Pishi

Pishi is a static binary rewriting tool designed to instrument basic blocks in XNU kernel and in arbitrary macOS kernel extensions (kexts).
for XNU kernel, Pishi allows you to instrument at a function, file, or folder level. For example, you can instrument everything in the /bsd/net/ directory or focus specifically on content_filter.c or just one specific function in the XNU source code, e.g vnode_getfromfd. this enables targeted fuzzing.

After building and installing Pishi, you can use my modified version of libprotobuf-mutator which requires you to apply my patch( to make libfuzzer Pishi-aware) then build LLVM to have structure-aware, feedback-aware macOS kernel KEXT fuzzing with libFuzzer.

For more technical discussions read MoreInfo. and to start fuzzing read HowToFuzz

compare so other XNU kernel instrumenations methods:

• hardware-assisted, Arm CoreSight instrumenations is no avabilie in Apple silicon.
• kernel.kasan.* do not have Coverage Sanitizer.
• No other public static or dynamic instrumenations methods.

A note on security and safety Avoid running Pishi on your personal device; instead, use a dedicated research device that you are willing to risk damaging.