etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
init-vhci (3565B)
      1 #!/bin/sh
      2 #
      3 # /init-vhci — initramfs init for vhci-hcd client-mode fuzzing VM.
      4 #
      5 # Unlike qemu/init (which runs usbipd as a server), this init loads vhci-hcd
      6 # as a CLIENT and continuously tries to attach to a remote device.  The remote
      7 # "device" is fuzz_vhci_server running on the host, which sends malformed
      8 # USBIP_RET_SUBMIT responses to trigger bugs in vhci-hcd.
      9 #
     10 # This is the attack surface for CVE-2016-3955 class bugs:
     11 #   - actual_length > transfer_buffer_length → heap overflow in usbip_recv_xbuff
     12 #   - ISO descriptor mismatches → overflow in usbip_recv_iso
     13 #   - status / number_of_packets edge cases
     14 #
     15 # QEMU invocation (from the host):
     16 #   qemu-system-x86_64 \
     17 #     -kernel bzImage \
     18 #     -initrd initramfs-vhci.cpio.gz \
     19 #     -nographic -append "console=ttyS0 quiet" \
     20 #     -m 512M \
     21 #     -net nic,model=e1000 -net user
     22 #
     23 # The host's fuzz_vhci_server listens on 0.0.0.0:13241.
     24 # QEMU user-mode networking: host is reachable at 10.0.2.2 from inside the VM.
     25 
     26 set -e
     27 
     28 # ── virtual filesystems ────────────────────────────────────────────────────────
     29 mount -t proc     proc    /proc
     30 mount -t sysfs    sysfs   /sys
     31 mount -t devtmpfs devtmpfs /dev
     32 mkdir -p /dev/pts
     33 mount -t devpts   devpts  /dev/pts
     34 mount -t tmpfs    tmpfs   /tmp
     35 
     36 # debugfs: required for KCOV (/sys/kernel/debug/kcov)
     37 mount -t debugfs  debugfs /sys/kernel/debug 2>/dev/null || true
     38 
     39 # suppress most kernel messages on the console
     40 echo 1 > /proc/sys/kernel/printk
     41 
     42 # KASAN: panic immediately on memory error so AFL++ detects it via ECONNRESET
     43 echo 1 > /proc/sys/kernel/panic_on_oops
     44 echo 1 > /proc/sys/kernel/panic
     45 
     46 # ── networking ─────────────────────────────────────────────────────────────────
     47 # QEMU user-mode networking gives us 10.0.2.15/24, gateway 10.0.2.2
     48 ip link set lo   up
     49 ip link set eth0 up
     50 ip addr add 10.0.2.15/24 dev eth0
     51 ip route add default via 10.0.2.2 dev eth0
     52 
     53 # ── USB/IP client kernel modules ───────────────────────────────────────────────
     54 modprobe usbip-core 2>/dev/null || true
     55 modprobe vhci-hcd   2>/dev/null || true
     56 # Note: do NOT load usbip-host — we're only the client here
     57 
     58 # ── usbip attach watchdog ──────────────────────────────────────────────────────
     59 # Continuously tries to attach to the host's fuzz_vhci_server.
     60 # Host address: 10.0.2.2 (QEMU user-mode networking gateway)
     61 # Port: 13241 (fuzz_vhci_server's listening port)
     62 # Busid: 1-1 (matches the device in fuzz_vhci_server's OP_REP_IMPORT response)
     63 #
     64 # When fuzz_vhci_server closes the connection (normal iteration end), the attach
     65 # fails and the watchdog immediately retries — connecting to the next AFL++
     66 # iteration of fuzz_vhci_server.
     67 #
     68 # When vhci-hcd causes a KASAN report → kernel panic → VM reboots → fuzz_vhci_server
     69 # detects ECONNRESET → exits 1 → AFL++ records a crash.
     70 
     71 HOST="10.0.2.2"
     72 PORT="13241"
     73 BUSID="1-1"
     74 
     75 echo "usbip-fuzz: starting vhci attach watchdog (${HOST}:${PORT} busid=${BUSID})"
     76 
     77 while true; do
     78     usbip attach -r "${HOST}" -p "${PORT}" -b "${BUSID}" 2>/dev/null || true
     79     # Brief pause to avoid hammering if the host server isn't ready yet
     80     sleep 0
     81 done
     82 
     83 # unreachable