VxFuzzer：基于全系统模拟的VxWorks灰盒模糊测试器

李松涛; 耿洋洋; 麻荣宽; 贾岩; 彭建山; 曹琰

doi:10.11959/j.issn.2096-109x.2025046

您当前的位置：

首页 >

文章列表页 >

VxFuzzer：基于全系统模拟的VxWorks灰盒模糊测试器

专题：新型工业化网络安全 | 更新时间：2025-09-12

- VxFuzzer：基于全系统模拟的VxWorks灰盒模糊测试器
- VxFuzzer: Grey-Box fuzzing for VxWorks based on whole system simulation
- 网络与信息安全学报 2025年11卷第4期页码：117-126
- 作者机构：
  
  1.郑州大学网络空间安全学院，河南郑州 450001
  2.信息工程大学，河南郑州 450001
  3.南开大学密码与网络空间安全学院，天津 300350
  4.网络空间安全教育部重点实验室，河南郑州 450001
- 作者简介：
  
  [ "李松涛（2001-），男，河南南阳人，郑州大学硕士生，主要研究方向为物联网安全。" ]
  [ "耿洋洋（1993- ），男，河南太康人，信息工程大学讲师，主要研究方向为工业控制系统安全、信息物理系统安全、漏洞挖掘。" ]
  [ "麻荣宽（1992- ），男，山东菏泽人，信息工程大学讲师，主要研究方向为漏洞挖掘、网络攻防与系统安全。" ]
  [ "贾岩（1992- ），男，河北保定人，南开大学副教授，主要研究方向为漏洞挖掘、物联网安全、网络攻防与系统安全。" ]
  [ "彭建山（1979- ），男，江西吉安人，信息工程大学副教授，主要研究方向为网络空间安全。" ]
  [ "曹琰（1983- ），男，河南郑州人，郑州大学副教授，主要研究方向为网络安全。" ]
- 基金信息：
  
  网络空间安全教育部重点实验室开放基金(KLCS20240211);中央高校基本科研业务费专项资金(079-63253221)
- DOI：10.11959/j.issn.2096-109x.2025046
  中图分类号： TP393
- 收稿：2025-05-09，
  
  修回：2025-07-15，
  
  纸质出版：2025-08-25
- 稿件说明：
移动端阅览
李松涛, 耿洋洋, 麻荣宽, 等. VxFuzzer:基于全系统模拟的VxWorks灰盒模糊测试器[J]. 网络与信息安全学报, 2025, 11(4): 117-126.

Format: LI S T, GENG Y Y, MA R K, et al. VxFuzzer: Grey-Box fuzzing for VxWorks based on whole system simulation[J]. Chinese Journal of Network and Information Security, 2025, 11(4): 117-126.
李松涛, 耿洋洋, 麻荣宽, 等. VxFuzzer:基于全系统模拟的VxWorks灰盒模糊测试器[J]. 网络与信息安全学报, 2025, 11(4): 117-126. DOI： 10.11959/j.issn.2096-109x.2025046.

Format: LI S T, GENG Y Y, MA R K, et al. VxFuzzer: Grey-Box fuzzing for VxWorks based on whole system simulation[J]. Chinese Journal of Network and Information Security, 2025, 11(4): 117-126. DOI： 10.11959/j.issn.2096-109x.2025046.

摘要

VxWorks 作为一款被广泛应用于工业控制、航空航天等关键基础设施领域的实时操作系统，其安全性直接关系到整个工业系统的稳定运行。然而，由于执行环境受限、系统实现复杂及与现有工具兼容性差等问题，对VxWorks系统进行模糊测试仍面临较大挑战。为应对这些挑战，研究人员提出并实现了一种基于QEMU全系统仿真的模糊测试框架VxFuzzer。该框架在QEMU全系统仿真的基础上，集成了基本块插桩、异常状态监控和快照恢复功能，能够全面感知目标程序的运行状态。同时，该框架具备良好的兼容性，能够与AFL、Boofuzz等多种模糊测试工具协同工作，从而在VxWorks系统中实现自动化漏洞挖掘。实验结果表明，即使在目标程序基本块数量超过10

的复杂场景下，VxFuzzer仍能稳定地记录程序覆盖率的变化，并有效地检测运行过程中的异常行为，展现出优异的覆盖率监控与异常检测性能。在实际测试中，VxFuzzer成功发现了4个安全漏洞，其中包括URGENT/11系列中的两个已知漏洞和一个0-Day漏洞，验证了该框架在工业级嵌入式系统安全检测中的可行性与有效性。

Abstract

VxWorks

a real-time operating system widely deployed in critical infrastructure sectors such as industrial control and aerospace

was studied in terms of its security due to its direct impact on the stable operation of entire industrial systems. However

fuzz testing of VxWorks remained highly challenging owing to constraints in its execution environment

the complexity of system implementation

and poor compatibility with existing tools. To address these challenges

a fuzz testing framework named VxFuzzer was proposed and implemented based on full-system simulation using QEMU. Built upon QEMU’s full-system simulation capability

this framework integrated basic block instrumentation

exception status monitoring

and snapshot recovery functions

enabling comprehensive perception of the target program’s execution status. Moreover

VxFuzzer was designed with high compatibility

allowing it to collaborate with multiple fuzzing tools such as AFL and Boofuzz

thereby facilitating automated vulnerability discovery in VxWorks systems. Experimental results show that even in complex scenarios where the number of basic blocks in the target program exceed one million

VxFuzzer could stably track changes in program coverage and effectively detect abnormal behaviors during execution

demonstrating excellent performance in both coverage monitoring and anomaly detection. In practical testing

VxFuzzer successfully identifies four security vulnerabilities

including two known vulnerabilities from the URGENT/11 series and one 0-day vulnerability

confirming the feasibility and effectiveness of the framework in security testing for industrial-grade embedded systems.

关键词

Keywords

references

张朝 . 多核嵌入式实时操作系统(RTOS)综述 [J ] . 电脑知识与技术：学术版 , 2015 ( 4 X):3.

ZHANG Z . A survey on multi-core embedded real-time operating systems (RTOS) [J ] . Computer Knowledge and Technology: Academic Edition , 2015 ( 4 X):3.

GODEFROID P . From blackbox fuzzing to whitebox fuzzing towards verification [C ] // The 2010 International Symposium on Software Testing and Analysis . 2010 .

MCNALLY R , YIU K , GROVE D , et al . Fuzzing: the state of the art [R ] . Edinburgh : Defence Science and Technology Organisation , 2012 .

刘航天 , 甘水滔 , 张超 , 等 . 物联网设备固件自动化漏洞挖掘技术研究综述 [J ] . 网络与信息安全学报 , 2025 , 11 ( 2 ): 26 - 49 .

LIU H T , GAN S T , ZHANG C , et al . Survey on automated vulnerability mining techniques for IoT device firmware [J ] . Chinese Journal of Network and Information Security , 2025 , 11 ( 2 ): 26 - 49 .

PAYER M . The fuzzing hype-train: how random testing triggers thousands of crashes [J ] . IEEE Security & Privacy , 2019 , 17 ( 1 ): 78 - 82 .

LIANG H , PEI X , JIA X , et al . Fuzzing: state of the art [J ] . IEEE Transactions on Reliability , 2018 , 67 ( 3 ): 1199 - 1218 .

JOHANSSON W , SVENSSON M , LARSON U E , et al . T-Fuzz: model-based fuzzing for robustness testing of telecommunication protocols [C ] // Proceedings of 2014 IEEE Seventh International Conference on Software Testing, Verification and Validation (ICST) . Virginia : the Internet Society , 2014 : 323 - 332 .

ZHANG H , ZHANG Z , TANG W . Improve peach: making network protocol fuzz testing more precisely [J ] . Applied Mechanics & Materials , 2014 , 551 : 642 - 647 .

JUN L , ZHAO B D , ZHANG C . Fuzzing: a survey [J ] . Cybersecurity , 2018 , 1 ( 1 ): 1 - 13 .

MANES V J M , HAN H , HAN C , et al . The Art, science, and engineering of fuzzing: a survey [J ] . IEEE Transactions on Software Engineering , 2019 , 47 ( 11 ): 2312 - 2331 .

BELLARD F . QEMU: a fast and portable dynamic translator [C ] // Proceedings of the USENIX Annual Technical Conference . Vancouver : USENIX Association , 2005 : 41 - 46 .

YUN J , RUSTAMOV F , KIM J , et al . Fuzzing of embedded systems: a survey [J ] . ACM Computing Surveys , 2023 , 55 ( 7 ): 1 - 33 .

ZHENG W , ZHOU Y , WANG B . Design and implementation of VxWorks system vulnerability mining framework based on dynamic symbol execution [C ] // Proceedings of the 9th International Conference on Computer Engineering and Networks . Singapore : Springer , 2021 : 801 - 811 .

CHEN L B , CAI Q P , MA Z B , et al . SFuzz: slice-based fuzzing for real-time operating systems [C ] // Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2022 : 485 - 498 .

DANG H V , NGUYEN A Q . Unicorn: next generation CPU emulator framework [R ] . BlackHat . 2015 .

邵帅 . 基于模糊测试的工控PLC系统漏洞挖掘技术研究 [D ] . 杭州 : 杭州电子科技大学 , 2020 .

SHAO S . Research on vulnerability mining technology of industrial control PLC system based on fuzzing [D ] . Hangzhou : Hangzhou Dianzi University , 2020 .

SZEKERES L , PAYER M , WEI T , et al . SoK: eternal war in memory [C ] // Proceedings of the 2013 IEEE Symposium on Security and Privacy . Piscataway : IEEE Press , 2013 : 48 - 62 .

PROBST M . Dynamic binary translation [C ] // The UKUUG Linux Developers' Conference . Bristol, United Kingdom , 2002 .

张锦 , 单泽虎 , 刘晓东 , 等 . 动态二进制翻译技术综述 [J ] . 计算机科学与探索 , 2024 , 18 ( 10 ): 2521 - 2550 .

ZHANG J , SHANE Z H , LIU X D , et al . Comprehensive review of research on dynamic binary translation techniques [J ] . Journal of Frontiers of Computer Science and Technology , 2024 , 18 ( 10 ): 2521 - 2550 .

ZHENG Y W , DAVANIAN A , YIN H , et al . FIRM-AFL: high-throughput greybox fuzzing of IoT firmware via augmented process emulation [C ] // Proceedings of the 28th USENIX Security Symposium (USENIX Security 19) . Berkeley : USENIX Association , 2019 : 1099 - 1114 .

HENDERSON A , YAN L K , HU X C , et al . DECAF: a platform-neutral whole-system dynamic binary analysis platform [J ] . IEEE Transactions on Software Engineering , 2017 , 43 ( 2 ): 164 - 184 .

FIORALDI A , MAIER D , EIBFELDT H , et al . AFL++: combining incremental steps of fuzzing research [C ] // Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT’20) . Berkeley : USENIX Association , 2020 .

FIORALDI A , D’ELIA D C , QUERZONI L . Fuzzing binaries for memory safety errors with QASan [C ] // Proceedings of the 2020 IEEE Secure Development (SecDev) . Piscataway : IEEE Press , 2020 : 23 - 30 .

MARINI M , D’ELIA D C , PAYER M , et al . QMSan: efficiently detecting uninitialized memory errors during fuzzing [C ] // Proceedings 2025 Network and Distributed System Security Symposium . Virginia : Internet Society , 2025 .

ZADDACH J , BRUNO L , FRANCILLON A , et al . Avatar: a framework to support dynamic security analysis of embedded systems’ firmwares [C ] // Proceedings 2014 Network and Distributed System Security Symposium . Internet Society , 2014 .

MUENCH M , NISI D , FRANCILLON A , et al . Avatar 2 : a multi-target orchestration platform [C ] // Proceedings 2018 Workshop on Binary Analysis Research . Virginia : the Internet Society , 2018 .

CLEMENTS A A , GUSTAFSON E , SCHARNOWSKI T , et al . HALucinator: firmware re-hosting through abstraction layer emulation [J ] . 2020 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于深度强化学习的高性能导向性模糊测试方案