2021 · Conference paper
DICE: Automatic Emulation of DMA Input Channels for Dynamic Firmware Analysis
DICE adds DMA input emulation to microcontroller firmware emulators that model neither peripherals nor DMA controllers. It watches firmware writes to the memory-mapped DMA controller region for pairs of source and destination transfer pointers, and infers the transfer direction from later firmware accesses. When firmware reads a peripheral-to-RAM destination buffer, DICE answers with analyzer-supplied input such as fuzzer data, growing buffer bounds conservatively. Prototypes patch the QEMU forks of P2IM (ARM Cortex-M) and a PIC32 emulator (MIPS M4K/M-Class). On 83 sample firmware covering 9 DMA controllers from 5 vendors, the authors report 33 of 37 input channels detected with no false positives, correct input for 21 of 22 buffers and 3.4% average overhead. Fuzzing 7 real firmware for 48 hours found 5 previously unknown bugs.
Scope and limitations
Emulates DMA input channels only; it does not model peripheral behavior, recover peripheral semantics or produce a faithful device replica, and supplied inputs are analyzer data rather than real peripheral traffic. It assumes transfer descriptors are written to DMA controller registers, so descriptors stored in RAM are unsupported. Destination-only configurations, used by two controller models such as nRF52832 EasyDMA, are also missed, accounting for 7 of 52 stream configurations. Buffer sizes are heuristic estimates. Ground truth came from datasheets and firmware inspection, and results cover the authors' 83 sample firmware and 7 fuzzed firmware. Bugs were found in two of the seven fuzzed firmware with a basic memory sanitizer. The PIC32 prototype runs only firmware whose other peripherals can be handled by simple default register handlers.
Why it fits this collection
Adds DMA input-channel emulation for firmware rehosting, complementing the collection's MMIO-modeling and fuzzing-oriented MCU rehosting research.
Publication and review details
- Venue
- IEEE S&P 2021
- Status
- Conference paper
- Publication / posting date
- May 2021
- Date source
- The publisher's Crossref deposit records print publication in May 2021, the month of the May 24–27 symposium. IEEE Xplore could not be retrieved automatically, and no publication day is asserted.
- First arXiv submission
- July 3, 2020
- arXiv
- 2007.01502
- Reviewed arXiv version
- v3
- DOI
- 10.1109/SP40001.2021.00018
Crossref establishes the four-author order, the 2021 IEEE S&P proceedings, pages 1938–1954 and the DOI; IEEE Xplore refused automated retrieval. Reviewed arXiv v3 of 2021-01-15 (v1 2020-07-03) carries journal reference “42nd IEEE Symposium on Security and Privacy, S&P 2021” and links the repository. The reviewed master snapshot 2b3b8c8b was pushed on 2023-10-14. Its LICENSE releases DICE under Apache-2.0 unless otherwise stated, while AFL and P2IM's AFL changes are Apache-2.0 and QEMU, P2IM's QEMU changes, the PIC32 extensions and P2IM itself are GPL-2.0; GitHub reports no single SPDX license. The p2im and mips-emulator directories are submodules pinned to RiS3-Lab/p2im 0a4870b4 and sergev/qemu a2e0277d. README supports Ubuntu 16.04 or 18.04 only, noting problems on 20.04. It applies DICE as patches to QEMU and supplies precompiled QEMU binaries plus evaluation firmware binaries, sources and scripts; bundled vendor sample firmware keeps its own terms. Source files were read; nothing was built, emulated or fuzzed.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://ieeexplore.ieee.org/document/9519398
- https://api.crossref.org/works/10.1109/SP40001.2021.00018
- https://arxiv.org/abs/2007.01502
- https://arxiv.org/pdf/2007.01502v3
- README.md GitHub · RiS3-Lab/DICE-DMA-Emulation · Revision 2b3b8c8
- LICENSE GitHub · RiS3-Lab/DICE-DMA-Emulation · Revision 2b3b8c8
- .gitmodules GitHub · RiS3-Lab/DICE-DMA-Emulation · Revision 2b3b8c8