An LLM-assisted firmware memory leak analysis based on instruction translation instrumentation

doi:10.3969/j.issn.1671-1122.2026.07.007

Abstract

Abstract:

With the widespread deployment of embedded devices in various critical scenarios, memory leaks in Linux-based embedded firmware can degrade service availability and even cause service failures. Existing memory leak detection methods for open-source firmware rely on source code and symbol information, making it difficult to directly extend to closed-source firmware; while automated memory leak detection methods for closed-source firmware suffer from insufficient support for ARM architecture firmware. Therefore, we proposed a memory leak analysis method for Linux-based closed-source firmware, MemLeakFinder. Based on QEMU’s intermediate code instruction translation and instrumentation technology, it achieved dynamic tracking and analysis of the target program’s memory operations. It combined fuzzing and disassembly analysis techniques to locate potential memory leak vulnerabilities and introduced a large language model (LLM) to perform semantic understanding and automated root cause analysis of the captured memory leak vulnerability scenarios. We selected BMC firmware as the target environment and CGI as the target protocol, and conducted comprehensive experiments. Experimental results show that MemLeakFinder achieves an accuracy rate of 92.16% in the Juliet test suite. In tests on 7 real BMC firmwares, MemLeakFinder successfully discovered and verified 5 actual vulnerabilities. One critical vulnerability has been assigned a CVE number. These results, verifying the effectiveness of this method in memory security analysis of closed-source firmware programs.

Key words: memory leaks, intermediate code instruction translation, instrumentation, firmware security, large language model

CLC Number:

TP309

Yao Wuhuang, Wang Jiapeng, Chen Kangbing, Zheng Zhihan, Tan Yu’an. An LLM-assisted firmware memory leak analysis based on instruction translation instrumentation[J]. Netinfo Security, 2026, 26(7): 1087-1100.

Figures/Tables 13

References 21

[1]	梁晓兵, 孔令达, 刘岩, 等. 轻量级嵌入式软件动态二进制插桩算法[J]. 信息网络安全, 2021, 21(4): 89-95.
[2]	Yang Shanquan, Gao Yansong, Kuang B, et al. DFirmSan: a lightweight dynamic memory sanitizer for linux-based firmware[J]. Computers & Security, 2025, 155: Article 104467.
[3]	Seward J, Nethercote N. Using valgrind to detect undefined value errors with bit-precision[C]// 2005 USENIX Annual Technical Conference. Berkeley: USENIX, 2005: 17-30.
[4]	汪小林, 王振林, 孙逸峰, 等. 利用虚拟化平台进行内存泄露探测[J]. 计算机学报, 2010, 33(3): 463-472.
[5]	梅傲寒, 谭毓安, 常振轩, 等. 一种面向开源BMC固件的内生模糊测试框架[J]. 信息安全研究, 2025, 11(7): 611-618.
[6]	常振轩, 郑之涵, 梅傲寒, 等. 一种面向固件网络应用的高效灰盒模糊测试方法[J]. 信息网络安全, 2025, 25(4): 654-663.
[7]	Song D, Lettner J, Rajasekaran P, et al. SOK: sanitizing for security[C]// 2019 Symposium on Security and Privacy. New York: IEEE, 2019: 1275-1295.
[8]	Bellard F. QEMU, a fast and portable dynamic translator[C]// 2005 USENIX Annual Technical Conference. Berkeley: USENIX, 2005: 41-46.
[9]	Marini M, D’elia D C, Payer M, et al. QMSan: efficiently detecting uninitialized memory errors during fuzzing[C]// 2025 Network and Distributed System Security Symposium. San Diego: Internet Society, 2025: 1-17
[10]	Asmita, Oliinyk Y, Scott M, et al. Fuzzing busybox: leveraging LLM and crash reuse for embedded bug unearthing[C]// The 33rd USENIX Security Symposium. Berkeley: USENIX, 2024: 883-900.
[11]	计江安, 井靖, 王奕森, 等. 嵌入式固件模糊测试研究综述[J]. 小型微型计算机系统, 2024, 45(5): 1173-1180.
[12]	孙琪明, 侯刚, 靳文杰, 等. 嵌入式软件模糊测试研究综述[J]. 计算机科学, 2025, 52(7): 13-25.
[13]	王琴应, 许嘉诚, 李宇薇, 等. 智能模糊测试综述:问题探索和方法分类[J]. 计算机学报, 2024, 47(9): 2059-2083.
[14]	李岩, 杨文章, 张翼, 等. 基于大语言模型的模糊测试研究综述[J]. 软件学报, 2025, 36(6): 2404-2431.
[15]	习宁, 周晓琳, 孙聪, 等. 支持物理交互的无人机飞控系统安全测试方法[J]. 电子学报, 2025, 53(3): 765-781. doi: 10.12263/DZXB.20240890
[16]	Bond M D, Mckinley K S. Tolerating memory leaks[C]// The 23rd ACM SIGPLAN Conference on Object-Oriented Programming Systems Languages and Applications. New York: ACM, 2008: 109-126.
[17]	Qin Feng, Lu Shan, Zhou Yuanyuan. SafeMem: exploiting ECC-memory for detecting memory leaks and memory corruption during production runs[C]// The 11th International Symposium on High-Performance Computer Architecture. New York: IEEE, 2005: 291-302.
[18]	Serebryany K, Bruening D, Potapenko A, et al. AddressSanitizer: a fast address sanity checker[C]// 2012 USENIX Annual Technical Conference. Berkeley: USENIX Association, 2012: 309-318.
[19]	Fioraldi A, D’elia D C, Querzoni L. Fuzzing binaries for memory safety errors with qasan[C]// 2020 IEEE Secure Development. New York: IEEE, 2020: 23-30.
[20]	Wei J, Wang Xuezhi, Schuumans D, et al. Chain-of-thought prompting elicits reasoning in large language models[C]// Advances in Neural Information Processing Systems 35 (2022). New York: Curran Associates, 2022: 24824-24837.
[21]	ARM. ARM architecture reference manual for a-profile architecture[EB/OL]. (2024-11-30)[2026-04-03]. https://developer.arm.com/documentation/ddi0487/la/?lang=en.

指令/类别	改变PC行为	状态变化	说明
ADD（Thumb T2）， MOV（Thumb T）	半字节对齐跳转	不变	忽略最低位，跳转到对齐地址
B，BL，CBNZ，CBZ	指定地址跳转	不变	指令定义保证对齐
BLX（立即数）	跳转到立即数地址	切换ARM/Thumb状态	地址对齐由指令保证
BLX（寄存器），BX，BXJ	跳转到寄存器值	根据最低位切换	LSB=1切Thumb LSB=0切ARM32
LDR（目标寄存器为PC）	跳转到内存中取出的地址	根据最低位切换	常用于函数返回
POP/LDM（含PC）	跳转到栈或寄存器列表中的地址	根据最低位切换	常见于函数返回
ADD, MOV，ADR等ARM 数据处理指令（Rd=PC，无 S位）	跳转到计算结果	不变	仅在ARM32状态下生效

组件	配置
宿主机操作系统	Ubuntu 24.04.1 LTS (64-bit)
QEMU版本	5.2.0
交叉编译工具链	gcc-linaro-4.9-2016.02-x86_64_arm-linux-gnueabi
AFL++版本	4.32
QASan版本	AFL++内置QASan（自定义修改）
IDA pro版本	7.5.201028 Windows x64 （32-bit address size）
宿主机CPU	Intel 11th Gen Core i5-11400
宿主机内存	24 GB DDR3
宿主机磁盘	512 GB NVMe SSD
目标平台架构	ARMv7（ARM32）

	检测为泄漏/例	检测为正常/例	总数/例
实际为泄漏	1257(TP)	107(FN)	1364
实际为正常	0(FP)	1364(TN)	1364

漏洞诱发模式	TN/例	TP/例	FN/例	准确率
分支/循环退出	596	489	107	82.05%
指针被覆盖	228	228	0	100%
异常处理路径	372	372	0	100%
忽略返回值	112	112	0	100%
全局变量未释放	56	56	0	100%
总计	1364	1257	107	92.16%

指标名称	计算式	数值
准确率	(TP+TN)/(TP+TN+FP+FN)	92.16%
精确率	TP/(TP+FP)	100%
召回率	TP/(TP+FN)	92.22%