs.

To proceed, you'll need to work through my Running Third Party Kernel Extensions on Virtualization Framework macOS Guest VMs. Many

How to Enable Intel PT (Processor Trace) in QEMU-KVM VMs

Caution

Intel PT virtualization is BROKEN, as it has multiple fatal flaws, several which put the host at risk. Use at your own risk.

This guide will most likely become obsolete once the feature will be removed from the various linux distros. For more info check out KVM: VMX: Mark Intel PT virtualization as BROKEN and CVE-2024-53135

This script sets KVM Processor Trace feature in host-guest mode enabling VMs to use intel-pt

Vendor docs

https://docs.banana-pi.org/en/BPI-F3/BananaPi_BPI-F3

https://docs.banana-pi.org/en/BPI-F3/GettingStarted_BPI-F3

https://wiki.banana-pi.org/Banana_Pi_BPI-F3

	#!/usr/bin/env python

	from elftools.elf.elffile import ELFFile
	from pathlib import Path
	import struct
	import subprocess

	# Steps
	#
	# 0) Read definitions with addresses

	#!/bin/bash

	# Run the lsregister command and store the output in a variable
	output=$(/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump)

	# Use awk to parse the relevant sections
	echo "$output" \| awk '
	# When "CFBundleDisplayName" is found, store the app name
	/CFBundleDisplayName/ {
	app_name = substr($0, index($0, "=") + 2)

	#!/usr/bin/env bash
	#
	# Build Frida DEB.

	# register the cleanup function to be called on the EXIT signal
	trap cleanup INT

	#######################################
	# Deletes the temp directory.
	# Globals:

	iOS 17.6b3:
	{
	"device": "iPhone11,2",
	"keybags": [
	{
	"buildnum": "21G5066d",
	"illb": "0AF1E048865508ED01193BC44D4EA6F84D9DA3195B8805379987DC61B4128F7E040BE69B8EA8F53A6E73539F1DE6CC91",
	"ibot": "B1FC5FC83B146F93D8A79FAC373D3313C5EBBBA22072CCDB71A0340DAE1675AD423F55B4E3F03CC70AD5F11BF69660B8",
	"ibec": "2EE1E89ABBC1BCDF8CAAC3E174EC79D2475C84FD76A9A78ABE803A75A1DD47FD8520E4B9EFD1C3C74520E67E06C80F8D",
	"ibss": "214AC6198966311151D56AFC469D32A26702FD70F717D243BBC9960F6D2155FAA9C23312CBFE7026D77F3421D77FA402"

	//
	// Non-conclusive list of interesting private Metal pixel formats
	//
	let MTLPixelFormatYCBCR8_420_2P: UInt = 500
	let MTLPixelFormatYCBCR8_422_1P: UInt = 501
	let MTLPixelFormatYCBCR8_422_2P: UInt = 502
	let MTLPixelFormatYCBCR8_444_2P: UInt = 503
	let MTLPixelFormatYCBCR10_444_1P: UInt = 504
	let MTLPixelFormatYCBCR10_420_2P: UInt = 505
	let MTLPixelFormatYCBCR10_422_2P: UInt = 506