Emulation-based fuzzers enable testing binaries without source code, and facilitate testing embedded applications where automated execution on the target hardware architecture is difficult and slow. The instrumentation techniques added to extract feedback and guide input mutations towards generating effective test cases is at the core of modern fuzzers. But, modern emulation-based fuzzers have evolved by re-purposing general-purpose emulators; consequently, developing and integrating fuzzing techniques, such as instrumentation methods, are difficult and often added in an ad-hoc manner, specific to an instruction set architecture (ISA). This limits state-of-the-art fuzzing techniques to few ISAs such as x86/x86-64 or ARM/AArch64; a significant problem for firmware fuzzing of diverse ISAs. This study presents our efforts to re-think emulation for fuzzing. We design and implement a fuzzing-specific, multi-architecture emulation framework -- Icicle. We demonstrate the capability to add instrumentation once, in an architecture agnostic manner, with low execution overhead. We employ Icicle as the emulator for a state-of-the-art ARM firmware fuzzer -- Fuzzware -- and replicate results. Significantly, we demonstrate the availability of new instrumentation in Icicle enabled the discovery of new bugs. We demonstrate the fidelity of Icicle and efficacy of architecture agnostic instrumentation by discovering LAVA-M benchmark bugs, requiring a known and specific operational capability of instrumentation techniques, across a diverse set of instruction set architectures (x86-64, ARM/AArch64, RISC-V, MIPS). Further, to demonstrate the effectiveness of Icicle to discover bugs in a currently unsupported architecture in emulation-based fuzzers, we perform a fuzzing campaign with real-world MSP430 firmware binaries and discovered 7 new bugs.

翻译：基于仿真的模糊测试器无需源代码即可测试二进制程序，并能在嵌入式应用中发挥重要作用，因为在这些场景下直接在目标硬件架构上自动化执行既困难又缓慢。用于提取反馈信息并引导输入变异以生成有效测试用例的插桩技术，是现代模糊测试器的核心。然而，现代基于仿真的模糊测试器是通过改造通用仿真器而演进的；因此，开发和集成模糊测试技术（例如插桩方法）十分困难，且通常以特定于指令集架构（ISA）的临时方式添加。这导致最先进的模糊测试技术仅限于少数ISA（如x86/x86-64或ARM/AArch64），成为面向多样化ISA固件模糊测试的重大问题。本研究提出重新思考面向模糊测试的仿真方法。我们设计并实现了一个面向模糊测试的、多架构仿真框架——Icicle。我们证明能够以架构无关的方式一次性添加插桩，且执行开销较低。我们将Icicle作为最先进的ARM固件模糊测试器Fuzzware的仿真器，并复现了其结果。重要的是，我们证明了Icicle中新增的插桩能力能够发现新漏洞。通过在一组多样化指令集架构（x86-64、ARM/AArch64、RISC-V、MIPS）上发现LAVA-M基准测试中的漏洞（这些漏洞需要已知且特定的插桩技术操作能力），我们验证了Icicle的保真度以及架构无关插桩的有效性。此外，为证明Icicle能够发现当前基于仿真的模糊测试器不支持的架构中的漏洞，我们对真实MSP430固件二进制程序进行了模糊测试活动，并发现了7个新漏洞。