Platform: Intel Simics OpenBoardPkg (EDK II)
Target: BoardX58Ich10
Build: DEBUG_GCC5
Harness type: UEFI Application (UEFI_APPLICATION)
UEFI Shell: EDK II Shell v2.2
Agent: SimicsAgent.efi (UEFI v1.5)
I built a UEFI application fuzz harness using SimicsOpenBoardPkg and TSFFS.
The application uses:
HARNESS_START(Input, &InputSize);
Input[255] = '\0'; // FileName
Input[519] = '\0'; // Description
CHAR8 *FileName = (CHAR8 *)(Input + 0);
UINT64 *LinePtr = (UINT64 *)(Input + 256);
CHAR8 *Desc = (CHAR8 *)(Input + 264);
DebugAssert(
FileName,
LineNumber,
Desc
);
HARNESS_STOP();
When running the app, TSFFS prints:
[tsffs info] Adding processor 0 to fuzzer
[tsffs info] Magic instruction 1 was triggered ... but the index is not configured for this magic number
Configured indices are: start: 0, stop: [0], assert: [0]
ASSERT [DebugAssertHarnessApp] (1)
fuzzing never starts here
So I manually configured this in fuzz.simics:
@tsffs.start_on_harness = True
@tsffs.magic_start_index = 3724198552
Even though fuzzing starts, the input buffer is always empty / zeroed
Input is not filled with testcase data