SEARCH · Search NASA

Results for “fuzz”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records

All sources NASA NTRS DOE OSTI

DOE OSTI2021

Material migration in W and Mo during bubble growth and fuzz formation

Growth of helium (He) induced bubbles and fuzz in tungsten (W) and molybdenum (Mo) is investigated using samples of W films on Mo substrates and Mo films on W substrates exposed to He-containing plasma in the temperature range of 340 to 1075 K, fluence range of 1.0–14 × 10 25 He·m -2 , and incident ion energy of <50 eV. No fuzz (only up to 2 nm diameter bubbles) and no material transport occur in W films at ≤750 K, while precursors-of or fully-developed fuzz and material mixing occur in W and Mo films at ≥800 K. This suggests that fuzz forms in multi-material systems as long as one material meets the conditions for fuzz formation, namely T s / T m ~ 0.27–0.5 where T s and T m are the sample exposure and material melting temperatures, respectively. Larger He bubbles, more material mixing, and further-developed fuzz occur at higher temperature due to increased mobility of He atoms and small He clusters. Accumulation of substrate material at the surface of fuzzy W and Mo thin-film (<80 nm) samples suggests fuzz growth by material transport from the bubble layer in the bulk up to the fiber tip, likely by a two-step process: (i) diffusion of punched dislocation loops in the bulk toward the fuzz base and (ii) diffusion of adatoms along the fuzz base and fiber surface (with effective transport of adatoms upwards due to trapping of adatoms at curved surfaces of fiber tips and/or due to the continuous generation of adatoms at the fuzz base). While the bubble size and fuzz thickness increase with reduced W concentration in Mo thin-film samples at 838 K likely due to an increase in trap mutation and dislocation loop punching in Mo compared to W, the fuzz thickness decreases with reduced W concentration at 1075 K despite an increase in the bubble size likely due to slower diffusion of interstitial loops in Mo.

Physics↗

DOE OSTI2023

The dependence of tungsten fuzz layer thickness and porosity on tungsten deposition rate and helium ion fluence

Abstract Fuzz formation on a heated tungsten surface in the presence of a helium-containing plasma and tungsten deposition source was investigated. Tungsten samples were exposed at 1123 K to pure helium plasma with ion incident energy of 76 eV, W/He ion flux ratio of ∼ 0.4 × 10 − 4 , and varied helium ion fluence from 0.18 to 3.4 × 10 26 m −2 . Fuzz thickness was measured by cross-sectional scanning electron microscopy to increase from 0.22 to 15 µ m with increasing helium ion fluence. No indication of saturation in fuzz thickness at high fluence was observed, in contrast to fuzz produced on a tungsten surface without tungsten deposition. Additional tungsten samples were exposed at 1123 K to pure helium plasma with ion incident energy of 76 eV, helium ion fluence of ∼ 3.4 × 10 26 m −2 , and varied W/He ion flux ratio from 0.26 to 3.0 × 10 − 4 . Fuzz thickness increased from 7.5 to 120 µ m with increasing W/He ion ratio. A final sample exposed at 1123 K to a mixed helium-deuterium plasma with ion incident energy of 76 eV, helium ion fluence of 0.18 × 10 26 m −2 , and W/He ion flux ratio of 2.2 × 10 − 4 developed nearly identical fuzz structures to that developed in a pure He plasma. As a function of deposited tungsten fluence, all results were found to trace out a single layer-growth curve given by a power law relation, indicating that fuzz thickness is independent of the W/He ion flux ratio in the range investigated and independent of any deuterium present in the plasma. As a result, for tungsten plasma facing walls in magnetic fusion devices at 1000–2000 K with 10 −4 W/He ion flux ratio, fuzz with thicknesses greater than hundreds of microns may form in as little as 10 4 s (in the absence of ELM-induced erosion or annealing), and may more significantly affect its thermophysical properties than fuzz generated without a tungsten deposition source.

Physics↗

DOE OSTI2025

Speeding-up fuzzing through directional seeds

Abstract Fuzzing is an automated process for discovering inputs in a program that may trigger unexpected behavior. Today, fuzzing has become a standard practice for the discovery of bugs and security vulnerabilities. However, the main issue with such practices is that the exploration of the input space of programs can often be prohibitively expensive. Therefore, several alternative fuzzing strategies have been introduced during the last few years. Some fuzzing techniques rely on human expertise to provide a plausible set of initial input examples, namely, seeds. However, the process of handcrafting seeds for fuzzing purposes often becomes strenuous for humans as it requires a deeper understanding of the Program-Under-Test (PUT). Also, the use of known inputs to programs often does not trigger vulnerable program behavior or may not reach potentially vulnerable code locations. To address those issues, we propose a seed generation framework that enables Human-In-The-Loop (HITL) directed fuzzing where the human assumes a more active role in the creation of seeds that can penetrate and assess desired locations of the PUT. Our proposed framework uses Symbolic Execution (SE) to generate seeds that exercise paths to target program locations. Moreover, our framework enables the visualization of the explored execution paths in the binary of the PUT for the generated seeds. We evaluated our approach on a set of 12 carefully designed C programs with diverse characteristics that mimic real-world programs. The experimental results show the effectiveness of the proposed approach in improving the performance of standard fuzzing tools such as the American Fuzzy Lop ("Image missing" <#comment/> ). Specifically, our solution can generate seeds that substantially enhance the performance of the fuzzer, achieving speedups ranging from $$1.46\times $$ 1.46 × to $$68.53\times $$ 68.53 × for branch conditions, $$1.39\times $$ 1.39 × to $$254.62\times $$ 254.62 × for branch depths, $$14,879.59\times $$ 14 , 879.59 × to $$30,295.88\times $$ 30 , 295.88 × for branch widths over traditional seeds. Additionally, the speedup increases with the number of target function ranging from $$12,260\times $$ 12 , 260 × to $$22,856.07\times $$ 22 , 856.07 × over traditional seeds while only requiring less than 15 seconds on average for the seed generation step.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2024

StructuredFuzzer: Fuzzing Structured Text-Based Control Logic Applications

Rigorous testing methods are essential for ensuring the security and reliability of industrial controller software. Fuzzing, a technique that automatically discovers software bugs, has also proven effective in finding software vulnerabilities. Unsurprisingly, fuzzing has been applied to a wide range of platforms, including programmable logic controllers (PLCs). However, current approaches, such as coverage-guided evolutionary fuzzing implemented in the popular fuzzer American Fuzzy Lop Plus Plus (AFL++), are often inadequate for finding logical errors and bugs in PLC control logic applications. They primarily target generic programming languages like C/C++, Java, and Python, and do not consider the unique characteristics and behaviors of PLCs, which are often programmed using specialized programming languages like Structured Text (ST). Furthermore, these fuzzers are ill suited to deal with complex input structures encapsulated in ST, as they are not specifically designed to generate appropriate input sequences. This renders the application of traditional fuzzing techniques less efficient on these platforms. To address this issue, this paper presents a fuzzing framework designed explicitly for PLC software to discover logic bugs in applications written in ST specified by the IEC 61131-3 standard. The proposed framework incorporates a custom-tailored PLC runtime and a fuzzer designed for the purpose. We demonstrate its effectiveness by fuzzing a collection of ST programs that were crafted for evaluation purposes. We compare the performance against a popular fuzzer, namely, AFL++. The proposed fuzzing framework demonstrated its capabilities in our experiments, successfully detecting logic bugs in the tested PLC control logic applications written in ST. On average, it was at least 83 times faster than AFL++, and in certain cases, for example, it was more than 23,000 times faster.

47 OTHER INSTRUMENTATION↗

DOE OSTI2025

IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit

As IoT devices with microcontroller (MCU)-based firmware become more common in our lives, memory corruption vulnerabilities in their firmware are increasingly targeted by adversaries. Fuzzing is a powerful method for detecting these vulnerabilities, but it poses unique challenges when applied to IoT devices. Direct fuzzing on these devices is inefficient, and recent efforts have shifted towards creating emulation environments for dynamic firmware testing. However, unlike traditional software, firmware interactions with peripherals that are significantly more diverse presents new challenges for achieving scalable full-system emulation and effective fuzzing. This paper reviews 27 state-of-the-art works in MCU-based firmware emulation and its applications in fuzzing. Instead of classifying existing techniques based on their capabilities and features, we first identify the fundamental challenges faced by firmware emulation and fuzzing. We then revisit recent studies, organizing them according to the specific challenges they address, and discussing how each specific challenge is addressed. We compare the emulation fidelity and bug detection capabilities of various techniques to clearly demonstrate their strengths and weaknesses, aiding users in selecting or combining tools to meet their needs. Finally, we highlight the remaining technical gaps and point out important future research directions in firmware emulation and fuzzing.

Zhou, Wei (ORCID:0000000178340839)↗

DOE OSTI2020

Material mixing during fuzz formation in W and Mo

Helium-induced fuzz formation in tungsten (W) and molybdenum (Mo) is investigated for a range of sample exposure temperatures from 838 K–1075 K (He fluence = 3.4 × 10 25 m -2 and ion energy <39 eV). Thin films of Mo deposited on W substrates show mixing of the film and substrate materials in the fuzz after He plasma exposure, including at 838 K (i.e. below the typical temperature range at which fuzz forms in pure W). Finally, the amount of material mixing increases with exposure temperature due to the increase in bubble size, and leads to significant accumulation of the substrate material at the fuzz surface at the highest temperature investigated, further supporting fuzz growth from the fiber tip outwards by material transport up the fibers.

36 MATERIALS SCIENCE↗

DOE OSTI2024

Hardware Fuzzing with An Emulator

Bugs in digital logic have led to some significant security vulnerabilities. Hardware bugs are particularly troublesome since they cannot be easily patched. Additionally, if the bug is in the root of trust, all trust built upon it can be vulnerable. Traditional testing either require a deep knowledge of the system, creative attack vectors and lots of human interaction. This is not scalable as there are very few engineers that can wear the hat of a designer, a verification engineer, and a cybersecurity expert. Hardware fuzzing is a relatively new research area in dynamic hardware testing. It has proven to be an effective method for discovering bugs, unexpected behaviors, and security vulnerabilities in software. While hardware fuzzing is new to the hardware domain, it has a strong track record in software testing. Fuzzing is a testing technique that randomly mutates the input data to uncover bugs or vulnerabilities in the design. It is especially good at finding corner cases that test engineers can not envision. Another advantage over other dynamic testing techniques is that, if done well, deep knowledge of the design is not required. Additionally, fuzzing scales well. If the system is set up correctly, it can run unsupervised for weeks if necessary. In this work, we propose using hardware fuzzing to improve the input vector generation for an information flow tracking tool. To get reasonable throughput of test vectors, an emulator is targeted as the execution platform. Efficient emulator execution has some specific requirements.

42 ENGINEERING↗

DOE OSTI2023

CROWBAR: Natively Fuzzing Trusted Applications Using ARM CoreSight

Abstract Trusted execution environments (TEE) are deployed on many platforms to provide both confidentiality and integrity, and their extensive use offers a secure environment for privacy-sensitive operations. Despite TEE prevalence in the smartphone and tablet market, vulnerability research into TEE security is relatively rare. This is, in part, due to the strong isolation guarantees provided by its implementation. In this paper, we propose a hardware assisted fuzzing framework, CROWBAR, that bypasses TEE isolation to natively evaluate trusted applications (TAs) on mobile devices by leveraging ARM CoreSight components. CROWBAR performs feedback-driven fuzzing on commercial, closed source TAs while running in a TEE protected environment. We implement CROWBAR on 2 prototype commercial-off-the-shelf (COTS) smartphones and one development board, finding 3 unique crashes in 5 closed source TAs that are previously unreported in the TrustZone fuzzing literature.

Shan, Haoqi↗

DOE OSTI2020

Multi-Node Program Fuzzing on High Performance Computing Resources

Significant effort is placed on tuning the internal parameters of fuzzers to explore the state space, measured as coverage, of binaries. In this work, we investigate the effects of the external environment on the resulting coverage after fuzzing two binaries with AFL for 24 hours. Parameters such as scaling to multiple nodes, node saturation, and parallel file system type on HPC resources are controlled in order to maximize coverage. It will be shown that employing a parallel file system such as IBM's General Parallel File System offers an advantage for fuzzing operations, since it contains enhancements for performance optimization. When combined with scaling to two and four nodes, while simultaneously restricting the number of coordinated AFL tasks per node on the low end (10-50% of available physical cores), coverage may be enhanced within a shorter period of time. Thus, controlling the external environment is a useful effort.

97 MATHEMATICS AND COMPUTING↗

NASA NTRS1983

Spectroscopy of the fuzz associated with four quasars

The spectral features detected in the fuzz of four probable quasars spanning the z range of 0.036-0.37 are reported; the objects studied are 0351 + 026 (z = 0.036), 1059 + 730 (z = 0.089), 0845 + 378 (z = 0.307), and 3C 48 (z = 0.368). The results indicate that apparently some (and probably all) low-redshift quasars are embedded in fuzz whose size, morphology, absolute magnitude, and spectroscopic character are those of a galaxy. Thus, it appears virtually certain that quasars are the active nuclei of galaxies.

Balick, B.↗

DOE OSTI2021

Crystallographic analysis of nano-tendril bundle vs fuzz growth on tungsten exposed to helicon wave-coupled helium plasma

The propensity for nano-tendril bundle (NTB) vs widespread nano-tendril growth (i.e., fuzz) on polycrystalline W under varying ion energy modulation conditions, from DC to peak-to-peak energy modulation of 42 eV at 13.56 MHz, is correlated with the crystal orientation of the underlying grains. Grains that are vicinal to crystal orientations with high surface diffusivity (e.g., {101} for a body centered cubic crystal structure) exhibit NTB growth at lower ion energy modulation amplitude than grains that are vicinal to low surface diffusivity orientations, such as {100}. Adatom mobility considerations are presented to describe the experimental observations. These results support that surface diffusion or W adatom mobility enhanced by ion bombardment plays a key role in the surface morphology evolution of W under He irradiation.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗

DOE OSTI2023

An Integrated Testbed for Trojans in Printed Circuit Boards with Fuzzing Capabilities

This paper showcases an all-in-one testing environment that combines Trojan detection and fuzzing capabilities for printed circuit boards using the OpenPLC “NYU Trojan Edition” and a dedicated Trojan detection framework. The demo system is self-contained and equipped with two OpenPLC-based boards (one with a Trojan and one without), and automated tools for inserting the Trojan and collecting side-channel data. We developed a graphical user interface for interactive Trojan selection, data visualization, and anomaly detection analysis.

Trojan detection, anomaly detection, PCB, timing l↗

DOE OSTI2023