ABSTRACT
Are you struggling to keep up with the rapidly evolving cybersecurity landscape? Are traditional vulnerability discovery methods such as code auditing and manual crashes no longer sufficient? Do you wish to find vulnerabilities at scale?
QEMU Internals, Instrumentation and Fuzzing is a 4 day hands-on course where participants will learn about the fundamentals of emulation and fuzzing, how to emulate a custom device in QEMU from the ground up, and how to instrument it for fuzzing and vulnerability research.
We will dive into QEMU, one of the most powerful software tools designed for emulation and fuzzing, to gain a deep understanding of its architecture and design principles. We'll cover machine types, hardware emulation, and how to write your own platform to emulate and fuzz.
Students will use AFL++, Hongfuzz and some handcrafted examples for testing large software systems for vulnerabilities. We will apply persistent fuzzing, mutational fuzzing and evolutionary fuzzing on real world firmware examples including CANBUS, Fitness devices, Media Players, Networked RTOS based systems, peripheral and bus fuzzing techniques such as USART, UART, baseband, routers, and device sensors.
The class features several hands on exercises where participants will gain an understanding of memory vulnerabilities in IoT devices and how to write exploits, as well as managing responsible disclosure and vulnerability mitigation.
By the end of the course, participants will have a unique set of skills and knowledge from different fields such as emulation of custom embedded systems, instrumented fuzzing, and dynamic analysis, all with a single goal: to find security vulnerabilities.
INTENDED AUDIENCE
KEY LEARNING OBJECTIVES
- Fundamental concepts of emulation and fuzzing as useful tools in vulnerability research
- QEMU, Panda, AFL++, Hongfuzz, Avatar2
- Set up an emulation and fuzzing environment for the course using QEMU and AFL/AFL++
- QEMU architecture and design principles, including machine types and hardware emulation
- QEMU execution modes and performance optimization using Panda or Avatar2
- Static and dynamic fuzzing techniques, and fuzzer injection into proprietary firmware
- Apply emulation and fuzzing techniques to real-world targets:
- IoT devices, CANBUS fuzzing, Media Players, Network Services, Fitness devices, Real-Time Tasks
- Knowledge of peripheral and bus fuzzing such as USART, UART, baseband, routers, device sensors
- Identify memory vulnerabilities and write exploits, and understand responsible disclosure and vulnerability mitigation
- Understand how fuzzing + emulation are the game changer for vulnerability research
COURSE DETAILS
AGENDA
DAY 1: INTRODUCTION
- Static analysis
- Binary lifting
- From lifting to execution
- Examples, P-Code, Intro to TCG
- Hands-on → Kunai, disasm and lift
- Hands-on → Kunai, IR analysis
- TCG Internals
- Hands-on tracking code through the TCG: registers
- Hands-on tracking code through the TCG: jumps
- Hands-on tracking code through the TCG: Code coverage
DAY 2: INTRODUCTION TO QEMU ARCHITECTURE AND DESIGN PRINCIPLES
- Overview of QEMU components and their interactions
- Understanding QEMU machine types and hardware emulation
- QEMU execution modes and performance optimisation
- Hands-on exercise: Building and customising a QEMU machine type for the ST Nucleo L452RE board
- Hands-on exercise: Writing the UART for the ST Nucleo L452RE board
- Case studies of successful emulation and fuzzing in vulnerability research (e.g., IoT devices, web applications)
- Hands-on exercise: Compare Avatar2 approach with Python vs. pure QEMU board emulation
- Fuzzing with QEMU
- Going through a fuzzing harness
- Hands-on exercise: Finding and exploiting vulnerabilities in our RTOS based firmware on the ST Nucleo L452RE board
- Hands-on exercise: Writing the harness for a specific component
DAY 3: PEBBLE WATCH AND REBBLEOS ON QEMU
- Fuzzing campaign
- Code analysis
- Harness
- Checking crashes
- Bugs and patches
- CAN Bus fuzzing
- Can Bus crash course
- Setup messages
- Fuzzing campaign
DAY 4: IOS DEVICES
- Approaching closed source firmwares iPod Touch 1/2g
- Finding code caves
- Injecting and testing code
- Re-writing the AFL harness
- iPhone 11 approach with syscalls
KNOWLEDGE PREQUISITES
C Programming, GDB and static analysis
REQUIREMENTS
HARDWARE
- Laptop capable of running Linux or macOS
- 16 GB RAM preferred
SOFTWARE
- Docker (for Linux/macOS)
ABOUT THE TRAINER
Antonio Nappa, PHD is the application analysis team leader at zimperium inc. Before joining zimperium he worked at brave software and corelight.
Antonio has been active in the cybersecurity industry since 17 years. He has been a visiting scholar at uc berkeley, eurecom, vsb-tuo. He has published more than 15 papers in international peer-reviewed venues. He is also an inventor and a well recognized adjunct professor at uc3m madrid.
He is co-author of: fuzzing against the machine: automate vulnerability research with emulated iot devices on qemu, packt publishing 2023.
Since the defcon 2008 finals with the guard@mylan0 team, he never goes to sleep with a segfault.
