DEFCON 2026 - There's A Bug in My Boot: Finding Vulnerabilities in U-Boot

This is a companion repo for the Packet Hacking Village: There's A Bug In My Boot talk.

The following are walk throughs to get you started with building and testing U-Boot, and performing root cause analysis on bootloader crashes.

The following labs/walk throughts are available:

• 00 - Sandbox Mode: Build a native ELF U-Boot and learn U-Boot!
• 01 - Root Cause Analysis with CVE 2022-33103: Leverage a Sandbox Mode built U-Boot to analyze a real CVE.
• 02 - LLM File System Generation: The directory structure and prompt templates I use for LLM assisted corrupted file system generation (aka SlopFS).
• 03 - Custom Struct Fuzzing: Example LLM tool generated from SquashFS documentation, and squashfs-utils to corrupt inode structures in existing squashfs file systems.

References

• AcidRain | A Modem Wiper Rains Down on Europe

• PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

• SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing

• Joern Query Database

• NIST: National Vulnerability Database - U-Boot Search

• QEMU

• U-Boot: Sandbox Mode

• kAFL: Github Project

• OpenCode

• BareBox

• (2025) IEEE Aerospace Conference - Space Cybersecurity Incident Response Framework: A Viasat Case Study

• (2025) NDSS - A Comprehensive Memory Safety Analysis of Bootloaders

• (2023) USENIX Securiy - FISHFUZZ: Catch Deeper Bugs by Throwing Larger Nets

• (2020) USENIX Security - ParmeSan: Sanitizer-guided Greybox Fuzzing

• (2019) NDSS REDQUEEN: Fuzzing with Input-to-State

• (2019) LEOPARD: Identifying Vulnerable Code for Vulnerability Assessment through Program Metrics

• (2018) NDSS BAR - Avatar2: Multi-Target Orchestration

• (2017) USENIX WOOT - kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels

• (2014) Modeling and Discovering Vulnerabilities with Code Property Graphs

• (2012) ReDeBug: Finding Unpatched Code Clones in Entire OS Distributions