{"id":15924585,"url":"https://github.com/nstarke/bootfuzz","last_synced_at":"2025-03-24T13:33:17.877Z","repository":{"id":229387098,"uuid":"776592954","full_name":"nstarke/bootfuzz","owner":"nstarke","description":"A MBR Fuzzer","archived":false,"fork":false,"pushed_at":"2024-04-03T14:50:57.000Z","size":154,"stargazers_count":29,"open_issues_count":1,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-19T03:53:30.637Z","etag":null,"topics":["boot-sector","fuzzer","fuzzing","mbr","nasm","security-tools"],"latest_commit_sha":null,"homepage":"","language":"Assembly","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nstarke.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-03-23T23:36:19.000Z","updated_at":"2025-03-18T17:59:14.000Z","dependencies_parsed_at":"2024-10-06T21:22:56.987Z","dependency_job_id":null,"html_url":"https://github.com/nstarke/bootfuzz","commit_stats":null,"previous_names":["nstarke/bootfuzz"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nstarke%2Fbootfuzz","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nstarke%2Fbootfuzz/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nstarke%2Fbootfuzz/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nstarke%2Fbootfuzz/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nstarke","download_url":"https://codeload.github.com/nstarke/bootfuzz/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245279946,"owners_count":20589553,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["boot-sector","fuzzer","fuzzing","mbr","nasm","security-tools"],"created_at":"2024-10-06T21:22:54.964Z","updated_at":"2025-03-24T13:33:17.434Z","avatar_url":"https://github.com/nstarke.png","language":"Assembly","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Bootfuzz\n\n![Bootfuzz Screenshot](/bootfuzz-screenshot.png \"Bootfuzz Screenshot\")\n\nA small fuzzer written to test motherboards / system BIOS for MBR-based hosts\n\n## What does this test?\nThis fuzzer will test Port IO using the x86 `in` and `out` instructions. It uses a BIOS Service Timer to generate random word values and then supply those random word values as operands to the `in` and `out` instructions.  \n\nThere are also testing modes for BIOS Services provided by `int 0x13` - specifically disk read/write.\n\n## Contributing\nIf you are able to run this on actual hardware, please open an issue and let us know your system specs and your results.\n\n## Assembling\nYou can assemble `bootfuzz.asm` with NASM thusly:\n\n```\nnasm -f bin -o bootfuzz.img bootfuzz.asm\n```\n\n## Running\n\n[![\"Bootfuzz Running on Physical Hardware\"](https://img.youtube.com/vi/_j66cVXjqEk/0.jpg)](https://www.youtube.com/watch?v=_j66cVXjqEk \"Bootfuzz Running on Physical Hardware\")\n\n_Video of Bootfuzz running on physical hardware_\n\nAfter you have assembled the fuzzer into `bootfuzz.img`, you can run the fuzzer in qemu thusly:\n\n```\nqemu-system-i386 -fda bootfuzz.img -nographic -accel kvm\n```\n\nIn VirtualBox, you will need to add a \"Floppy\" controller in the VM settings and then add a floppy drive.  After the floppy drive is created, you can point it at `bootfuzz.img` and then boot up.\n\n## Precompiled\nYou can also use the provided `bootfuzz.img` in this repository as a precompiled mbr for fuzzing.\n\n## Crashing Test Cases\nI have seen repeatable crashes in QEMU, VirtualBox, and VMWare Workstation Player already, but I do not have the time or interest in triaging them.  I'm more interested in getting it running on physical hardware.\n\n**Crashing Testcase 1: QEMU and VirtualBox**\n\n* `QEMU emulator version 8.0.4 (Debian 1:8.0.4+dfsg-1ubuntu3.23.10.3)`\n* `VirtualBox Version 7.0.14 r161095`\n\n```\norg 0x7c00\n\nstart:\n    mov dx, 0x03ff\n    in ax, dx\n\ntimes 510-($-$$) db 0\ndb 0x55, 0xaa \n```\n\n**Crashing Testcase 2: VMWare Player**\n\n* `VMWare Workstation Player Version 17.5.1 build-23298084`\n\n```\norg 0x7c00\n\nstart:\n    mov dx, 0x04ba\n    mov ax, 0x00a8\n    out dx, ax\n\ntimes 510-($-$$) db 0\ndb 0x55, 0xaa \n```\n\n**Crashing Testcase 3: VMWare Player**\n\n* `VMWare Workstation Player Version 17.5.1 build-23298084`\n\n```\norg 0x7c00\n\nstart:\n    mov ax, 0x163e\n    mov dx, 0x043e\n    in ax, dx\n\ntimes 510-($-$$) db 0\ndb 0x55, 0xaa \n```\n\n## Bugs\nIf you find bugs using this fuzzer I would appreciate a shout out or a link back to this project.  \n\n### Qemu\nHere is a list of instructions that will cause problems at least with QEMU:\n\n```\nmov ax, 0x9090 (Any 16bit word)\nmov dx, 0x0cfe ; 0x03fb\nout dx, ax\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnstarke%2Fbootfuzz","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnstarke%2Fbootfuzz","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnstarke%2Fbootfuzz/lists"}