Source Extract — 2021 Portfolio PDF

# Source Extract — 2021 Portfolio PDF

AI Summary

Purpose:

• Preserve the relevant technical content extracted from Hyunwook Kim's 2021 portfolio PDF for comparison with the current technical portfolio.

Key points:

• The current public portfolio already covers the main fuzzing/publication/patent items: UART firmware acquisition, EF-Fuzz thesis, IoTFirmFuzz patent, IoTHybridFuzzer patent, and FIRM-COV.
• Non-duplicate reusable content in this PDF is strongest around hands-on dynamic analysis environments: PLC firmware dynamic analysis, On-Chip Debugging/debug shell methodology, UART/JTAG connection to real devices, VxWorks shell access, and magic-key recovery.
• The PDF also lists an automatic exploit-generation research project and embedded vulnerability-analysis projects, but these overlap with the existing hybrid fuzzing/symbolic execution and firmware fuzzing portfolio items unless more evidence is added.

Relevant when:

• Updating the technical portfolio with older graduate-school firmware-security work.
• Avoiding duplicate portfolio entries from the 2021 portfolio PDF.

Do not read full document unless:

• You need exact wording, dates, or project descriptions from the original PDF extraction.

Linked documents:

• [[../../wiki/academic/embedded-dynamic-analysis]]
• [[../../wiki/academic/uart-firmware-acquisition]]
• [[../../wiki/academic/iotfirmfuzz]]
• [[../../wiki/academic/iothybridfuzzer]]

Open Questions

• Original PDF image evidence exists in the uploaded portfolio, but public-safe screenshots were not added to the repository in this update.
• Project names and agency names are preserved from the PDF; any confidential report contents remain excluded.

Details

Source file received in Hermes cache:

• /home/khw-bot/.hermes/cache/documents/doc_514231e95ead_44e352da866fff1e.pdf

Extraction method:

• pdfinfo confirmed 16 pages, created by Microsoft PowerPoint on 2021-02-05.
• pdftotext -layout extracted text to /home/khw-bot/workspace/pdf_extract_2021/portfolio.txt.

Already represented in current technical portfolio

The PDF contains several items that are already represented in human/portfolio/ and should not be duplicated as new cards without a distinct angle:

• UART 기반 임베디드 펌웨어 획득 연구

- PDF: "임베디드 장비 펌웨어 획득을 위한 UART 연결 방법 연구". - Current portfolio: human/portfolio/items/uart-firmware-acquisition.html.

• EF-Fuzz / 석사학위논문

- PDF: "결합된 에뮬레이션을 이용한 임베디드 시스템의 효율적인 커버리지 가이드 퍼징 연구". - Current portfolio: human/portfolio/items/sejong-master-thesis.html.

• IoTFirmFuzz 등록특허

- PDF: "펌웨어 퍼징 장치 및 방법", application 10-2020-0089416, registration 10-2209676. - Current portfolio: human/portfolio/items/iotfirmfuzz-patent.html.

• IoTHybridFuzzer 특허

- PDF: "IoT 장비 펌웨어 하이브리드 퍼징 시스템 및 방법". - Current portfolio: human/portfolio/items/iothybridfuzzer-patent.html.

• FIRM-COV / BugMiner-adjacent firmware fuzzing paper

- PDF: "복합 에뮬레이션을 이용한 효율적인 커버리지 가이드 IoT 펌웨어 퍼징 기법" and "BugMiner... Target-Oriented Hybrid Fuzzer". - Current portfolio: human/portfolio/items/firm-cov-fuzzing.html and academic wiki pages.

Non-duplicate candidate selected for portfolio update

#### 제어기기 펌웨어 동적 분석 환경구축 방법론 연구

PDF fields:

• 주관기관: 국가보안기술연구소
• 참여기관: 세종대학교 정보보호학과 지능 보안 연구실
• 사업 일정: 2019.03 ~ 2019.10 (7개월)
• 참여 일정: 2019.03 ~ 2019.10

PDF research content/results:

• 제어기기(PLC)의 펌웨어를 동적으로 분석할 수 있는 환경 구축.
• On-Chip Debugging을 통한 펌웨어 분석환경 구축.
• 디버깅 쉘 등 기기가 제공하는 기능을 활용한 펌웨어 분석환경 구축.
• 그 외 동적 분석환경 구축 방법 식별.
• 펌웨어를 정적·동적 분석할 수 있는 방법론 연구.
• 정적 분석을 위한 방법론 절차, 예: IDA 활용 등.
• 분석환경 구축 절차 및 환경 별 디버깅 방법.
• 제어시스템 펌웨어 취약점 분석이 가능한 환경구축 방법론 제시.
• 연구결과 보고서.

#### Embedded Analysis project slide

PDF fields:

• 연구 기간: 2019.03 ~ 2019.10
• 연구 목적: 대학원 연구실 연구 과제 & UART/JTAG을 통해 임베디드 장치 쉘 획득
• 개발 내용: 실제 장치에서 UART와 JTAG을 연결시켜 VxWorks shell 획득
• 개발 결과: 여러 공유기의 매직키를 획득하여 VxWorks shell까지 얻을 수 있었음

Visual evidence described in the PDF slide:

• TL-WR886N 장치 쉘 획득
• VCC/GND/RX/TX pin labels
• 납땜 후 PC 연결
• 기기의 정보 & 쉘 획득

Overlapping candidates not added as separate cards in this update

#### 소프트웨어 자동 Exploit 생성기술 연구

PDF fields:

• 기간: 2018.09.01 ~ 2018.11.12
• Static analysis to find vulnerable points in binaries.
• Dynamic analysis/fuzzing research.
• Symbolic Execution research and tool development.
• Targeted symbolic execution to reduce Path Explosion by using paths to vulnerable points found by static analysis.
• Crash detection and exploit-generation possibility research.
• Research report and SW crash output-system prototype.

Reason not added as a separate portfolio card:

• It substantially overlaps with the existing IoTHybridFuzzer card, which already represents hybrid fuzzing + symbolic/concolic execution.
• Add later only if a distinct prototype artifact, report-safe detail, or public-safe narrative is available.

#### 임베디드 소프트웨어 취약점 분석 기술 개발 / IoT 펌웨어 취약점 자동분석 기술 연구

PDF fields:

• Firmware extraction, static/dynamic analysis, buffer overflow and command injection detection.
• IoT firmware analysis tool survey, blackbox/whitebox/greybox fuzzing system analysis.
• Efficient IoT firmware fuzzing-system prototype.

Reason not added as separate cards:

• Much of this is background feeding the existing UART, EF-Fuzz, IoTFirmFuzz, IoTHybridFuzzer, and FIRM-COV entries.
• The non-duplicate operationally clear part is captured in the new dynamic-analysis-environment page.