📗 kAFL’s Documentation

kAFL/Nyx is a fast guided fuzzer for the x86 VM. It is great for anything that executes as QEMU/KVM guest, in particular x86 firmware, kernels and full-blown operating systems.

Features

• kAFL/Nyx uses Intel VT, Intel PML and Intel PT to achieve efficient execution, snapshot reset and coverage feedback for greybox or whitebox fuzzing scenarios. It allows to run many x86 FW and OS kernels with any desired toolchain and minimal code modifications.

• The kAFL-Fuzzer is written in Python and designed for parallel fuzzing with multiple Qemu instances. kAFL follows an AFL-like design but is easy to extend with custom mutation, analysis or scheduling options.

• kAFL integrates the Radamsa fuzzer as well as Redqueen and Grimoire extensions. Redqueen uses VM introspection to extract runtime inputs to conditional instructions, overcoming typical magic byte and other input checks. Grimoire attempts to identify keywords and syntax from fuzz inputs in order to generate more clever large-scale mutations.

For details on Redqueen, Grimoire, IJON, Nyx, please visit nyx-fuzz.com.

Components

The project is structured around multiple components:

• IntelLabs/kAFL: The main repository which organises all subcomponents

• IntelLabs/kafl.fuzzer: The fuzzer frontend

• IntelLabs/kafl.linux: Modified KVM with Intel PT and kAFL hypercalls support

• IntelLabs/kafl.qemu: Modified QEMU with fast-snapshots support

• IntelLabs/kafl.libxdc: Fast Intel PT decoding library

• IntelLabs/kafl.targets: Example kAFL targets

• IntelLabs/kafl.actions: Github Action for CI/CD integration

Contents

Tutorials

• Introduction
• Installation
  • 1. Requirements
  • 2. Cloning the sources
  • 3. Deploying kAFL : make deploy
  • 4. Setting kAFL environment : make env
  • 5. Verify the installation
  • 6. On to the next steps !
• Concepts
  • kAFL Agent
  • Pick a Target !
• Linux Target
  • DVKM
  • Linux Kernel target
• Windows Target
  • Driver
  • Userspace

How-to guides

• Github Actions CI/CD
  • 1 - Deploying the kernel
  • 2 - Setting up Docker
  • 3 - Setup the Github Actions Runner
  • 4 - Using kafl.actions
  • References

Reference

• Fuzzer Configuration
  • Configuration sources and precedence
  • Overriding settings from environment variables
  • Configuration keys
• Deployment
  • System modifications
  • Makefile targets
  • Ansible tags
  • Ansible Galaxy and composability
• kAFL/Nyx Hypercall API
  • Essential hypercalls
  • Further optional hypercalls
  • Utility functions
  • Untested and not fully integrated
  • Deprecated
• kAFL Workdir
  • Usage Conventions
  • Configuration Options
  • Detailed Content
• kAFL User Interface
  • kAFL GUI

Context

• Research Papers

Development

• Building the documentation