syzkaller is a fuzzer that test system calls. Therefore, it starts one or more VMs in order to test system calls on the OS inside the VM.

syzkaller consists of three main components. syz-manager runs on the host. It starts the VMs and connects to them via SSH. syz-fuzzer runs inside a VM. It maintains one or more syz-executor, syz-executor actually executes the system call.

To be able to start a VM, syzkaller uses a virtualization software. syzkaller best supports qemu.

The first task is to create the VM.

create directory on host for vm

mkdir -p ~/qemu/freebsd

create qemu hard disk image

sudo qemu-img create freebsd.img 8G

start vm and install FreeBSD (download iso from freebsd.org)

sudo qemu-system-x86_64 -enable-kvm -hda freebsd.img -m 2G -net user,hostfwd=tcp::10021-:22 -net nic -curses -cdrom FreeBSD iso -boot d

after installation let vm print to console → add in /boot/loader.conf

console="comconsole"

start vm without graphic and with network sudo qemu-system-x86_64 -hda freebsd.img -enable-kvm -m 2G -net user,hostfwd=tcp::10021-:22 -net nic -nographic

• -net user let the vm uses a user mode network stack. Since hostfwd=tcp::10021-:22 is added, a connection to localhost:10021 (on host) is forwarded to the vm.

     guest (10.0.2.15)  <------>  Firewall/DHCP server <-----> Internet
                           |          (10.0.2.2)
                           |
                           ---->  DNS server (10.0.2.3)
                           |
                           ---->  SMB server (10.0.2.4)

• -nographic prints the console output of the vm directly into the console on the host

syzkaller needs root access to the OS in the VM via SSH.

create ssh keys on the host

ssh-keygen -f freebsd_id_rsa

add public key on the host (from freebsd_id_rsa.pub) into /root/.ssh/authorized_keys in the vm

allow ssh as root in vm. In /etc/ssh/sshd_config set

#PermitRootLogin no

to

PermitRootLogin yes

after that, restart sshd

sudo service sshd restart

Test ssh from host to vm

ssh -i ~/qemu/freebsd/freebsd_id_rsa -p 10021 -o "StrictHostKeyChecking no" root@localhost

This must work without entering a password.

syzkaller uses Go → Install Go

wget https://storage.googleapis.com/golang/go1.10.4.linux-amd64.tar.gz
tar -xf go1.10.4.linux-amd64.tar.gz
mv go goroot
export GOROOT=`pwd`/goroot
export PATH=$GOROOT/bin:$PATH
mkdir gopath
export GOPATH=`pwd`/gopath

get syzkaller

go get -u -d github.com/google/syzkaller/...

build syz-manager, syz-fuzzer on host

cd gopath/src/github.com/google/syzkaller/
mkdir workdir
make manager fuzzer execprog TARGETOS=freebsd

note the used GitRevision, for me it was

GitRevision=5b11ac2c91d99eababa8f04c7e2f9484c0763b53

build syz-executor on target (inside the VM)

• create folder in VM

mkdir -p ~/syzkaller/executor

• use scp on host to copy source files from host to VM

scp -P 10021 ~/gopath/github.com/google/syzkaller/executor/* localhost:~/src/syzkaller/executor/

• build syz-executor in vm using the GitRevision as noted before.

cd ~/syzkaller
c++ -o syz-executor executor/executor.cc -pthread -Wall -Wframe-larger-than=8192 -Wparentheses -Werror -O2 -m64 -static -DGOOS_freebsd=1 -DGOARCH_amd64=1 -DGIT_REVISION=\"5b11ac2c91d99eababa8f04c7e2f9484c0763b53\"

• use scp to copy built executable from VM to host.

scp -P 10021 localhost:~/syzkaller/syz-executor ~/gopath/src/github.com/google/syzkaller/bin/freebsd_amd64/

create syz-manager config file (on host) ~/gopath/src/github.com/google/syzkaller/freebsd.cfg

{
  "target": "freebsd/amd64",
  "http": "127.0.0.1:56741",
  "workdir": "/home/msvoelker/gopath/src/github.com/google/syzkaller/workdir",
  "image": "/home/msvoelker/qemu/freebsd2/freebsd.img",
  "sshkey": "/home/msvoelker/qemu/freebsd2/freebsd_id_rsa",
  "syzkaller": "/home/msvoelker/gopath/src/github.com/google/syzkaller",
  "enable_syscalls": [
    "socket$inet_sctp",
    "bind$inet",
    "listen",
    "connect$inet",
    "accept$inet",
    "read",
    "write",
    "close"
  ],
  "procs": 4,
  "type": "qemu",
  "cover": true,
  "vm": {
    "count": 4,
    "cpu": 1,
    "mem": 2048
  }
}

start syz-manager on host

cd ~/gopath/src/github.com/google/syzkaller
sudo bin/syz-manager -config freebsd.cfg