Abstract: As a type of embedded firmware pre-installed in server hardware, the Baseboard Management Controller (BMC) is responsible for managing and monitoring the full operational lifecycle of servers, and its security posture directly determines the overall security and stability of the entire server system. With the rising trend of cyberattacks targeting low-level system components, BMC firmware has gradually become a key attack surface that cannot be ignored.As a mainstream vulnerability detection technology, fuzzing has been widely recognized and applied in both academic research and industrial practice. However, fuzzing testing for BMC firmware still faces multiple non-trivial challenges: on the one hand, the diversity of BMC instruction set architectures and the closed proprietary attribute of firmware increase the difficulty of testing; on the other hand, the large number of complex binary programs contained in BMC firmware also brings great obstacles to the positioning of fuzzing target functions.This paper proposes a target function-guided fuzzing method oriented to closed-source BMC firmware. First, we design a target function discovery algorithm that integrates static analysis and pre-defined dangerous function call relationship rules, which can automatically identify high-value fuzzing targets from BMC firmware. Second, based on the proposed target discovery algorithm, we implement a QEMU-based BMC firmware fuzzer with the support of LibAFL. This fuzzer integrates modern fuzzing technologies including dynamic binary instrumentation and coverage-guided fuzzing to effectively improve fuzzing efficiency.Experimental results show that the proposed target function discovery algorithm significantly reduces the manual workload required for target function selection. Compared with AFL++ running in QEMU mode, the fuzzer proposed in this paper achieves better code coverage and higher testing performance, which verifies the effectiveness of our method in BMC firmware security fuzzing.

Key words: QEMU emulation; firmware security; fuzzing; system security; baseboard management controller

摘要： 基板管理控制器（Baseboard Management Controller，BMC）作为服务器设备的嵌入式固件，管理和监控服务器运行，其安全性影响着整个服务器的安全性。随着网络攻击不断向底层系统拓展，BMC固件也成为攻击者的攻击目标之一。模糊测试已成为当下学术界与工业界广泛使用的漏洞挖掘技术。然而，由于BMC固件存在架构多样，程序封闭等原因，对于BMC固件的模糊测试难以进行，且BMC固件包含大量功能复杂的二进制程序，难以快速寻找到模糊测试的目标函数。本文针对二进制闭源BMC固件，设计了一种基于目标函数引导的BMC固件模糊测试方法。本文首先提出一种目标函数发现算法，通过静态分析与预定义危险函数调用关系分析，提取出有价值的模糊测试目标函数；然后结合目标函数发现算法，使用LibAFL构建基于QEMU的BMC的固件模糊测试器；最后结合QEMU的动态仿真技术，将动态二进制插桩、覆盖率导向等现代模糊测试技术应用于BMC固件模糊测试中，提高BMC固件模糊测试的效率。通过实验，本文提出的目标函数发现算法能够有效降低寻找目标函数的工作量，与AFL++ QEMU模式相比，本文设计的模糊测试器在覆盖率与性能上均优势明显。

关键词: QEMU仿真；固件安全；模糊测试；系统安全；基板管理控制器