https://github.com/Riscure/optee_fuzzer

This repository contains the code for a fuzzing prototype for the OP-TEE system call interface using AFL.
https://github.com/Riscure/optee_fuzzer

afl fuzzing op-tee trusted-execution-environment

Last synced: about 1 month ago
JSON representation

This repository contains the code for a fuzzing prototype for the OP-TEE system call interface using AFL.

• Host: GitHub
• URL: https://github.com/Riscure/optee_fuzzer
• Owner: Riscure
• License: gpl-3.0
• Created: 2019-03-02T03:06:04.000Z (almost 6 years ago)
• Default Branch: master
• Last Pushed: 2021-08-12T08:03:12.000Z (over 3 years ago)
• Last Synced: 2024-08-02T05:13:41.086Z (4 months ago)
• Topics: afl, fuzzing, op-tee, trusted-execution-environment
• Language: C
• Homepage:
• Size: 59.6 KB
• Stars: 132
• Watchers: 12
• Forks: 36
• Open Issues: 7
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• security-study-tutorial - 用AFL Fuzz OP-TEE的系统调用

README

        

# OP-TEE Fuzzer

This repository contains the code for a fuzzing prototype for the OP-TEE system call interface using AFL. It works by having a proxy CA that works as target from the perspective of AFL and that invokes a proxy TA that performs arbitrary system calls defined through a custom function call definition format. An AFL post library is used to discard invalid input files without invoking the TEE (which is relatively slow).

The fuzzer and ideas behind it were presented at Nullcon 2019 and Linaro Connect SAN19.

Slides: https://static.linaro.org/connect/san19/presentations/san19-225.pdf

Video: https://www.youtube.com/watch?v=7bYAwaJ7WZw

The code in this repository is an unpolished prototype that is released "as-is" to demonstrate the concepts of fuzzing a Trusted Execution Environment.

## Build Instructions

Ensure you have a fully checked out OP-TEE build tree. Clone this repository as subdirectory of the build tree and name it afl-tee. Apply the patches to the OP-TEE build system, client library and OS itself. Then build OP-TEE using the instructions provided at https://optee.readthedocs.io/en/latest/building/gits/build.html. As last step build the fuzzer using "make fuzzer" in the OP-TEE build folder. Additionally, cross-compile AFL for ARM.

Note: the provided (raw) patches are for OP-TEE 3.3.0. Porting them to a different OP-TEE version requires most likely some changes.

## Usage Instructions

Boot the system normally (using QEMU or using real hardware) and make sure the TEE functions normally (i.e. tee-supplicant running etc.) Copy the proxy TA to the correct folder (normally /lib/optee_armtz) and start AFL:

`AFL_POST_LIBRARY=/path/to/fuzzer/afl_validate.so

afl-fuzz -i /path/to/fuzzer/seeds -t 300+ -o /tmp/state -M $1 -- /path/to/fuzzer/tee_invoke_svc`

## License, Copyright and more

Copyright 2019 Riscure B.V. All rights reserved.

This program is free software: you can redistribute it and/or modify

it under the terms of the GNU General Public License as published by

the Free Software Foundation, either version 3 of the License, or

(at your option) any later version.

Riscure B.V. reserves the right to dual-license the code under a different license at any future moment. Therefore, patches or code contributions cannot be accepted without transferring the copyright to Riscure B.V.