💻 computer science

Multi-Agent Cooperative Fuzzing for HarmonyOS APIs

This paper presents HMFuzzer, a multi-agent cooperative fuzzing framework that enhances HarmonyOS API vulnerability discovery by leveraging Android code retrieval, multimodal document interpretation, reinforcement learning for prompt optimization, and automated crash analysis to overcome the scarcity and low quality of existing ecosystem documentation.

Original authors: Fei Jia, Lei Zhang, Huibing Zhang, Lianhai Liu

Published 2026-06-24✓ Author reviewed ⓘ

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Fei Jia, Lei Zhang, Huibing Zhang, Lianhai Liu

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to teach a robot how to break into a very new, high-tech house (HarmonyOS) to find weak spots in the locks and windows. The problem is, the house is so new that there are almost no blueprints, no "how-to" videos, and the few instructions you do have are written in a language the robot doesn't speak well, with lots of confusing pictures instead of words.

This paper introduces a new team of robot specialists called HMFuzzer to solve this problem. Instead of one robot trying to do everything, they use a three-person team working together, much like a specialized detective squad.

Here is how their team works, explained with simple analogies:

1. The Problem: The "New House" with Missing Manuals

HarmonyOS is like a brand-new smart city. It has millions of doors (APIs) that let different devices talk to each other. But because it's new:

There are very few examples of how to use these doors.
The official instruction manuals are full of diagrams and images that text-based robots can't read.
Existing tools (other robots) try to guess how to break in, but they keep failing because they don't have enough information.

2. The Solution: The Three-Agent Team

The HMFuzzer team consists of three specialized agents who pass the work down the line:

Agent A: The "Translator & Organizer" (Preprocessing Agent)

The Job: This agent takes the messy instruction manuals. Since the manuals have lots of pictures (like flowcharts) that the robot can't understand, this agent uses a "super-eyes" AI (Multimodal Large Models) to look at the pictures and describe them in plain text.
The Analogy: Imagine a librarian who takes a book full of confusing sketches and writes a detailed story description for every picture so the robot can actually read it.
The Permission Check: This agent also checks the "security guard" rules. It makes sure the robot only tries to open doors it is actually allowed to touch, so it doesn't get flagged for trying to break into a restricted area.

Agent B: The "Driver Builder" (Driver Generation Agent)

The Job: This agent builds the actual "keys" (fuzz drivers) to test the doors. But since there are no HarmonyOS keys to copy, this agent gets a clever idea: It looks at Android.
The Analogy: HarmonyOS and Android are like cousins; they wear different clothes but have similar family trees. If the robot needs to know how to open a Bluetooth door in HarmonyOS, it looks at how Android opens its Bluetooth doors. It uses a massive library of Android examples as a "cheat sheet" to guess how the HarmonyOS doors work.
The "Coach" (Reinforcement Learning): If the robot builds a key that doesn't fit (a syntax error), a "Coach" steps in. Instead of just saying "wrong," the Coach uses a scoring system to tell the robot, "Try this specific type of key shape next time." The robot learns from its mistakes and gets better at building keys with every attempt.

Agent C: The "Crime Scene Investigator" (Vulnerability Analysis Agent)

The Job: When a test causes the system to crash (like a door jamming or a window shattering), this agent investigates.
The Analogy: In the past, robots just looked at text logs. But HarmonyOS sometimes doesn't give clear text logs. So, this agent takes a photo of the crash (a screenshot) and uses the "super-eyes" AI to describe what happened in the photo.
The Detective Work: It combines the photo description, the text logs, and a database of known crimes (vulnerabilities) to figure out: "Was this a simple mistake, or a real security hole?" It uses a "chain of thought" method, meaning it talks through its reasoning step-by-step before making a conclusion.

3. The Results: What Did They Find?

The team tested their new squad on HarmonyOS 5.0 and found some real security holes that other tools missed.

The Big Win: They found a specific vulnerability in how the system handles SVG images (those are the tiny graphics used in apps). They created a test that fed the system a string of numbers so long it broke the buffer (like trying to pour an ocean into a teacup). The system crashed, revealing a security flaw.
Efficiency: Their team used less computer memory than other tools because they were smarter about how they tested, rather than just brute-forcing everything.
Versatility: They even tested their team on other systems (like PyTorch and TensorFlow) and found new bugs there too, proving the team is good at breaking things in general, not just in HarmonyOS.

Summary

In short, the paper describes a smart, three-part robot team that:

Reads confusing picture-heavy manuals by turning images into text.
Copies ideas from a similar, older system (Android) to build better test keys.
Investigates crashes by analyzing screenshots and logs to find real security holes.

They call their tool HMFuzzer, and it successfully found vulnerabilities in HarmonyOS that other tools couldn't see, all while learning and improving as it went.

Technical Summary: Multi-Agent Cooperative Fuzzing for HarmonyOS APIs

1. Problem Statement

HarmonyOS, a microkernel-based operating system with a unified API framework, has achieved massive deployment across heterogeneous devices. However, its security is threatened by an expanding attack surface, particularly within its APIs. Existing fuzzing tools struggle to effectively test HarmonyOS due to three primary challenges:

Scarcity of Examples: Unlike mature ecosystems, HarmonyOS lacks publicly available API usage examples, making it difficult for automated tools to understand logical structures.
Documentation Limitations: Official developer documentation is often low-quality, image-heavy, and interleaves text with workflow diagrams (e.g., flowcharts, sequence diagrams) that are not machine-readable, hindering semantic extraction.
Crash Analysis Difficulties: The microkernel architecture and asynchronous nature of HarmonyOS APIs result in crash characteristics that differ from conventional OSs. Existing deduplication and classification algorithms often fail, leading to erroneous merging of distinct vulnerabilities or fragmentation of single vulnerabilities.

2. Methodology: HMFuzzer Framework

The authors propose HMFuzzer, a multi-agent cooperative fuzzing framework designed to automate vulnerability identification with minimal human intervention. The framework integrates three collaborative agents:

A. Preprocessing Agent

This agent prepares the input data to overcome documentation and permission barriers:

Multimodal Semantic Alignment: To address the image-heavy documentation, the agent employs three multimodal Large Language Models (LLMs)—Qwen, Llama, and Gemini—to convert API workflow diagrams (JPG/PNG) into textual descriptions. A text-based LLM (DeepSeek) fuses these descriptions to create a final, accurate textual representation, which is then aligned with the original document via file paths.
Permission Extraction: To prevent false positives caused by missing permissions, the agent automatically extracts permission requirements (name, description, level, mode, validity) from official documents and generates a configuration file assigned to the corresponding APIs.

B. Driver Generation Agent

This agent addresses the lack of HarmonyOS-specific examples by leveraging cross-platform knowledge and reinforcement learning:

Android Knowledge Base (RAG): Recognizing the design similarities between HarmonyOS and Android, the system embeds a curated library of 231 Android example codes (covering UI, storage, network, etc.) into a vector database. Using Retrieval-Augmented Generation (RAG), the system retrieves semantically similar Android code snippets to supplement the training data for generating HarmonyOS drivers.
Reinforcement Learning (RL) for Prompt Optimization: To improve driver quality, the agent uses an RL scheme to dynamically select and mutate prompt templates (based on criteria like CRISPE, CO-STAR, etc.). The reward function ( $R$ ) balances syntax correctness, the minimization of errors (warnings, syntax, semantic, linker, preprocessor), and generation time.
Syntax Verification: Generated drivers are compiled using the ArkCompiler. Drivers failing syntax checks are returned to the agent for automated repair guided by the RL-selected prompts.

C. Vulnerability Analysis Agent

This agent analyzes execution results to identify vulnerabilities:

Crash Capture: Due to limitations in log collection on certain HarmonyOS versions, the system captures crash screenshots in addition to logs.
Multimodal Crash Analysis: Screenshots are converted to text via multimodal LLMs. These descriptions, combined with logs and a vulnerability knowledge base (containing known CVEs), are fed into an LLM (DeepSeek) utilizing Chain-of-Thought (CoT) reasoning.
Classification: The agent identifies vulnerability types, cross-validates against known databases, and flags unknown crashes for manual verification.

D. Fuzzing Loop

The system operates in a loop where seeds (API parameter lists) are initialized with energy values. The LLM performs type-aware mutations on these seeds. Seed energy is recalculated based on log output (warnings, errors, fatal errors) and the presence of crashes in screenshots, guiding the selection of the next test cases.

3. Key Contributions

First Fuzzer for HarmonyOS: HMFuzzer is presented as the first tool specifically designed to apply fuzz testing to HarmonyOS APIs.
Cross-Platform Knowledge Transfer: The novel integration of an Android example code library as a knowledge base to compensate for the scarcity of HarmonyOS-specific examples.
Multimodal Documentation Processing: A pipeline using multimodal LLMs to convert image-based workflow diagrams into text, enabling semantic alignment with code generation.
RL-Driven Driver Generation: A reinforcement learning mechanism that dynamically optimizes prompt templates to repair syntax errors and improve driver validity.
Open-Source Implementation: The authors have open-sourced the HMFuzzer code to facilitate practical use and further research.

4. Experimental Results

Experiments were conducted on HarmonyOS Next 5.0 using a Huawei Nova 12 Ultra device, comparing HMFuzzer against baselines fuzz4ALL and TitanFuzz.

Vulnerability Discovery: HMFuzzer successfully detected a known SVG parsing vulnerability (CVE-2024-58115) involving a buffer overflow, which neither baseline tool identified. The baselines failed to generate effective SVG-related drivers due to the lack of specific examples.
Driver Quality: In ablation studies, the integration of modules showed incremental improvements in the number of usable drivers (UD):
- Baseline: 134 UD
- - RL: 157 UD (+17%)
- - RL + Android Examples (AEC): 167 UD (+25%)
- - RL + AEC + Multimodal Generation (MMG): 174 UD (+30%)
LLM Selection: DeepSeek was identified as the most effective model for driver generation, producing 134 valid drivers in 141 iterations, outperforming Qwen (72 valid in 160 iterations) and ChatGPT (106 valid in 236 iterations).
Generalizability: When tested on non-HarmonyOS targets (PyTorch and TensorFlow), HMFuzzer confirmed 2 known and 3 new vulnerabilities in PyTorch, and 4 known and 3 new in TensorFlow.
Efficiency: HMFuzzer demonstrated lower memory usage compared to TitanFuzz and Fuzz4All, attributed to its lightweight random mutation strategy.
Combined Vulnerabilities: 98.25% of vulnerabilities found by HMFuzzer were identified as combined vulnerabilities, significantly higher than the 41.5% found by TitanFuzz.

5. Significance and Claims

The paper claims that HMFuzzer effectively addresses the unique challenges of fuzzing the HarmonyOS ecosystem, specifically the lack of examples and the complexity of multimodal documentation. By leveraging the mature Android ecosystem as a proxy knowledge base and employing multimodal LLMs for documentation parsing, the framework significantly improves driver generation quality and vulnerability discovery efficiency. The authors assert that their approach reduces manual effort while uncovering critical vulnerabilities, including buffer overflows and denial-of-service (DoS) vectors, thereby contributing to the security of the rapidly expanding HarmonyOS ecosystem.