VxFuzzer: Grey-Box fuzzing for VxWorks based on whole system simulation

LI Songtao; GENG Yangyang; MA Rongkuan; JIA Yan; PENG Jianshan; CAO Yan

doi:10.11959/j.issn.2096-109x.2025046

您当前的位置：

首页 >

文章列表页 >

VxFuzzer: Grey-Box fuzzing for VxWorks based on whole system simulation

Topic: Cybersecurity for New Industrialization | 更新时间：2025-09-12

- VxFuzzer: Grey-Box fuzzing for VxWorks based on whole system simulation
- Chinese Journal of Network and Information Security Vol. 11, Issue 4, Pages: 117-126(2025)
- 作者机构：
  
  1.郑州大学网络空间安全学院，河南郑州 450001
  2.信息工程大学，河南郑州 450001
  3.南开大学密码与网络空间安全学院，天津 300350
  4.网络空间安全教育部重点实验室，河南郑州 450001
- 作者简介：
- 基金信息：
  
  Open Foundation of Key Laboratory of Cyberspace Security, Ministry of Education of China(KLCS20240211);The Fundamental Research Funds for the Central Universities(079-63253221)
- DOI：10.11959/j.issn.2096-109x.2025046
  CLC： TP393
- Received：09 May 2025，
  
  Revised：2025-07-15，
  
  Published：25 August 2025
- 稿件说明：
移动端阅览
李松涛, 耿洋洋, 麻荣宽, 等. VxFuzzer:基于全系统模拟的VxWorks灰盒模糊测试器[J]. 网络与信息安全学报, 2025, 11(4): 117-126.

Format: LI S T, GENG Y Y, MA R K, et al. VxFuzzer: Grey-Box fuzzing for VxWorks based on whole system simulation[J]. Chinese Journal of Network and Information Security, 2025, 11(4): 117-126.
李松涛, 耿洋洋, 麻荣宽, 等. VxFuzzer:基于全系统模拟的VxWorks灰盒模糊测试器[J]. 网络与信息安全学报, 2025, 11(4): 117-126. DOI： 10.11959/j.issn.2096-109x.2025046.

Format: LI S T, GENG Y Y, MA R K, et al. VxFuzzer: Grey-Box fuzzing for VxWorks based on whole system simulation[J]. Chinese Journal of Network and Information Security, 2025, 11(4): 117-126. DOI： 10.11959/j.issn.2096-109x.2025046.

摘要

VxWorks 作为一款被广泛应用于工业控制、航空航天等关键基础设施领域的实时操作系统，其安全性直接关系到整个工业系统的稳定运行。然而，由于执行环境受限、系统实现复杂及与现有工具兼容性差等问题，对VxWorks系统进行模糊测试仍面临较大挑战。为应对这些挑战，研究人员提出并实现了一种基于QEMU全系统仿真的模糊测试框架VxFuzzer。该框架在QEMU全系统仿真的基础上，集成了基本块插桩、异常状态监控和快照恢复功能，能够全面感知目标程序的运行状态。同时，该框架具备良好的兼容性，能够与AFL、Boofuzz等多种模糊测试工具协同工作，从而在VxWorks系统中实现自动化漏洞挖掘。实验结果表明，即使在目标程序基本块数量超过10

的复杂场景下，VxFuzzer仍能稳定地记录程序覆盖率的变化，并有效地检测运行过程中的异常行为，展现出优异的覆盖率监控与异常检测性能。在实际测试中，VxFuzzer成功发现了4个安全漏洞，其中包括URGENT/11系列中的两个已知漏洞和一个0-Day漏洞，验证了该框架在工业级嵌入式系统安全检测中的可行性与有效性。

Abstract

VxWorks

a real-time operating system widely deployed in critical infrastructure sectors such as industrial control and aerospace

was studied in terms of its security due to its direct impact on the stable operation of entire industrial systems. However

fuzz testing of VxWorks remained highly challenging owing to constraints in its execution environment

the complexity of system implementation

and poor compatibility with existing tools. To address these challenges

a fuzz testing framework named VxFuzzer was proposed and implemented based on full-system simulation using QEMU. Built upon QEMU’s full-system simulation capability

this framework integrated basic block instrumentation

exception status monitoring

and snapshot recovery functions

enabling comprehensive perception of the target program’s execution status. Moreover

VxFuzzer was designed with high compatibility

allowing it to collaborate with multiple fuzzing tools such as AFL and Boofuzz

thereby facilitating automated vulnerability discovery in VxWorks systems. Experimental results show that even in complex scenarios where the number of basic blocks in the target program exceed one million

VxFuzzer could stably track changes in program coverage and effectively detect abnormal behaviors during execution

demonstrating excellent performance in both coverage monitoring and anomaly detection. In practical testing

VxFuzzer successfully identifies four security vulnerabilities

including two known vulnerabilities from the URGENT/11 series and one 0-day vulnerability

confirming the feasibility and effectiveness of the framework in security testing for industrial-grade embedded systems.

关键词

Keywords

references

张朝 . 多核嵌入式实时操作系统(RTOS)综述 [J ] . 电脑知识与技术：学术版 , 2015 ( 4 X):3.

ZHANG Z . A survey on multi-core embedded real-time operating systems (RTOS) [J ] . Computer Knowledge and Technology: Academic Edition , 2015 ( 4 X):3.

GODEFROID P . From blackbox fuzzing to whitebox fuzzing towards verification [C ] // The 2010 International Symposium on Software Testing and Analysis . 2010 .

MCNALLY R , YIU K , GROVE D , et al . Fuzzing: the state of the art [R ] . Edinburgh : Defence Science and Technology Organisation , 2012 .

刘航天 , 甘水滔 , 张超 , 等 . 物联网设备固件自动化漏洞挖掘技术研究综述 [J ] . 网络与信息安全学报 , 2025 , 11 ( 2 ): 26 - 49 .

LIU H T , GAN S T , ZHANG C , et al . Survey on automated vulnerability mining techniques for IoT device firmware [J ] . Chinese Journal of Network and Information Security , 2025 , 11 ( 2 ): 26 - 49 .

PAYER M . The fuzzing hype-train: how random testing triggers thousands of crashes [J ] . IEEE Security & Privacy , 2019 , 17 ( 1 ): 78 - 82 .

LIANG H , PEI X , JIA X , et al . Fuzzing: state of the art [J ] . IEEE Transactions on Reliability , 2018 , 67 ( 3 ): 1199 - 1218 .

JOHANSSON W , SVENSSON M , LARSON U E , et al . T-Fuzz: model-based fuzzing for robustness testing of telecommunication protocols [C ] // Proceedings of 2014 IEEE Seventh International Conference on Software Testing, Verification and Validation (ICST) . Virginia : the Internet Society , 2014 : 323 - 332 .

ZHANG H , ZHANG Z , TANG W . Improve peach: making network protocol fuzz testing more precisely [J ] . Applied Mechanics & Materials , 2014 , 551 : 642 - 647 .

JUN L , ZHAO B D , ZHANG C . Fuzzing: a survey [J ] . Cybersecurity , 2018 , 1 ( 1 ): 1 - 13 .

MANES V J M , HAN H , HAN C , et al . The Art, science, and engineering of fuzzing: a survey [J ] . IEEE Transactions on Software Engineering , 2019 , 47 ( 11 ): 2312 - 2331 .

BELLARD F . QEMU: a fast and portable dynamic translator [C ] // Proceedings of the USENIX Annual Technical Conference . Vancouver : USENIX Association , 2005 : 41 - 46 .

YUN J , RUSTAMOV F , KIM J , et al . Fuzzing of embedded systems: a survey [J ] . ACM Computing Surveys , 2023 , 55 ( 7 ): 1 - 33 .

ZHENG W , ZHOU Y , WANG B . Design and implementation of VxWorks system vulnerability mining framework based on dynamic symbol execution [C ] // Proceedings of the 9th International Conference on Computer Engineering and Networks . Singapore : Springer , 2021 : 801 - 811 .

CHEN L B , CAI Q P , MA Z B , et al . SFuzz: slice-based fuzzing for real-time operating systems [C ] // Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2022 : 485 - 498 .

DANG H V , NGUYEN A Q . Unicorn: next generation CPU emulator framework [R ] . BlackHat . 2015 .

邵帅 . 基于模糊测试的工控PLC系统漏洞挖掘技术研究 [D ] . 杭州 : 杭州电子科技大学 , 2020 .

SHAO S . Research on vulnerability mining technology of industrial control PLC system based on fuzzing [D ] . Hangzhou : Hangzhou Dianzi University , 2020 .

SZEKERES L , PAYER M , WEI T , et al . SoK: eternal war in memory [C ] // Proceedings of the 2013 IEEE Symposium on Security and Privacy . Piscataway : IEEE Press , 2013 : 48 - 62 .

PROBST M . Dynamic binary translation [C ] // The UKUUG Linux Developers' Conference . Bristol, United Kingdom , 2002 .

张锦 , 单泽虎 , 刘晓东 , 等 . 动态二进制翻译技术综述 [J ] . 计算机科学与探索 , 2024 , 18 ( 10 ): 2521 - 2550 .

ZHANG J , SHANE Z H , LIU X D , et al . Comprehensive review of research on dynamic binary translation techniques [J ] . Journal of Frontiers of Computer Science and Technology , 2024 , 18 ( 10 ): 2521 - 2550 .

ZHENG Y W , DAVANIAN A , YIN H , et al . FIRM-AFL: high-throughput greybox fuzzing of IoT firmware via augmented process emulation [C ] // Proceedings of the 28th USENIX Security Symposium (USENIX Security 19) . Berkeley : USENIX Association , 2019 : 1099 - 1114 .

HENDERSON A , YAN L K , HU X C , et al . DECAF: a platform-neutral whole-system dynamic binary analysis platform [J ] . IEEE Transactions on Software Engineering , 2017 , 43 ( 2 ): 164 - 184 .

FIORALDI A , MAIER D , EIBFELDT H , et al . AFL++: combining incremental steps of fuzzing research [C ] // Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT’20) . Berkeley : USENIX Association , 2020 .

FIORALDI A , D’ELIA D C , QUERZONI L . Fuzzing binaries for memory safety errors with QASan [C ] // Proceedings of the 2020 IEEE Secure Development (SecDev) . Piscataway : IEEE Press , 2020 : 23 - 30 .

MARINI M , D’ELIA D C , PAYER M , et al . QMSan: efficiently detecting uninitialized memory errors during fuzzing [C ] // Proceedings 2025 Network and Distributed System Security Symposium . Virginia : Internet Society , 2025 .

ZADDACH J , BRUNO L , FRANCILLON A , et al . Avatar: a framework to support dynamic security analysis of embedded systems’ firmwares [C ] // Proceedings 2014 Network and Distributed System Security Symposium . Internet Society , 2014 .

MUENCH M , NISI D , FRANCILLON A , et al . Avatar 2 : a multi-target orchestration platform [C ] // Proceedings 2018 Workshop on Binary Analysis Research . Virginia : the Internet Society , 2018 .

CLEMENTS A A , GUSTAFSON E , SCHARNOWSKI T , et al . HALucinator: firmware re-hosting through abstraction layer emulation [J ] . 2020 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

High-performance directional fuzzing scheme based on deep reinforcement learning

Related Author

Tian XIAO

Zhihao JIANG

Peng TANG

Zheng HUANG

Jie GUO

Weidong QIU

Related Institution

School of Cyber Science and Engineering, Shanghai Jiao Tong University

Columbia University, New York 10027, America

⁰