Apparatus and method for fuzzing firmware

Patent metadata

Field	Value
Publication number	US-2022019926-A1
Application number	US-202117308316-A
Country	US
Kind code	A1
Filing date	May 5, 2021
Priority date	Jul 20, 2020
Publication date	Jan 20, 2022
Grant date	—

Abstract

An apparatus for fuzzing firmware according to an embodiment includes an emulator that provides a user mode emulation environment for firmware installed in any Internet of Things (IoT) device, a generator that generates one or more test cases in which at least some of a plurality of pre-set mutation operators are applied to at least one of a plurality of seed files, and an executor that executes mutation-based fuzzing on the firmware in the user mode emulation environment based on the one or more test cases.

First claim

What is claimed is:

1 . An apparatus for fuzzing firmware, the apparatus comprising:
an emulator that provides a user mode emulation environment for firmware installed in any Internet of Things (IoT) device; a generator that generates one or more test cases in which at least some of a plurality of pre-set mutation operators are applied to at least one of a plurality of seed files; and an executor that executes mutation-based fuzzing on the firmware in the user mode emulation environment based on the one or more test cases.

2 . The apparatus of claim 1 , wherein the emulator comprises:
a system mode emulator that emulates an entire system related to the firmware in a system mode emulation environment; and a user mode emulator that emulates a part of process of the firmware in the user mode emulation environment based on a memory file corresponding to the part of the process of the firmware.

3 . The apparatus of claim 1 , wherein the generator applies at least some of the plurality of mutation operators to at least one of the plurality of seed files based on a particle swarm optimization (PSO) algorithm.

4 . The apparatus of claim 1 , further comprising:
a controller that controls the mutation-based fuzzing based on at least one of whether or not a system call occurs, whether or not a new path is detected, and whether or not a crash occurs.

5 . The apparatus of claim 4 , wherein the emulator further provides a system mode emulation environment for the firmware; and
the controller temporarily pauses the mutation-based fuzzing and resume the mutation-based fuzzing after processing the system call in the system mode emulation environment when the system call occurs during execution of the mutation-based fuzzing.

6 . The apparatus of claim 4 , wherein the controller stores a test case used to execute the mutation-based fuzzing and report information related to the mutation-based fuzzing when the new path is detected or the crash occurs due to the mutation-based fuzzing.

7 . A method for fuzzing firmware, the method comprising:
providing a user mode emulation environment for firmware installed in any Internet of Things (IoT) device; generating one or more test cases in which at least some of a plurality of pre-set mutation operators are applied to at least one of a plurality of seed files; and executing mutation-based fuzzing on the firmware in the user mode emulation environment based on the one or more test cases.

8 . The method of claim 7 , wherein the providing comprises:
emulating an entire system related to the firmware in a system mode emulation environment; and emulating a part of process of the firmware in the user mode emulation environment based on a memory file corresponding to the part of the process of the firmware.

9 . The method of claim 7 , wherein, in the generating, at least some of the plurality of mutation operators is applied to at least one of the plurality of seed files based on a particle swarm optimization (PSO) algorithm.

10 . The method of claim 7 , further comprising:
controlling the mutation-based fuzzing based on at least one of whether or not a system call occurs, whether or not a new path is detected, and whether or not a crash occurs.

11 . The method of claim 10 , wherein, in the providing, a system mode emulation environment is provided for the firmware; and
the controlling further comprises:
temporarily pausing the mutation-based fuzzing when the system call occurs during execution of the mutation-based fuzzing;
processing the system call in the system mode emulation environment; and
resuming the mutation-based fuzzing after the system call is processed.

12 . The method of claim 10 , wherein, in the controlling, a test case used to execute the mutation-based fuzzing and report information related to the mutation-based fuzzing are stored when the new path is detected or the crash occurs due to the mutation-based fuzzing.

Assignees

• Univ Sejong Ind Acad Coop Foud

Inventors

• Yun Joo Beom
• Kim Hyun Wook
• Kim Ju Hwan

Classifications

• G06F9/455

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• G06F8/654

  using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories · CPC title

• G06F9/4411

  Configuring for operating with peripheral devices; Loading of device drivers · CPC title

• G06F11/3688 Primary

  for test execution, e.g. scheduling of test suites · CPC title

• G06F11/3684

  for test design, e.g. generating new test cases · CPC title