The goal of the work is to survey the options for recovery of unknown application programming interface (API) of black box implementation running on a smartcard. The practical part will design and implement analysis setup using a combination of instruction bruteforcing, generic instrumentation-based fuzzer (AFL) and code execution characteristics obtainable from smartcard probing (response time, response data, error code) including usage of power analysis via digital oscilloscope (power profile of the code executed during input command processing). The goal is to recover the supported commands (INS and other related values from APDU header) as well as and the format of APDU data payload.
The efficiency of the designed setup shall be verified on a testing JavaCard applet with a known interface (e.g., OpenPGP applet) and 1-2 smartcards with an unknown interface.
The thesis will cover the following topics:

• Survey of existing research articles on black-box API discovery methods with a focus on the area of smartcards.
• Extension of APDUFuzzer project with AFL fuzzer combined with power trace analysis recorded by digital oscilloscope.
• Analysis of fuzzing performance to discover the expected apdu payload using an applet(s) with a known interface as ground truth (e.g., OpenPGP or SimpleAPDU).
• Application of fuzzing setup on 1-2 cards with an unknown interface with results interpretation.
• A suggestion of techniques to cluster the same or very similar fuzzing "hits" together and how to extract apdu payload structure based on the hits obtained.
• Suggestions for further optimization of the fuzzing setup.

The resulting implementation shall provide quality and well-documented open-source code and repeatable measurement setup construction.

Literature:
APDUFuzzer project: https://github.com/petrs/pyAPDUFuzzer
Smart Card Handbook, W. Rankl, W. Effing, ISBN-10: 0470743670, Wille, 2010
american fuzzy lop (AFL) http://lcamtuf.coredump.cx/afl/
Picoscope https://www.picotech.com/products/oscilloscope