Source author record

Wenqiang Li

Wenqiang Li appears in the imported research catalog. Authorship, coauthor and topic links are available while profile ownership is still unclaimed.

ResearcherUnclaimed source record

Cryptography and Security math.OC math.PR physics.ins-det physics.optics quant-ph Software Engineering

Catalog footprint

What is connected

3works

7topics

4close collaborators

Actions

Connect this record

Open graph Browse works

Inspect adjacent papers, topics, institutions and collaborators without losing the researcher page.

Building this map preview

BZPEER is loading the nearby papers, people, topics and institutions for this page.

preprint2022arXiv

$μ$AFL: Non-intrusive Feedback-driven Fuzzing for Microcontroller Firmware

Fuzzing is one of the most effective approaches to finding software flaws. However, applying it to microcontroller firmware incurs many challenges. For example, rehosting-based solutions cannot accurately model peripheral behaviors and thus cannot be used to fuzz the corresponding driver code. In this work, we present $μ$AFL, a hardware-in-the-loop approach to fuzzing microcontroller firmware. It leverages debugging tools in existing embedded system development to construct an AFL-compatible fuzzing framework. Specifically, we use the debug dongle to bridge the fuzzing environment on the PC and the target firmware on the microcontroller device. To collect code coverage information without costly code instrumentation, $μ$AFL relies on the ARM ETM hardware debugging feature, which transparently collects the instruction trace and streams the results to the PC. However, the raw ETM data is obscure and needs enormous computing resources to recover the actual instruction flow. We therefore propose an alternative representation of code coverage, which retains the same path sensitivity as the original AFL algorithm, but can directly work on the raw ETM data without matching them with disassembled instructions. To further reduce the workload, we use the DWT hardware feature to selectively collect runtime information of interest. We evaluated $μ$AFL on two real evaluation boards from two major vendors: NXP and STMicroelectronics. With our prototype, we discovered ten zero-day bugs in the driver code shipped with the SDK of STMicroelectronics and three zero-day bugs in the SDK of NXP. Eight CVEs have been allocated for them. Considering the wide adoption of vendor SDKs in real products, our results are alarming.

preprint2020arXiv

Force and acceleration sensing with optically levitated nanogram masses at microkelvin temperatures

This paper demonstrates cooling of the center-of-mass motion of 10 $μ$m-diameter optically levitated silica spheres to an effective temperature of $50\pm22 μ$K, achieved by minimizing the technical pointing noise of the trapping laser. This low noise leads to an acceleration and force sensitivity of $95\pm41$ n$g/\sqrt{\mathrm{Hz}}$ ($g = 9.8$ m/s$^2$) and $0.95\pm0.11$ aN$/\sqrt{\mathrm{Hz}}$, respectively, at frequencies near 50 Hz. This force sensitivity is comparable to that demonstrated for optically levitated nanospheres that are $10^4$ times less massive, corresponding to an acceleration sensitivity that is several orders of magnitude better. It is further shown that under these conditions the spheres remain stably trapped at pressures of $\sim 10^{-7}$ mbar with no active cooling for periods longer than a day. Feedback cooling is still necessary in the moderate-pressure regime, motivating a comprehensive study of the loss mechanisms of the microspheres and providing better understanding of the requirements for feedback-free optical trapping in vacuum. This work can enable high-sensitivity searches for accelerations and forces acting on micron-sized masses, including those that could be produced by new physics beyond the Standard Model.

preprint2015arXiv

Zero-sum and nonzero-sum differential games without Isaacs condition

In this paper we study the zero-sum and nonzero-sum differential games with not assuming Isaacs condition. Along with the partition $π$ of the time interval $[0,T]$, we choose the suitable random non-anticipative strategy with delay to study our differential games with asymmetric information. Using Fenchel transformation, we prove that the limits of the upper value function $W^π$ and lower value function $V^π$ coincide when the mesh of partition $π$ tends to 0. Moreover, we give a characterization for the Nash equilibrium payoff (NEP, for short) of our nonzero-sum differential games without Isaacs condition, then we prove the existence of the NEP of our games. Finally, by considering all the strategies along with all partitions, we give a new characterization for the value of our zero-sum differential game with asymmetric information under some equivalent Isaacs condition.