Binary lifting and formal verification of control algorithms in embedded firmware

In this thesis, I present two novel contributions: ANANKE, a framework for abstracting control algorithms in firmware by dynamically rewriting and reducing symbolic expressions during symbolic execution, and an emulation-based fuzzing framework for GPU firmware security testing. ANANKE extends the symbolic execution system angr to skip program regions and replace them with abstractions while maintaining the integrity of the symbolic state’s semantics. The framework allows users to nest abstractions, creating an extensible lifting framework. ANANKE’s effectiveness is demonstrated by lifting continuous equations from quad-copter and PLC firmware, uncovering bugs and reproducing attacks. The GPU fuzzing framework combines the Unicorn emulation engine, AFL fuzzer, and custom GPU models to uncover vulnerabilities in GPU firmware and drivers. The framework targets the device manager communication protocol and modules written in Ada/SPARK, demonstrating the effectiveness of emulation-based fuzzing for GPU security testing. The thesis contributions include: (1) ANANKE a tool for lifting control algorithms from firmware binaries; (2) a specification language for symbolic expression rewriting and program region abstraction; (3) a demonstration of ANANKE on real-world firmware; (4) an emulation-based fuzzing framework for GPU firmware security testing; and (5) an exploration of fuzzing techniques on NVIDIA Hopper/Blackwell GPU firmware, complementing Ada/SPARK’s formal verification.

Name thesis:degree_name

M.S.

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Electrical & Computer Engr

Grantor

University of Illinois at Urbana-Champaign

Year dc:date

2024

Author dc:creator

• Chen, Anthea

Contributors dc:contributor

• Levchenko, Kirill

• Security
• Emulation
• Industrial Control
• Fuzzing
• Lifting

Statement dc:rights

• Copyright 2024 Anthea Chen

Language dc:language

en, eng

Handle dc:identifier

https://hdl.handle.net/2142/124686

OAI record oai:identifier

https://www.ideals.illinois.edu/oai-pmh?verb=GetRecord&metadataPrefix=etdms&identifier=oai%3Awww.ideals.illinois.edu%3A2142%2F124686