一句话：提出模型引导内核执行，半自动生成外设模型并合成 QEMU 虚拟机，实现嵌入式 Linux 内核 rehosting。
嵌入式系统广泛使用 Linux 内核，但硬件碎片化使 QEMU 难以支持大量外设，导致无法进行全系统动态分析。本文提出模型引导的内核执行技术，结合 Linux 内核的外设抽象与内核-外设交互，半自动生成外设模型，并合成 QEMU 虚拟机以启动动态分析。作者实现 FirmGuide，生成 9 个完整功能与 64 个最小功能外设模型，覆盖 26 种 SoC。对 6,188 个固件镜像的评估显示，该方法在 2 种架构、22 个版本上成功 rehosting 超过 95% 的 Linux 内核，而原版 QEMU 均无法完成；LTP 验证了可靠性，并展示了漏洞分析与模糊测试应用。
Linux kernel is widely used in embedded systems. To understand practical threats to the Linux kernel, we need to perform dynamic analysis with a full-system emulator, e.g., QEMU. However, due to hardware fragmentation, e.g., various types of peripherals, most embedded systems are not currently supported by QEMU. Though some progress has been made on rehosting firmware, it mainly focuses on user space programs or simple real-time operating systems.The goal of this work is to boost the capability of rehosting the embedded Linux kernels in QEMU. By doing so, dynamic analysis systems can be firstly applied on embedded Linux kernels by leveraging off-the-shelf tools upon QEMU. Accordingly, we proposed a new technique called model-guided kernel execution. It combines the peripheral abstractions in the Linux kernel and kernel-peripheral interactions to semi-automatically generate peripheral models that are then used to synthesize new QEMU virtual machines to start the dynamic analysis.We have implemented a prototype called FirmGuide. It generates 9 peripheral models with full functionality and 64 with minimum functionality covering 26 SoCs. Our evaluation with 6,188 firmware images shows that it can successfully rehost more than 95% of Linux kernels in 2 architectures and 22 versions. None of them can be rehosted in the vanilla QEMU. The result of the LTP benchmark shows the reliability and robustness of the rehosted Linux kernels. We further conduct two security applications, i.e., vulnerability analysis and fuzzing, on the rehosted Linux kernels to demonstrate the usage scenarios.
DOI 原文 ·
@inproceedings{paperbot6560,
title = {FirmGuide: Boosting the Capability of Rehosting Embedded Linux Kernels through Model-Guided Kernel Execution},
author = {Qiang Liu and Cen Zhang and Lin Ma and Muhui Jiang and Yajin Zhou and Lei Wu and Wenbo Shen and Xiapu Luo and Yang Liu and Kui Ren},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678653}
}