Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing. Tobias Scharnowski, Nils Bars, Moritz Schloegel, Eric Gustafson, Marius Muench, Giovanni Vigna, Christopher Kruegel, Thorsten Holz, & Ali Abbasi In USENIX Security, August, 2022. ![Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing [pdf]](https://bibbase.org/img/filetypes/pdf.svg "pdf")
Paper abstract bibtex 67 downloads 
As embedded devices are becoming more pervasive in our everyday lives, they turn into an attractive target for adversaries. Despite their high value and large attack surface, applying automated testing techniques such as fuzzing is not straightforward for such devices. As fuzz testing firmware on constrained embedded devices is inefficient, state-of-the-art approaches instead opt to run the firmware in an emulator (through a process called re-hosting). However, existing approaches either use coarse-grained static models of hardware behavior or require manual effort to re-host the firmware. We propose a novel combination of lightweight program analysis, re-hosting, and fuzz testing to tackle these challenges. We present the design and implementation of Fuzzware, a software-only system to fuzz test unmodified monolithic firmware in a scalable way. By determining how hardware-generated values are actually used by the firmware logic, Fuzzware can automatically generate models that help focusing the fuzzing process on mutating the inputs that matter, which drastically improves its effectiveness. We evaluate our approach on synthetic and real-world targets comprising a total of 19 hardware platforms and 77 firmware images. Compared to state-of-the-art work, Fuzzware achieves up to 3.25 times the code coverage and our modeling approach reduces the size of the input space by up to 95.5%. The synthetic samples contain 66 unit tests for various hardware interactions, and we find that our approach is the first generic re-hosting solution to automatically pass all of them. Fuzzware discovered 15 completely new bugs including bugs in targets which were previously analyzed by other works; a total of 12 CVEs were assigned.
@inproceedings{tobias_scharnowski_fuzzware_2022,
title = {Fuzzware: {Using} {Precise} {MMIO} {Modeling} for {Effective} {Firmware} {Fuzzing}},
url = {https://www.usenix.org/system/files/sec22summer_scharnowski.pdf},
abstract = {As embedded devices are becoming more pervasive in our everyday lives, they turn into an attractive target for adversaries. Despite their high value and large attack surface, applying automated testing techniques such as fuzzing is not straightforward for such devices. As fuzz testing firmware on constrained embedded devices is inefficient, state-of-the-art approaches instead opt to run the firmware in an emulator (through a process called re-hosting). However, existing approaches either use coarse-grained static models of hardware behavior or require manual effort to re-host the firmware.
We propose a novel combination of lightweight program analysis, re-hosting, and fuzz testing to tackle these challenges. We present the design and implementation of Fuzzware, a software-only system to fuzz test unmodified monolithic firmware in a scalable way. By determining how hardware-generated values are actually used by the firmware logic, Fuzzware can automatically generate models that help focusing the fuzzing process on mutating the inputs that matter, which drastically improves its effectiveness.
We evaluate our approach on synthetic and real-world targets comprising a total of 19 hardware platforms and 77 firmware images. Compared to state-of-the-art work, Fuzzware achieves up to 3.25 times the code coverage and our modeling approach reduces the size of the input space by up to 95.5\%. The synthetic samples contain 66 unit tests for various hardware interactions, and we find that our approach is the first generic re-hosting solution to automatically pass all of them. Fuzzware discovered 15 completely new bugs including bugs in targets which were previously analyzed by other works; a total of 12 CVEs were assigned.},
booktitle = {{USENIX} {Security}},
author = {{Tobias Scharnowski} and {Nils Bars} and {Moritz Schloegel} and {Eric Gustafson} and {Marius Muench} and {Giovanni Vigna} and {Christopher Kruegel} and {Thorsten Holz} and {Ali Abbasi}},
month = aug,
year = {2022},
keywords = {artifacts:available, artifacts:functional, artifacts:reproduced, class\_binary, proj\_intersect, proj\_tropics, type\_ae, type\_conf, type\_paper, type\_tier1, type\_top},
}
Downloads: 67
{"_id":"hrXfv7TTch8FbbutX","bibbaseid":"tobiasscharnowski-nilsbars-moritzschloegel-ericgustafson-mariusmuench-giovannivigna-christopherkruegel-thorstenholz-etal-fuzzwareusingprecisemmiomodelingforeffectivefirmwarefuzzing-2022","author_short":["Tobias Scharnowski","Nils Bars","Moritz Schloegel","Eric Gustafson","Marius Muench","Giovanni Vigna","Christopher Kruegel","Thorsten Holz","Ali Abbasi"],"bibdata":{"bibtype":"inproceedings","type":"inproceedings","title":"Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing","url":"https://www.usenix.org/system/files/sec22summer_scharnowski.pdf","abstract":"As embedded devices are becoming more pervasive in our everyday lives, they turn into an attractive target for adversaries. Despite their high value and large attack surface, applying automated testing techniques such as fuzzing is not straightforward for such devices. As fuzz testing firmware on constrained embedded devices is inefficient, state-of-the-art approaches instead opt to run the firmware in an emulator (through a process called re-hosting). However, existing approaches either use coarse-grained static models of hardware behavior or require manual effort to re-host the firmware. We propose a novel combination of lightweight program analysis, re-hosting, and fuzz testing to tackle these challenges. We present the design and implementation of Fuzzware, a software-only system to fuzz test unmodified monolithic firmware in a scalable way. By determining how hardware-generated values are actually used by the firmware logic, Fuzzware can automatically generate models that help focusing the fuzzing process on mutating the inputs that matter, which drastically improves its effectiveness. We evaluate our approach on synthetic and real-world targets comprising a total of 19 hardware platforms and 77 firmware images. Compared to state-of-the-art work, Fuzzware achieves up to 3.25 times the code coverage and our modeling approach reduces the size of the input space by up to 95.5%. The synthetic samples contain 66 unit tests for various hardware interactions, and we find that our approach is the first generic re-hosting solution to automatically pass all of them. Fuzzware discovered 15 completely new bugs including bugs in targets which were previously analyzed by other works; a total of 12 CVEs were assigned.","booktitle":"USENIX Security","author":[{"firstnames":[],"propositions":[],"lastnames":["Tobias Scharnowski"],"suffixes":[]},{"firstnames":[],"propositions":[],"lastnames":["Nils Bars"],"suffixes":[]},{"firstnames":[],"propositions":[],"lastnames":["Moritz Schloegel"],"suffixes":[]},{"firstnames":[],"propositions":[],"lastnames":["Eric Gustafson"],"suffixes":[]},{"firstnames":[],"propositions":[],"lastnames":["Marius Muench"],"suffixes":[]},{"firstnames":[],"propositions":[],"lastnames":["Giovanni Vigna"],"suffixes":[]},{"firstnames":[],"propositions":[],"lastnames":["Christopher Kruegel"],"suffixes":[]},{"firstnames":[],"propositions":[],"lastnames":["Thorsten Holz"],"suffixes":[]},{"firstnames":[],"propositions":[],"lastnames":["Ali Abbasi"],"suffixes":[]}],"month":"August","year":"2022","keywords":"artifacts:available, artifacts:functional, artifacts:reproduced, class_binary, proj_intersect, proj_tropics, type_ae, type_conf, type_paper, type_tier1, type_top","bibtex":"@inproceedings{tobias_scharnowski_fuzzware_2022,\n\ttitle = {Fuzzware: {Using} {Precise} {MMIO} {Modeling} for {Effective} {Firmware} {Fuzzing}},\n\turl = {https://www.usenix.org/system/files/sec22summer_scharnowski.pdf},\n\tabstract = {As embedded devices are becoming more pervasive in our everyday lives, they turn into an attractive target for adversaries. Despite their high value and large attack surface, applying automated testing techniques such as fuzzing is not straightforward for such devices. As fuzz testing firmware on constrained embedded devices is inefficient, state-of-the-art approaches instead opt to run the firmware in an emulator (through a process called re-hosting). However, existing approaches either use coarse-grained static models of hardware behavior or require manual effort to re-host the firmware.\n\nWe propose a novel combination of lightweight program analysis, re-hosting, and fuzz testing to tackle these challenges. We present the design and implementation of Fuzzware, a software-only system to fuzz test unmodified monolithic firmware in a scalable way. By determining how hardware-generated values are actually used by the firmware logic, Fuzzware can automatically generate models that help focusing the fuzzing process on mutating the inputs that matter, which drastically improves its effectiveness.\n\nWe evaluate our approach on synthetic and real-world targets comprising a total of 19 hardware platforms and 77 firmware images. Compared to state-of-the-art work, Fuzzware achieves up to 3.25 times the code coverage and our modeling approach reduces the size of the input space by up to 95.5\\%. The synthetic samples contain 66 unit tests for various hardware interactions, and we find that our approach is the first generic re-hosting solution to automatically pass all of them. Fuzzware discovered 15 completely new bugs including bugs in targets which were previously analyzed by other works; a total of 12 CVEs were assigned.},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {{Tobias Scharnowski} and {Nils Bars} and {Moritz Schloegel} and {Eric Gustafson} and {Marius Muench} and {Giovanni Vigna} and {Christopher Kruegel} and {Thorsten Holz} and {Ali Abbasi}},\n\tmonth = aug,\n\tyear = {2022},\n\tkeywords = {artifacts:available, artifacts:functional, artifacts:reproduced, class\\_binary, proj\\_intersect, proj\\_tropics, type\\_ae, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n","author_short":["Tobias Scharnowski","Nils Bars","Moritz Schloegel","Eric Gustafson","Marius Muench","Giovanni Vigna","Christopher Kruegel","Thorsten Holz","Ali Abbasi"],"key":"tobias_scharnowski_fuzzware_2022","id":"tobias_scharnowski_fuzzware_2022","bibbaseid":"tobiasscharnowski-nilsbars-moritzschloegel-ericgustafson-mariusmuench-giovannivigna-christopherkruegel-thorstenholz-etal-fuzzwareusingprecisemmiomodelingforeffectivefirmwarefuzzing-2022","role":"author","urls":{"Paper":"https://www.usenix.org/system/files/sec22summer_scharnowski.pdf"},"keyword":["artifacts:available","artifacts:functional","artifacts:reproduced","class_binary","proj_intersect","proj_tropics","type_ae","type_conf","type_paper","type_tier1","type_top"],"metadata":{"authorlinks":{}},"downloads":67},"bibtype":"inproceedings","biburl":"https://download.vusec.net/papers/zotero.php?tag=&full=1&format=bibtex&sort=date","dataSources":["ko3LvYe6e8CFNtt9q","M2Mt9WaG853nFZTaQ","NB57bojGNo9dTTvq7","JWcaY4xDbjG3msjWc","L7FP8s8TQAiQFmr64","t6W6sycBAWvFqAdmK","cCFT2dQoNmvA9cGsg","EvThddwxhXnn67kfA","LY5xkJFgS2sBQ9umB","cEmMXPermWEFsgmMR","7jKWLcMEQyj34TAfx","GLkTGe3ma9f5R3CMg"],"keywords":["artifacts:available","artifacts:functional","artifacts:reproduced","class_binary","proj_intersect","proj_tropics","type_ae","type_conf","type_paper","type_tier1","type_top"],"search_terms":["fuzzware","using","precise","mmio","modeling","effective","firmware","fuzzing","tobias scharnowski","nils bars","moritz schloegel","eric gustafson","marius muench","giovanni vigna","christopher kruegel","thorsten holz","ali abbasi"],"title":"Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing","year":2022,"downloads":67}