Reaching firmware vulnerabilities behind unsatisfiable input guards

Develop techniques that enable directed firmware fuzzers to reach vulnerability sites guarded by conditions that fuzz-controlled input cannot satisfy, including authentication checks, session tokens, LAN-subnet restrictions, checksums, and encoded input transformations.

Background

Directed firmware fuzzing assumes that a feasible input path exists from the available input channel to the designated vulnerability site. In practice, firmware targets may be protected by authentication, session-state, network-origin restrictions, checksums, or encoded transformations that cannot be satisfied through straightforward mutation of the fuzzed input.

The paper’s comparison-guided mutation can resolve many guards when the relevant operand bytes appear in the colorized taint region, but it cannot bootstrap a match when those bytes are absent from the taint region or when the guard depends on a checksum or other encoded transformation. Existing path-pruning and directed-fuzzing techniques likewise cannot reach targets whose guards are not input-satisfiable, leaving the development of methods for handling such gates unresolved.