Enhancing IoT Security: A Full-System Simulation Dynamic Taint Analysis Framework for Firmware

Dynamic taint analysis is a common and efficient technique in program analysis. IoT devices are widespread and generally have weak protection, making them a hotspot for vulnerabilities. Although some dynamic taint analysis tools and frameworks have been proposed for IoT firmware, they all suffer from one or more issues: performance degradation, lack of generality, or being limited to user mode only. We propose a cross-platform, full-system simulation dynamic taint analysis framework for IoT firmware, Firmware Dynamic Taint Analysis Framework (FDTAF). FDTAF provides a novel Virtual Machine Introspection (VMI) combined with bit-level taint propagation at TCG layer of QEMU. Additionally, we provide analysis tools for the generated taint data flow to improve the usability of dynamic taint analysis when analyzing IoT devices. The implementation of FDTAF includes 1680 lines of C++ code, 9490 lines of C code, and 320 lines of Python code. We present a comparison of the applicability of FDTAF and DECAF in firmware analysis and validate the practicality of the analysis framework using real-world vulnerabilities.