Fuzzing has become a very common place technique used for software testing and is heavily used to find security problems. There are many frameworks (sully, Peach Fuzzer etc.) that are geared up for fuzzing large, complex software systems. I have not found much information about fuzzing of smaller, simpler embedded systems (generally those that are small and simple enough to not run an OS).These small systems are found everywhere - RFID card readers, burglar alarm systems, keyless entry systems, engine control units, HVAC controls, and so on. They frequently have very limited inputs and outputs (buttons, keypads, small character displays, LEDs, buzzers, RF communications). Complex networking (Ethernet, TCP/IP), serial ports etc. are rare.I have had good success employing fuzzing like techniques to find security problems and see how the system behaves. Currently, this has largely comprised of fuzzing the formatting of packets sent into the system, based on observations of genuine packets. Some examples:Using fuzzing to determine the structure of packets - sometimes you knowthe approximate packet format, but things like ID bits, checksumsetc. are not always certain if you only have a small number ofgenuine devices or sampled transmissions. Finding problems in packetdecoding when packets are longer than expected - simple things likesetting variable packet lengths to higher than expected values.Finding limits of acceptable transmissions - things likeretransmission are common in one-way RF systems. What is the smallestnumber of packets that will register as a correct transmission? Howmuch can we vary the baud rate (i.e. is there good clock recovery inthe receiver). Finding the limits of jamming detection. How far canwe push the system before jamming is detected? Finding undocumentedfeatures - for example, if 00 is arm, 01 is disarm, 10 is part-arm,what does 11 do?One of the biggest challenges I have found is methods to detect the state of the system. This has generally ended up with a hodge-podge of outputs taken from LEDs, LCD buses and so on. I have been using Arduino and Arduino-like boards for the inputs and outputs (generally a Teensy 2.0). I also often need to include a method to power cycle the system in the event of a crash.What I have been surprised by is that I cannot find many others performing work or research in this area. I'm largely making this up as I go along.So, the questions are:Are there any resources out there along these lines? Can any of the complex fuzzing frameworks be used for this application?(as an aside, I don't think this is a failure to google. Similar concepts include glitching and fault injection, but I believe this to be distinct)I have seen this training available:https://www.blackhat.com/us-13/training/peach-fuzzer-embedded-edition.html
Where can I learn more about black-box fuzzing of small embedded systems?
hardware;fuzzing