What You See is Not What You Get: Revealing Hidden Memory Mapping for Peripheral Modeling
What You See is Not What You Get: Revealing Hidden Memory Mapping for Peripheral Modeling
复制标题
DOI：
10.1145/3545948.3545957
复制
发表时间：
2022-10
期刊：
影响因子：
--
通讯作者：
Jun Yeon Won;Haohuang Wen;Zhiqiang Lin
中科院分区：
文献类型：
--
作者：
Jun Yeon Won;Haohuang Wen;Zhiqiang Lin
如今，有大量的嵌入式物联网（IoT）设备，每个设备都包含一个可以支持众多外设的微控制器单元（MCU）。为了检测这些嵌入式设备的安全漏洞，有许多仿真（或重新托管）框架，它们通过仅使用设备固件代码而不涉及实际硬件来支持可扩展的动态分析。然而，我们表明，仅使用固件代码进行仿真是不够的，因为在外围寄存器中存在一种特殊类型的硬件定义属性，该属性允许有界寄存器在没有CPU干预的情况下同时更新，这被称为隐藏内存映射。在本文中，我们证明了现有的重托管框架（如P2IM和μEMU）在仿真过程中由于无法正确处理隐藏内存映射而导致执行路径不正确。为了解决这一挑战，我们提出了第一个框架AutoMap，它使用差分硬件内存自省方法来自动显示外围寄存器之间隐藏的内存映射，以进行忠实的固件仿真。我们在Unicorn仿真器上开发了AutoMap，并使用基于Nordic MCU开发的41个嵌入式设备固件和基于两款意法半导体MCU的μEMU和P2IM评估的9个真实固件对其进行了评估。其中，AutoMap成功地提取了2359个唯一的内存映射，这些映射可以通过知识库与重新托管框架共享。此外，通过将AutoMap与μEMU集成，AutoMap能够识别和纠正不能在实际硬件上运行的程序的路径。
Nowadays, there are a massive number of embedded Internet-of-Things (IoT) devices, each of which includes a microcontroller unit (MCU) that can support numerous peripherals. To detect security vulnerabilities of these embedded devices, there are a number of emulation (or rehosting) frameworks that enable scalable dynamic analysis by using only the device firmware code without involving the real hardware. However, we show that using only the firmware code for emulation is insufficient since there exists a special type of hardware-defined property among the peripheral registers that allows the bounded registers to be updated simultaneously without CPU interventions, which is called the hidden memory mapping. In this paper, we demonstrate that existing rehosting frameworks such as P2IM and μEMU have incorrect execution paths as they fail to properly handle hidden memory mapping during emulation. To address this challenge, we propose the first framework AutoMap that uses a differential hardware memory introspection approach to automatically reveal hidden memory mappings among peripheral registers for faithful firmware emulation. We have developed AutoMap atop the Unicorn emulator and evaluated it with 41 embedded device firmware developed based on the Nordic MCU and 9 real-world firmware evaluated by μEMU and P2IM on the two STMicroelectronics MCUs. Among them, AutoMap successfully extracted 2, 359 unique memory mappings in total which can be shared through a knowledge base with the rehosting frameworks. Moreover, by integrating AutoMap with μEMU, AutoMap is able to identify and correct the path of the program that will not run on the actual hardware.