FaultFinder: Lightning-fast, Multi-architectural Fault Injection Simulation

Fault injection is a common technique to break security algorithms on microcontrollers and other processors. However, it is often unclear which specific effect a physical fault had, for example, which instruction in a firmware binary was changed and how. A common approach to evaluate a binary for potential fault injection targets is to emulate the binary and simulate fault injection. Hence, various approaches for fault simulation have been proposed in the literature. However, these tools are often not optimised for maximum performance, which limits their application to large firmware binaries. To address this issue, in this paper, we present FaultFinder, a fast and easy-to-use tool for exhaustive fault injection simulation. FaultFinder allows us to efficiently simulate the injections of millions of faults into firmware binaries. Built on the Unicorn engine CPU emulator, FaultFinder supports a variety of CPU architectures, including ARM, x86, Tricore, and RISC-V. We describe two techniques to improve fault simulation inspired by research on binary analysis: the first, checkpoints, vastly increases the performance of our tool by caching and reusing intermediate states in the simulation. The second, novel provision, equivalences, simplifies the interpretation of the output by merging faults with equivalent effects. We compare FaultFinder with three alternative tools, ARCHIE, ARMory and FiSim, and apply it to the startup code taken from a real-world automotive processor.