{"id":21094628,"url":"https://github.com/ise-uiuc/kernelgpt","last_synced_at":"2025-04-07T12:01:41.890Z","repository":{"id":228267150,"uuid":"769608799","full_name":"ise-uiuc/KernelGPT","owner":"ise-uiuc","description":"KernelGPT: Enhanced Kernel Fuzzing via Large Language Models (ASPLOS 2025)","archived":false,"fork":false,"pushed_at":"2025-02-07T21:41:14.000Z","size":699,"stargazers_count":88,"open_issues_count":3,"forks_count":14,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-03-31T11:01:38.554Z","etag":null,"topics":["linux","syzkaller","testing"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ise-uiuc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-03-09T15:01:28.000Z","updated_at":"2025-03-29T12:57:37.000Z","dependencies_parsed_at":"2024-04-02T00:22:09.253Z","dependency_job_id":"bea76442-0cc6-415d-81b6-756da96b149b","html_url":"https://github.com/ise-uiuc/KernelGPT","commit_stats":{"total_commits":10,"total_committers":2,"mean_commits":5.0,"dds":0.09999999999999998,"last_synced_commit":"bb936aae0a201ad14bbd4198227581bc6c6bfc01"},"previous_names":["ise-uiuc/kernelgpt"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ise-uiuc%2FKernelGPT","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ise-uiuc%2FKernelGPT/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ise-uiuc%2FKernelGPT/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ise-uiuc%2FKernelGPT/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ise-uiuc","download_url":"https://codeload.github.com/ise-uiuc/KernelGPT/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247648874,"owners_count":20972944,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["linux","syzkaller","testing"],"created_at":"2024-11-19T22:18:11.514Z","updated_at":"2025-04-07T12:01:41.859Z","avatar_url":"https://github.com/ise-uiuc.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# KernelGPT: Enhanced Kernel Fuzzing via Large Language Models\n\n\u003cp align=\"left\"\u003e\n    \u003ca href=\"https://arxiv.org/abs/2401.00563\"\u003e\u003cimg src=\"https://img.shields.io/badge/arXiv-2401.00563-b31b1b.svg?style=for-the-badge\"\u003e\n\u003c/p\u003e\n\n\u003e [!IMPORTANT]\n\u003e We are keeping improving the documents and adding more implementation details. Please stay tuned at [README-DEV.md](README-DEV.md) for more information.\n\n**Contact:** [Chenyuan Yang](https://yangchenyuan.github.io/), [Zijie Zhao](https://zijie.cs.illinois.edu/), [Lingming Zhang](https://lingming.cs.illinois.edu).\n\n## About\n\n* **KernelGPT** is a novel approach to automatically inferring Syzkaller specifications via Large Language Models (LLMs) for enhanced kernel fuzzing\n* KernelGPT leverages an iterative approach to automatically infer all the necessary specification components, and further leverages the validation feedback to repair/refine the initial specifications. \n\n\u003e [!IMPORTANT]\n\u003e * KernelGPT has detected **24** new bugs 🐛 in the Linux kernel, with **11 assigned with CVEs**❗, and 12 of them are fixed.\n\u003e * A number of specifications generated by KernelGPT have already been merged into Syzkaller.\n\n## 🔨 Installation\n\nTo install the required packages, run the following command:\n\n```bash\npip install -r requirements.txt\n```\n\n### Linux \u0026 Syzkaller\nYou need to clone the linux and syzkaller repository to run the code. You can do this by running the following command:\n\n```bash\ngit submodule update --init --recursive\n```\n\nPlease refer to the [Sykaller documentation](https://github.com/google/syzkaller/blob/master/docs/linux/setup.md) for setup instructions.\n\n### Image\n\n```bash\ncd image \u0026\u0026 bash create-image.sh\n```\n\n## 🔍 Usage\n\n### Parsing\n\nYou need to first compile the kernel with Clang and trace the compile commands. To do this, run the following command:\n\n```bash\ncd linux\nmake CC=clang HOSTCC=clang allyesconfig\nbear -- make CC=clang HOSTCC=clang -j$(nproc)\n```\n\nTo parse the Linux repository, run the following command:\n\n```bash\ncd spec-gen/analyzer\nmake all\n```\n\nThis will create one `analyze` and one `usage` executable in the `spec-gen/analyzer` directory.\n\n\u003cdetails\u003e\n  \u003csummary\u003e⚠️ Possible issues\u003c/summary\u003e\nYou need to install `clang` and `libclang-dev` to compile the `analyze` and `usage` executables. More specifically, we need the Clang with version 14. You can install it by running the following command:\n\n```bash\nsudo apt-get install clang-14 libclang-dev\n```\nPlease refer to the [analyzer README](spec-gen/analyzer/README.md) for more information.\n\u003c/details\u003e\n\n```bash\n./analyze -p /path/to/linux/compile_commands.json\n```\n\nRun the `process_output.py` script\n\n```bash\npython process_output.py --linux-path /path/to/linux\n```\n\nThen collect the usage information\n\n```bash\n./usage -p /path/to/linux/compile_commands.json\n```\n\nAnd run the process_output.py script again\n\n```bash\npython process_output.py --linux-path /path/to/linux --usage\n```\n\nAfter that, you will get the following files under the `spec-gen/analyzer` directory:\n```\nprocessed_enum.json\nprocessed_enum-typedef.json\nprocessed_func.json\nprocessed_handlers.debug.json\nprocessed_handlers.json\nprocessed_ioctl_filtered.json\nprocessed_ioctl.json\nprocessed_struct.json\nprocessed_struct-typedef.json\nprocessed_usage.json\n```\n\n### Specification Generation\n\nTo generate the specification, first put your OpenAI API key in the `openai_key` file under the `spec-gen` directory. Then run the following command:\n\n```bash\npython gen_spec.py -d analyzer/processed_handlers.json -o spec-output -n 1\n```\n\nThis will generate one specification file in the `spec-output` directory.\n\n\nThen you can validate and repair the specification by running the following command:\n\n```bash\npython eval_spec.py -u -s spec-output/_generated --output-name debug -o eval-output\n```\n\nThis will validate the specification and generate the repaired specification in the `eval-output` directory.\nIt will invoke the `spec-eval/run-specs.py`.\n\n### Reuse the Generated Specifications\n\nIf you want to reuse our generated specifications for drivers (or sockets), you could use `eval_spec.py`:\n\n```bash\n# Under the directory `spec-gen`\npython eval_spec.py -u -s ../generated-specs/specs-6.7/correct-driver-spec --output-name debug -o eval-output --merge\n```\nThis command will translate all specification written in `json` to `syzkaller` format and run the syzkaller.\nThe log for this process is `spec-eval/debug/merged.log`.\n\nThen, all the textural specifications will be under `spec-eval/debug/default-tmp/syzkaller/sys/linux` directory, with `gpt4_`as the prefix.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fise-uiuc%2Fkernelgpt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fise-uiuc%2Fkernelgpt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fise-uiuc%2Fkernelgpt/lists"}