ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels

Muhui Jiang; Lin Ma; Yajin Zhou; Qiang Liu; Cen  Zhang; Zhi Wang; Xiapu Luo; Lei  Wu; Kui Ren

doi:10.1145/3460120.3484753

ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels

Muhui Jiang, Lin Ma, Yajin Zhou, Qiang Liu, Cen Zhang, Zhi Wang, Xiapu Luo, Lei Wu, Kui Ren

Research output: Chapter in book / Conference proceeding › Conference article published in proceeding or book › Academic research › peer-review

6 Citations (Scopus)

Abstract

Dynamic analysis based on the full-system emulator QEMU is widely used for various purposes.However, it is challenging to run firmware images of embedded devices in QEMU, especially the process to boot the Linux kernel (we call this process rehosting the Linux kernel in this paper). That's because embedded devices usually use different system-on-chips (SoCs) from multiple vendors and only a limited number of SoCs are currently supported in QEMU.

In this work, we propose a technique called peripheral transplantation. The main idea is to transplant the device drivers of designated peripherals into the Linux kernel binary. By doing so, it can replace the peripherals in the kernel that are currently unsupported in QEMU with supported ones, thus making the Linux kernel rehostable. After that, various applications can be built.

We implemented this technique inside a prototype system called ECMO and applied it to 815 firmware images, which consist of 20 kernel versions and 37 device models. The result shows that ECMO can successfully transplant peripherals for all the 815 Linux kernels. Among them, 710 kernels can be successfully rehosted, i.e., launching a user-space shell (87.1% success rate). The failed cases are mainly because the root file system format (ramfs) is not supported by the kernel. Meanwhile, we are able to inject rather complex drivers (i.e., NIC driver) for all the rehosted Linux kernels by installing kernel modules. We further build three applications, i.e., kernel crash analysis, rootkit forensic analysis, and kernel fuzzing, based on the rehosted kernels to demonstrate the usage scenarios of ECMO.

Original language	English
Title of host publication	CCS 2021 - Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security
Pages	734–748
Number of pages	15
ISBN (Electronic)	9781450384544
DOIs	https://doi.org/10.1145/3460120.3484753
Publication status	Published - 12 Nov 2021

Publication series

Name	Proceedings of the ACM Conference on Computer and Communications Security
ISSN (Print)	1543-7221

Keywords

Linux kernel
peripheral transplantation
rehosting

ASJC Scopus subject areas

Software
Computer Networks and Communications

More information

10.1145/3460120.3484753

Cite this

Jiang, M., Ma, L., Zhou, Y., Liu, Q., Zhang, C., Wang, Z., Luo, X., Wu, L., & Ren, K. (2021). ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels. In CCS 2021 - Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (pp. 734–748). (Proceedings of the ACM Conference on Computer and Communications Security). https://doi.org/10.1145/3460120.3484753

@inproceedings{d4c4cace4adc4d94848976fb58f15f3b,

title = "ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels",

abstract = "Dynamic analysis based on the full-system emulator QEMU is widely used for various purposes.However, it is challenging to run firmware images of embedded devices in QEMU, especially the process to boot the Linux kernel (we call this process rehosting the Linux kernel in this paper). That's because embedded devices usually use different system-on-chips (SoCs) from multiple vendors and only a limited number of SoCs are currently supported in QEMU.In this work, we propose a technique called peripheral transplantation. The main idea is to transplant the device drivers of designated peripherals into the Linux kernel binary. By doing so, it can replace the peripherals in the kernel that are currently unsupported in QEMU with supported ones, thus making the Linux kernel rehostable. After that, various applications can be built.We implemented this technique inside a prototype system called ECMO and applied it to 815 firmware images, which consist of 20 kernel versions and 37 device models. The result shows that ECMO can successfully transplant peripherals for all the 815 Linux kernels. Among them, 710 kernels can be successfully rehosted, i.e., launching a user-space shell (87.1% success rate). The failed cases are mainly because the root file system format (ramfs) is not supported by the kernel. Meanwhile, we are able to inject rather complex drivers (i.e., NIC driver) for all the rehosted Linux kernels by installing kernel modules. We further build three applications, i.e., kernel crash analysis, rootkit forensic analysis, and kernel fuzzing, based on the rehosted kernels to demonstrate the usage scenarios of ECMO.",

keywords = "Linux kernel, peripheral transplantation, rehosting",

author = "Muhui Jiang and Lin Ma and Yajin Zhou and Qiang Liu and Cen Zhang and Zhi Wang and Xiapu Luo and Lei Wu and Kui Ren",

note = "Funding Information: We would like to thank the anonymous reviewers for their comments that greatly helped improve the presentation of this paper. We also want to thank Andrew Baumann for shepherding our paper. This work was partially supported by the National Natural Science Foundation of China (Grant No.61872438), the Fundamental Research Funds for the Central Universities (Zhejiang University NGICS Platform ZJUNGICS2021016, K20200019), Leading Innovative and Entrepreneur Team Introduction Program of Zhejiang (No. 2018R01005), HK RGC Project (No. PolyU 152239/18E). Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of funding agencies. Publisher Copyright: {\textcopyright} 2021 ACM.",

year = "2021",

month = nov,

day = "12",

doi = "10.1145/3460120.3484753",

language = "English",

series = "Proceedings of the ACM Conference on Computer and Communications Security",

pages = "734–748",

booktitle = "CCS 2021 - Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security",

}

Jiang, M, Ma, L, Zhou, Y, Liu, Q, Zhang, C, Wang, Z, Luo, X, Wu, L & Ren, K 2021, ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels. in CCS 2021 - Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. Proceedings of the ACM Conference on Computer and Communications Security, pp. 734–748. https://doi.org/10.1145/3460120.3484753

ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels. / Jiang, Muhui; Ma, Lin; Zhou, Yajin et al.
CCS 2021 - Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 2021. p. 734–748 (Proceedings of the ACM Conference on Computer and Communications Security).

Research output: Chapter in book / Conference proceeding › Conference article published in proceeding or book › Academic research › peer-review

TY - GEN

T1 - ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels

AU - Jiang, Muhui

AU - Ma, Lin

AU - Zhou, Yajin

AU - Liu, Qiang

AU - Zhang, Cen

AU - Wang, Zhi

AU - Luo, Xiapu

AU - Wu, Lei

AU - Ren, Kui

N1 - Funding Information: We would like to thank the anonymous reviewers for their comments that greatly helped improve the presentation of this paper. We also want to thank Andrew Baumann for shepherding our paper. This work was partially supported by the National Natural Science Foundation of China (Grant No.61872438), the Fundamental Research Funds for the Central Universities (Zhejiang University NGICS Platform ZJUNGICS2021016, K20200019), Leading Innovative and Entrepreneur Team Introduction Program of Zhejiang (No. 2018R01005), HK RGC Project (No. PolyU 152239/18E). Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of funding agencies. Publisher Copyright: © 2021 ACM.

PY - 2021/11/12

Y1 - 2021/11/12

N2 - Dynamic analysis based on the full-system emulator QEMU is widely used for various purposes.However, it is challenging to run firmware images of embedded devices in QEMU, especially the process to boot the Linux kernel (we call this process rehosting the Linux kernel in this paper). That's because embedded devices usually use different system-on-chips (SoCs) from multiple vendors and only a limited number of SoCs are currently supported in QEMU.In this work, we propose a technique called peripheral transplantation. The main idea is to transplant the device drivers of designated peripherals into the Linux kernel binary. By doing so, it can replace the peripherals in the kernel that are currently unsupported in QEMU with supported ones, thus making the Linux kernel rehostable. After that, various applications can be built.We implemented this technique inside a prototype system called ECMO and applied it to 815 firmware images, which consist of 20 kernel versions and 37 device models. The result shows that ECMO can successfully transplant peripherals for all the 815 Linux kernels. Among them, 710 kernels can be successfully rehosted, i.e., launching a user-space shell (87.1% success rate). The failed cases are mainly because the root file system format (ramfs) is not supported by the kernel. Meanwhile, we are able to inject rather complex drivers (i.e., NIC driver) for all the rehosted Linux kernels by installing kernel modules. We further build three applications, i.e., kernel crash analysis, rootkit forensic analysis, and kernel fuzzing, based on the rehosted kernels to demonstrate the usage scenarios of ECMO.

AB - Dynamic analysis based on the full-system emulator QEMU is widely used for various purposes.However, it is challenging to run firmware images of embedded devices in QEMU, especially the process to boot the Linux kernel (we call this process rehosting the Linux kernel in this paper). That's because embedded devices usually use different system-on-chips (SoCs) from multiple vendors and only a limited number of SoCs are currently supported in QEMU.In this work, we propose a technique called peripheral transplantation. The main idea is to transplant the device drivers of designated peripherals into the Linux kernel binary. By doing so, it can replace the peripherals in the kernel that are currently unsupported in QEMU with supported ones, thus making the Linux kernel rehostable. After that, various applications can be built.We implemented this technique inside a prototype system called ECMO and applied it to 815 firmware images, which consist of 20 kernel versions and 37 device models. The result shows that ECMO can successfully transplant peripherals for all the 815 Linux kernels. Among them, 710 kernels can be successfully rehosted, i.e., launching a user-space shell (87.1% success rate). The failed cases are mainly because the root file system format (ramfs) is not supported by the kernel. Meanwhile, we are able to inject rather complex drivers (i.e., NIC driver) for all the rehosted Linux kernels by installing kernel modules. We further build three applications, i.e., kernel crash analysis, rootkit forensic analysis, and kernel fuzzing, based on the rehosted kernels to demonstrate the usage scenarios of ECMO.

KW - Linux kernel

KW - peripheral transplantation

KW - rehosting

UR - http://www.scopus.com/inward/record.url?scp=85119346966&partnerID=8YFLogxK

U2 - 10.1145/3460120.3484753

DO - 10.1145/3460120.3484753

M3 - Conference article published in proceeding or book

T3 - Proceedings of the ACM Conference on Computer and Communications Security

SP - 734

EP - 748

BT - CCS 2021 - Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security

ER -

ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels

Abstract

Publication series

Keywords

ASJC Scopus subject areas

More information

Other files and links

Fingerprint

Cite this