Firmware testing method, device, equipment and storage medium

Abstract

The present invention provides a firmware testing method, device, equipment and storable medium, and the testing method and device thereof include: setting a simulator component that can simulate the target firmware operating environment, reading in a random seed during testing as the input of the target firmware, and configuring a peripheral model file of the simulator component; using a fuzzy test component to perform a fuzzy test according to the random value generated by the target firmware input; setting a peripheral model instantiation component of an abstract model defined by the MCU architecture of the target firmware; if the simulator component runs the target firmware normally, starting the fuzzy test component to test the firmware; if the simulator component fails to run the target firmware, starting the peripheral model instantiation component, updating the peripheral model file, until the target firmware runs normally, and outputting the peripheral model file, and executing the previous step again. The present invention can realize the operation and testing of MCU firmware without relying on any hardware running the firmware.

Description

Technical Field

[0001] The present invention relates to the technical field of firmware testing, and in particular to an MCU firmware testing method, device, equipment and storage medium. Background Art

[0002] MCU firmware contains vulnerabilities just like computer software. Therefore, the techniques used to detect vulnerabilities on computers (such as fuzz testing) can also be applied to MCU firmware. However, in actual applications, existing fuzz testing programs cannot directly test firmware, resulting in insufficient or even impossible security testing of many firmware security vulnerabilities.

[0003] At present, there are several commonly used firmware testing methods: First, physically connect the test machine to the firmware to be tested, and test by sending data to the firmware to be tested. This method relies on hardware devices, and needs to be connected to the physical device every time it is tested, which has a high testing cost. Second, use a simulation platform to simulate the device for testing. This method requires the simulation platform to simulate a specific firmware physical device, and the simulated physical device model needs to completely match the firmware. If there is no simulation device of the corresponding model, the simulation cannot be executed.

[0004] The existing firmware testing methods have the following problems: First, firmware testing requires the support of certain hardware (such as peripherals), but there is no simulation of these hardware. Moreover, independent hardware testing is much slower than running the emulator directly on the computer. Second, the high heterogeneity of MCU hardware. Each firmware can interact with a different set of peripherals, which can be customized by the MCU vendor. Peripherals of the same type but different models / brands usually have different specifications and interfaces. Therefore, fuzz testing of new firmware usually requires a specially customized emulator. Third, many MCU devices do not even have a complete operating system, but a system for managing hardware and task scheduling. The different operating systems or scheduling systems used by MCUs make fuzz testing programs not universal and not suitable for firmware.

[0005] Therefore, it is necessary to solve the above problems. Summary of the invention

[0006] The embodiments of the present invention provide a firmware testing method, apparatus, device and storage medium, which can realize running and testing MCU firmware without relying on any hardware for running the firmware.

[0007] In a first aspect, an embodiment of the present invention provides a firmware testing method, including:

[0008] Setting a simulator component capable of simulating the target firmware running environment, reading a random seed during testing as an input of the target firmware, and configuring a peripheral model file for the simulator component;

[0009] Setting a fuzzy test component, and using the fuzzy test component to perform fuzzy testing according to the random value generated by the target firmware input;

[0010] Setting a peripheral model instantiation component, the peripheral model instantiation component having an abstract model defined by the MCU architecture of the target firmware;

[0011] If the simulator component runs the target firmware normally, start the fuzz test component to test the firmware;

[0012] If the simulator component fails to run the target firmware, start the peripheral model instantiation component, update the peripheral model file, until the target firmware runs normally, output the peripheral model file, and execute the previous step again.

[0013] In a second aspect, an embodiment of the present invention provides a firmware testing device, including:

[0014] A fuzz testing component, used to generate random values ​​as inputs of the target firmware, perform fuzz testing, and output inputs that cause crashes;

[0015] A simulator component, used to simulate the environment in which the target firmware is running;

[0016] Peripheral Model Instantiation Component, used to instantiate the abstract model defined for the MCU architecture of the target firmware.

[0017] In a third aspect, an embodiment of the present invention further provides a terminal device, comprising a processor and a memory communicatively connected to the processor, the memory storing instructions executable by the processor, the instructions being executed by the processor so that the processor can perform the above-mentioned firmware testing method.

[0018] In a third aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the above-mentioned firmware testing method.

[0019] The present invention has the following technical effects:

[0020] (1) The present invention uses a simulator component to simulate the target firmware operating environment, and can run and test the MCU firmware without relying on any firmware running hardware.

[0021] (2) The present invention can use a fuzzy test component to perform fuzzy testing based on the random value generated by the target firmware input, does not require a special simulator, and can be suitable for different specifications and interfaces.

[0022] (3) The present invention is provided with an abstract model defined by the MCU architecture of the target firmware, which can continuously update the peripheral model, can adapt to different operating systems, and has good test versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of a firmware testing method flow chart provided by an embodiment of the present invention;

[0024] Figure 2 A schematic diagram of a firmware testing device provided by an embodiment of the present invention;

[0025] Figure 3 A schematic diagram of the functional modules of the simulator components provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0027] The embodiment of the present invention first provides a firmware testing method, see Figure 1 , the firmware testing method comprises:

[0028] S10 sets a simulator component, uses the simulator component to simulate the operating environment of the target firmware to be tested, and when the simulator component runs the target firmware to be tested, reads in a random seed as an input of the target firmware; the simulator component configures a peripheral model file.

[0029] Specifically, the simulator component is configured with a simulation processor module, a memory management module, an interrupt controller module, a peripheral interrupt module and a peripheral module. The peripheral module is configured with a peripheral model file, starts running with the simulation processor, and generates corresponding peripherals according to the configured model file.

[0030] The simulator component is used to simulate the operating environment required by the firmware, avoiding the direct use of physical devices to run the firmware, and effectively solving the defects of using peripheral devices that need to be customized and need to adapt to different specifications and interfaces of peripherals of different models / brands.

[0031] The input data is a random value, which can be generated by various random algorithms. The model file is configured according to the control register, status register, and data register of different configurations.

[0032] Specifically, the method for the simulator component to simulate the operating environment of the target firmware to be tested includes:

[0033] S101 The interrupt controller module determines the timing state of the target firmware system when it is running, and enables and disables the corresponding peripheral timing interrupt according to the system timing sequence. If the system timing is in the enabled state, the peripheral timing interrupt is enabled; if the system timing is in the disabled state, the peripheral timing interrupt is disabled.

[0034] in,

[0035] S1011 peripheral timing start interrupt includes:

[0036] When the processor module executes the interrupt enable instruction, it notifies the interrupt controller module to enable the interrupt;

[0037] The interrupt controller module notifies the peripheral interrupt module to enable interrupt;

[0038] The peripheral interrupt module traverses the interrupt array, finds the corresponding interrupt number, and sets it to enable;

[0039] If the interrupt number is not found in the existing interrupt array and the existing interrupt array exceeds the maximum number of interrupt enablements, exit; if the existing interrupt array does not exceed the maximum number of interrupt enablements, insert the interrupt into the existing interrupt array.

[0040] S1012 peripheral timing disable interrupts include:

[0041] When the processor module executes the instruction to disable interrupts, it notifies the interrupt controller module to disable interrupts;

[0042] The interrupt controller module notifies the peripheral interrupt module to disable interrupts;

[0043] The peripheral interrupt module traverses the interrupt array, finds the corresponding interrupt number, and sets it to disabled.

[0044] After the S102 processor module executes a certain cycle of instructions, it sends an interrupt using the interrupt sending method.

[0045] Among them, interrupt sending includes:

[0046] The peripheral interrupt module traverses the interrupt array, and if an interrupt is enabled, it notifies the interrupt control module to set the interrupt to be processed according to the interrupt number of the interrupt.

[0047] S103: The memory management module performs read and write operations.

[0048] When performing a read operation, the mapping address of the peripheral in the memory is obtained according to the given address, and the value of the corresponding register is read; when performing a write operation, the mapping address of the peripheral in the memory is obtained according to the given address, and the value of the corresponding register is written.

[0049] S20 sets a fuzzy test component, and uses the fuzzy test component to perform fuzzy testing according to the random value generated by the target firmware input.

[0050] Fuzz testing process: Give a random initial value, perform different transformations on the initial value, derive a variety of different values, and use these values ​​as the input value of the firmware to run the firmware. The fuzz testing process can cause the firmware to crash.

[0051] S30 sets a peripheral model instantiation component, where the peripheral model instantiation component has an abstract model defined by the MCU architecture of the target firmware.

[0052] Since the firmware program needs to communicate and interact with peripherals, the model instantiation component is used to generate peripheral models during the firmware execution process. Different firmwares need to interact with different peripheral models and interfaces, and the peripheral model instantiation component is used to generate peripheral models in a targeted manner.

[0053] S40 uses simulator components to test the target firmware.

[0054] S401: If the simulator component runs the target firmware normally and the system does not crash, then start the fuzz test component to test the firmware;

[0055] If the simulator component fails to run the target firmware, resulting in a system crash, in step S402, the peripheral model instantiation component is started to continuously update the peripheral model file configured by the simulator component until the target firmware runs normally and outputs the peripheral model file, and step S401 is executed again.

[0056] When the firmware accesses the peripherals, the peripheral model instantiation component first dynamically generates control registers, status registers, and data registers with different configurations, and then runs the firmware to see if it is running normally under this configuration. If the firmware cannot run normally, then the control registers, status registers, and data registers with different configurations are updated until the firmware can run normally. At this time, it is used as an available peripheral model and the corresponding configuration file is output.

[0057] This approach can be used to test firmware that needs to interact with different peripheral devices, avoiding dependence on the hardware environment.

[0058] See also Figure 2 , an embodiment of the present invention further provides a firmware testing device, comprising:

[0059] The simulator component 1 is used to simulate the environment of running the target firmware.

[0060] The fuzz testing component 2 is used to generate random values ​​as inputs of the target firmware, perform fuzz testing, and output inputs that cause crashes.

[0061] The peripheral model instantiation component 3 is used to instantiate the abstract model defined for the MCU architecture of the target firmware.

[0062] See also Figure 3 In a preferred embodiment of the present invention, the simulator component 10 comprises:

[0063] The processor module 101 is used to simulate a processor and execute instructions of a target firmware program.

[0064] The memory management module 102 is used to manage and create a memory area for peripherals and map the registers of the peripherals to the memory, including read operations and write operations.

[0065] The peripheral interrupt module 103 is used to receive program control instructions and execute the functions of enabling interrupts, disabling interrupts, and issuing interrupts;

[0066] The interrupt control module 104 is used to receive a program control instruction, and notify the peripheral interrupt module to enable an interrupt with a certain interrupt number, or notify the peripheral interrupt module to disable an interrupt with a certain interrupt number.

[0067] The peripheral module 105 is used to simulate peripheral registers, including peripheral control registers, status registers, and data registers.

[0068] In a preferred embodiment, the fuzzy testing component 2 includes:

[0069] Perform fuzz testing and call peripheral model instantiation components.

[0070] Existing fuzz testing methods can be used to perform fuzz testing.

[0071] Call the peripheral model instantiation component, wait for the peripheral model instantiation component to finish executing, and update the peripheral model file.

[0072] The above modules can be provided in the firmware testing device in the form of hardware, or can be stored in the memory in the form of software, so that the computer device can call and execute the corresponding functions of the above modules.

[0073] An embodiment of the present invention also provides a terminal device, which includes: a processor, and a memory communicatively connected to the processor, the memory storing instructions executable by the processor, the instructions being executed by the processor, and the processor implementing the steps in any of the above-mentioned firmware testing method embodiments when executing the computer program.

[0074] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are executed by a processor, the steps in the above-mentioned firmware testing method embodiments can be implemented.

[0075] The above-mentioned embodiments of the present invention are only part of the preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made by those skilled in the art without departing from the essence of the present invention are within the protection scope of the present invention.

Claims

1. A firmware testing method, characterized in that: include: Setting a simulator component capable of simulating the target firmware running environment, reading a random seed during testing as an input of the target firmware, and configuring a peripheral model file for the simulator component; Setting a fuzzy test component, and using the fuzzy test component to perform fuzzy testing according to the random value generated by the target firmware input; Setting a peripheral model instantiation component, the peripheral model instantiation component having an abstract model defined by the MCU architecture of the target firmware; If the simulator component runs the target firmware normally, start the fuzz test component to test the firmware; If the simulator component fails to run the target firmware, start the peripheral model instantiation component, update the peripheral model file, until the target firmware runs normally, output the peripheral model file, and execute the previous step again.

2. The firmware testing method according to claim 1, characterized in that: The method for the simulator component to simulate the operating environment of the target firmware to be tested includes: Enable or disable the corresponding peripheral timing interrupt according to the system timing status; After executing a certain number of instructions, an interrupt is sent using the interrupt sending method.

3. The firmware testing method according to claim 2, characterized in that: Determine the system timing status. If the system timing is in the enabled state, enable the peripheral timing interrupt; if the system timing is in the disabled state, disable the peripheral timing interrupt.

4. The firmware testing method according to claim 2 or 3, characterized in that: The peripheral timing start interrupt includes: Execute the interrupt enable instruction; Notification to enable interruption; Traverse the interrupt array, find the corresponding interrupt number, and set it to enable; If the interrupt number is not found in the existing interrupt array and the existing interrupt array exceeds the maximum number of enabled interrupts, exit; if the existing interrupt array does not exceed the maximum number of enabled interrupts, insert the interrupt into the existing interrupt array.

5. The firmware testing method according to claim 2 or 3, characterized in that: The peripheral timing disabling interrupt comprises: Execute the disable interrupt instruction; Notify disable interrupts; The peripheral interrupt module traverses the interrupt array, finds the corresponding interrupt number, and sets it to disabled.

6. The firmware testing method according to claim 2, characterized in that: The interruption sending comprises: Traverse the interrupt array, if an interrupt is enabled, set it to be processed according to the interrupt number.

7. A firmware testing device, characterized in that include: A fuzz testing component, used to generate random values ​​as inputs of the target firmware, perform fuzz testing, and output inputs that cause crashes; A simulator component, used to simulate the environment in which the target firmware is running; The peripheral model instantiation component is used to instantiate the abstract model defined for the MCU architecture of the target firmware; If the simulator component runs the target firmware normally, start the fuzz test component to test the firmware; If the simulator component fails to run the target firmware, start the peripheral model instantiation component, update the peripheral model file, until the target firmware runs normally, output the peripheral model file, and execute the previous step again.

8. The firmware testing device according to claim 7, characterized in that: The simulator components include: A processor module, used for simulating a processor and executing instructions of a target firmware program; The memory management module is used to manage the memory area of ​​the created peripherals and map the registers of the peripherals to the memory; The interrupt control module is used to notify the peripheral interrupt module to enable or disable the interrupt of a certain interrupt number; The peripheral interrupt module executes the functions of enabling interrupts, disabling interrupts, and issuing interrupts; The peripheral module is used to simulate the registers of the peripherals.

9. A terminal device, characterized in that: The method comprises a processor and a memory in communication with the processor, wherein the memory stores instructions executable by the processor, and the instructions are executed by the processor so that the processor can execute the firmware testing method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the firmware testing method according to any one of claims 1 to 6.

Images