Dynamic analysis security testing techniques on RISC-V bootloaders
Τεχνικές δυναμικής ανάλυσης για τον έλεγχο ασφαλείας σε RISC-V bootloaders
View/
Keywords
RISC-V ; U-Boot ; Fuzzing ; Bootloader ; Security ; LibAFL ; Rust ; Python ; Dynamic analysis ; Security testingAbstract
Bootloaders are critical components of embedded systems, responsible for early
hardware initialization, memory setup, and the secure loading of firmware and operating
system images. Due to their privileged execution context, limited runtime support, and
extensive parsing logic, bootloaders constitute a high-impact attack surface. Memory
safety vulnerabilities at this stage can undermine the entire chain of trust and enable
persistent system compromise. These risks are amplified in modern open instruction
set architectures such as RISC-V, where increasing adoption across various platforms
introduces diverse security implementations.
This thesis investigates dynamic analysis–based security testing techniques for RISC-
V bootloaders, with U-Boot serving as the primary case study. We focus on coverage-
guided fuzzing as a practical method with edge coverage as the primary feedback
mechanism. To overcome the challenges of testing bootloaders on real hardware, we
adopt a re-hosting approach, executing RISC-V cross-compiled U-Boot binaries inside a
modified QEMU emulator. This environment enables deterministic execution, fine-grained
instrumentation, and rapid testing cycles while preserving architectural fidelity.
To improve vulnerability detection, we design and integrate a minimal Kernel
Address Sanitizer (KASan) runtime tailored to the constraints of bare-metal RISC-V
environments. The sanitizer leverages shadow memory to detect invalid memory accesses
during execution and converts otherwise silent corruptions into observable failures.
Fuzzing orchestration, feedback collection, and mutation strategies are implemented using
LibAFL, a modern fuzzing framework developed in Rust, that provides fuzzing tools in
a modular API. Popular techniques like edge-coverage, cmp instruction logging, input-2-
state mutation and the re-hosting backend are provided by the API.
Our evaluation targets security-critical U-Boot interfaces, including the UART console
and the FIT image parser, both of which involve complex structured input processing
and validation logic. The evaluation stage, demonstrates how the framework’s granular
approach with the custom KASan instrumentation are a significant foundation to
focus on techniques that are more specific to RISC-V bootloaders. This work exhibits
the feasibility and effectiveness of systematic dynamic analysis for security testing in
RISC-V firmware and provides a foundation for extending these techniques to additional
architectures, boot stages, and embedded systems.
Postgraduate Studies Programme
Κυβερνοασφάλεια και Τεχνολογίες Τεχνητής Νοημοσύνης / MSc Cybersecurity & AI TechnologiesDepartment
Σχολή Τεχνολογιών Πληροφορικής και Επικοινωνιών. Τμήμα ΠληροφορικήςNumber of pages
83Language
EnglishCollections
Except where otherwise noted, this item's license is described as
Αναφορά Δημιουργού - Παρόμοια Διανομή 3.0 Ελλάδα
Αναφορά Δημιουργού - Παρόμοια Διανομή 3.0 Ελλάδα