Breakpoint in multi-thread environment causes hang once reached about qemu-libafl-bridge HOT 2 CLOSED

Handling multithread applications with qemu user is complex, the best would be to fuzz them with fullsystem. Breakpoints, for obvious reasons, are not traps but they simply exit the emulation loop. Having multiple threads in qemu usermode means having multiple emulation loops and so the emu.run() that you run in the harness it is just the emulation loop of the first thread.

From what I understood, you want to start fuzzing from another thread that is not the main one. Before starting any thread, create a thread creation hook with https://docs.rs/libafl_qemu/latest/libafl_qemu/emu/struct.Emulator.html#method.set_on_thread_hook and call emu.run from there. the fuzzer code must go in this hook once you recognize that you are creating the target thread

from qemu-libafl-bridge.

Thanks for the instant response. I wrongly assumed that the other threads are suspended once the breakpoint hits and the emulation loop is somehow synchronized, but this behavior makes sense if you think about it.

set_on_thread_hook looks good, that should solve the issue. Thanks again!

from qemu-libafl-bridge.