Grant: Discovery Launch Supplement

Dynamic program analysis is at the heart of security research. Its key advantage is that it either does not abstract program code at all or the level of abstraction is very close to the original executable code. This allows us to reason about security properties of a code with a very high degree of precision. Dynamic analysis is especially effective inside an emulator, i.e. off-device: it allows for internal state introspection and thus more intricate types of instrumentation are possible. This, in turn, allows us to detect more vulnerabilities and find the root cause of a crash faster and with much less effort. There are many unsolved research problems however when it comes to dynamic analysis, and especially off-device dynamic analysis, of system code: low-level code that controls device's hardware, e.g. Android kernel or baseband firmware; to a degree that effectively prevents us from using it on scale. For example, a known problem is due to that system code expects and interacts with specific hardware of the device it was created for. This means that for every new kernel/firmware under analysis, an emulated version of this specific hardware needs to be created and added to the emulation environment. Due to the plethora of smartphones models on the market today, this is economically infeasible on scale. This proposal aims to advance the field of dynamic program analysis and make it work for low-level system code: by developing new generic approaches applicable to various devices and platforms thus eliminating the need to develop ad-hoc methods for each new device. Our recent work towards this direction, in which we discovered a number of zero-day vulnerabilities as a side-effect, indicates that this is both possible and promising. Through our advances in the filed of dynamic analysis, the ultimate goal of this research is to improve security of modern smartphones. Consider an example of Android smartphones. With the number of new models released every year, each featuring new peripherals and new drivers (which historically have been a source of many vulnerabilities), conducting manual dynamic analysis on-device, i.e. using physical copies of the devices, can be very costly. Doing the analysis in emulator instead would be a much more efficient and scalable strategy in this case, and would significantly reduce the number of devices that need to be purchased. Another example is baseband processor firmware responsible for all cellular network functionality. On-device dynamic analysis in this case is hindered by lack of debugging interfaces which prevents monitoring code's internal state. Off-device analysis would not have such problems.