Preparing your harness to start fuzzing
The objective of this chapter is to design a syscall fuzzer for iOS. To achieve this, we leveraged Trung’s harness, incorporating as much of it as possible, which is primarily located in softmmu/main.c and is generally understandable. Trung crafted a very handy harness that avoids some of the delays of TriforceAFL. Thanks to the dup2() call, we just bring AFL’s output to QEMU’s stdin with a little trick, by duplicating its standard input to a safer file descriptor. The dup2() call moves the file descriptor 0 (which is the QEMU stdin) to descriptor number 9. This is an arbitrary choice to avoid conflicts with other program descriptors and, simultaneously isolate the interaction of AFL with QEMU to a specific file descriptor. Let’s observe the code in bold:
56 int main(int argc, char **argv, char **envp)
57 {
58 if (getenv(SHM_ENV_VAR)) {
59 ...
