Getting started

June 24, 2025 ยท View on GitHub

  1. Clone the repository.

  2. Set Up the Fuzzer: The environment variables used by the fuzzer are set in .cargo/config.toml. Descriptions:

    • CUSTOM_QEMU_DIR: sets the path to the qemu-libafl-bridge directory
    • CUSTOM_QEMU_NO_BUILD: can be set to 1 to prevent qemu from rebuilding the qemu-libafl-bridge. For the first run, it is recommended to comment this out.
    • CUSTOM_QEMU_NO_CONFIGURE: can be set to 1 to prevent qemu from reconfiguring. For the first run, it is recommended to comment this out.
    • KERNEL: path to the baseband firmware
    • NUM_JOBS: number of jobs the fuzzer will run

    The fuzzer dependencies and features are set in Cargo.toml.

    Run the fuzzer with the following command:

    cargo fuzz

    To run the project without fuzzing and just starting the emulation, run: cargo emu

  3. Killing the Fuzzer: We probably wouldn't need this later on

    If you need to stop the fuzzer, press Ctrl-Z to suspend it, then run:

    kill -9 %1

  4. Using tmux: The script tmux_bootsrap.sh creates a tmux session with 3 windows - fuzzer, qemu monitor and lldb. The setup can directly be used for fuzzing or debugging the emulation.