Breaking Through: Open-Source Toolchain for Fuzzing Qualcomm Hexagon Basebands

Qualcomm's proprietary Hexagon baseband architecture has hindered security research due to a lack of suitable tooling. This paper introduces the first open-source toolchain enabling full-system emulated fuzzing of Hexagon firmware. Leveraging a QEMU fork with Hexagon support and LibAFL, this toolchain addresses the gap in analyzing Hexagon basebands. Researchers can now perform coverage-guided fuzzing and utilize visualization tools to improve reverse engineering. This significantly advances Hexagon baseband security analysis, opening up new avenues for research and enhancing the security of billions of devices.