高通可信应用的模糊测试仿真
Qualcomm Trusted Application Emulation for Fuzzing Testing
AI总结：
本研究针对高通TEE中的可信应用（TAs）提出了一款新型轻量级仿真器，结合逆向工程与模糊测试技术有效发现潜在安全漏洞，并首次公开其实现方法与源代码，为安全测试提供了便捷高效的方案。
摘要：
近年来，随着网络安全意识的不断提高，硬件设备与产品中的信息安全问题备受关注。将可信执行环境（TEEs）融入产品设计已成为保护敏感用户信息的标准做法。然而，这些组件中的漏洞带来了巨大风险，若被攻击者利用，可能导致敏感数据泄露，从而损害用户隐私与安全。本研究聚焦于高通 TEE 中的可信应用（TAs），并引入了一款专为这些应用设计的新型仿真器。通过逆向工程技术，我们深入分析了高通 TAs，并开发了一个能够准确模拟其行为的部分仿真环境。此外，我们将模糊测试技术集成到仿真器中，以系统地发现高通 TAs 中的潜在漏洞，展示了其在识别现实安全缺陷方面的实际有效性。本研究首次提供了高通 TAs 仿真器的实现方法与源代码，为未来的研究工作提供了宝贵参考，做出了重大贡献。与以往依赖复杂且资源消耗大的全系统模拟的方法不同，我们的方法轻量且高效，使 TA 的安全测试更加便捷。
英文摘要：
In recent years, the increasing awareness of cybersecurity has led to a heightened focus on information security within hardware devices and products. Incorporating Trusted Execution Environments (TEEs) into product designs has become a standard practice for safeguarding sensitive user information. However, vulnerabilities within these components present significant risks, if exploited by attackers, these vulnerabilities could lead to the leakage of sensitive data, thereby compromising user privacy and security. This research centers on trusted applications (TAs) within the Qualcomm TEE and introduces a novel emulator specifically designed for these applications. Through reverse engineering techniques, we thoroughly analyze Qualcomm TAs and develop a partial emulation environment that accurately emulates their behavior. Additionally, we integrate fuzzing testing techniques into the emulator to systematically uncover potential vulnerabilities within Qualcomm TAs, demonstrating its practical effectiveness in identifying real-world security flaws. This research makes a significant contribution by being the first to provide both the implementation methods and source codes for a Qualcomm TAs emulator, offering a valuable reference for future research efforts. Unlike previous approaches that relied on complex and resource-intensive full-system simulations, our approach is lightweight and effective, making security testing of TA more convenient.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
