Abstract

‍
The Genode OS framework represents a novel operating system architecture that has been developed to address the challenges posed by complexity. It is an open-source tool kit for building highly secure component-based operating systems and its functionality extends across a wide range of devices, from those intended for use in embedded systems to those designed for dynamic general-purpose computing. Despite Genode’s self-characterisation as a security-oriented operating system, it is notable that there is an absence of support for fuzzing, a process which has proven its worth in discovering real-world software vulnerabilities. In this thesis we present the process of porting AFL++, a state-of-the-art fuzzer, to Genode, with the objective to address this lack of support for fuzzing. The experimental findings demonstrate that, despite the introduction of additional overhead by Genode, the ported fuzzer runs at 93% of the fuzzing speed compared to running AFL++ on a general-purpose operating system. The fuzzer was then employed to test a security-critical Genode component.

‍