Typical Vulnerability Analysis Method Based On Dynamic Simulation Execution

With the rapid development of embedded system technology,embedded systems has become a core component of daily life with the characteristics of streamlined system,strong specificity and high real-time performance.At the same time,the country has vigorously developed the Internet of Things,and more and more embedded devices are connected with the Internet,which brings great convenience to production and life,accelerates the arrival of the digital information era.However,new opportunities have also brought new challenges.Compared with traditional computers,embedded devices have low power consumption,small size,and limited processing resources.These features also mean that their operating system design can not be too complicated.It has become the preferred target for criminal attacks on the Internet.The processor architecture of embedded devices is diverse and has different functions,which leads to complex security analysis steps for embedded devices,strict requirements for professional knowledge,and people's security awareness is still weak.Therefore,the current security analysis for embedded devices Development is slow.Traditional embedded device security analysis is usually based on specific hardware devices,and the compatibility is poor,which cannot be a general analysis method.Based on the QEMU full simulation simulator to simulate the embedded system,this thesis designs a general embedded device automation analysis platform,which can automate the vulnerability analysis of ARM and MIPS processor architecture embedded device firmware under Linux platform.The main work of this thesis is as follows:1.Write the crawler to download the firmware of the mainstream embedded device manufacturer's official website.For the device that does not provide the download webpage,use the programmer to read the firmware data in the device memory chip through hardware access.2.Analyze and classify the binary data of the obtained firmware set to establish a feature value data table of the embedded firmware.3.Research and classify common security vulnerabilities of embedded devices,analyze the generation principles and attack forms of vulnerabilities.Then,by the static and dynamic methods to studied in vulnerability detection,and write the vulnerability detection script.4.Perform a full system simulation of the embedded system firmware and attack it with a variety of automated vulnerability detection scripts to detect for vulnerabilities.5.Analyze the experimental data of this thesis and compare the vulnerability analysis platform designed with two existing vulnerability analysis platforms.The experimental results show that the automated analysis platform designed in this thesis can effectively analyze the vulnerability of embedded system firmware to compare their advantages and disadvantages.