Gravis

Vulnerabilty Research student/apprentice

[FuzzingLabs @FuzzingLabs]

How does architecture, mobility management, Firmwire, and fuzzing come together to shape secure communication systems? Let’s break it down! 🧵👇

[Gravis @gravis_re]

@R00tkitSMM Indeed, and yes it's better to fuzz baremetal in that case ^^
Idk if you saw my other responses to my previous answers
Can't spill my current work, you'll get a sweet blogpost if it concludes ^^

[Gravis @gravis_re]

@R00tkitSMM If L2 tries running VMX instructions, it will be trapped by L0 the same way. Then L0 will look at the VMCS12 to see if L1 wants to trap them (if L1 is KVM it will).
If L1 wants to trap them, L0 will send the trapping to L1.
If L1 does unsafe things with it, L0 will trap back L0

[Gravis @gravis_re]

@R00tkitSMM That's why I'm saying it shouldn't be a problem to just trace L1, if KVM is correctly implemented, it should be seamless for it, for coverage, and for fuzzing

[Gravis @gravis_re]

@R00tkitSMM For instance svm_vcpu_enter_exit is noinstr, perhaps that's why you don't see them VMX instructions ? They are indeed executed by the L1, which provokes a VMEXIT and the instruction being emulated by L0, but you should still be able to trace it (without the noinstr)

[Gravis @gravis_re]

@R00tkitSMM I get it, but I'm not sure I aggree, the seamlessness is well implemented inside of KVM.
If L1 cov is not enough, L0 tracing (or intel-pt) might be the way to go.
Also some of that code is marked noinstr so careful with kcov ^^

[Gravis @gravis_re]

@andremoulu @CellebriteLabs 👋 ^^

[Gravis @gravis_re]

@ech0re @kusamanetwork So the nominated validator acts as a trust fund?

[Gravis @gravis_re]

@Synacktiv 🔥🔥🔥