# FirmHunter: State-Aware and Introspection-Driven Grey-Box Fuzzing towards IoT Firmware
## 4 Tool Design  
The architecture of FirmHunter is shown in Figure 5. The workflow is that we first emulate the target firmware and provide its web interfaces. Once running, our Traffic Collector applies a crawler to interact with web applications, captures the messages, and delivers the collected messages formatting in pcap files to Message Parser. Then Message Parser builds state-message queues which satisfy authentication dependency, intra-message dependency, and inter-message dependency. After that, Queue Scheduler sends these message queues to the emulated device and scores them. After a more interesting queue is chosen, Fuzzer establishes socket communication with the emulated device and sends test cases generated \begin{table}
\begin{tabular}{l c c} \hline \hline
**Type** & **Name** & **Func** \\ \hline Network & inet\_accept & Accepted of messages \\ System & do\_mount & Mounting of file system \\ Write & vfs\_unlink & Deletion of files \\ Read & do\_sys\_open & Opening of file descriptors \\ Execution & mmap\_region & Memory mapping \\  & do\_execve & Execution of programs \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Hooked System Calls. by applying mutation on the chosen queue; Monitor detects the abnormal behaviors of the emulated device and generates reports. Emulator: For the collected firmware images, we implement a full-system emulation platform to emulate them. In order to capture system calls, we modify the Linux kernel to hook sensitive system calls in Table 1. At the same time, to obtain the coverage information of the whole system, we write a QEMU plugin to gain the executed basic block ids. Furthermore, after we extracted the file system from firmware, we injected a CI (Command Injection) file into it, which helps us find command injection vulnerabilities. When a CI file is executed, a system call for open \"ci_file\" will be triggered and we assume a OS command is successfully injected once we capture this specified system call. Traffic Collector: To avoid manually writing protocol templates, we obtain templates by analyzing traffic packets. This component consists of two parts, one is a crawler, which traverses web applications, and the other is a middle proxy used to process traffic packets. First, we write a crawler for the web application of IoT devices. This crawler logs in on the homepage according to the IP address provided by the emulation platform, recognizes the input box and clicks on the button, fills in the username and password, and traverses the web application. At the same time, it records these actions with time stamps. While the crawler crawls the pages, the middle proxy processes the generated requests. First, it de-duplicates the messages according to the URL in the message header and filters out the useless requests, which are related to static resources like Javascript files and images. Then this component delivers the filtered messages to the Message Parser. Message Parser: Message Parser analyzes the collected messages to construct message-state queues according to the rules in Section 3.1. Queue Scheduler: Queue Scheduler sends the constructed state-aware queues to the Emulator and collects execution information after 10 s separately. Then this component ranks these queues according to the algorithm in Section 3.2 and sends queues to Fuzzer in order. Fuzzer: For one message queue, Fuzzer performs the following mutations on the queue:  
1. Select the Auth of the message queue for fuzzing. 2. Keep the Auth unchanged and mutate the REQ. 3. Keep the Auth and the REQ unchanged and mutate the ACT. For each message, Fuzzer identifies the types of different values in both the header and the body. Then Fuzzer performs mutation strategies, which are shown in Table 2, according to the value Type. Figure 5: Architecture of FirmHunter. Monitor: Monitor is responsible for detecting abnormal behaviors of IoT devices, identifying types of vulnerabilities, and maintaining the status of emulated IoT devices.