Fuzzing Zephyr Apps - Struggles of Dynamic Analysis on Embedded Applications
summary
Claims that Zephyr gains system‑level fuzzing beyond unit tests by integrating AFL++ with the native simulator, complements existing libFuzzer coverage‑guided API fuzzing, and uses QEMU‑style rehosting and peripheral models for higher fidelity. A prototype produces an instrumented Zephyr executable that runs under AFL++, finds injected crashes, and yields repro inputs and gdb traces. Work is validated on the native SIM platform, an RFC/PR is open, and broader platform support needs peripheral modeling and refactoring before merge.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:11Why fuzzing matters
- 7:55Challenges in embedded fuzzing
- 12:10Execution environment solutions
- 17:56Fuzzing Zephyr apps
- 21:09AFL++ vs LipFuzzer
- 25:29Integrating AFL++ into Zephyr
- 28:40Conclusion and future steps
related talks
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
20mAFL++ : Combining Incremental Steps of Fuzzing Research
45mFuzzing with AFL
55mZephyr: An Ideal Platform for Introducing Processes of Safety-Critical Embedded Systems
58mFuzzing Embedded (Trusted) Operating Systems Using AFL
01h 15mMake your programs more reliable with Fuzzing
25mGoing Beyond Coverage-Guided Fuzzing with Structured Fuzzing
52mStructure aware fuzzing