AwesomeREA.org

2021 · Conference paper

Jetset: Targeted Firmware Rehosting for Embedded Systems

Evan Johnson; Maxwell Bland; YiFei Zhu; Joshua Mason; Stephen Checkoway; Stefan Savage; Kirill Levchenko

Jetset rehosts firmware only as far as an analyst-chosen goal address, such as the point where a fuzzer can inject input. Given the architecture, the MMIO address range, an entry point and the goal, it symbolically executes the firmware with angr against a modified QEMU, treating peripheral reads as symbolic, cycling interrupts, and steering toward the goal with CFG distances and Tabu search. Solved constraints become C peripheral models for QEMU that replay the inferred values and interrupts so the firmware boots concretely to the goal. The authors evaluate 13 targets across x86, ARM and Motorola ColdFire, including Linux on a Raspberry Pi 2, a BeagleBoard-xM bootloader, a SEL-751 relay, a Boeing 737 CMU-900 and nine P²IM firmware, and use the CMU model with AFL to find a privilege escalation in its VRTX kernel.

Scope and limitations

This is targeted rehosting, not full device emulation or firmware decompilation. The analyst supplies the MMIO range, entry point and goal address, and the synthesized models replay one satisfying path and then the last satisfying value for each address, so they need not match real hardware and may mishandle stateful or complex peripheral interaction after the goal. DMA is unsupported; the two targets that needed it relied on an existing QEMU device model or a manually symbolic memory region. Incomplete CFGs, for example across virtual calls or x86 task switches, weaken the distance heuristic, and the BeagleBoard-xM emulator crashed when synthesized serial data was executed as code. Fidelity checks compare against hardware or a manually built QEMU model for selected targets. The VRTX privilege escalation is described by the authors as primarily of academic interest.

Why it fits this collection

Adds symbolic-execution-based peripheral model synthesis for booting firmware to an analysis point, complementing the section’s HAL replacement, MMIO-modeling fuzzing and Linux user-space rehosting research.

Publication and review details

Venue
USENIX Security 2021
Status
Conference paper
Publication / posting date
August 2021
Date source
The official USENIX proceedings citation gives August 2021. Month precision is retained; the August 11–13 symposium dates on the proceedings cover are not substituted for a publication day.

The USENIX presentation page and final proceedings PDF give the seven authors in this order, the 30th USENIX Security Symposium, pages 321–338, ISBN 978-1-939133-24-3 and month August; the 19-page PDF includes a proceedings cover page. The page also links a separate prepublication PDF. No DOI or arXiv identifier was found; the record uses the reviewed USENIX Security presentation-page and final-PDF profile. The paper cites jetset.aerosec.org as its open-source release, but that host did not resolve during this review. The aerosec GitHub organization, whose site lists the paper, hosts aerosec/jetset with commits from the first two authors; its README says it contains the code and data to reproduce the paper’s results, except the proprietary or security-critical CMU-900 and ICS binaries. The reviewed 2024-03-21 commit is GPL-2.0, and its Makefile clones the jetset_engine, jetset_qemu and jetset_public_data repositories over SSH; GitHub does not identify a single license for the modified-QEMU repository jetset_qemu, and jetset_public_data declares none. No code, firmware or experiments were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Report an outdated entry Suggest a translation fix

Primary sources

  1. https://www.usenix.org/conference/usenixsecurity21/presentation/johnson
  2. https://www.usenix.org/system/files/sec21-johnson.pdf
  3. README.md GitHub · aerosec/jetset · Revision a55dc69
  4. LICENSE.GPL GitHub · aerosec/jetset · Revision a55dc69
  5. Makefile GitHub · aerosec/jetset · Revision a55dc69
  6. README.md GitHub · aerosec/jetset_engine · Revision b71990f
  7. _data/publications.yml GitHub · aerosec/aerosec.github.io · Revision c831d9d
  8. LICENSE GitHub · aerosec/jetset_qemu · Revision ea9d17a
  9. https://github.com/aerosec/jetset_public_data/tree/c1f387325bd102f248d6f4a02f86d616210fad74