IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit

Zhou, Wei; Shen, Shandian; Liu, Peng

doi:10.3390/fi17010019

IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit

Journal Article · Mon Jan 06 00:00:00 EST 2025 · Future Internet

DOI:https://doi.org/10.3390/fi17010019· OSTI ID:2496727

; ; Liu, Peng

As IoT devices with microcontroller (MCU)-based firmware become more common in our lives, memory corruption vulnerabilities in their firmware are increasingly targeted by adversaries. Fuzzing is a powerful method for detecting these vulnerabilities, but it poses unique challenges when applied to IoT devices. Direct fuzzing on these devices is inefficient, and recent efforts have shifted towards creating emulation environments for dynamic firmware testing. However, unlike traditional software, firmware interactions with peripherals that are significantly more diverse presents new challenges for achieving scalable full-system emulation and effective fuzzing. This paper reviews 27 state-of-the-art works in MCU-based firmware emulation and its applications in fuzzing. Instead of classifying existing techniques based on their capabilities and features, we first identify the fundamental challenges faced by firmware emulation and fuzzing. We then revisit recent studies, organizing them according to the specific challenges they address, and discussing how each specific challenge is addressed. We compare the emulation fidelity and bug detection capabilities of various techniques to clearly demonstrate their strengths and weaknesses, aiding users in selecting or combining tools to meet their needs. Finally, we highlight the remaining technical gaps and point out important future research directions in firmware emulation and fuzzing.

View Journal Article

Sponsoring Organization:: USDOE

OSTI ID:: 2496727

Journal Information:: Future Internet, Journal Name: Future Internet Journal Issue: 1 Vol. 17; ISSN FIUNAE; ISSN 1999-5903

Publisher:: MDPI AGCopyright Statement

Country of Publication:: Country unknown/Code not available

Language:: English

References (28)

Reinforcement learning algorithms: A brief survey Shakya, Ashish Kumar; Pillai, Gopinatha; Chakrabarty, Sohom Expert Systems with Applications, Vol. 231 https://doi.org/10.1016/j.eswa.2023.120495	journal	November 2023
Simics: A full system simulation platform Magnusson, P. S.; Christensson, M.; Eskilson, J. Computer, Vol. 35, Issue 2 https://doi.org/10.1109/2.982916	journal	January 2002
MemorySanitizer: Fast detector of uninitialized memory use in C++ Stepanov, Evgeniy; Serebryany, Konstantin 2015 IEEE/ACM International Symposium on Code Generation and Optimization (CGO) https://doi.org/10.1109/CGO.2015.7054186	conference	February 2015
Challenges in Designing Exploit Mitigations for Deeply Embedded Systems Abbasi, Ali; Wetzels, Jos; Holz, Thorsten 2019 IEEE European Symposium on Security and Privacy (EuroS&P) https://doi.org/10.1109/EuroSP.2019.00013	conference	June 2019
Detecting Vulnerability on IoT Device Firmware: A Survey Feng, Xiaotao; Zhu, Xiaogang; Han, Qing-Long IEEE/CAA Journal of Automatica Sinica, Vol. 10, Issue 1 https://doi.org/10.1109/JAS.2022.105860	journal	January 2023
DICE: Automatic Emulation of DMA Input Channels for Dynamic Firmware Analysis Mera, Alejandro; Feng, Bo; Lu, Long 2021 IEEE Symposium on Security and Privacy (SP) https://doi.org/10.1109/SP40001.2021.00018	conference	May 2021
HEAPSTER: Analyzing the Security of Dynamic Allocators for Monolithic Firmware Images Gritti, Fabio; Pagani, Fabio; Grishchenko, Ilya 2022 IEEE Symposium on Security and Privacy (SP) https://doi.org/10.1109/SP46214.2022.9833610	conference	May 2022
AIM: Automatic Interrupt Modeling for Dynamic Firmware Analysis Feng, Bo; Luo, Meng; Liu, Changming IEEE Transactions on Dependable and Secure Computing, Vol. 21, Issue 4 https://doi.org/10.1109/TDSC.2023.3339569	journal	July 2024
Speeding Up Bug Finding using Focused Fuzzing Kargén, Ulf; Shahmehri, Nahid Proceedings of the 13th International Conference on Availability, Reliability and Security https://doi.org/10.1145/3230833.3230867	conference	August 2018
Fuzzing Godefroid, Patrice Communications of the ACM, Vol. 63, Issue 2 https://doi.org/10.1145/3363824	journal	January 2020
FirmXRay: Detecting Bluetooth Link Layer Vulnerabilities From Bare-Metal Firmware Wen, Haohuang; Lin, Zhiqiang; Zhang, Yinqian Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security https://doi.org/10.1145/3372297.3423344	conference	October 2020
Challenges in Firmware Re-Hosting, Emulation, and Analysis Wright, Christopher; Moeglein, William A.; Bagchi, Saurabh ACM Computing Surveys, Vol. 54, Issue 1 https://doi.org/10.1145/3423167	journal	January 2021
Device-agnostic Firmware Execution is Possible: A Concolic Execution Approach for Peripheral Emulation Cao, Chen; Guan, Le; Ming, Jiang Annual Computer Security Applications Conference https://doi.org/10.1145/3427228.3427280	conference	December 2020
FirmAE: Towards Large-Scale Emulation of IoT Firmware for Dynamic Analysis Kim, Mingeun; Kim, Dongkwan; Kim, Eunsoo Annual Computer Security Applications Conference https://doi.org/10.1145/3427228.3427294	conference	December 2020
Conware: Automated Modeling of Hardware Peripherals Spensky, Chad; Machiry, Aravind; Redini, Nilo Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security https://doi.org/10.1145/3433210.3437532	conference	May 2021
SoK: Enabling Security Analyses of Embedded Systems via Rehosting Fasano, Andrew; Ballo, Tiemoko; Muench, Marius Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security https://doi.org/10.1145/3433210.3453093	conference	May 2021
ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels Jiang, Muhui; Ma, Lin; Zhou, Yajin Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security https://doi.org/10.1145/3460120.3484753	conference	November 2021
What You See is Not What You Get: Revealing Hidden Memory Mapping for Peripheral Modeling Won, Jun Yeon; Wen, Haohuang; Lin, Zhiqiang Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses https://doi.org/10.1145/3545948.3545957	conference	October 2022
MetaEmu Chen, Zitai; Thomas, Sam L.; Garcia, Flavio D. Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security https://doi.org/10.1145/3548606.3559338	conference	November 2022
SFuzz Chen, Libo; Cai, Quanpu; Ma, Zhenbang Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security https://doi.org/10.1145/3548606.3559367	conference	November 2022
What Your Firmware Tells You Is Not How You Should Emulate It Zhou, Wei; Zhang, Lan; Guan, Le Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security https://doi.org/10.1145/3548606.3559386	conference	November 2022
Ember-IO: Effective Firmware Fuzzing with Model-Free Memory Mapped IO Farrelly, Guy; Chesser, Michael; Ranasinghe, Damith C. Proceedings of the ACM Asia Conference on Computer and Communications Security https://doi.org/10.1145/3579856.3582840	conference	July 2023
Avatar²: A Multi-Target Orchestration Platform Muench, Marius; Nisi, Dario; Francillon, Aurélien Proceedings 2018 Workshop on Binary Analysis Research https://doi.org/10.14722/bar.2018.23017	conference	January 2018
Understanding MPU Usage in Microcontroller-based Systems in the Wild Zhou, Wei; Jiang, Zhouqi; Guan, Le Proceedings 2023 Workshop on Binary Analysis Research https://doi.org/10.14722/bar.2023.23007	conference	January 2023
Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems’ Firmwares Zaddach, Jonas; Bruno, Luca; Francillon, Aurélien Proceedings 2014 Network and Distributed System Security Symposium https://doi.org/10.14722/ndss.2014.23229	conference	January 2014
Towards Automated Dynamic Analysis for Linux-based Embedded Firmware Chen, Daming D.; Egele, Manuel; Woo, Maverick Proceedings 2016 Network and Distributed System Security Symposium https://doi.org/10.14722/ndss.2016.23415	conference	January 2016
What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices Muench, Marius; Stijohann, Jan; Kargl, Frank Proceedings 2018 Network and Distributed System Security Symposium https://doi.org/10.14722/ndss.2018.23166	conference	January 2018
FirmWire: Transparent Dynamic Analysis for Cellular Baseband Firmware Hernandez, Grant; Muench, Marius; Maier, Dominik Proceedings 2022 Network and Distributed System Security Symposium https://doi.org/10.14722/ndss.2022.23136	conference	January 2022

Similar Records

Hardware Fuzzing with An Emulator

Technical Report · Sun Sep 01 00:00:00 EDT 2024 · OSTI ID:2480163

Challenges in Firmware Re-Hosting, Emulation, and Analysis

Journal Article · Fri Jan 01 19:00:00 EST 2021 · ACM Computing Surveys · OSTI ID:1760456

Secure LoRa Firmware Update with Adaptive Data Rate Techniques

Journal Article · Mon Mar 29 20:00:00 EDT 2021 · Sensors · OSTI ID:1778075

IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit

Citation Formats

References (28)

Similar Records

Related Subjects