Small embedded devices are becoming more prevalent in the world with each passing year to improve our quality of life. However, as more devices are created, an increasing number of older devices are declared obsolete despite still being used. This results in an increasing amount of devices being vulnerable to exploitation due to a lack of security updates. Identifying these vulnerabilities manually without any system knowledge is an arduous task, and current state-of-the-art technologies do not perform generalized analysis in RTOS-based firmware. In this work, we present PinDown, an analysis framework that enables the automated identification of application code in RTOS-based firmware without requiring partial system knowledge. By identifying functions that modify the heap, we can identify RTOS components that can be leveraged to locate memory regions that host application code.

During this research we have replaced Bracha’s layer in the state-of-the-art Bracha-Dolev protocol to improve the performance by decreasing the message complexity of the protocol running on top of a given network topology so long as the requirements stated by Bracha and Dolev are met. Bracha-Dolev is an algorithm that is used to establish a Byzantine fault tolerant communication in a network but it requires a lot of messages to reach consensus. This improvement has been achieved by utilizing a Byzantine Consistent Broadcast algorithm in place of Bracha’s layer: Authenticated Echo Broadcast in order to reduce the message complexity and reduce the network consumption compared to the original optimized Bracha-Dolev algorithm.
Some of the optimizations applied to optimized Bracha-Dolev have also been applied to this new protocol under the hard assumption that the sender is always reliable. As a result, this new protocol is an optimal choice in such instances where these constraints hold and where multiple faulty nodes are present in the system.