Fuzzing Embedded (Trusted) Operating Systems Using AFL
summary
Presents a fuzzing framework for OP-TEE that integrates AFL (unmodified) with compile-time coverage hooks inside the TEE kernel to fuzz kernel code, the non-secure-facing interface, and embedded trusted applications. Describes running AFL as a Linux application in the non-secure world while collecting coverage from the TEE, the challenges of fuzzing a non-virtualized device, and how they generated initial seed inputs; approach is applicable to other trusted operating systems.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 2:58TrustOS basics
- 12:50Fuzzing TrustOS with AFL
- 22:50Proxy application design
- 33:58Demo: Encryption in TrustOS
- 47:08Visualizing fuzzing results
- 57:07Summary and Q&A
related talks
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
20mAFL++ : Combining Incremental Steps of Fuzzing Research
32mFuzzing Zephyr Apps - Struggles of Dynamic Analysis on Embedded Applications
45mFuzzing with AFL
01h 15mMake your programs more reliable with Fuzzing
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
24mDesigning UAPI for Fuzz-ability
54mMy Fuzzy Driver