关键词: QEMU仿真；固件安全；模糊测试；系统安全；基板管理控制器

Abstract: As a type of embedded firmware pre-installed in server hardware, the Baseboard Management Controller (BMC) is responsible for managing and monitoring the full operational lifecycle of servers, and its security posture directly determines the overall security and stability of the entire server system. With the rising trend of cyberattacks targeting low-level system components, BMC firmware has gradually become a key attack surface that cannot be ignored.As a mainstream vulnerability detection technology, fuzzing has been widely recognized and applied in both academic research and industrial practice. However, fuzzing testing for BMC firmware still faces multiple non-trivial challenges: on the one hand, the diversity of BMC instruction set architectures and the closed proprietary attribute of firmware increase the difficulty of testing; on the other hand, the large number of complex binary programs contained in BMC firmware also brings great obstacles to the positioning of fuzzing target functions.This paper proposes a target function-guided fuzzing method oriented to closed-source BMC firmware. First, we design a target function discovery algorithm that integrates static analysis and pre-defined dangerous function call relationship rules, which can automatically identify high-value fuzzing targets from BMC firmware. Second, based on the proposed target discovery algorithm, we implement a QEMU-based BMC firmware fuzzer with the support of LibAFL. This fuzzer integrates modern fuzzing technologies including dynamic binary instrumentation and coverage-guided fuzzing to effectively improve fuzzing efficiency.Experimental results show that the proposed target function discovery algorithm significantly reduces the manual workload required for target function selection. Compared with AFL++ running in QEMU mode, the fuzzer proposed in this paper achieves better code coverage and higher testing performance, which verifies the effectiveness of our method in BMC firmware security fuzzing.

Key words: QEMU emulation; firmware security; fuzzing; system security; baseboard management controller