Reproduce “Qualcomm Trusted Application Emulation for Fuzzing Testing” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Chun-I Fan, Li-En Chang, Cheng-Han Shie
Researchers from National Sun Yat-sen University developed a lightweight, open-source emulation and fuzzing framework for Qualcomm Trusted Applications, successfully rediscovering a known N-Day out-of-bounds write vulnerability (CVE-2021-0592) in the Widevine TA.
Key insights
- Qualcomm TAs employ a fragmented file distribution and a specific loading process that can be reverse-engineered to reconstruct executable binaries.
- A lightweight, partial emulation approach using Unicorn with custom loaders and hooks can accurately mimic complex TA execution for targeted security analysis without full-system overhead.
- Effective fuzzing of TAs requires careful identification of user-controllable input parameters and pre-setting non-controllable values through hooks to reach vulnerable code paths.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.