BLuEMan: A Stateful Simulation-based Fuzzing Framework for Open-Source RTOS...
summary
BLuEMan executes real open-source BLE stacks on Linux ELF binaries hooked into a Babel physical-layer simulator to scale stateful fuzzing without hardware, records full multi-layer packet sequences as seeds via an in-line interceptor, and uses coverage-guided feedback plus stackable mutation plugins that preserve length and layer semantics. Evaluation reports 18× and 162× speedups over simulation- and platform-based baselines, coverage gains up to 256%, and discovery of four CVEs discovered across controller and host components.
AI-written summary · about
chapters (12)
- 0:00BLuEMan framework intro
- 1:38BLE security challenges
- 3:02Bluetooth stack overview
- 4:30Fuzzing method limitations
- 6:36BLuEMan design goals
- 8:46Babel simulation platform
- 10:13Packet sequence collection
- 11:37Mutation architecture
- 13:43BLuEMan performance
- 15:58Tool comparison
- 17:01Vulnerabilities found
- 18:03Q&A
related talks
32mBluetooth Low Energy GATT Fuzzing: Specification To Implementation
10mFuzzBT: Holistic-State-Guided Fuzzing for Bluetooth Host Stack in Kernels
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
53mThree Colours of Fuzzing: Reflections and Open Challenges
50mWhat the Fuzz
01h 15mMake your programs more reliable with Fuzzing
18mBluetooth Security Testing with BlueToolkit: a Large-Scale Automotive Case Study
27mPeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary