AwesomeREA.org

2014 · Conference paper

Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems’ Firmwares

Jonas Zaddach; Luca Bruno; Aurélien Francillon; Davide Balzarotti

Avatar runs embedded firmware in an instrumented emulator, S²E on QEMU, while forwarding memory-mapped I/O to the real device and injecting the device's interrupts back into the emulator, so firmware that depends on undocumented peripherals can still be analyzed dynamically. The device is reached through JTAG via OpenOCD or through a small debugging stub over a serial line. Because forwarding every access over a 38400-baud serial link is very slow, about five instructions per second in one of the authors' measurements, Avatar also keeps memory that never behaves like I/O local to the emulator, migrates selected code to run natively on the device, and switches state between the two. With S²E's selective symbolic execution, the authors probe a hard-disk mask-ROM bootloader for hidden commands, an IEEE 802.15.4 sensor node for an injected overflow, and the SMS decoding routines of a GSM feature phone.

Scope and limitations

Avatar needs the physical device and a working debug channel or an injectable stub; it does not model peripherals, so it is not standalone rehosting. The three case studies are all ARM devices (a hard disk with an ARM966 core, a Redwire Econotag and a Motorola C118 phone), and each needed manual work to choose hook points and code regions. Full-separation mode is too slow for time-critical code such as DRAM initialization, and the authors report that memory changed by DMA, or by code migrated to the device, is hard to keep synchronized with the emulator. The sensor-node vulnerability was artificially inserted into a demonstration program, the bootloader study confirmed documented commands rather than finding a backdoor, and the phone's GSM stack was too complex for symbolic execution: 42 subroutines were explored without an exploitable condition before state explosion. These are 2014 results on an S²E port the authors extended for ARM.

Why it fits this collection

Adds hardware-in-the-loop firmware analysis, which forwards emulator I/O to the real device, alongside the collection's emulation-based firmware rehosting research.

Publication and review details

Venue
NDSS 2014
Status
Conference paper
Publication / posting date
2014 (exact date not verified)
Date source
Internet Society-deposited Crossref metadata supplies only publication year 2014; the publisher PDF separately identifies the 23–26 February 2014 symposium, which is not used to assert a publication month or day.
DOI
10.14722/ndss.2014.23229

Crossref gives the title, the four-author order and year 2014 with no pages. The DOI’s registered target, a /ndss2014/programme/ URL ending in an encoded apostrophe, returned HTTP 404 on 2026-10-19, so this record uses the working NDSS programme page, which links the 16-page PDF and slides. The PDF footer identifies NDSS ’14, 23–26 February 2014, San Diego, with ISBN 1-891562-35-5, but its DOI line is the placeholder “http://dx.doi.org/OETT”; the Crossref DOI is recorded here. The paper gives the framework’s location as the EURECOM project page, which now carries a deprecation notice pointing to the successor Avatar² (avatartwo/avatar2), a later, separate project not covered by this record. That page links the Python core, whose eurecom-s3 URL redirects to avatarone/avatar-python; the reviewed 2016-10-18 commit is Apache-2.0 (Copyright 2013–2014 Institut Eurecom) and points to separate repositories for the NDSS’14 samples, the patched S²E and OpenOCD. No code was installed or run, and no devices were used.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Report an outdated entry Suggest a translation fix

Primary sources

  1. https://www.ndss-symposium.org/ndss2014/ndss-2014-programme/avatar-framework-support-dynamic-security-analysis-embedded-systems-firmwares/
  2. https://api.crossref.org/works/10.14722/ndss.2014.23229
  3. https://www.ndss-symposium.org/wp-content/uploads/2017/09/02_3_1.pdf
  4. https://s3.eurecom.fr/tools/avatar/
  5. README.rst GitHub · avatarone/avatar-python · Revision c6d74f8
  6. COPYRIGHT GitHub · avatarone/avatar-python · Revision c6d74f8