Figure 1 - uploaded by Dominik Maier
Content may be subject to copyright.
Download
View publication
BaseSAFE

BaseSAFE

Source publication
Figure 1: BaseSAFE
Figure 3: Reported edge coverage of packages for each parser. The...
Figure 4: Structure of MTK ILM, encapsulating a PCCH Message including...
Figure 5: Wireshark trace of one of the fuzzer-generated signaling...
Figure 6: Base station setup with our test phone HTC One E9.
BaseSAFE: Baseband SAnitized Fuzzing through Emulation
Preprint
Full-text available
  • May 2020
Rogue base stations are an effective attack vector. Cellular basebands represent a critical part of the smartphone's security: they parse large amounts of data even before authentication. They can, therefore, grant an attacker a very stealthy way to gather information about calls placed and even to escalate to the main operating system, over-the-ai...
Cite
Download full-text

Contexts in source publication

Context 1
... this section, we discuss the BaseSAFE API. Unicorn is extended with an AFL-specific API to enable easy fuzzing, and an extra API to hook the operating system's heap sanitizer. A high-level overview of the BaseSAFE procedure is depicted in Fig. 1. The API of BaseSAFE goes beyond previous emulators, such as AFL Unicorn by Voss [56] which did not offer interactions with AFL. Interactions with AFL are required to kick off the fast persistent mode, but simply always started fuzzing after the first instruction. As execution left the emulator after the first instruction to read AFL ...
Context 2
... this section, we discuss the BaseSAFE API. Unicorn is extended with an AFL-specific API to enable easy fuzzing, and an extra API to hook the operating system's heap sanitizer. A high-level overview of the BaseSAFE procedure is depicted in Fig. 1. The API of BaseSAFE goes beyond previous emulators, such as AFL Unicorn by Voss [56] which did not offer interactions with AFL. Interactions with AFL are required to kick off the fast persistent mode, but simply always started fuzzing after the first instruction. As execution left the emulator after the first instruction to read AFL ...