一句话：利用 Arm Cortex-M 的 Debug Monitor 中断链让固件自我追踪，从而在真实设备上高效地进行二进制固件模糊测试。
二进制固件模糊测试因不需要源码信息而比源码方案更具适用性，这对只发布二进制、不公开源码的固件厂商尤为重要。为摆脱传统 hardware-in-the-loop（HiL）方式，已有研究尝试更高效地驱动真实硬件，但这些方案存在依赖高端硬件特性、无法恢复完整覆盖率、执行速度慢等固有缺陷。本文提出 DRIFT，一种遵循 semihosting 思路的片上二进制固件测试方法。其核心洞察是使用 Arm Cortex-M 的 Debug Monitor（DM）——该特性可在断点命中时触发中断；通过串联 DM 中断，DRIFT 让固件对自身进行追踪，这种自追踪方式最大程度减少了工作站的干预，显著提升模糊测试性能。DRIFT 在设计上高度灵活，可适应多种硬件资源限制。在新的固件上，DRIFT 发现了三个此前未知、且现有二进制模糊测试技术未能发现的漏洞；在速度和保真度上，DRIFT 优于所有最先进的二进制固件模糊器，仅落后于需要源码的 SHiFT。
Binary firmware fuzzing has garnered attention in recent years. Compared to source-code-based approaches, binary approaches require less semantic information and are therefore more applicable. This is particularly relevant in firmware analysis, as most firmware vendors distribute only binaries, withholding source code due to proprietary concerns.Pivoting away from the traditional hardware-in-the-loop (HiL) methodology, researchers are exploring more efficient ways to engage real hardware for fuzzing. However, existing approaches have inherent drawbacks, such as reliance on high-end hardware features, inability to recover complete coverage, and slow execution speeds. We propose DRIFT, a novel approach for on-device binary firmware testing that follows the semihosting methodology. DRIFT addresses all the aforementioned drawbacks. The core insight of DRIFT is to use the Debug Monitor (DM) for firmware fuzzing. DM is a Arm Cortex-M CPU feature that allows triggering interrupt when a breakpoint is hit. Through chaining the DM interrupts, DRIFT is able let firmware to trace itself. This self-tracing approach minimizes interference from the workstation, significantly boosting fuzzing performance.We designed DRIFT to be highly flexible, accommodating a number of hardware resource limitations. When applied to new firmware, DRIFT discovered three previously unknown bugs that were not identified by existing binary fuzzing techniques. Furthermore, DRIFT outperforms all state-of-the-art binary firmware fuzzers in terms of speed and fidelity, trailing only SHiFT, an approach that requires source code.
DOI 原文 ·
@inproceedings{paperbot9486,
title = {DRIFT: Debug-based Trace Inference for Firmware Testing},
author = {Changming Liu and Alejandro Mera and Meng Xu and Engin Kirda},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00211}
}