The discovery of vulnerabilities in embedded firmware has received significant attention from security researchers. However, current vulnerability detection methods still suffer from false negatives and inefficiency, which limit detection effectiveness and require substantial analysis time. To alleviate the above problems, we propose a bidirectional path and data flow analysis method, named BPDA, that effectively compensates for the limitations in detecting firmware vulnerabilities at nonstandard sink points. Our key insight is that, some vulnerabilities arise in nonstandard library sinks, and not all user inputs can reach each corresponding sink. Guided by these insights, we design a more comprehensive sink identification algorithm and leverage accurate backward data flow tracking to eliminate the non-vulnerable paths. After that, we execute forward taint analysis and generate the final Proof of Concepts (PoCs). To evaluate the effectiveness of BPDA, we evaluated it on 84 firmware samples (including both Linux and VxWorks firmware) from 8 major brands, comparing it with state-of-the-art methods (i.e., SaTC and Mango). BPDA discovered 163 real vulnerabilities, including 34 0-day vulnerabilities, of which 32 have been confirmed by CVE/CNVD. Besides, results show that BPDA completed its analysis in just 6% of the time required by SaTC, and remarkably identified 21 vulnerabilities that SaTC and Mango had not detected. It also resolved the issue of Mango failing to analyze specific firmware. In addition, we also performed an ablation study to verify the effectiveness of optimization methods in taint analysis. These results demonstrate the superiority of BPDA in terms of effectiveness and efficiency in detecting embedded firmware vulnerabilities.

With increasing dimension of variation space and computational intensive circuit simulation, accurate and fast yield estimation of realistic SRAM chip remains a significant and complicated challenge. In this paper, du Experiment results show that the proposed method has an almost constant time complexity as the dimension increases, and gains 6x speedup over the state-of-the-art method in the 485D cases.

Yield 1 analysis of SRAM is a challenging issue, because the failure rates of SRAM cells are extremely small. In this article, an efficient non-Gaussian sampling method of cross entropy optimization is proposed for estimating the high sigma SRAM yield. Instead of sampling with the Gaussian distribution in existing methods, a non-Gaussian distribution, i.e., a joint one-dimensional generalized Pareto distribution and ( n -1)-dimensional Gaussian distribution, is taken as the function family of practical distribution, which is proved to be more suitable to fit the ideal distribution in the view of extreme failure event. To minimize the cross entropy between practical and ideal distributions, a sequential quadratic programing solver with multiple starting points strategy is applied for calculating the optimal parameters of practical distributions. Experimental results show that the proposed non-Gaussian sampling is a 2.2--4.1× speedup over the Gaussian sampling, on the whole, it is about a 1.6--2.3× speedup over state-of-the-art methods with low- and high-dimensional cases without loss of accuracy