Charm: Facilitating Dynamic Analysis of Device Drivers of Mobile Systems
summary
System runs mobile device drivers inside an x86 VM via remote device driver execution and a custom low-latency USB channel that forwards register I/O, interrupts, and shared-resource RPCs to the phone, requiring no special hardware. Implemented for camera, audio, GPU and IMU drivers from Nexus 5X, Nexus 6P and Galaxy S7; porting took about seven days for a large GPU driver and two days for an IMU. Fuzzing throughput slightly improves vs. on-phone, record-and-replay and gdb debugging work, leading to 25 bugs found and one arbitrary-code kernel exploit.
AI-written summary · about
chapters (7)
- 0:00Motivation and background
- 2:54System design of Charm
- 7:48Implementation and porting
- 9:20Fuzzing and bug discovery
- 13:00Record and replay analysis
- 14:58Manual debugging and results
- 17:24Summary and Q&A
related talks
53mDIFUZE: Android Kernel Driver Fuzzing
35mKernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections
53mResearching New Attack Interfaces On iOS And OSX
27mPeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary
54mMy Fuzzy Driver
31mBypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis
48mXen and the Art of Embedded Systems Virtualization
25mDon't Trust Your USB! How to Find Bugs in USB Device Drivers