benpye

ABSTRACT

In this paper, we propose SYSTEM, a novel fuzzer that uses a symbolic virtual machine (SVM) to generate input programs.

EVALUATION

We used SYSTEM to search for bugs in binutils version 2.34, and we found 50 new bugs. The search ran for 24 hours on a system with a EPYC 7003 CPU and 1 TB of memory. We found 8 high severity vulnerabilities: CVE-2020-2736, CVE-2020-2737, CVE-2020-25758, CVE-2020-25759, CVE-2020-25757, CVE-2020-25756, CVE-2020-25760 and CVE-2020-25754.

We use SYSTEM to search for bugs in parser generators and programming languages. We found 4 new vulnerabilities in the Racc ruby parser generator.

We use SYSTEM to search for bugs in three Linux distributions: Arch Linux, Fedora and Debian. We found 31 bugs in a one week search. 14 of the bugs are medium or high severity.

benpye

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Drawing;
using System.Linq;
using System.Windows.Forms;
using Microsoft.Management.Infrastructure;
using Microsoft.Management.Infrastructure.Options;

namespace VirtualMachineTray

benpye

import 'package:flutter/material.dart';

void main() {
  MaterialPageRoute.debugEnableFadingRoutes = true; // ignore: deprecated_member_use
  runApp(new MyApp());
}

class MyApp extends StatelessWidget {
  // This widget is the root of your application.
  @override

benpye

$wslpath = wsl.exe wslpath $args
wsl.exe vim $wslpath

benpye

SectionVendorTokens."skl_tokens" {
	SKL_TKN_UUID "1"
	SKL_TKN_U8_NUM_BLOCKS "2"
	SKL_TKN_U8_BLOCK_TYPE "3"
	SKL_TKN_U8_IN_PIN_TYPE "4"
	SKL_TKN_U8_OUT_PIN_TYPE "5"
	SKL_TKN_U8_DYN_IN_PIN "6"
	SKL_TKN_U8_DYN_OUT_PIN "7"
	SKL_TKN_U8_IN_QUEUE_COUNT "8"
	SKL_TKN_U8_OUT_QUEUE_COUNT "9"

benpye

TEST_CASE("CB opcodes", "[cb]")
{
    auto cpu = std::make_unique<CpuWrapper>();

    uint8_t code[] = {0xCB, 0xFF};
    cpu->WriteMemory(code, 0, sizeof(code));
    cpu->Reset();
    cpu->SetA(0);

    cpu->RunCycles(8);

benpye

Config Files

config.txt

# For more options and information see
# http://www.raspberrypi.org/documentation/configuration/config-txt.md
# Some settings may impact device functionality. See link above for details

# uncomment if you get no picture on HDMI for a default "safe" mode
#hdmi_safe=1

benpye

Keybase proof

I hereby claim:

• I am benpye on github.
• I am benpye (https://keybase.io/benpye) on keybase.
• I have a public key whose fingerprint is D373 8993 D52F A3FD C846 C908 FC89 A6C3 0CCA 2992

To claim this, I am signing this object:

benpye

# BCM2837 Raspberry Pi 3 Target

tcl_port 5555
telnet_port 4444
gdb_port 3333

transport select jtag

adapter_khz 1000

benpye

module top (
	input  clk,
	output LED0,
	output LED1,
	output LED2,
	output LED3,
	output LED4,
	output LED5,
	output LED6,
	output LED7