Device-agnostic Firmware Execution is Possible: A Concolic Execution Approach for Peripheral Emulation

Cao, Chen; Guan, Le; Jiang, Ming; Liu, Peng

doi:10.1145/3427228.3427280

Cited by 43 publications

(37 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The literature lacks a formal definition of rehosting fidelity and no large-scale fidelity evaluations have been conducted to date. However, individual rehosting techniques have been evaluated by measuring if systems accept network connections [10], collecting and comparing peripheral interactions [49], and comparing the similarity of instruction traces [8].…”

Section: Evaluating Fidelitymentioning

confidence: 99%

“…A critical, yet challenging, component of building a high-fidelity VE is generating an accurate model of all the peripherals with which the firmware will interact. Between the early drafts of this paper in 2018 and our current submission, researchers have started down the path to automated peripheral modeling we describe here (in particular, Pretender [36], and Laelaps [8]). We find it encouraging that the research community has begun to realize the importance of automated emulation of embedded devices, but stress that open problems remain formidable.…”

Section: Handling Peripheralsmentioning

confidence: 99%

“…Pretender [36] shows that MMIO traces from a physical system can be used to infer some peripheral models, but additional work is necessary to model complex peripherals. Alternatively peripheral models could be generated by analyzing driver code using symbolic execution (e.g., Laelaps [8]), fuzzing, or static analysis.…”

Section: Handling Peripheralsmentioning

confidence: 99%

See 2 more Smart Citations

SoK: Enabling Security Analyses of Embedded Systems via Rehosting

Fasano

Ballo

Muench

et al. 2021

Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

Closely monitoring the behavior of a software system during its execution enables developers and analysts to observe, and ultimately understand, how it works. This kind of dynamic analysis can be instrumental to reverse engineering, vulnerability discovery, exploit development, and debugging. While these analyses are typically wellsupported for homogeneous desktop platforms (e.g., x86 desktop PCs), they can rarely be applied in the heterogeneous world of embedded systems. One approach to enable dynamic analyses of embedded systems is to move software stacks from physical systems into virtual environments that sufficiently model hardware behavior. This process which we call "rehosting" poses a significant research challenge with major implications for security analyses. Although rehosting has traditionally been an unscientific and ad-hoc endeavor undertaken by domain experts with varying time and resources at their disposal, researchers are beginning to address rehosting challenges systematically and in earnest. In this paper, we establish that emulation is insufficient to conduct large-scale dynamic analysis of real-world hardware systems and present rehosting as a firmwarecentric alternative. Furthermore, we taxonomize preliminary rehosting efforts, identify the fundamental components of the rehosting process, and propose directions for future research.

show abstract

Section: Evaluating Fidelitymentioning

confidence: 99%

Section: Handling Peripheralsmentioning

confidence: 99%

See 1 more Smart Citation

SoK: Enabling Security Analyses of Embedded Systems via Rehosting

Fasano

Ballo

Muench

et al. 2021

Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…PRETENDER [28] "learns" the interaction model between the original hardware and the firmware, and automatically creates models of peripherals. Laelaps [13] addresses a similar problem using symbolic execution. HALucinator [16] avoids the problem of peripheral emulation by replacing the high-level HAL function with a host implementation.…”

Section: B Generic Firmware Emulationmentioning

confidence: 99%

From Library Portability to Para-rehosting: Natively Executing Microcontroller Software on Commodity Hardware

Li¹,

Guan

Lin

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

Self Cite

View full text Add to dashboard Cite

Finding bugs in microcontroller (MCU) firmware is challenging, even for device manufacturers who own the source code. The MCU runs different instruction sets than x86 and exposes a very different development environment. This invalidates many existing sophisticated software testing tools on x86. To maintain a unified developing and testing environment, a straightforward way is to re-compile the source code into the native executable for a commodity machine (called rehosting). However, ad-hoc re-hosting is a daunting and tedious task and subject to many issues (library-dependence, kernel-dependence and hardware-dependence). In this work, we systematically explore the portability problem of MCU software and propose pararehosting to ease the porting process. Specifically, we abstract and implement a portable MCU (PMCU) using the POSIX interface. It models common functions of the MCU cores. For peripheral specific logic, we propose HAL-based peripheral function replacement, in which high-level hardware functions are replaced with an equivalent backend driver on the host. These backend drivers are invoked by well-designed para-APIs and can be reused across many MCU OSs. We categorize common HAL functions into four types and implement templates for quick backend development. Using the proposed approach, we have successfully rehosted nine MCU OSs including the widely deployed Amazon FreeRTOS, ARM Mbed OS, Zephyr and LiteOS. To demonstrate the superiority of our approach in terms of security testing, we used off-the-shelf dynamic analysis tools (AFL and ASAN) against the rehosted programs and discovered 28 previously-unknown bugs, among which 5 were confirmed by CVE and the other 19 were confirmed by vendors at the time of writing.

show abstract

“…Symdrive [35] aims to discover vulnerabilities in drivers and makes device input to the driver symbolic thereby allowing execution on the complete range of device inputs. Laelaps [17] infers the expected behavior of firmware via symbolicexecution-assisted peripheral emulation and generates proper inputs to steer concrete execution on the fly. Model-based Emulation.…”

Section: Full Emulationmentioning

confidence: 99%

Firmware Re-hosting Through Static Binary-level Porting

Xin

Wen

Deng

et al. 2021

Preprint

View full text Add to dashboard Cite

The rapid growth of the Industrial Internet of Things (IIoT) has brought embedded systems into focus as major targets for both security analysts and malicious adversaries. Due to the non-standard hardware and diverse software, embedded devices present unique challenges to security analysts for the accurate analysis of firmware binaries. The diversity in hardware components and tight coupling between firmware and hardware makes it hard to perform dynamic analysis, which must have the ability to execute firmware code in virtualized environments. However, emulating the large expanse of hardware peripherals makes analysts have to frequently modify the emulator for executing various firmware code in different virtualized environments, greatly limiting the ability of security analysis.In this work, we explore the problem of firmware re-hosting related to the real-time operating system (RTOS). Specifically, developers create a Board Support Package (BSP) and develop device drivers to make that RTOS run on their platform. By providing high-level replacements for BSP routines and device drivers, we can make the minimal modification of the firmware that to be migrated from its original hardware environment into a virtualized one. We show that an approach capable of offering the ability to execute firmware at scale through the use of firmware patching in an automated manner without modifying the existing emulators. Our approach, called static binary-level porting, first identifies the BSP and device drivers in target firmware, then patches the firmware with pre-built BSP routines and drivers that can be adapted to the existing emulator. Finally, we demonstrate the practicality of the proposed method on multiple hardware platforms and firmware samples for security analysis. The result shows that the approach is flexible enough to emulate firmware for vulnerability assessment and exploits development.

show abstract

Device-agnostic Firmware Execution is Possible: A Concolic Execution Approach for Peripheral Emulation

Cited by 43 publications

References 31 publications

SoK: Enabling Security Analyses of Embedded Systems via Rehosting

SoK: Enabling Security Analyses of Embedded Systems via Rehosting

From Library Portability to Para-rehosting: Natively Executing Microcontroller Software on Commodity Hardware

Firmware Re-hosting Through Static Binary-level Porting

Contact Info

Product

Resources

About