Lucid is an educational fuzzing project which aims to create a Bochs emulator based snapshot fuzzer capable of fuzzing traditionally hard to fuzz targets such as kernels and browsers.
Lucid is based on a fuzzer originally conceived of and developed by Brandon Falk.
Lucid utilizes changes to Musl in order to affect Bochs’ behavior and achieve a functional sandbox that will allow Lucid to run Bochs within its virtual address space without being able to interact directly with the operating system.
The goal of the sandbox is to achieve determinism.
Lucid is currently in the early stages of development and can load and run a -static-pie
test program as well as Bochs
itself.
Lucid is also capable of sandboxing the test program from syscalls and access to thread-local-storage. More sandboxing work is required.
You can catch up on development efforts on the blog detailing each development step: The current codebase is more current than the latest blogpost.
Building the Rust portions of the project is very straightfoward, you should just be able to:
git clone https://github.com/h0mbre/Lucid
cd Lucid
cargo build --release
Lucid requires Musl libc 1.2.4, modified with Lucid-specific patches. Download and extract Musl:
tar -xzf musl-1.2.4.tar.gz
Apply Lucid patches to Musl:
cd path/to/musl-1.2.4
patch -p1 < path/to/musl_patches/musl.patch
Build and install the customized Musl:
./configure
make
sudo make install
Confirm that Musl is now installed at /usr/local/musl
, then you can:
gcc --specs=/path/to/musl_specs/musl-gcc.specs test.c -o test -g --static-pie
./lucid --bochs-image /path/to/test (--bochs-args)
lucid· Bochs image path: 'test'
lucid· Loading Bochs...
lucid· Bochs mapping: 0x10000 - 0x18000
lucid· Bochs mapping size: 0x8000
lucid· Bochs stack: 0x7F906B7FD000
lucid· Bochs entry: 0x11058
lucid· Creating Bochs execution context...
lucid· Starting Bochs...
Argument count: 1
Args:
-./bochs
Test alive!
Test alive!
Test alive!
Test alive!
Test alive!
g_lucid_ctx: 0x55a26ef9fce0
fatal: Bochs exited early
An innovative tool designed to revolutionize the testing, evaluation, and security of LLM applications. This…
A sophisticated tool designed for exploiting vulnerabilities in Android devices. This article dives into the…
SeamlessPass is a tool designed to obtain Microsoft 365 access tokens using on-premises Active Directory…
Comprehensive guide to the tools and resources pivotal in the world of forensic analysis. From…
An advanced Nmap script designed to detect potential vulnerabilities in network services. This article delves…
A powerful tool designed to tunnel TCP connections through a file. Ideal for circumventing firewalls…