qiling07 / kasper

Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel

Home Page:https://vusec.net/projects/kasper

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel

Setting up

Install dependencies, including go-task as a task-runner:

sudo apt install build-essential clang-11 lld-11 libelf-dev qemu-system-x86 bison flex golang libssl-dev cmake debootstrap python3-pexpect socat ninja-build ccache
sudo sh -c "$(curl -ssL https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin

Initialize/update git submodules (this will take awhile the first time it's run):

task update

Building

Create an initramfs and a disk image to be used with syzkaller:

task initramfs:create
task syzkaller:create-image

Configure and build LLVM with Kasper support:

task llvm:config llvm:build

Build syzkaller with Kasper support:

WARNING: the version of syzkaller we use only works with golang 1.15 (we are using golang 1.15.15)!

task syzkaller:build

Configure and build a Kasper-instrumented Linux kernel:

task kernel:config build kernel:bzImage

Running

Test that the instrumented kernel runs correctly:

task qemu:test

Fuzz the instrumented kernel:

task syzkaller:run-nobench

Evaluation

To aggregate gadgets and run the evaluation please check out kasper-results.

About

Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel

https://vusec.net/projects/kasper

License:Apache License 2.0


Languages

Language:C 49.3%Language:C++ 35.1%Language:Python 8.3%Language:CMake 4.4%Language:Shell 1.6%Language:Assembly 1.3%