github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/docs/windows/README.md (about) 1 # Windows 2 3 `Windows` support is very raw and preliminary (read, non-working). 4 5 There is a [closed-source port at Microsoft](https://github.com/dwizzzle/Presentations/blob/master/David%20Weston%20-%20Keeping%20Windows%20Secure%20-%20Bluehat%20IL%202019.pdf). 6 7 There is a more complete 8 [closed-source Windows port](https://www.slideshare.net/AnthonyLAOUHINETSUEI/wsl-reloaded) 9 done by [Fritz](https://twitter.com/anarcheuz) and [zer0mem](https://twitter.com/zer0mem). 10 The port has found 6 bugs including 11 [CVE-2018-8441](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8441). 12 13 Also, BSoDs in WSL: [1](https://twitter.com/yoavalon/status/1102563655743406082), [2](https://twitter.com/NetanelBenSimon/status/1102563950221316096). 14 See [BUGS ON THE WINDSHIELD: FUZZING THE WINDOWS KERNEL](https://www.offensivecon.org/speakers/2020/netanel-ben-simon-yoav-alon.html) presentation. 15 16 To update descriptions run (assumes `cl` cross-compiler is in PATH): 17 ``` 18 syz-extract -os=windows 19 syz-sysgen 20 ``` 21 22 `sys/windows/windows.txt` was auto-extracted from windows headers with `tools/syz-declextract`. 23 24 To build binaries: 25 ``` 26 make fuzzer execprog stress TARGETOS=windows 27 REV=git rev-parse HEAD 28 cl executor\executor_windows.cc /EHsc -o bin\windows_amd64\syz-executor.exe \ 29 -DGIT_REVISION=\"$REV\" \ 30 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib \ 31 shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib \ 32 winmm.lib rpcrt4.lib Crypt32.lib imm32.lib Urlmon.lib Oleaut32.lib \ 33 Winscard.lib Opengl32.lib Mpr.lib Ws2_32.lib Bcrypt.lib Ncrypt.lib \ 34 Synchronization.lib Shell32.lib Rpcns4.lib Mswsock.lib Mincore.lib \ 35 Msimg32.lib RpcRT4.lib Rpcrt4.lib lz32.lib 36 ``` 37 38 To run `syz-execprog`: 39 ``` 40 bin\windows_amd64\syz-execprog.exe -executor c:\full\path\to\bin\windows_amd64\syz-executor.exe -stress 41 ``` 42 43 Windows is supported by only `gce` VMs at the moment. 44 To use `gce`, create a Windows GCE VM, inside of the machine: 45 46 - Enable serial console debugging (see [this](https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/boot-parameters-to-enable-debugging) for details): 47 ``` 48 bcdedit /debug on 49 bcdedit /dbgsettings serial debugport:1 baudrate:115200 /noumex 50 ``` 51 52 - Disable automatic restart in `sysdm.cpl -> Advanced -> Startup and Recovery` 53 54 - Setup sshd with key auth, [these](https://winscp.net/eng/docs/guide_windows_openssh_server) instructions worked for me. 55 Preferably use non-admin user. Save private ssh key. 56 57 Then shutdown the machine, stop the instance and create an image from the disk. 58 Then start `syz-manager` with config similar to the following one: 59 60 ``` 61 { 62 "name": "windows", 63 "target": "windows/amd64", 64 "http": ":20000", 65 "workdir": "/workdir", 66 "syzkaller": "/syzkaller", 67 "sshkey": "/id_rsa", 68 "ssh_user": "you", 69 "cover": false, 70 "procs": 8, 71 "type": "gce", 72 "vm": { 73 "count": 10, 74 "machine_type": "n1-highcpu-2", 75 "gce_image": "your-gce-image" 76 } 77 } 78 ```