KVM-Nyx is a fork of KVM and enables Intel-PT tracing for vCPUs and nested hypercalls which are required for hypervisor fuzzing. It enables fuzzing of any x86 / x86-64 target by using one of Nyx's fuzzer frontends. Our patches are based on kernel version 5.10.73. You can find more detailed information in our main repository.

Warning: Our patches are only supported on Intel CPUs (Skylake or later).

There are 3 different ways to install and setup KVM-Nyx. The first approach is to install an Ubuntu pre-compiled mainline kernel and then install our prebuilt KVM-Nyx binaries. If you want to build the modules yourself, you install the Ubuntu kernel (including the headers) and then compile the KVM-Nyx modules. The last option is to compile the entire kernel including KVM-Nyx (this repository is a copy of a full kernel source tree).

We recommend the first approach, as it is by far the easiest to set up KVM-Nyx.

First, install the Ubuntu kernel image and its modules (headers are not necessarily required):

cd /tmp/ &&
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.10.75/amd64/linux-image-unsigned-5.10.75-051075-generic_5.10.75-051075.202110201038_amd64.deb &&
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.10.75/amd64/linux-modules-5.10.75-051075-generic_5.10.75-051075.202110201038_amd64.deb &&
sudo dpkg -i *.deb
sudo reboot

Next, make sure you have booted the Ubuntu kernel (run uname -a and check that the kernel version is 5.10.75-051075-generic). Download our KVM-Nyx module binaries (check the release section), extract the modules and move into the output directory. Finally, run the following command to load the modules:

unzip kvm-nyx-5.10.73-1.1.zip
cd kvm-nyx-5.10.73-1.1
sudo rmmod kvm_intel kvm
sudo insmod ./kvm.ko;
sudo insmod ./kvm-intel.ko;
sudo chmod 777 /dev/kvm

At this point your system is now ready for fuzzing targets in Intel-PT mode. Please keep in mind that you need to re-execute the last commands (which load the modules) to use KVM-Nyx after reboot. To install KVM-Nyx permanently, you can replace the KVM modules in the /lib/modules/$(uname -r) directory by the KVM-Nyx modules.

First, install the Ubuntu kernel image, its modules and all headers:

cd /tmp/ &&
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.10.75/amd64/linux-headers-5.10.75-051075-generic_5.10.75-051075.202110201038_amd64.deb &&
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.10.75/amd64/linux-headers-5.10.75-051075_5.10.75-051075.202110201038_all.deb &&
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.10.75/amd64/linux-image-unsigned-5.10.75-051075-generic_5.10.75-051075.202110201038_amd64.deb &&
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.10.75/amd64/linux-modules-5.10.75-051075-generic_5.10.75-051075.202110201038_amd64.deb &&
sudo dpkg -i *.deb
sudo reboot

Make sure you have booted the Ubuntu kernel (run uname -a and check that the kernel version is 5.10.75-051075-generic). Next, check out this repository by running the following command:

git clone --depth 1 --branch kvm-nyx-5.10.73 [email protected]:nyx-fuzz/kvm-nyx.git
cd kvm-nyx

To compile KVM-Nyx (out-of-three) you can use the following scripts:

sh compile_kvm_nyx_standalone.sh

To load the modules you can simply run the following command:

sh load_kvm_nyx.sh

Please keep in mind that you need to re-execute the last commands (which load the modules) to use KVM-Nyx after reboot. To install KVM-Nyx permanently, you can replace the KVM modules in the /lib/modules/$(uname -r) directory by the KVM-Nyx modules.

Check out this repository by running the following command:

git clone --depth 1 --branch kvm-nyx-5.10.73 [email protected]:nyx-fuzz/kvm-nyx.git
cd kvm-nyx

Prepare a kernel config (e.g. by running make oldconfig) and add the following option to the config (.config) before compile the kernel and its modules:

CONFIG_KVM_NYX=y

If you found and fixed a bug on your own: We are very open to patches, please create a pull request!

Our patches are provided under GPLv2 license.

Free Software Hell Yeah!

Proudly provided by:

• Sergej Schumilo - [email protected] / @ms_s3c
• Cornelius Aschermann - [email protected] / @is_eqv