EL3XIR: Fuzzing COTS Secure Monitors
summary
EL3XIR rehosts commercial EL3 binaries into QEMU + AFL, uses Avatar2 memory hooks to intercept MMIO, and auto-generates fuzz harnesses from Linux drivers via harness synthesis. Reflected peripheral modeling feeds the fuzzer’s leftover bytes into MMIO reads so the monitor keeps running. The pipeline runs deterministically from a boot snapshot, scales in the cloud, and on seven tested monitors triggers 17 security-relevant bugs with six CVEs assigned, including a reproduced 2019 P20 Lite EL3 RCE.
AI-written summary · about
chapters (12)
- 0:00Introduction to EL3
- 1:20Motivation and target analysis
- 3:26Secure monitor challenges
- 6:19Fuzzing requirements
- 8:33Partial rehosting strategy
- 12:11Software dependency management
- 16:44Hardware dependency management
- 18:46Harness synthesis
- 21:05Reflected peripheral modeling
- 23:00Evaluation and results
- 27:08Demo: Rediscovering a bug
- 30:32Bug analysis and Q&A
related talks
42mCPU Fuzzing: Automatic Discovery of...
29mVirtual Device Fuzzing Support in QEMU
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
50mWhat the Fuzz
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
16mELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space
53mThree Colours of Fuzzing: Reflections and Open Challenges
27mPeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary