Skip to content

Forked from QEMU, based on QEMU-bitflip by AndersTrier

License

Unknown and 2 other licenses found

Licenses found

Unknown
LICENSE
GPL-2.0
COPYING
LGPL-2.1
COPYING.LIB
Notifications You must be signed in to change notification settings

tanyav2/flip-qemu

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

QEMU-flip

Testing utility to cause determinstic and composable bit flips in CPU registers, flags, memory and binaries.

A bitflip is represented by the tuple: < pc, L, M, i >

pc: Program counter @ which flip is to be triggered
L: target register, or memory address
M: mask to xor L with, allows flipping multiple bits
i: Iteration number at which PC hits that value (helps prevent FLIP from triggering flip each time the virtual CPU hits that PC value)

Building

(Verified to work with Ubuntu 18.04 LTS)

mkdir build
cd build
../configure --disable-kvm --enable-debug --target-list="x86_64-linux-user"
make

Example

Altering the value of variable a in asmexample.c

Without bitflips:

$ qemu-x86_64 asmexample
Value of A is 6

With bitflips:

$ qemu-x86_64 -bitflips ex-asm-mem.txt asmexample
Read following 1 bitflip(s):
Bitflip 0:
pc = 40000006c8,
mem_ptr = 4001a0243c,
mask = 2,
itr = 1.
Value of A is 8

Creating your own bitflips

To create your own bitflips, you need to know the instruction pointer that you are targeting, and the memory address. You can find these using GDB. You will need to open two terminals, and remotely attach GDB.

For instance, in order to find possible bitflip targets for asmexample.c, in one terminal run $ qemu-x86_64 -g 12345 asmexample and in the another, $ gdb asmexample, followed by (gdb) target remote localhost:12345, and then proceed normally.

Note that the IP (or program counter) you need points to the instruction that is exactly after the instruction you are targeting, because the QEMU translation of instructions adds bitflips immediately before the next instruction is executed.

About

Forked from QEMU, based on QEMU-bitflip by AndersTrier

Resources

License

Unknown and 2 other licenses found

Licenses found

Unknown
LICENSE
GPL-2.0
COPYING
LGPL-2.1
COPYING.LIB

Security policy

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published