This repository contains all the code and data necessary for building Jetset and reproducing the results presented in our Usenix'21 paper Jetset: Targeted Firmware Rehosting for Embedded Systems.
The ability to execute code in an emulator is a fundamental part of modern vulnerability testing.
Unfortunately, this poses a challenge for many embedded systems, where firmware expects to interact with hardware devices specific to the target.
Getting embedded system firmware to run outside its native environment, termed rehosting, requires emulating these hardware devices with enough accuracy to convince the firmware that it is executing on the target hardware.
However, full fidelity emulation of target devices (which requires considerable engineering effort) may not be necessary to boot the firmware to a point of interest for an analyst (for example, apoint where fuzzer input can be injected).
We hypothesized that, for the firmware to boot successfully, it is sufficient to emulate only the behavior expected by the firmware, and that this behavior could be inferred automatically.
To test this hypothesis, we developed and implemented Jetset, a system that uses symbolic execution to infer what behavior firmware expects from a target device. Jetset can generate devices models for hardware peripherals in C, allowing an analyst to boot the firmware in an emulator (e.g.,QEMU).
We successfully applied Jetset to thirteen distinct pieces of firmware together representing three architectures, three application domains (power grid, avionics, and consumer electronics), and five different operating systems.
We also demonstrate how Jetset-assisted rehosting facilitates fuzz-testing, a common security analysis technique, on an avionics embedded system, in which we found a previously unknown privilege escalation vulnerability.
You first need to install several dependencies:
apt-get install git make build-essential zlib1g-dev pkg-config libglib2.0-dev binutils-dev libboost-all-dev autoconf libtool libssl-dev libpixman-1-dev virtualenv xterm
Once you have these, you can build Jetset:
make clone
make config_qemu
make build_qemu
make virtualenv
make build_jetset_engine
The top-level script that coordinates symbolic execution and generates peripheral devices is in jetset_engine/execution/jetset_server.py.
Usage:
usage: jetset_server.py [-h] [--useFunctionPrologues] [--useSlicer]
[--useFinalizer] [--verbose] [--noAutoDetectLoops]
[--port PORT] [--soc SOCNAME] [-o OUTFILE]
[--cmdfile CMDFILE]
Run Symbolic Execution engine for Jetset
optional arguments:
-h, --help show this help message and exit
--useFunctionPrologues
Try to infer the start of functions (for CFG) using
architecture specific function prologues
--useSlicer Use constraint slicer to improve performance of
constraint solving
--useFinalizer After making a certain decision n times, finalize and
make that always the solution
--verbose Print out all log messages and other warnings
--noAutoDetectLoops Omit auto loop detection
--port PORT Port number to communicate with Qemu (over localhost)
--soc SOCNAME Type of soc (console | heat_press | steering_control |
robot | gateway | drone | reflow_oven | cnc | stm32f4
| rpi | beagle)
-o OUTFILE output file
--cmdfile CMDFILE path to script to invoke qemu instance. If window
doesn't open, make sure that the qemu run script is
executable
This repo contains all the infrastructure necessary for reproducing the results described in the paper. Once you build Jetset you can run our public evaluation targets.
To symbolically execute and synthesize devices for the targets described in the paper, except the CMU900 and ICS binaries (they are proprietary / security-critical) the make command corresponding to a target run:
make run_<target name>
For example:
make run_rpi
To run the synthesized devices used in the paper:
make run_<target name>_concrete
For example:
make run_rpi_concrete
There are three other repos needed to reproduce results. They are all pulled in automatically by the makefile.
Symbolic Execution Engine: Jetset's symbolic execution is here.
Modified QEMU: Jetset's modified version of qemu is here.
Binaries used for evaluation: The binaries we executed as part of our evaluation are here.
Architecture Independent Fuzzer: Jetset's fuzzer is here.
How do I add custom firmware and symbolic devices?: See the README.md files here and here.