This repository contains an overview and documentation for our prototype of HyperMirage, a hybrid virtual CPU fuzzer presented at NDSS 2026. HyperMirage deploys a novel fuzzing technique for fuzzing virtual CPUs dubbed Direct State Manipulation (DSM). DSM enables the fuzzer to force the target hypervisor to handle artifical VM-exits, where all VM data accesses by the target hypervisor (i.e., to VM registers, memory or VMCS fields) are redirected to the fuzzing input. Support for DSM is implemented on top of the Nyx framework, for which we host patched versions. To enable efficient symbolic execution on hypervisors, we implement a record-and-replay runtime for SymCC, which consists of a frontend and a backend. The frontend is linked into the target hypervisor and the backend is linked into the host QEMU. For details please read our NDSS 2026 paper.
Repositories are hosted under a separate organization.
Documentation on how you can setup HyperMirage is provided in docs.
Start out with the host setup, then setup the desired guests. Afterwards, you can start fuzzing in either pure greybox mode or hybrid mode.
Build dependencies are more or less vanilla per component and are not specified here.