模糊测试/逆向工程虚拟机
我是逆向工程的初学者/中级人员，我正在努力跃升为专家。我想在虚拟机上做一个专门转义它们的项目，并且想知道模糊测试是否可以应用于它们。例如对虚拟机内部的网络和 I/O 设备进行模糊测试，然后评估结果。这是查找虚拟机漏洞的有效方法吗？
另外，我将如何调试虚拟机和虚拟机管理程序？
我希望寻找参考和好的指导。
非常好，正是我正在寻找的东西，谢谢。另一个问题是如何调试 vbox 和 qemu 之类的东西，这是在虚拟机还是主机中完成，或者是否提供了工具？这是我唯一不确定的部分。
I'm a beginner/intermediate at reverse engineering and I’m trying to make the leap to expert. I want to do a project on virtual machines specifically escaping them and was wondering if fuzzing could be applied to them. Such as fuzzing the networking and I/O devices inside the VM, then evaluate the results. Would this be a valid way of finding vulnerabilities in VM’s?
Also how would I go about debugging a VM and hypervisor?
I'm hopefully looking for references and good pointers.
Excellent just what I was looking for thanks. Another question would be how to debug things like vbox and qemu, would this be done in the virtual machine or the host, or are there tools provided? That is the only part I'm not sure about.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您需要阅读以下论文：
Tavis Ormandy，针对敌对虚拟化环境主机的安全暴露的实证研究< /a>，2007 年。
该论文描述了 Tavis Ormandy 如何对各种虚拟机进行模糊测试并报告其结果。他发现了一些严重的安全漏洞。基本上，他做了你想做的一切——所以你应该从阅读开始，看看他做了什么，以及你可以从中学到什么。
You need to read the following paper:
Tavis Ormandy, An Empirical Study into the Security Exposure to Hosts of Hostile Virtualized Environments, 2007.
That paper describes how Tavis Ormandy fuzz-tested a variety of virtual machines and reports on his results. He found a number of serious security vulnerabilities. Basically, he did everything it sounds like you want to do -- so you should start by reading to see what he did and what you can learn from it.
当然为什么不呢，只需找到一些具有大输入域的组件并进行模糊处理即可。一定要攻击那些实际上需要物理设备的东西，比如磁盘、视频、网络等，因为这些东西保证是由主机上的虚拟机用一些愚蠢的语言（比如 C 或 C++）实现的。
blackhat/defcon 会议上有很多关于这个主题的论文/幻灯片，但我不记得有什么特别的了，你自己看看吧。
Sure why not, just find some component with a big domain of inputs and fuzz away. Be sure to attack something that actually requires a physical device such as disk, video, networking etc, because those are guaranteed to be implemented by the VM on the host in some stupid language like C or C++.
There are a bunch of papers/slides from blackhat/defcon conferences on this topic, I can't remember any in particular though, see for yourself.
作为 Longpoke 和 DW 答案的补充步骤，也许您想看看 kemufuzzer< 等工具/a>.它提供了一个 gdb 后端来与 VMware 的内置调试器交互，您也可以对其进行扩展。
这是信息安全领域相对不太成熟的领域，因此您最终可能不得不实现大部分工具箱 - 尽管在大多数情况下您可以扩展现有的工具。
As an added step to Longpoke and D.W.'s answers, perhaps you'd want to take a look at tools like kemufuzzer. It provides a gdb backend to interact with VMware's builtin debugger, which you can also extend.
This is a relatively less mature field in information security, so you may end up having to implement most of your toolbox - though in most cases you can do with extending already existing tools.