Bond

• Artifact for USENIX Security '26 Submission

• 《Constraint-Directed Fuzzing for Automated Validation of Taint Analysis Results in Linux-based IoT Firmware》

Overview

Bond is a directed fuzzing framework for the automated validation of taint analysis reports. Based on the (source, sink, call traces) information contained in the reports, Bond performs entry point identification, constraint analysis, and black-box validation. To use Bond, some environment configuration is required, after which the tool can be executed from the command line. The inputs are firmware binaries together with taint analysis reports, and the expected output is a proof of concept. During execution, Bond also generates intermediate output files, such as path constraint analysis results and entry point identification results.

Dependencies

• Python 3.7

• Java 8 (1.8.0_202)

• npm 10.8.2

• Python packages (see requirements.txt)

• IDA Pro 7.5

Configuration

Since we have modified the underlying mutation logic of BooFuzz, and our constraint analysis is built on EmTaint, which requires changes to the core code of Angr, you will need to replace several library files. We have provided the necessary patched libraries and their relative paths under the third_party directory.

run_para.py: Contains device-specific configurations, such as login credentials and IP addresses.

dataflow.conf: Contains directory configurations, for example, you need to specify the path to your IDA Pro engine here.

Usage

1. Setup the testing environment;

2. Run Bond in the following way:

   python Bond.py -f "DIR816_1.10CNB05" -b "goahead"

3. Check the output and the result folder for results.

Important Files and Directories

CVE Reports

This dataset is used for validating known vulnerabilities. It is located at:

Bond_result\custom_analysis\A3002R_1.1.1

Here, A3002R_1.1.1 represents the firmware model. For example, within this folder you will find:

A3002R_1.1.1_boa_CVE_reports.json

This JSON file already contains the annotated vulnerability points. You can directly feed it into Bond to perform validation.

Dataset

This artifact includes two datasets, comprising a total of 19 real-world firmware images used to evaluate Bond. Note that these datasets are already included in the code artifact, and no additional action is required.