ES-Fuzz: Adaptive Modeling of MMIO Data Chunks for Firmware Fuzzing
About
Fuzzing has been widely used for testing embedded-system firmware in a fully rehosted environment without real peripherals, native system supports, or access to the source code and specifications. Some fuzzers emulate the MMIO behavior of missing peripherals based on the firmware binaries to boost code coverage. They emulate each individual MMIO read in the firmware with a fixed model. We find this ineffective when multiple MMIO reads collectively retrieve a data chunk, which greatly impedes the coverage growth. We propose ES-Fuzz to overcome this coverage bottleneck by adaptively modeling MMIO data chunks. ES-Fuzz runs alongside a given fuzzer and starts a new run when the fuzzer's coverage stagnates. In each run, it analyzes a high-coverage test case to infer new MMIO data-chunk models that unlock additional execution paths. We have implemented ES-Fuzz on Fuzzware and evaluated it on 24 popular firmware binaries. ES-Fuzz boosts Fuzzware's coverage by up to 68% in 11 -- and triggers additional bugs in 5 -- of them without degrading the coverage in the remainder. Its models describe a wide range of MMIO data chunks and the firmware's use of each across various contexts.