PISHI: COVERAGE GUIDED MACOS KEXT FUZZING

Summary from the TLDR InfoSec newsletter

This author provides a deep dive on macOS internals and their process in building a KEXT fuzzer. The post begins by detailing the difficulties of kernel-level binary instrumentation in macOS. The author then describes how they came to decide on an architecture that uses a custom-built trampoline to instrument basic blocks that were identified in the Boot Kext Collection and then feed the coverage results into the next iteration of the fuzzer.