论文标题
骰子：DMA输入通道的自动仿真，用于动态固件分析
DICE: Automatic Emulation of DMA Input Channels for Dynamic Firmware Analysis
论文作者
论文摘要
基于微控制器的嵌入式设备是Things Internet和网络物理系统的核心。这些设备的安全性至关重要。在确保嵌入式设备的方法中，由于其离线性质和低阳性速率，动态固件分析最近引起了人们的关注。但是，无论使用哪种分析和仿真技术，现有的动态固件分析仪具有主要限制，即无法使用DMA处理固件。它严重限制了支持的设备和固件代码覆盖范围的类型。我们提出了DICE，这是一种用于固件分析仪模拟DMA输入通道并生成或操纵DMA输入的解决方案。 DICE的设计目的是与硬件无关，并且与常见的MCU固件和嵌入式体系结构兼容。骰子将DMA输入通道标识为固件将源和目标DMA传输指针写入DMA控制器。然后，DICE代表固件分析仪操纵通过DMA传输的输入。我们将骰子集成到固件分析仪P2IM（Cortex-M架构）和PIC32仿真器（MIPS M4K/M级体系结构）中。我们在83个基准和示例固件上对其进行了评估，代表来自5个不同供应商的9个不同的DMA控制器。骰子检测到37个DMA输入通道中的33个，带有0个假阳性。它正确提供了22个DMA缓冲液中的21个DMA输入，由于缺乏DMA仿真，以前的固件分析仪无法实现。 Dice的开销相当低，平均为P2IM执行时间增加了3.4％。我们还使用骰子对7个现实世界进行了模糊测试，并将结果与原始P2IM进行了比较。骰子发现了更多的执行路径（多达79倍），并发现了5个以前未知的虫子，这些错误是无法实现的，没有DMA仿真。我们所有的源代码和数据集均可公开使用。
Microcontroller-based embedded devices are at the core of Internet-of-Things and Cyber-Physical Systems. The security of these devices is of paramount importance. Among the approaches to securing embedded devices, dynamic firmware analysis gained great attention lately, thanks to its offline nature and low false-positive rates. However, regardless of the analysis and emulation techniques used, existing dynamic firmware analyzers share a major limitation, namely the inability to handle firmware using DMA. It severely limits the types of devices supported and firmware code coverage. We present DICE, a drop-in solution for firmware analyzers to emulate DMA input channels and generate or manipulate DMA inputs. DICE is designed to be hardware-independent, and compatible with common MCU firmware and embedded architectures. DICE identifies DMA input channels as the firmware writes the source and destination DMA transfer pointers into the DMA controller. Then DICE manipulates the input transferred through DMA on behalf of the firmware analyzer. We integrated DICE to the firmware analyzer P2IM (Cortex-M architecture) and a PIC32 emulator (MIPS M4K/M-Class architecture). We evaluated it on 83 benchmarks and sample firmware, representing 9 different DMA controllers from 5 different vendors. DICE detected 33 out of 37 DMA input channels, with 0 false positives. It correctly supplied DMA inputs to 21 out of 22 DMA buffers, which previous firmware analyzers cannot achieve due to the lack of DMA emulation. DICE's overhead is fairly low, it adds 3.4% on average to P2IM execution time. We also fuzz-tested 7 real-world firmware using DICE and compared the results with the original P2IM. DICE uncovered tremendously more execution paths (as much as 79X) and found 5 unique previously-unknown bugs that are unreachable without DMA emulation. All our source code and dataset are publicly available.
