Fuzzing Embedded Systems using Debug Interfaces
This work observes that many microcontrollers feature a debug interface through which a debug probe can set a limited number of hardware breakpoints, and uses these to extract partial coverage feedback even for uninstrumented binary code; and thus enables effective fuzzing for embedded systems through a generic, widespread mechanism.
Abstract
Fuzzing embedded systems is hard. Their key components – microcontrollers – are highly diverse and cannot be easily virtualized; their software may not be changed or instrumented. However, we observe that many, if not most, microcontrollers feature a debug interface through which a debug probe (typically controllable via GDB, the GNU debugger) can set a limited number of hardware breakpoints. Using these, we extract partial coverage feedback even for uninstrumented binary code; and thus enable effective fuzzing for embedded systems through a generic, widespread mechanism. In its evaluation on four different microcontroller boards, our prototypical implementation GDBFuzz quickly reaches high code coverage and detects known and new vulnerabilities. As it can be applied to any program and system that GDB can debug, GDBFuzz is one of the least demanding and most versatile coverage-guided fuzzers.