【摘要】 在云边协同场景中，保障海量边缘设备固件安全面临状态感知困难和执行效率低下的双重挑战。由于固件通常以二进制形式发布，依赖源码插桩的状态感知方法不再适用。同时，在x86平台上对ARM等异构架构固件进行高效全系统仿真成为现有技术的瓶颈，严重限制了模糊测试的吞吐量。针对这些问题，文章提出一种面向ARM架构固件的高效模糊测试框架。为突破跨架构仿真的性能瓶颈，文章将fork机制应用于QEMU内部，设计并实现了一种不依赖特定硬件(如Intel VT-x)的轻量级、跨架构全系统虚拟机快照技术。为实现无源码下的状态感知，文章实现了基于网络数据包、内存数据聚类和调用堆栈分析的多种状态识别方法。此外，统一的代理模块还支持对网络服务等复杂目标的透明测试。实验结果表明，该框架在测试效率上取得近19%的提升，成功复现了CVE-2019-15232等已知漏洞，并验证了其在无源码条件下对程序进行状态建模的能力，为云边协同安全测试提供了有效的解决方案。更多还原

【Abstract】 In the context of cloud-edge collaboration,ensuring the security of firmware for massive edge devices faces dual challenges:difficulties in state perception and low execution efficiency.As firmware is typically released in binary form,state perception methods relying on source code instrumentation are no longer applicable.Meanwhile,efficient full-system emulation of heterogeneous architectures such as ARM on x86 platforms represents a bottleneck in existing technologies,significantly limiting the throughput of fuzz testing.To address these issues,this paper proposed an efficient fuzz testing framework tailored for ARM architecture firmware.To overcome the performance bottleneck of cross-architecture emulation,this work the fork mechanism internally within QEMU,designing and implementing a lightweight,cross-architecture full-system virtual machine snapshot technology that did not rely on specific hardware (e.g.,Intel VT-x),significantly enhancing testing efficiency.To achieve state perception without source code,this paper implemented multiple state identification methods based on network packet analysis,memory data clustering,and call stack analysis.Additionally,a unified proxy module supported transparent testing of complex targets such as network services.Experimental results demonstrate that the proposed framework achieves approximately a 19% improvement in testing efficiency,successfully reproduces known vulnerabilities such as CVE-2019-15232,and validates its capability to model program states under source-code-absent conditions,providing an effective solution for security testing in cloud-edge collaborative scenarios.更多还原