0x6b7966 / kasper

Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel

Setting up

Install dependencies, including go-task as a task-runner:

sudo apt install build-essential clang-11 lld-11 libelf-dev qemu-system-x86 bison flex golang libssl-dev cmake debootstrap python3-pexpect socat ninja-build ccache
sudo sh -c "$(curl -ssL https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin

Initialize/update git submodules (this will take awhile the first time it's run):

task update

Building

Create an initramfs and a disk image to be used with syzkaller:

task initramfs:create
task syzkaller:create-image

Build syzkaller with Kasper support:

task syzkaller:build

Configure and build LLVM with Kasper support:

task llvm:config llvm:build

Configure and build a Kasper-instrumented Linux kernel:

task kernel:config build kernel:bzImage

Running

Test that the instrumented kernel runs correctly:

task qemu:test

Fuzz the instrumented kernel:

task syzkaller:run-nobench

Evaluation

To aggregate gadgets and run the evaluation please check out kasper-results.