CROWBAR: Natively Fuzzing Trusted Applications Using ARM CoreSight

Abstract Trusted execution environments (TEE) are deployed on many platforms to provide both confidentiality and integrity, their extensive use offers a secure environment for privacy-sensitive operations. Despite TEE prevalence in the smartphone tablet market, vulnerability research into security is relatively rare. This is, part, due strong isolation guarantees provided by its implementation. In this paper, we propose hardware assisted fuzzing framework, CROWBAR, that bypasses natively evaluate trusted applications (TAs) mobile devices leveraging ARM CoreSight components. CROWBAR performs feedback-driven commercial, closed source TAs while running protected environment. We implement 2 prototype commercial-off-the-shelf (COTS) smartphones one development board, finding 3 unique crashes 5 previously unreported TrustZone literature.