cpufuzz is a dumb, simple and portable CPU fuzzer.
It's written in less than 100 lines of C code and supports any architecture in which you can install Linux or other Unix-like operating systems.
Its purpose is to find bugs or at least do an initial testing in CPU emulators, but it could also be used to find bugs or undocumented instructions in hardware CPUs.
You can see some of the bugs it found in the results section.
The program simply tries to execute random data as if they were instructions. This is done by child processes that will likely crash, or be killed by the parent process after a timeout.
The data that is going to be executed is sent out of the system using a network socket, so in the case of a system failure the executed buffer can be recovered for analysis.
make
You can easily cross compile replacing CC:
make CC=arm-linux-gnueabihf-gcc
Run a listening socket in the host:
while [ 1 ]; do nc -l -p 9999; done
Run the fuzzer in the guest: ./cpufuzz <output_ip_addr> <port>
Although the fuzzer tries its best to not crash, we are executing random data with unexpected results, so it's recommended to restart the fuzzer often while running:
while [ 1 ]; do timeout -s 9 300 ./cpufuzz 10.0.2.2 9999; pkill -9 cpufuzz; done
If everything goes as expected you should see something like this in the guest:
