Refinement of MMIO Models for Improving the Coverage of Firmware Fuzzing

Embedded systems (ESes) are now ubiquitous, collecting sensitive user data and helping the users make safety-critical decisions. Their vulnerability may thus pose a grave threat to the security and privacy of billions of ES users. Grey-box fuzzing is widely used for testing ES firmware. It usually runs the firmware in a fully emulated environment for efficient testing. In such a setting, the fuzzer cannot access peripheral hardware and hence must model the firmware's interactions with peripherals to achieve decent code coverage. The state-of-the-art (SOTA) firmware fuzzers focus on modeling the memory-mapped I/O (MMIO) of peripherals. We find that SOTA MMIO models for firmware fuzzing do not describe the MMIO reads well for retrieving a data chunk, leaving ample room for improvement of code coverage. Thus, we propose ES-Fuzz that boosts the code coverage by refining the MMIO models in use. ES-Fuzz uses a given firmware fuzzer to generate stateless and fixed MMIO models besides test cases after testing an ES firmware. ES-Fuzz then instruments a given test harness, runs it with the highest-coverage test case, and gets the execution trace. The trace guides ES-Fuzz to build stateful and adaptable MMIO models. The given fuzzer thereafter tests the firmware with the newly-built models. The alternation between the fuzzer and ES-Fuzz iteratively enhances the coverage of fuzz-testing. We have implemented ES-Fuzz upon Fuzzware and evaluated it with 21 popular ES firmware. ES-Fuzz boosts Fuzzware's coverage by up to $160%$ in some of these firmware without lowering the coverage in the others much.