QEMU Internals, Instrumentation and Fuzzing is a 4 day hands-on course where participants will learn about the fundamentals of emulation and fuzzing, how to emulate a custom device in QEMU from the ground up, and how to instrument it for fuzzing and vulnerability research.

We will dive into QEMU, one of the most powerful software tools designed for emulation and fuzzing, to gain a deep understanding of its architecture and design principles. We’ll cover machine types, hardware emulation, and how to write your own platform to emulate and fuzz.

Students will use AFL++, Hongfuzz and some handcrafted examples for testing large software systems for vulnerabilities. We will apply persistent fuzzing, mutational fuzzing and evolutionary fuzzing on real world firmware examples including CANBUS, Fitness devices, Media Players, Networked RTOS based systems, peripheral and bus fuzzing techniques such as USART, UART, baseband, routers, and device sensors.

The class features several hands on exercises where participants will gain an understanding of memory vulnerabilities in IoT devices and how to write exploits, as well as managing responsible disclosure and vulnerability mitigation.

By the end of the course, participants will have a unique set of skills and knowledge from different fields such as emulation of custom embedded systems, instrumented fuzzing, and dynamic analysis, all with a single goal: to find security vulnerabilities.

– Researchers and developers working with low level embedded systems
– Members of internal penetration testing teams to find and exploit vulnerabilities in bare metal embedded IoT devices
– Vulnerability researchers interested in implementing custom emulation and fuzzing harnesses for proprietary IoT devices

• Fundamental concepts of emulation and fuzzing as useful tools in vulnerability research
  • QEMU, Panda, AFL++, Hongfuzz, Avatar2
• Set up an emulation and fuzzing environment for the course using QEMU and AFL/AFL++
• QEMU architecture and design principles, including machine types and hardware emulation
• QEMU execution modes and performance optimization using Panda or Avatar2
• Static and dynamic fuzzing techniques, and fuzzer injection into proprietary firmware
• Apply emulation and fuzzing techniques to real-world targets:
  • IoT devices, CANBUS fuzzing, Media Players, Network Services, Fitness devices, Real-Time Tasks
• Knowledge of peripheral and bus fuzzing such as USART, UART, baseband, routers, device sensors
• Identify memory vulnerabilities and write exploits, and understand responsible disclosure and vulnerability mitigation
• Understand how fuzzing+emulation are the game changer for vulnerability research