Abstract:

Gray-box fuzzing is an effective way to conduct vulnerability analysis and exploit discovery on general software programs, but it cannot be directly applied to firmware devices. This paper first systematically summarized the basic technical requirements of gray-box fuzzing from the perspectives of functionality, effectiveness, and sustainability. Then it pointed out that existing firmware gray-box fuzzing methods for firmware suffer from complex configuration, poor generality, and significant overhead from the virtual machine introspection system. Subsequently, an efficient gray-box fuzzing approach for firmware network applications was proposed, which monitored the guest machine’s network-related system calls and leveraged the page directory address to identify the target process and collect code coverage information. The approach could meet the three basic technical requirements of gray-box fuzzing without the support of any complex virtual machine introspection system. Based on the proposed approach, the author developed a prototype system called FAN (FirmAFLNet), which supported various network protocols and was used to test two firmware network applications. Compared to using a virtual machine introspection system, the time overhead introduced by the approach has decreased from 12% to about 4%. The experimental results fully demonstrate the effectiveness of the approach.

Key words: firmware security, vulnerability analysis, gray-box fuzzing