ABYSS-Kernel-Framework

ABYSS: An Advanced Security Engineering Framework for Kernel and Hardware Auditing

ABYSS is a modular, low-level auditing framework developed in pure C, specifically designed for security researchers and systems engineers aiming to enhance the security posture of their systems. By targeting deep operating system and hardware components—including Bare-Metal Firmware, Kernel Drivers, ACPI Tables, and KVM Hypervisors—ABYSS provides powerful tools for inspection, analysis, and stress-testing.

Architecture & Core Modules

ABYSS features a high-performance modular architecture that comprises multiple essential components:

1. main.c: Acts as the advanced command-line interface (CLI) manager, handling global configuration and supporting daemon mode.
2. fuzz.c: A driver IOCTL fuzzing engine equipped with process sandboxing capabilities and crash detection mechanisms.
3. hyper.c: A lightweight Type-2 KVM-based hypervisor that facilitates VM-Exit interception, MSR, and PCI monitoring.
4. acpi.c: A robust ACPI table parser along with an AML bytecode mutation engine aimed at uncovering firmware vulnerabilities.
5. ipc.c / shm_ipc_log.c: Implements an atomic ring-buffer inter-process communication (IPC) and logging system utilizing shared memory.
6. report.c: Generates comprehensive telemetry reports, accessible in both JSON and HTML formats.

Prerequisites

To leverage the capabilities of ABYSS, a modern Linux environment with the appropriate privileges is necessary. Key requirements include:

• GCC (C99 or newer)
• Make
• KVM Kernel Support (specifically, /dev/kvm should be available)

Usage & Command Line Options

ABYSS can be executed as a whole or with specific modules activated. Basic usage is conducted as follows:

./abyss [options]

Command Options:

• -h, --help : Display help information and exit.
• -v, --verbose : Activate verbose debugging logs.
• -c, --config FILE : Load an external configuration file.
• -o, --output DIR : Designate an output directory for reports (defaults to ./abyss_report).
• -f, --format FMT : Specify report formats such as json or html.
• -d, --daemon : Execute the suite as a background daemon.
• --hyper : Limit execution to the hypervisor module only.
• --acpi : Target the ACPI engine module exclusively.
• --fuzz : Execute the driver fuzzer module only.
• --all : Sequentially activate all system modules.
• --iter N : Set the number of fuzzing iterations per IOCTL (default: 1000).
• --timeout MS : Specify the timeout for child processes in milliseconds (default: 2000).
• --shm NAME : Indicate the shared memory segment name (default: abyss_shm).

Example Commands:

1. Conduct a full audit with verbose logging:

   ./abyss --all --verbose
   

2. Execute the driver fuzzer module with 5000 iterations:

   ./abyss --fuzz --iter 5000 -o /tmp/fuzz_results
   

Testing & Quality Assurance

To ensure output integrity, users can run smoke tests using the following command:

make test

Furthermore, memory leaks can be examined with Valgrind:

make valgrind

ABYSS serves as a robust solution for scientific research, advanced penetration testing, and comprehensive operating system auditing.