
Numerous interconnected small embedded systems, such as Internet of Things (IoT) devices, are pervasive in our daily lives; however, their security lags behind. In particular, firmware vulnerabilities in low-level infrastructure have a more severe impact than application -level vulnerabilities. Fuzzing is the most effective technique for detecting vulnerabilities in firmware, but it encounters several challenges such as hardwaredependency, input channel, and instrumentation. Existing studies attempt to overcome these challenges by applying fuzzing to firmware re -hosting. However, they explore only worthwhile paths based on heuristics and human assistance without identifying security -critical firmware code. This results in low code coverage and reduces the likelihood of discovering potential bugs. In this work, we propose a novel hardware dependencyaware re -hosting system named HD -FUZZ that focuses on the firmware fuzzing process to efficiently discover bugs by exploring all possible paths in security -critical firmware code. The key ideas of HD -FUZZ are: (1) to propose a hybrid memory -mapped I/O (MMIO) modeling; (2) to achieve efficiency by mainly performing MMIO modeling through fuzzing; and (3) to achieve completeness by performing MMIO modeling through symbolic execution only to satisfy complex checks affecting the execution flow. HD -FUZZ has been extensively evaluated on both unit test cases and real -world targets, covering 12 hardware platforms and 67 firmware images. Compared to state-of-the-art works, HD -FUZZ achieves the highest passing rate in unit test benchmarks, reaches up to 2.62 times higher code coverage in fuzzing benchmarks, and generates initial access models up to 11.6 times faster. Notably, HD -FUZZ finds two new bugs, including ones in targets that were previously analyzed by other works.
Symbolic execution, 1708 Hardware and Architecture, Firmware, 1705 Computer Networks and Communications, Internet of Things, 1706 Computer Science Applications, Fuzzing, Vulnerability
Symbolic execution, 1708 Hardware and Architecture, Firmware, 1705 Computer Networks and Communications, Internet of Things, 1706 Computer Science Applications, Fuzzing, Vulnerability
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 7 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Top 10% | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Average | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Top 10% |
