Skip to content

Latest commit

 

History

History
270 lines (248 loc) · 22.6 KB

README.md

File metadata and controls

270 lines (248 loc) · 22.6 KB
Raw

Awesome Embedded Fuzzing

Last Update

Description

A list of helpful fuzzing tools and research materials for embedded applications can be found in this repository.

All resources are alphabetically organized and labeled, making it simple to locate them simply searching one item from the index on the entire page (with CTRL+F). The ones not having a link attached are present in the documents/ folder.

Labels Indexes

By Type

  • Type: awesome
  • Type: benchmark
  • Type: blog%20post
  • Type: book
  • Type: code%20snippets
  • Type: community
  • Type: demo
  • Type: emulator
  • Type: library
  • Type: presentation
  • Type: reverse%20engineering
  • Type: testbed
  • Type: tool
  • Type: tutorial
  • Type: video

By Purpose

  • Purpose: benchmark
  • Purpose: binary%20analysis
  • Purpose: binary%20disassembly
  • Purpose: directed%20fuzzing
  • Purpose: embedded%20fuzzing
  • Purpose: emulation
  • Purpose: firmware%20rehosting
  • Purpose: firmware%20testing
  • Purpose: fuzzing
  • Purpose: fuzzing%20firmware
  • Purpose: fuzzing%20network%20protocols
  • Purpose: fuzzing%20x86%20binaries
  • Purpose: instrumentation
  • Purpose: symbolic%20execution
  • Purpose: synthetic%20bugs

Papers

Paper Title Abstract Venue Publication Date
JetSet
Click to see the abstract! The ability to execute code in an emulator is a fundamental part of modern vulnerability testing. Unfortunately, this poses a challenge for many embedded systems, where firmware expects to interact with hardware devices specific to the target. Getting embedded system firmware to run outside its native environment, termed rehosting, requires emulating these hardware devices with enough accuracy to convince the firmware that it is executing on the target hardware. However, full fidelity emulation of target devices (which requires considerable engineering effort) may not be necessary to boot the firmware to a point of interest for an analyst (for example, a point where fuzzer input can be injected). We hypothesized that, for the firmware to boot successfully, it is sufficient to emulate only the behavior expected by the firmware, and that this behavior could be inferred automatically. To test this hypothesis, we developed and implemented Jetset, a system that uses symbolic execution to infer what behavior firmware expects from a target device. Jetset can generate devices models for hardware peripherals in C, allowing an analyst to boot the firmware in an emulator (e.g., QEMU). We successfully applied Jetset to thirteen distinct pieces of firmware together representing three architectures, three application domains (power grid, avionics, and consumer electronics), and five different operating systems. We also demonstrate how Jetset-assisted rehosting facilitates fuzztesting, a common security analysis technique, on an avionics embedded system, in which we found a previously unknown privilege escalation vulnerability
USENIX 2021 2021
SoK: Enabling Security Analyses of Embedded Systems via Rehosting
Click to see the abstract! Closely monitoring the behavior of a software system during its execution enables developers and analysts to observe, and ultimately understand, how it works. This kind of dynamic analysis can be instrumental to reverse engineering, vulnerability discovery, exploit development, and debugging. While these analyses are typically wellsupported for homogeneous desktop platforms (e.g., x86 desktop PCs), they can rarely be applied in the heterogeneous world of embedded systems. One approach to enable dynamic analyses of embedded systems is to move software stacks from physical systems into virtual environments that sufficiently model hardware behavior. This process which we call “rehosting” poses a significant research challenge with major implications for security analyses. Although rehosting has traditionally been an unscientific and ad-hoc endeavor undertaken by domain experts with varying time and resources at their disposal, researchers are beginning to address rehosting challenges systematically and in earnest. In this paper, we establish that emulation is insufficient to conduct large-scale dynamic analysis of real-world hardware systems and present rehosting as a firmwarecentric alternative. Furthermore, we taxonomize preliminary rehosting efforts, identify the fundamental components of the rehosting process, and propose directions for future research.
ASIACCS 2021 2021

Resources

Contribution

  1. Edit the resources.csv file.
  2. Push the changes into the GitHub repository.
  3. Wait for the GitHub action to automatically recompile README.md.

Credits

The template is inspired from this repository.