Mobile devices rely on Trusted Execution Environments (TEEs) to execute security-critical code and protect sensitive assets. This security-critical code is modularized in components known as Trusted Applications (TAs). Vulnerabilities in TAs can compromise the TEE and, thus, the entire system. However, the closed-source nature and fragmentation of mobile TEEs severely hinder dynamic analysis of TAs, limiting testing efforts to mostly static analyses. This paper presents TÄMU, a rehosting platform enabling dynamic analysis of TAs, specifically fuzzing and debugging, by interposing their execution at the API layer. To scale to many TAs across different TEEs, TÄMU leverages the standardization of TEE APIs, driven by the GlobalPlatform specifications. For the remaining TEE-specific APIs not shared across different TEEs, TÄMU introduces the notion of greedy high-level emulation, a technique that allows prioritizing manual rehosting efforts based on the potential coverage gain during fuzzing. We implement TÄMU and use it to emulate 67 TAs across four TEEs. Our fuzzing campaigns yielded 17 zero-day vulnerabilities across 11 TAs. These results indicate a deficit of dynamic analysis capabilities across the TEE ecosystem, where not even vendors with source code unlocked these capabilities for themselves. TÄMU promises to close this gap by bringing effective and practical dynamic analysis to the mobile TEE domain.

翻译：移动设备依赖可信执行环境（TEE）来执行安全关键代码并保护敏感资产。这些安全关键代码被模块化为称为可信应用（TA）的组件。TA中的漏洞可能危及TEE乃至整个系统的安全。然而，移动TEE的闭源特性和碎片化严重阻碍了对TA的动态分析，使得测试工作大多局限于静态分析。本文提出TÄMU——一种通过在API层拦截TA执行来实现动态分析（特别是模糊测试与调试）的重托管平台。为扩展到跨不同TEE的众多TA，TÄMU利用了由GlobalPlatform规范推动的TEE API标准化。针对不同TEE间不共享的剩余TEE专用API，TÄMU提出了贪婪高级模拟的概念，该技术可根据模糊测试期间潜在的覆盖率增益来优先安排人工重托管工作。我们实现了TÄMU并用其在四个TEE上模拟了67个TA。我们的模糊测试活动在11个TA中发现了17个零日漏洞。这些结果表明TEE生态系统普遍缺乏动态分析能力，甚至拥有源代码的供应商自身也未解锁这些能力。TÄMU有望通过为移动TEE领域带来高效实用的动态分析来弥补这一差距。