Dynamically Instrumenting the QEMU Emulator for Linux Process Trace Generation with the GDB Debugger

Abstract

In software debugging, trace generation techniques are used to resolve highly complex bugs. However, the emulators increasingly used for embedded software development do not yet offer the types of trace generation infrastructure available in hardware. In this article, we make changes to the ARM ISA emulation of the QEMU emulator to allow for continuous instruction-level trace generation. Using a standard GDB client, tracepoints can be inserted to dynamically log registers and memory addresses without altering executing code. The ability to run trace experiments in five different modes allows the scope of trace generation to be narrowed as needed, down to the level of a single Linux process. Our scheme collects the execution traces of a Linux process on average between 9.6x-0.7x the speed of existing QEMU trace capabilities, with 96.7% less trace data volume. Compared to a software-instrumented tracing scheme, our method is both unobtrusive and performs on average between 3-4 orders of magnitude faster.

Optimization Research of Directed Fuzzing Based on AFL

“…AFL is a coverage-guided fuzzing tool that tracks the code coverage of input samples and modifies input samples to enhance coverage and increase the likelihood of discovering vulnerabilities. It may collaborate with QEMU (quick emulator) to carry out fuzz testing on closed-source binary files [18] and attack potential memory security flaws, such as stack overflow, double free, etc. The process [19] roughly looks like this: (1) instrument the source code compilation program and record the code coverage; (2) select some input files as the original test set to join the input queue; (3) place the files in the queue according to a certain strategy "mutate"; (4) if the mutated file updates the coverage, keep it and add it to the queue; (5) the above process loops forever, during which the file that caused the program to crash is logged.…”