信息网络安全

信息网络安全 ›› 2026, Vol. 26 ›› Issue (7): 1087-1100.doi: 10.3969/j.issn.1671-1122.2026.07.007

• AI安全防御 • 上一篇    下一篇

基于指令翻译插桩的LLM辅助固件内存泄漏分析

姚戊煌, 王佳鹏, 陈康冰, 郑之涵, 谭毓安()   

  1. 北京理工大学网络空间安全学院， 北京 100081
  • 收稿日期:2026-04-29 出版日期:2026-07-10 发布日期:2026-09-03
  • 通讯作者: 谭毓安 E-mail:tan2008@bit.edu.cn
  • 作者简介:姚戊煌（2002—），男，福建，硕士研究生，主要研究方向为固件安全、系统安全|王佳鹏（2000—），男，黑龙江，硕士研究生，主要研究方向为固件安全、系统安全|陈康冰（2000—），男，浙江，博士研究生，主要研究方向为嵌入式安全、固件安全、二进制安全|郑之涵（2000—），男，山西，博士研究生，主要研究方向为固件安全、UEFI安全、模糊测试|谭毓安（1972—），男，重庆，教授，博士，CCF会员，主要研究方向为固件安全、数据安全、网络安全。
  • 基金资助:
    国家自然科学基金(U2336201)

An LLM-assisted firmware memory leak analysis based on instruction translation instrumentation

Yao Wuhuang, Wang Jiapeng, Chen Kangbing, Zheng Zhihan, Tan Yu’an()   

  1. School of Cyberspace Science and Technology, Beijing Institute of Technology, Beijing 100081, China
  • Received:2026-04-29 Online:2026-07-10 Published:2026-09-03
  • Contact: Tan Yu’an E-mail:tan2008@bit.edu.cn

RichHTML

7

PDF (PC)

15

摘要：

随着嵌入式设备在各类关键场景中广泛部署，基于Linux的嵌入式固件中的内存泄漏会导致服务可用性下降。现有针对开源固件程序的内存泄漏漏洞检测方法依赖源代码及符号信息，难以直接推广到闭源固件；而针对闭源固件程序的自动化内存泄漏检测方法则存在对ARM架构固件支持能力不足的问题。为此，文章提出一种面向基于Linux的嵌入式固件程序的内存泄漏分析方法MemLeakFinder，该方法基于QEMU的中间码指令翻译和插桩技术，实现对目标程序内存操作的动态追踪和分析，结合模糊测试和反汇编分析技术定位潜在的内存泄漏漏洞，并引入大语言模型（LLM）对捕获的内存泄漏漏洞现场进行语义理解与根因自动化分析。文章选择BMC固件作为目标环境，选择CGI作为目标协议并进行了综合性实验。实验结果表明，MemLeakFinder在Juliet测试套件上的识别准确率达92.16%，在对7种真实BMC固件的测试中，利用MemLeakFinder工具成功发现并验证了5个实际漏洞，涉及的关键漏洞已获得一项CVE编号，验证了该方法在闭源固件程序内存安全性分析中的有效性。

关键词: 内存泄漏, 中间码指令翻译, 插桩, 固件安全, 大语言模型

Abstract:

With the widespread deployment of embedded devices in various critical scenarios, memory leaks in Linux-based embedded firmware can degrade service availability and even cause service failures. Existing memory leak detection methods for open-source firmware rely on source code and symbol information, making it difficult to directly extend to closed-source firmware; while automated memory leak detection methods for closed-source firmware suffer from insufficient support for ARM architecture firmware. Therefore, we proposed a memory leak analysis method for Linux-based closed-source firmware, MemLeakFinder. Based on QEMU’s intermediate code instruction translation and instrumentation technology, it achieved dynamic tracking and analysis of the target program’s memory operations. It combined fuzzing and disassembly analysis techniques to locate potential memory leak vulnerabilities and introduced a large language model (LLM) to perform semantic understanding and automated root cause analysis of the captured memory leak vulnerability scenarios. We selected BMC firmware as the target environment and CGI as the target protocol, and conducted comprehensive experiments. Experimental results show that MemLeakFinder achieves an accuracy rate of 92.16% in the Juliet test suite. In tests on 7 real BMC firmwares, MemLeakFinder successfully discovered and verified 5 actual vulnerabilities. One critical vulnerability has been assigned a CVE number. These results, verifying the effectiveness of this method in memory security analysis of closed-source firmware programs.

Key words: memory leaks, intermediate code instruction translation, instrumentation, firmware security, large language model

中图分类号: