一句话：提出 IFIZZ，面向 Linux IoT 固件错误处理代码，通过状态感知与有界错误生成高效触发深层故障路径并发现缺陷。
IoT 设备因恶劣环境和有限算力而极易出现错误，正确的错误处理至关重要，但现有 fuzzing 难以有效测试错误处理代码：错误通常属于边角情况，难以触发；测试错误处理又常导致执行崩溃，阻碍后续深层错误路径。为此，本文提出 IFIZZ，一个专为 Linux-based IoT 固件错误处理代码设计的缺陷检测系统。IFIZZ 首先采用基于二进制的自动化方法，分析闭源 IoT 固件中的错误及错误条件，识别现实运行时错误；然后使用状态感知与有界错误生成，有效到达深层错误路径。作者在 10 个流行 IoT 固件上实现并评估 IFIZZ，发现 109 个关键 bug，其中 63 个位于广泛使用的 IoT 库中。IFIZZ 还具备高代码覆盖率与效率，比正常执行多覆盖 67.3% 的错误路径，错误处理覆盖深度为当前最优方法的 7.3 倍，并已被一家全球领先的 IoT 公司实际采用和部署。
IoT devices are abnormally prone to diverse errors due to harsh environments and limited computational capabilities. As a result, correct error handling is critical in IoT. Implementing correct error handling is non-trivial, thus requiring extensive testing such as fuzzing. However, existing fuzzing cannot effectively test IoT error-handling code. First, errors typically represent corner cases, thus are hard to trigger. Second, testing error-handling code would frequently crash the execution, which prevents fuzzing from testing following deep error paths.In this paper, we propose IFIZZ, a new bug detection system specifically designed for testing error-handling code in Linux-based IoT firmware. IFIZZ first employs an automated binary-based approach to identify realistic runtime errors by analyzing errors and error conditions in closed-source IoT firmware. Then, IFIZZ employs state-aware and bounded error generation to reach deep error paths effectively. We implement and evaluate IFIZZ on 10 popular IoT firmware. The results show that IFIZZ can find many bugs hidden in deep error paths. Specifically, IFIZZ finds 109 critical bugs, 63 of which are even in widely used IoT libraries. IFIZZ also features high code coverage and efficiency, and covers 67.3% more error paths than normal execution. Meanwhile, the depth of error handling covered by IFIZZ is 7.3 times deeper than that covered by the state-of-the-art method. Furthermore, IFIZZ has been practically adopted and deployed in a worldwide leading IoT company. We will open-source IFIZZ to facilitate further research in this area.
@inproceedings{paperbot6554,
title = {IFIZZ: Deep-State and Efficient Fault-Scenario Generation to Test IoT Firmware},
author = {Peiyu Liu and Shouling Ji and Xuhong Zhang and Qinming Dai and Kangjie Lu and Lirong Fu and Wenzhi Chen and Peng Cheng and Wenhai Wang and Raheem Beyah},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678785}
}