Erwan Fasquel†, Frédéric Tronel‡, Yaëlle Vinçont†
‡CentraleSupélec, Inria, Univ Rennes, CNRS, IRISA
†Univ Rennes, Inria, CNRS, IRISA

## I. Introduction

Fuzzing macOS *Kernel Extensions* to find vulnerabilities is **challenging** due to their **unique** properties:

* Closed-source code with few documentation

* Recent shift from Intel chips to Apple Silicons

* Security measures like PAC, SIP, etc.

We present the **main obstacles** in fuzzing macOS, how **6 recent macOS fuzzers** face them, and we discuss ways to **improve** them.

<figure><img src="image_1.png" /><figcaption>**Figure 1:** Process used by macOS to link the Kernel to the Kernel Extensions</figcaption></figure>

## II. Background

<figure><img src="image_2.png" /><figcaption>**Figure 2:** Process to fuzz macOS kext with a feedback loop based on both coverage and bug detection</figcaption></figure>

## III. Recent macOS Fuzzing Solutions

<table><thead><tr><th rowspan="2">Fuzzer</th><th colspan="2">Targets</th><th colspan="4">Test Case Generation</th><th colspan="3">Execution</th><th colspan="4">Evaluation</th><th colspan="2">Analysis</th></tr><tr><th>Part</th><th>Chips</th><th>Type</th><th>Base Fuzzer</th><th>Test Cases</th><th>Grammar (Written vs Inferred)</th><th>Bug Types</th><th>Instrumented Basic Blocks</th><th>Coverage Collected With</th><th>Initial Seeds</th><th>macOS version</th><th>Trials</th><th>Time-out</th><th>Unique Bugs</th><th>Baseline</th><th>Techniques used</th></tr></thead><tbody><tr><td>IMF [1]</td><td>K</td><td>Intel</td><td>M</td><td>K</td><td>A, O, ED, ID</td><td></td><td>C</td><td></td><td></td><td>RWP traces</td><td>10.12.3</td><td>1*</td><td>24h</td><td>32</td><td>IOKit Fuzzer [9]</td><td>Syscall tracing</td></tr><tr><td>SyzGen [2]</td><td>K, X</td><td>Intel</td><td>MC</td><td>Syzkaller [6]</td><td>A, O, ED, ID</td><td></td><td>C</td><td>100%</td><td>Kernel space debugger</td><td>RWP traces</td><td>10.15.4</td><td>3</td><td>24h</td><td>34</td><td>IMF [1]</td><td>Syscall tracing, Dynamic Symbolic Execution, CFG extraction</td></tr><tr><td>KextFuzz [3]</td><td>K, X</td><td>arm64e</td><td>MC</td><td>Syzkaller [6]</td><td>A, O, ED, ID</td><td></td><td>C</td><td>~39%</td><td>Trampolines to another kext</td><td></td><td>11.5.2 (M1)</td><td>3</td><td>24h</td><td>49</td><td>SyzGen [2]</td><td>CFG extraction, taint analysis, function hooking, binary rewriting</td></tr><tr><td>Google Zero Project [4]</td><td>X</td><td>arm64e</td><td>MC</td><td>Jackalope [7]</td><td>K, X, P</td><td></td><td>C</td><td>100%</td><td>Userspace debugger</td><td></td><td>14 (M3)</td><td>?</td><td>?</td><td>3</td><td></td><td>Function hooking, binary rebasing, CFG extraction</td></tr><tr><td>Pishi [5]</td><td>K, X</td><td>arm64e</td><td>MC</td><td>Libfuzzer [8]</td><td>K, X</td><td></td><td>S, C</td><td>~99%</td><td>Trampolines to another kext</td><td></td><td>13 (M1)</td><td>?</td><td>?</td><td>9</td><td></td><td>CFG extraction, binary rewriting</td></tr><tr><td>Syzkaller [6]</td><td>K</td><td>arm64e</td><td>MC</td><td>K</td><td>A, O, ED, ID</td><td></td><td>S, C</td><td>100%</td><td>Emulation</td><td></td><td></td><td></td><td></td><td></td><td></td><td>Manual creation of syscall grammar</td></tr><tr><td>Prospective Us</td><td>K, X</td><td>arm64e</td><td>MC</td><td>Libfuzzer [8]</td><td>K, X, P, O</td><td></td><td>S, C, R</td><td>100%</td><td>Trampolines to another kext</td><td></td><td>14/15 (M2)</td><td>5</td><td>24h</td><td></td><td>Pishi [5], KextFuzz [3]</td><td>CFG extraction, binary rewriting, function hooking</td></tr></tbody></table>

**Target:** K means Kernel, X means Kernel Extensions. **Type:** M means Mutation, MC means Mutation with coverage feedback. **Test Cases:** K means Kernel syscalls, X means Kernel Extension syscalls, P means Power Events, O means Other Events (Interrupt, Timing, ...). **Grammar (Written and Inferred):** A means Arguments, O means syscall Order, ED means Explicit Dependencies, ID means Implicit Dependencies. **Bug Types:** C means crashes, S means memory bugs detected by a memory sanitizer, R means Race Condition. **Initial Seeds:** RWP means Real-World Programs. **Trials:** ? means the number of trials was not mentioned, 1* means we assume the trials were done at least once. **Timeout:** ? means the timeout was not mentioned.

<caption>**Table 1:** State of the art of macOS Kernel and Kernel Extensions fuzzing</caption>

## IV. Challenges

<figure><img src="image_3.png" /></figure>

**Identify** communications and create a grammar

* Lack of documentation for kext system calls

* Deep code protected by privileges and system states

<figure><img src="image_4.png" /></figure>

**Instrument kexts ...**

... to collect coverage:

* No active debugger

* Little virtualisation support

* Overhead of binary instrumentation

... to detect bugs:

* KASAN is only available for the kernel

<figure><img src="image_5.png" /></figure>

**The new Apple Silicons**

* ARM chips do not allow x86-64 techniques to be reused

* Few analysis tools (no active debugger, little virtualization, no CoreSight [5])

## V. Conclusion & Future Works

The unique architecture and close-source environment present **challenges** that, when overcome, will yield **new opportunities** for **improving kext fuzzing**.

5 potential improvements to kext fuzzing in macOS:

1. Use **multiple fuzzing generators**

* Share interesting elements (test cases, mutation ratios, ...)

2. **Detect more** than just crashes and memory bugs

* For example, race conditions

3. Conduct a comprehensive **assessment of the instrumentation**

* Overhead introduced by instrumentation

* Collect coverage on a significant number of kexts

4. Evaluate fuzzing techniques on recent versions of macOS

* Establish a baseline for future evaluations

5. Create a test-suite to evaluate kext fuzzers

* Use both **real-world bugs** and **synthetic bugs**

## References

[1] H. Han and S. K. Cha, "IMF: Inferred Model-based Fuzzer," in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Oct. 2017, pp. 2345-2358
[2] W. Chen, Y. Wang, Z. Zhang, and Z. Qian, "SyzGen: Automated Generation of Syscall Specification of Closed-Source macOS Drivers", in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, in CCS'21, Nov. 2021, pp. 749-763.
[3] T. Yin, Z. Gao, Z. Xiao, Z. Ma, M. Zheng, and C. Zhang, "KextFuzz: A Practical Fuzzer for macOS Kernel EXTensions on Apple Silicon", IEEE Transactions on Dependable and Secure Computing, pp. 1-15, 2023.
[4] Google Project Zero and I. Fratric, "Simple macOS kernel extension fuzzing in userspace with IDA and TinyInst," Nov. 21, 2024. Available: https://googleprojectzero.blogspot.com/2024/11/simple-macos-kernel-extension-fuzzing.html [Accessed: May 11, 2025]
[5] M. Firouzi, "Pishi: Coverage guided macOS KEXT fuzzing.," My interesting research, Nov. 08, 2024. Available: https://r00tkitsmm.github.io/fuzzing/2024/11/08/Pishi.html. [Accessed: May 11, 2025]
[6] "Syzkaller - kernel fuzzer", 2015. https://github.com/google/syzkaller [Accessed: May 11, 2025]
[7] Google Project Zero, "Jackalope: Binary, coverage-guided fuzzer for Windows, macOS, Linux and Android," 2020. Available: https://github.com/googleprojectzero/Jackalope. [Accessed: May 11, 2025]
[8] "LibFuzzer - a library for coverage-guided fuzz testing." https://llvm.org/docs/LibFuzzer.html [Accessed: May 11, 2025]
[9] Ian Beer, "2014. pwn4fun Spring 2014-Safari-Part II," 2014. Available: http://googleprojectzero.blogspot.com/2014/11/pwn4fun-spring-2014-safari-part-ii.html. [Accessed: May 11, 2025]