EFI_DXE_Emulator: Qiling support in the works!

Re: https://firmwaresecurity.com/2019/08/23/qiling-binary-emulation-framework/ and https://firmwaresecurity.com/2020/02/27/efi-dxe-emulator-and-debugger-ported-to-windows/

Qiling has been looking for UEFI support for a while, see their TODO file:
https://github.com/qilingframework/qiling/blob/master/TODO

The EFI_DEX_Emulator is getting Qiling support!

Awesome to see this cross-platform UEFI emulator!!! https://t.co/eVbnivBJas

— Qiling Framework (@qiling_io) April 29, 2020

Inspired by several old Pin tools by @JonathanSalwan, I recently decided to add some basic taint analysis capabilities to the UEFI DXE emulator. It can already provide some potentially interesting insights!https://t.co/hdCnRfmlML pic.twitter.com/1OAiJcBOvp

— Assaf Carlsbad (@assaf_carlsbad) April 14, 2020

Just implemented BBs coverage collection for the UEFI emulator. Coverage file is saved in DRCOV format so it can be loaded by Lighthouse out-of-the-box.https://t.co/hdCnRfmlML pic.twitter.com/OOKyV7DSg1

— Assaf Carlsbad (@assaf_carlsbad) April 23, 2020

So actually one of my colleagues already started working on porting the entire codebase of the DXE emulator to be based on Qiling. Hopefully we'll have something to show for it soon😀

— Assaf Carlsbad (@assaf_carlsbad) April 24, 2020

https://github.com/assafcarlsbad/efi_dxe_emulator

PS: Qiling mentions how it’d be nice to fuzz UEFI with AFL:

Running UEFI on Qiling Framework and debug with IDAPro. Maybe we can also fuzz UEFI with AFLplusplus too. Thanks to @liba2k for his excellent work! Follow and star our project on https://t.co/6N3hq0JiGh pic.twitter.com/bk0FELDKTR

— Qiling Framework (@qiling_io) May 6, 2020

I just noticed that the below project (which I was about to point out to the Qiling project) is no longer available, unfortunately:

https://firmwaresecurity.com/2018/10/23/uefifuzzing-uefi-applications-and-libraries-for-afl-fuzzing/

CHIPSEC has a few small built-in fuzzers, some of which apply to UEFI.

The only other UEFI fuzzing project I know about is Intel’s Project Excite, an open source project which I don’t think they ever managed to open source, and I think it used KLEE instead of AFL:

https://software.intel.com/en-us/articles/finding-bios-vulnerabilities-with-symbolic-execution-and-virtual-platforms

EFI_DXE_Emulator: Qiling support in the works!

Published by hucktech

Leave a Reply Cancel reply

Share this:

Like this:

Published by hucktech

Leave a Reply Cancel reply