{
  "added_at": "2026-11-06",
  "arxiv_id": "2006.09809",
  "arxiv_version_reviewed": "v1",
  "authors": [
    "Jan Ruge",
    "Jiska Classen",
    "Francesco Gringoli",
    "Matthias Hollick"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-frankenstein.bib",
  "code_url": null,
  "date_basis": "First arXiv submission date; the arXiv comment names the venue.",
  "date_basis_zh": "arXiv 首次提交日期；arXiv 备注中写明发表场所。",
  "date_precision": "day",
  "description_en": "Frankenstein emulates Bluetooth firmware dumps and fuzzes a virtual modem. It evaluates Broadcom and Cypress stacks, finding three zero-click vulnerabilities, host escalation issues, and BlueFrag on Android.",
  "description_zh": "Frankenstein 仿真蓝牙固件转储，并对虚拟调制解调器进行模糊测试。论文评估了博通和赛普拉斯蓝牙协议栈，发现三个零点击漏洞、涉及主机的权限提升问题，以及 Android 上的 BlueFrag 漏洞。",
  "doi": null,
  "entry_url": "https://awesomerea.org/papers/paper-frankenstein/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-frankenstein/",
  "evidence_urls": [
    "https://arxiv.org/abs/2006.09809"
  ],
  "first_arxiv_date": "2020-06-17",
  "id": "paper-frankenstein",
  "json_url": "https://awesomerea.org/papers/paper-frankenstein/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-frankenstein/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-frankenstein/index.md",
  "metadata_notes": "The arXiv comment reads: To be published at USENIX Security",
  "metadata_notes_zh": "发表场所依据 arXiv 备注。",
  "pdf_url": "https://arxiv.org/pdf/2006.09809",
  "project_url": null,
  "publication_date": "2020-06-17",
  "publication_status": "conference-accepted",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "The evaluation covers Broadcom and Cypress Bluetooth stacks, Wi-Fi/Bluetooth coexistence, a Bluetooth 5.2 link-key flaw, and Android devices.",
  "scope_limitations_zh": "评估范围包括博通和赛普拉斯蓝牙协议栈、Wi-Fi 与蓝牙共存机制、蓝牙 5.2 的链路密钥问题，以及 Android 设备。",
  "targets": [
    "firmware",
    "protocol"
  ],
  "title": "Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets",
  "title_zh": "Frankenstein：利用高级无线模糊测试攻击新的蓝牙权限提升目标",
  "url": "https://arxiv.org/abs/2006.09809",
  "venue": "USENIX Security 2020",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06",
  "why_fits_en": "It uses emulation of closed-source firmware dumps to examine Bluetooth behavior and find vulnerabilities.",
  "why_fits_zh": "论文通过仿真闭源固件转储来分析蓝牙行为并发现漏洞，符合逆向工程主题。",
  "year": 2020
}