Snapshot Fuzzing macOS Kernel Via Emulation

The talk presents a project that brings snapshot-based, coverage-guided fuzzing to macOS kernel components. The speaker explains why fuzzing closed-source Apple code is hard: there is no source for compile-time instrumentation, dynamic binary instrumentation tools struggle with kernel code, and testing on Apple hardware limits how far the work can scale. Snapshot fuzzing avoids repeated startup cost by recording a running state and restoring it for each test case.

The middle of the talk covers the build. An earlier prototype on a bare-metal hypervisor needed dedicated physical hardware, so the team took VMware Fusion snapshots instead. They used the VMware GDB stub to pause the guest at a chosen breakpoint, then saved the memory and CPU state. The undocumented machine state file was parsed by patching an existing Volatility parser. The memory dump was loaded into an extended version of an existing Windows-focused fuzzer that runs an x86 emulator, and crashes are caught with a breakpoint on the kernel exception triage function.

The worked example targets the IPv6 input path. A packet is mutated in the mbuf before each run, and a single core reached roughly 1,000 executions per second. Coverage tracing, symbolized traces and IDA Lighthouse visualization were added for analysis. The main takeaway for practitioners is that emulation-based snapshots let kernel fuzzing run on ordinary servers, while Apple silicon support and more kernel targets remain future work.