Harzer Roller：基于链接器的增强嵌入式安全测试工具
Harzer Roller: Linker-Based Instrumentation for Enhanced Embedded Security Testing
摘要：
由于物联网的兴起，有许多新的芯片和平台可供业余爱好者和工业界使用，以构建智能设备。这些新平台的SDK通常包括包含无线协议实现、加密实现或其他库函数的闭源二进制文件，这些文件在平台上的所有用户代码中共享。利用这样的库漏洞对给定的平台有很大的影响。然而，由于这些平台通常是现成的，像JTAG这样的经典调试基础设施往往是不可用的。在本文中，我们提出了一种方法，称为Harzer辊，以提高资源受限的设备上的嵌入式固件安全测试。使用Harzer Roller，我们将插装代码挂钩到函数调用和返回中。挂钩不仅适用于用户应用程序代码，也适用于用于构建固件的SDK。虽然我们保持Harzer Rollergenerally架构的设计独立，但我们提供了基于Xtensa架构的ESP8266 Wi-Fi IoT芯片的实现。我们表明，可以利用Harzer辊跟踪执行流通过库没有可用的源代码，并检测基于堆栈的缓冲区溢出。此外，我们还展示了如何使用溢出检测来转储调试信息以供以后分析。这可以更好地使用各种软件安全测试方法，如无线协议实现的模糊测试或概念验证攻击开发。
英文摘要：
Due to the rise of the Internet of Things, there are many new chips and platforms available for hobbyists and industry alike to build smart devices. The SDKs for these new platforms usually include closed-source binaries containing wireless protocol implementations, cryptographic implementations, or other library functions, which are shared among all user code across the platform. Leveraging such a library vulnerability has a high impact on a given platform. However, as these platforms are often shipped ready-to-use, classic debug infrastructure like JTAG is often times not available. In this paper, we present a method, called Harzer Roller, to enhance embedded firmware security testing on resource-constrained devices. With the Harzer Roller, we hook instrumentation code into function call and return. The hooking not only applies to the user application code but to the SDK used to build firmware as well. While we keep the design of the Harzer Rollergenerally architecture independent, we provide an implementation for the ESP8266 Wi-Fi IoT chip based on the xtensa architecture. We show that the Harzer Roller can be leveraged to trace execution flow through libraries without available source code and to detect stack-based buffer-overflows. Additionally, we showcase how the overflow detection can be used to dump debugging information for later analysis. This enables better usage of a variety of software security testing methods like fuzzing of wireless protocol implementations or proof-of-concept attack development.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
