Git Product home page Git Product logo

para-rehosting's Introduction

para-rehosting

Finding bugs in microcontroller (MCU) firmware is challenging, even for device manufacturers who own the source code. The MCU runs different instruction sets than x86 and exposes a very different development environment. This invalidates many existing sophisticated software testing tools on x86. To maintain a unified developing and testing environment, a straightforward way is to re-compile the source code into the native executable for a commodity machine (called rehosting). However, ad-hoc re-hosting is a daunting and tedious task and subject to many issues (library-dependence, kernel-dependence and hardware-dependence). In this work, we systematically explore the portability problem of MCU software and propose para-rehosting to ease the porting process. Specifically, we abstract and implement a portable MCU (PMCU) using the POSIX interface. It models common functions of the MCU cores. For peripheral specific logic, we propose HAL-based peripheral function replacement, in which high-level hardware functions are replaced with an equivalent backend driver on the host. These backend drivers are invoked by well-designed para-APIs and can be reused across many MCU OSs. We categorize common HAL functions into four types and implement templates for quick backend development. Using the proposed approach, we have successfully rehosted nine MCU OSs including the widely deployed Amazon FreeRTOS, ARM Mbed OS, Zephyr and LiteOS. To demonstrate the superiority of our approach in terms of security testing, we used off-the-shelf dynamic analysis tools (AFL and ASAN) against the rehosted programs and discovered 28 previously-unknown bugs, among which 5 were confirmed by CVE and the other 19 were confirmed by vendors at the time of writing.

This repo is for the paper From Library Portability to Para-rehosting: Natively Executing Microcontroller Software on Commodity Hardware. You may download a full copy here.

Directory Arch

- FreeRTOS/: Fuzzing demos for FreeRTOS
- MbedOS/: Fuzzing demos for Mbed OS5
- FreeRTOS_FE.c: Source code for FreeRTOS frontend
- MbedOS_FE.c: Source code for Mbed OS frontend
- RTOS_BE.c: Source code for RTOS backend
- RTOS_BE.h: Header file for RTOS backend
- debug_log.h: Mbed OS debug log header
- port.h: Header file for Mbed OS frontend
- portmacro.h: Header file for FreeRTOS frontend

How to setup

To fuzz with provided demos, please prepare the enviroment below.

How to fuzz

For FreeRTOS, each demo contains a makefile and you only need to run the command make to build them.

For Mbed OS, all demos are included in the file main.cpp, and an option FUZZ_TARGET is provided to choose which demo is the fuzzing target.

To start fuzzer, please use the command afl-fuzz -m none -t 1000 -i ./in_dir -o ./our_dir ./binary_file

P.S.

  1. FreeRTOS_FATFS is patched and won't crash. If not, we couldn't reach deeper paths.
  2. Only partial demos are uploaded. Others will come soon.

How to port

To port a new RTOS, you need to implement a frondend source file and a header file with the help of RTOS backend. Specifically, you have to implement two frontend functions for the RTOS backend.

  • PMCU_FE_Yield(): The RTOS operations to switch the tasks with RTOS API.
  • FE_Thread_Exit(): The RTOS operations when a task exit.

para-rehosting's People

Contributors

aoao921 avatar hornos3 avatar orangeyyc avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.