Harness used

[0xDivyanshu-new]

Hi,

I have been going through the repository and wanted to understand more about the harness that was used to capture the callstacks during a crash.

I see that the Harness inside the kafl.fuzzer Util's is using callbacks to capture the stack trace on KeBugCheck. I reversed the driver and so far it seems like the driver has been taken from https://github.com/SafeBreach-Labs/hAFL2/blob/main/drivers/CrashMonitoringDriver/CrashMonitoringDriver/main.c repository.

I wanted to know if there are couple of more additions that you did for the fuzzer to reliably capture the crash or this is all the code is really ?

Thanks

[5angjun]

You are correct. The Driver is from hAFL2.

As my best knowledge, I changed the hypercall used in hAFL2 for our framework and CallStack depth Log Level. Also, in our kafl.fuzzer, matching call stack with each payload for usability.

Best regards

[0xDivyanshu-new]

Hi @5angjun, Is it possible for you to share the code of the harness driver as part of the repo?

[5angjun]

I hope so. But unfotunately i cant. Because the code i wrote are in my former computer that i removed all data.

Why don't you to understand their Code? If you fully undetstand, you can figure out what to do for your work.

I modified their code in this way

1. change the hypercall number for nyx qemu/kernel
2. remove the code related to hyper-v's harness

[5angjun]

This issue will be closed due to prolonged inactivity.

If you have further questions or concerns, please feel free to reopen this issue.

Thank you for your understanding.