AwesomeREA.org

2022 · Conference paper

Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing

Tobias Scharnowski; Nils Bars; Moritz Schloegel; Eric Gustafson; Marius Muench; Giovanni Vigna; Christopher Kruegel; Thorsten Holz; Ali Abbasi

Rehosts monolithic ARM Cortex-M firmware for fuzzing, using locally scoped symbolic execution to model memory-mapped I/O accesses and focus input mutations on values relevant to firmware logic.

Scope and limitations

The Cortex-M3/M4 artifact requires memory-map configuration and does not automatically model DMA. Abstracting hardware can produce crashes that are impossible on the physical device. This is an analysis environment, not original-source recovery or faithful full-device reconstruction.

Why it fits this collection

Shows how firmware logic can be exercised without its original hardware by reconstructing enough of the execution environment for dynamic analysis.

Publication and review details

Venue
USENIX Security 2022
Status
Conference paper
Publication / posting date
August 2022
Date source
Publication month in the official USENIX proceedings citation; no exact publication day is asserted.

The official proceedings give pages 1239–1256 and nine authors. No paper DOI or arXiv identifier was verified. Zenodo DOI 10.5281/zenodo.6499215 identifies the software artifact, not this paper. The artifact appendix names the sec22-ae-accepted release and declares Apache-2.0 for code and data; third-party components retain their own terms.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://www.usenix.org/conference/usenixsecurity22/presentation/scharnowski
  2. https://www.usenix.org/system/files/sec22-scharnowski.pdf
  3. https://www.usenix.org/system/files/usenixsecurity22-scharnowski.pdf
  4. https://github.com/fuzzware-fuzzer/fuzzware/blob/424fce42bbe0cef3928ae589b8f6bbac666857e1/README.md
  5. https://github.com/fuzzware-fuzzer/fuzzware/blob/424fce42bbe0cef3928ae589b8f6bbac666857e1/LICENSE
  6. https://github.com/fuzzware-fuzzer/fuzzware-experiments/blob/b6462adfa125ae1664077a0aa912c081cfde1c4a/README.md
  7. https://github.com/fuzzware-fuzzer/fuzzware-experiments/blob/b6462adfa125ae1664077a0aa912c081cfde1c4a/LICENSE
  8. https://zenodo.org/records/6499215