title: ÐÐ±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð¼ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ð¸ Ð²ÑÑÑÐ°Ð¸Ð²Ð°ÐµÐ¼ÑÑ ÑÐ¸ÑÑÐµÐ¼ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ ÑÐ°Ð·Ð·Ð¸Ð½Ð³-ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Vulnerability detection in embedded software using fuzz testing
Creators: name: ÐÐ²Ð°Ð½Ð¾Ð², ÐÐ¸ÑÐ¸Ð»Ð»
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2025
Subjects: ÑÐ°Ð·Ð·Ð¸Ð½Ð³
Ð¿Ð¾Ð¸ÑÐº ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
Ð²ÑÑÑÐ°Ð¸Ð²Ð°ÐµÐ¼ÑÐµ ÑÐ¸ÑÑÐµÐ¼Ñ
fuzzing
vulnerability searching
embedded systems

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÐ±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð¼ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ð¸ Ð²ÑÑÑÐ°Ð¸Ð²Ð°ÐµÐ¼ÑÑ ÑÐ¸ÑÑÐµÐ¼ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ ÑÐ°Ð·Ð·Ð¸Ð½Ð³-ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸ÑÂ». Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ðµ ÑÐºÐ¾ÑÐ¾ÑÑÐ¸ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÑ Ð¾ÑÐ¸Ð±Ð¾Ðº Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ ÑÐ°Ð·Ð·Ð¸Ð½Ð³-ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð²ÑÑÑÐ°Ð¸Ð²Ð°ÐµÐ¼ÑÑ ÑÐ¸ÑÑÐµÐ¼ Ð±ÐµÐ· Ð´Ð¾ÑÑÑÐ¿Ð° Ðº ÐµÐ³Ð¾ Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð¼Ñ ÐºÐ¾Ð´Ñ. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: Â  Â  1. ÐÑÐ¾Ð²ÐµÑÑÐ¸ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÑ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² ÑÐ°Ð·Ð·Ð¸Ð½Ð³-ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð±ÐµÐ· Ð´Ð¾ÑÑÑÐ¿Ð° Ðº ÐµÐ³Ð¾ Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð¼Ñ ÐºÐ¾Ð´Ñ. Â  Â  2.Â  Ð¡ÑÐµÐ´Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð²ÑÐ±ÑÐ°ÑÑ Ð½Ð°Ð¸Ð»ÑÑÑÐ¸Ð¹ Ð´Ð»Ñ Ð²ÑÑÑÐ°Ð¸Ð²Ð°ÐµÐ¼ÑÑ ÑÐ¸ÑÑÐµÐ¼. Â  Â  3. ÐÑÐµÐ´Ð»Ð¾Ð¶Ð¸ÑÑ Ð¸ ÑÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°ÑÑ ÑÐ»ÑÑÑÐµÐ½Ð¸Ðµ Ð²ÑÐ±ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð°. Â  Â  4. ÐÑÐ¾ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°ÑÑ ÑÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½Ð½Ð¾Ðµ ÑÐ»ÑÑÑÐµÐ½Ð¸Ðµ Ð½Ð° Ð²ÑÑÑÐ°Ð¸Ð²Ð°ÐµÐ¼ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð°Ñ. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ñ Ð¼ÐµÑÐ¾Ð´Ñ ÑÐ°Ð·Ð·Ð¸Ð½Ð³-ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð±ÐµÐ· Ð´Ð¾ÑÑÑÐ¿Ð° Ðº ÐµÐ³Ð¾ Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð¼Ñ ÐºÐ¾Ð´Ñ. ÐÐ°ÑÐµÐ¼ Ð±ÑÐ»Ð¾ Ð¾ÑÑÑÐµÑÑÐ²Ð»ÐµÐ½Ð¾ ÑÑÐ°Ð²Ð½ÐµÐ½Ð¸Ðµ ÑÐ°ÑÑÐ¼Ð°ÑÑÐ¸Ð²Ð°ÐµÐ¼ÑÑ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¿ÑÐ¸Ð¼ÐµÐ½Ð¸ÑÐµÐ»ÑÐ½Ð¾ Ðº Ð²ÑÑÑÐ°Ð¸Ð²Ð°ÐµÐ¼ÑÐ¼ ÑÐ¸ÑÑÐµÐ¼Ð°Ð¼. ÐÑÐ±ÑÐ°Ð½Ð½ÑÐ¹ ÐºÐ°Ðº Ð»ÑÑÑÐ¸Ð¹ Ð´Ð»Ñ Ð²ÑÑÑÐ°Ð¸Ð²Ð°ÐµÐ¼ÑÑ ÑÐ¸ÑÑÐµÐ¼ Ð¼ÐµÑÐ¾Ð´ (UnicornAFL) Ð±ÑÐ» ÑÐ»ÑÑÑÐµÐ½ Ð¿ÑÑÐµÐ¼ Ð´Ð¾Ð±Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ÑÑÐ¸ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ°ÐºÐ¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Laf-Intel Ð¸ Red-Queen ÑÐ¾Ð²Ð¼ÐµÑÑÐ½Ð¾ Ñ Ð½Ð¸Ð¼. Ð¢Ð°Ðº Ð¶Ðµ Ð±ÑÐ»Ð¸ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ñ ÑÐ»ÑÑÑÐµÐ½Ð¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Laf-Intel Ð¸ Red-Queen. ÐÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð½ÑÐµ ÑÐ»ÑÑÑÐµÐ½Ð¸Ñ Ð±ÑÐ»Ð¸ Ð¿ÑÐ¾ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ñ Ð½Ð° ÐÐ eMMC ÐºÐ¾Ð½ÑÑÐ¾Ð»Ð»ÐµÑÐ° Ð¸ Wifi Ð¼Ð°ÑÑÑÑÑÐ¸Ð·Ð°ÑÐ¾ÑÐ°. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð´Ð»Ñ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ ÐÐ Ð²ÑÑÑÐ°Ð¸Ð²Ð°ÐµÐ¼ÑÑ ÑÐ¸ÑÑÐµÐ¼ Ð±ÐµÐ· Ð´Ð¾ÑÑÑÐ¿Ð° Ðº Ð¸Ñ Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð¼Ñ ÐºÐ¾Ð´Ñ.
description: The topic of the graduate qualification work is Â«Vulnerability detection in embedded software using fuzz testingÂ». The purpose of the study is increasing the speed of identifying embed software errors using fuzz testing without access to its source code. The research set the following goals: Â  Â  1. Perform an analysis of modern methods of software fuzzing testing without access to its source code. Â  Â  2. Select the best one for embedded systems among the analyzed methods. Â  Â  3. Propose and implement improvements to the selected method. Â  Â  4. Test the implemented improvement on embedded systems. During the work, methods for fuzzing software testing without access to its source code were investigated. Then, a comparison was made of the considered methods in relation to embedded systems. The selected method for embedded systems (UnicornAFL) has been improved by adding the ability to use Laf-Intel and Red-Queen methods in conjunction with it. Improvements to the Laf-Intel and Red-Queen methods were also proposed. The proposed improvements were tested on the eMMC controller and Wifi router software. The results obtained can be used to test the security of software of embedded systems without access to their source code.