Pith. sign in

REVIEW 4 major objections 4 minor 28 references

Side-Channel Aware Fuzzing

T0 review · 4 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Power traces alone can feed fuzzing on OS-less embedded chips.

desk verdict A genuinely new idea — using power side-channel traces as AFL-style coverage feedback for OS-less embedded devices — with a plausible but thin proof of concept that needs a stronger evaluation before the fuzzing claim is fully earned. read the letter →

arxiv 1908.05012 v1 pith:GUYLKFQB submitted 2019-08-14 cs.CR

Philip Sperl , Konstantin Böttinger This is my paper · ORCID
classification cs.CR
keywords side-channelanalysisfuzzingembeddedsystemssecuritypowertracescontrolflowreconstructioncodecoveragebranchdetectionmachinelearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Embedded devices without an operating system cannot easily report which code paths an input exercised, so fuzzers run blind. This paper claims that the power consumption of the chip itself can replace that missing feedback: by watching power traces while inputs are processed, a machine-learning pipeline can detect branch instructions, reconstruct the control-flow graph, and assign each input a coverage score proportional to the number of newly executed basic-block transitions. The authors build a proof of concept on an ARM Cortex-M4, fuzzing synthetic decision-stage software and an AES implementation, and report a maximum correlation of 0.95 between their calculated scores and the true coverage scores. If the claim holds, fuzzing of OS-less embedded firmware no longer has to be purely black-box, because the device's own power draw supplies the coverage signal.

What carries the argument

The load-bearing mechanism is a three-stage pipeline on measured power traces. In stage one, each trace is split into fixed windows aligned to potential branch-instruction starts; a binary classifier (k-nearest neighbours, k=3) decides which windows contain a branch instruction, and a second supervised model estimates the branch's skip distance. Stage two reconstructs the control flow by one of two routes: CFG-RI stacks for each branch a two-dimensional vector of the branch's code offset and the length of the following basic block, while CFG-RII fingerprints each basic block from four features of its trace slice—length, number of peaks, mean, and skewness. Stage three converts the reconstructed transition sequence into a score by counting how many neighbouring basic-block pairs are new, using the same coverage notion as the fuzzer whose metric the paper adopts. The CFG-RI route is precise but propagates errors from a single misclassified distance; CFG-RII is more robust but can suffer fingerprint collisions.

What would settle it

Rerun the same STM32F417 test software with the CPU clock set to a different frequency, such as 72 MHz instead of 84 MHz, feeding the original trained branch-detection and distance models without retraining. If the correlation between computed and true coverage scores drops well below 0.95 or the branch-detection MCC collapses, the fixed-window alignment and the transferability of the supervised models are load-bearing.

Watch

Extended reading notes

Core claim

The central discovery, on the paper's own terms, is that the power side-channel of an embedded processor carries enough information to drive a feedback-based fuzzing loop. Branch instructions mark the borders between basic blocks, and the paper shows experimentally that these branch moments are detectable in power traces with a k-nearest-neighbour classifier, that the distance a branch skips is also leaked through power, and that either branch-distance vectors or fingerprint vectors of the trace segments between branches suffice to reconstruct the executed control flow. From that reconstruction the paper computes for each input a score equal to the number of newly triggered basic-block transitions, mirroring the coverage metric used by a standard coverage-guided fuzzer. The reported proof of concept achieves a maximum correlation coefficient of 0.95 between the computed result trace and the true coverage trace, and on a lightweight AES implementation it detects on average 38 of 41 unique basic-block transitions across 100 encryption runs.

Load-bearing premise

The approach assumes that each branch instruction leaves a separable, learnable signature in the power trace and that the fixed trace windows stay aligned to instruction boundaries; if either fails, neither control-flow reconstruction nor coverage scores can be trusted.

Editorial extensions

If this is right

  • On OS-less embedded devices, fuzzing feedback can be obtained without instrumentation, recompilation, or an operating system, closing the feedback gap that currently forces black-box fuzzing.
  • Coverage scores computed from power traces can be handed to a standard coverage-guided fuzzer, which then prioritizes and mutates the promising inputs to close the fuzzing loop.
  • The branch-distance and fingerprint reconstruction paths give two complementary trade-offs: precise reconstruction with error propagation versus collision-prone but robust fingerprints.
  • The same pipeline applies to real-world code with input-independent control flow such as AES: the framework recovered 38 of 41 static basic-block transitions over 100 encryption runs.
  • Noise-averaging preprocessing through mean or sweep traces consistently improves score quality over single traces, so measurement redundancy is part of the method rather than an optional extra.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper leaves implicit is to test the same windowing and kNN approach on 8-bit or 16-bit microcontrollers, where smaller instruction sets might produce even more separable power signatures; this is testable without new theory.
  • The fixed-window assumption suggests a concrete stress test: introduce clock jitter or an interrupt during measurement. If alignment drifts, both branch detection and distance classification should degrade, and the reported proof-of-concept MCC of 0.78 already leaves headroom for such disturbances.
  • The reliance on a supervised training phase on an identical programmable device implies each target board needs a training twin; whether the learned branch model transfers across boards of the same model with different electrical noise is an open question the paper's transferability discussion leaves to future work.
  • The score metric counts new basic-block transitions, not crash detection, and the authors note that fault detection remains unsolved; a next step would be to extend the same power-trace analysis to recognize reboot sequences as crash signals.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a novel fuzzing feedback mechanism for OS-less embedded devices: instead of relying on instrumentation or an OS, it measures the device's power consumption while it processes each input, extracts features from the power traces, reconstructs the control flow at the basic-block level, and computes a coverage score analogous to AFL's basic-block-transition score. The approach is evaluated on an ARM Cortex-M4 running synthetic decision-stage code and a lightweight AES implementation. The authors report a maximum correlation of 0.95 between calculated and theoretical score traces, and detection of 38 out of 41 unique basic-block transitions in the AES implementation, concluding that the power side-channel carries information relevant for fuzzing.

Significance. If substantiated, the proposal would be a meaningful step toward coverage-guided fuzzing of embedded devices without source code or instrumentation, an area where black-box fuzzing dominates. The paper's contribution is primarily conceptual and methodological: it connects side-channel analysis with fuzzing feedback and provides a test environment and metrics that could serve as a baseline for future work. The core result is not circular: the machine-learning classifiers are trained on separately recorded labeled traces and the computed scores are compared to independently computed theoretical scores. However, the evaluation currently does not establish that the feedback signal is useful for the per-input decisions that coverage-guided fuzzing actually makes, and the real-world experiment on AES is not an input-dependent branch scenario.

major comments (4)
  1. [Section 3.3 and Table 2] The primary quantitative claim (maximum correlation 0.95) is based on Pearson correlation between cumulative 'result-traces'. As defined in Section 3.3, each score is the cumulative number of newly triggered basic-block transitions after the current input, so both the theoretical and calculated traces are monotone nondecreasing sequences. Two such sequences can be highly correlated even when the per-input increments are predicted poorly. Coverage-guided fuzzing, however, relies on the per-input decision of whether a new transition occurred. Please report correlations on the first differences of the score traces, and the precision/recall (or a confusion matrix) for the binary event 'at least one new transition triggered by this input'. The 'crucial errors' metric only counts false negatives (score 0 when a new transition exists) and ignores false positives and wrong magnitudes, so it does not fully characterize the feedback signal.
  2. [Section 4.6] The AES experiment does not demonstrate input-dependent feedback, because the paper states that the AES implementation performs no input-dependent branches. Over 100 encryption runs with random plaintexts, the same sequence of basic-block transitions is executed each time; detecting 38 of 41 transitions is therefore a static characterization of the control flow, not evidence that power traces can distinguish whether a particular input reaches new code. To support the central claim that side-channel feedback is useful for fuzzing, an experiment on code with input-dependent branch behavior is needed, or the paper should explicitly restrict its real-world claim to static control-flow recovery.
  3. [Section 4.4 and Table 2] The evaluation uses a single batch of 100 random inputs, and Table 2 reports point estimates of MSE, correlation, and crucial errors without variance across repeated batches, random seeds, or different input distributions. The differences between preprocessing and reconstruction variants are small and may not be statistically meaningful. Please report the number of runs and confidence intervals, and at minimum state whether the 0.95 maximum correlation is stable across multiple independent batches.
  4. [Section 4.7] The claim in Section 4.7 that 'we suffer no limitations regarding transferability to other RISC-based target devices' is not supported by the presented evidence, which comes from a single DUT. Moreover, the training procedure in Section 3.1 requires an identical and programmable target device, so the cross-device transfer question is non-trivial. This statement should be softened to a conjecture or supported by experiments on at least a second device and a different firmware.
minor comments (4)
  1. [Section 4.7] There is a typo: 'we payed attention' should be 'we paid attention'.
  2. [Section 4.1] The synthetic evaluation code is described as having 48 basic blocks and 60 possible transitions per version, with five versions totaling 300 transitions, but the paper does not report how many of these transitions are actually triggered by the 100 random inputs. A histogram of theoretical scores would make the interpretation of the crucial-errors and correlation metrics much clearer.
  3. [Table 2] The table layout with gray and white shading for majority versus non-majority vote, and the grouping of metrics, is hard to read; a separate table for each metric, or explicit row labels, would improve clarity.
  4. [Section 3.1] The number of free parameters in the pipeline (window size, peak-detection thresholds, MSE threshold, kNN k) is quite large, and the paper does not discuss sensitivity of the final scores to these parameters. A brief robustness discussion or a sensitivity analysis would strengthen the practical applicability of the method.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity; the side-channel-derived scores are validated against independent theoretical coverage ground truth with no fitting to that ground truth.

full rationale

The claimed derivation chain is: power traces -> ML-based branch detection and distance classification or basic-block fingerprinting -> CFG reconstruction -> per-input coverage scores, compared with theoretical scores computed from the known test program. The theoretical scores are never used to train the branch/distance models or to set the preprocessing parameters; the training labels are branch/no-branch windows and branch distances (Section 3.1), and the MSE deduplication threshold is set from noise properties of the DUT (Section 3.5). The 100 random evaluation inputs are separate from the supervised training traces, so the calculated scores are genuine predictions on unseen inputs. No self-citation is load-bearing: prior work is cited only for standard components (AFL scoring, power model, MCC), not to justify the central claim. The paper's own limitations, e.g. that AES has no input-dependent branches (Section 4.6) and that transferability to other RISC targets is an assumption (Section 4.7), affect evidential strength and generalizability, but they do not make any step equivalent to its inputs by construction. The correlation metric is computed on per-input scores, not cumulative counts, so the cumulative-artifact concern does not apply. There is therefore no identified circular step.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim depends on four hand-chosen or fitted parameters and five domain assumptions about power-side-channel learnability, trace alignment, and availability of a training device. No new physical or abstract entities are introduced. The free-parameter count is modest for an empirical ML paper, but the lack of stated values for the MSE threshold, window size, and peak detection limits independent replication.

free parameters (4)
  • kNN neighborhood size k = 3
    Chosen by comparing eight ML algorithms on 50,000 labeled traces; k=3 gives the best Matthews correlation coefficient (0.93) and is used for branch detection in the proof of concept.
  • MSE trace-deduplication threshold = unspecified
    Used to discard duplicate traces before scoring; the authors state it must be derived from the DUT's noise properties but give no calibration procedure, no value, and no sensitivity analysis.
  • Branch-instruction window size = unspecified
    Trace windows are sliced to match the length of one branch instruction characterized in training; this length determines which segments are classified as branches, but the value is not reported.
  • Number of window starts and peak-detection parameters = unspecified
    Power traces are segmented into potential branch starts using peak detection; thresholds and window count are not specified and directly affect all downstream results.
assumptions (5)
  • domain assumption Power consumption of a digital circuit is a sum of instruction-dependent, data-dependent, noise, and constant components.
    Invoked in Section 3.1 to justify detecting branches and distances from power traces; no physical validation specific to this DUT is given beyond qualitative figures.
  • domain assumption Branch instructions produce power signatures that are learnable and separable from other instructions with supervised ML.
    The entire branch detection step assumes a trained classifier generalizes from labeled training traces to unseen test traces on the same MCU; this is empirically supported by an MCC of 0.78 but not proven across devices.
  • domain assumption The CPU computes branch distance by adding a data-dependent value to the program counter, and that data dependency is observable in power consumption.
    Section 3.1 uses this to justify branch distance classification; Figure 6 shows two example traces but no quantitative leakage assessment.
  • domain assumption A precise trigger based on the system clock aligns all traces, and fixed windows correspond to instruction boundaries.
    Section 3.4 states traces need to be aligned and uses a clock-based trigger; if alignment drifts, window-based branch detection and fingerprinting fail.
  • domain assumption An identical, programmable training device is available for supervised model training.
    Section 3.1 requires a training device to generate labeled traces; this is a realistic but restrictive assumption for black-box security testing, where an identical device may not be available.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Side-Channel Aware Fuzzing." pith.science (2026). https://pith.science/paper/GUYLKFQB

@misc{pith2026190805012,
  author       = {Pith},
  title        = {Pith review of: Side-Channel Aware Fuzzing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GUYLKFQB}},
  note         = {Machine review of arXiv:1908.05012}
}
read the original abstract

Software testing is becoming a critical part of the development cycle of embedded devices, enabling vulnerability detection. A well-studied approach of software testing is fuzz-testing (fuzzing), during which mutated input is sent to an input-processing software while its behavior is monitored. The goal is to identify faulty states in the program, triggered by malformed inputs. Even though this technique is widely performed, fuzzing cannot be applied to embedded devices to its full extent. Due to the lack of adequately powerful I/O capabilities or an operating system the feedback needed for fuzzing cannot be acquired. In this paper we present and evaluate a new approach to extract feedback for fuzzing on embedded devices using information the power consumption leaks. Side-channel aware fuzzing is a threefold process that is initiated by sending an input to a target device and measuring its power consumption. First, we extract features from the power traces of the target device using machine learning algorithms. Subsequently, we use the features to reconstruct the code structure of the analyzed firmware. In the final step we calculate a score for the input, which is proportional to the code coverage. We carry out our proof of concept by fuzzing synthetic software and a light-weight AES implementation running on an ARM Cortex-M4 microcontroller. Our results show that the power side-channel carries information relevant for fuzzing.

Figures

Figures reproduced from arXiv: 1908.05012 by the authors.

Figure 1
Figure 1. Side-channel driven fuzzing feedback loop. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Illustration of the two control flow reconstruction algorithms and the [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Overview of the building blocks of side-channel aware fuzzing. [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Four power traces measured during the execution of the same instructions, [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Power trace during the branch detection, consisting of a peak detection [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 6
Figure 6. Figure 6: Two power traces during the execution of two branches with different [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 24 canonical work pages

  1. [1]

    In: 2014 International Conference on High Performance Computing Simulation (HPCS)

    Alimi, V., Vernois, S., Rosenberger, C.: Analysis of Embedded Applications By Evolutionary Fuzzing. In: 2014 International Conference on High Performance Computing Simulation (HPCS). pp. 551–557 (July 2014)

    work page 2014

  2. [2]

    http://infocenter.arm

    Arm Holdings: Cortex-M4 Technical Reference Manual. http://infocenter.arm. com/help/topic/com.arm.doc.ddi0439b/DDI0439B cortex m4 r0p0 trm.pdf

    work page

  3. [3]

    In: Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation

    Cadar, C., Dunbar, D., Engler, D.: Klee: Unassisted and automatic generation of high-coverage tests for complex systems programs. In: Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation. pp. 209–

    work page

  4. [4]

    In: Proceedings of the 25th International Symposium on Software Testing and Analysis

    Callan, R., Behrang, F., Zajic, A., Prvulovic, M., Orso, A.: Zero-overhead Pro- filing via EM Emanations. In: Proceedings of the 25th International Symposium on Software Testing and Analysis. pp. 401–412. ISSTA 2016, ACM, New York, NY, USA (2016). https://doi.org/10.1145/2931037.2931065, http://doi.acm.org/ 10.1145/2931037.2931065

    arXiv 2016

  5. [5]

    In: 27th USENIX Security Sym- posium (USENIX Security 18)

    Corteggiani, N., Camurati, G., Francillon, A.: Inception: System-wide security test- ing of real-world embedded systems software. In: 27th USENIX Security Sym- posium (USENIX Security 18). pp. 309–326. USENIX Association, Baltimore, Side-Channel Aware Fuzzing 19 MD (2018), https://www.usenix.org/conference/usenixsecurity18/presentation/ corteggiani

    work page 2018

  6. [6]

    In: Presented as part of the 22nd USENIX Security Symposium (USENIX Security 13)

    Davidson, D., Moench, B., Ristenpart, T., Jha, S.: FIE on firmware: Finding vulner- abilities in embedded systems using symbolic execution. In: Presented as part of the 22nd USENIX Security Symposium (USENIX Security 13). pp. 463–478. USENIX, Washington, D.C. (2013), https://www.usenix.org/conference/usenixsecurity13/ technical-sessions/paper/davidson

    work page 2013

  7. [7]

    In: IEEE Symposium on Security and Privacy

    Dolan-Gavitt, B., Hulin, P., Kirda, E., Leek, T., Mambretti, A., Robertson, W.K., Ulrich, F., Whelan, R.: Lava: Large-scale automated vulnerability addition. In: IEEE Symposium on Security and Privacy. pp. 110–121. IEEE Computer Society (2016)

    work page 2016

  8. [8]

    In: Network and Distributed System Security (NDSS) Symposium

    Godefroid, P., Levin, M.Y., Molnar, D.: Automated Whitebox Fuzz Testing. In: Network and Distributed System Security (NDSS) Symposium. NDSS 08 (2008)

    work page 2008

Show all 28 references
  1. [9]

    In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communi- cations Security

    Han, Y., Etigowni, S., Liu, H., Zonouz, S., Petropulu, A.: Watch me, but don’t touch me! contactless control flow monitoring via electromagnetic emanations. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communi- cations Security. pp. 1095–1108. ACM (2017)

    2017

  2. [10]

    Morgan Kaufmann Publishers Inc., San Francisco, CA, USA, 5th edn

    Hennessy, J.L., Patterson, D.A.: Computer Architecture, Fifth Edition: A Quan- titative Approach. Morgan Kaufmann Publishers Inc., San Francisco, CA, USA, 5th edn. (2011)

    2011

  3. [11]

    Microsoft Press, Red- mond, WA, USA (2006)

    Howard, M., Lipner, S.: The Security Development Lifecycle. Microsoft Press, Red- mond, WA, USA (2006)

    2006

  4. [12]

    In: Proceedings of the 19th Annual International Cryptology Conference on Advances in Cryptology

    Kocher, P.C., Jaffe, J., Jun, B.: Differential Power Analysis. In: Proceedings of the 19th Annual International Cryptology Conference on Advances in Cryptology. pp. 388–397. CRYPTO ’99, Springer-Verlag, Berlin, Heidelberg (1999)

    1999

  5. [13]

    In: Proceedings of the 2010 IEEE Symposium on Security and Privacy

    Koscher, K., Czeskis, A., Roesner, F., Patel, S., Kohno, T., Checkoway, S., McCoy, D., Kantor, B., Anderson, D., Shacham, H., Savage, S.: Experimental Security Analysis of a Modern Automobile. In: Proceedings of the 2010 IEEE Symposium on Security and Privacy. pp. 447–462. SP ...

    2010 doi

  6. [14]

    In: 2015 IEEE 29th International Conference on Advanced Information Networking and Applications

    Lee, H., Choi, K., Chung, K., Kim, J., Yim, K.: Fuzzing CAN Packets into Auto- mobiles. In: 2015 IEEE 29th International Conference on Advanced Information Networking and Applications. pp. 817–821 (March 2015)

    2015

  7. [15]

    Springer-Verlag, Berlin, Heidelberg (2007)

    Mangard, S., Oswald, E., Popp, T.: Power Analysis Attacks: Revealing the Se- crets of Smart Cards (Advances in Information Security). Springer-Verlag, Berlin, Heidelberg (2007)

    2007

  8. [16]

    Biochimica et Biophysica Acta (BBA) - Protein Structure 405(2), 442 – 451 (1975)

    Matthews, B.: Comparison of the predicted and observed secondary structure of T4 phage lysozyme. Biochimica et Biophysica Acta (BBA) - Protein Structure 405(2), 442 – 451 (1975)

    1975

  9. [17]

    In: Huang, X., Zhou, J

    Msgna, M., Markantonakis, K., Mayes, K.: Precise instruction-level side channel profiling of embedded processors. In: Huang, X., Zhou, J. (eds.) Information Se- curity Practice and Experience. pp. 129–143. Springer International Publishing, Cham (2014)

    2014

  10. [18]

    In: Network and Distributed System Security (NDSS) Symposium

    Muench, M., Stijohann, J., Kargl, F., Francillon, A., Balzarotti, D.: What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices. In: Network and Distributed System Security (NDSS) Symposium. NDSS 18 (February 2018)

    2018

  11. [19]

    NIST FIPS PUB 197 (2001) 20 P

    National Institute of Standards and Technology: Advanced encryption standard. NIST FIPS PUB 197 (2001) 20 P. Sperl, K. B¨ ottinger

    2001

  12. [20]

    In: 2015 13th Annual Conference on Privacy, Security and Trust (PST)

    Papp, D., Ma, Z., Buttyan, L.: Embedded systems security: Threats, vulnerabili- ties, and attack taxonomy. In: 2015 13th Annual Conference on Privacy, Security and Trust (PST). pp. 145–152 (July 2015)

    2015

  13. [21]

    Powers, D.: Evaluation: From Precision, Recall and F-Factor to ROC, Informed- ness, Markedness & Correlation (2011)

    2011

  14. [22]

    Proceedings of the IRE 37(1), 10–21 (Jan 1949)

    Shannon, C.E.: Communication in the presence of noise. Proceedings of the IRE 37(1), 10–21 (Jan 1949)

    1949

  15. [23]

    https://www.st.com/resource/en/ datasheet/dm00035129.pdf

    STMicroelectronics: STM32F417xx Datasheet. https://www.st.com/resource/en/ datasheet/dm00035129.pdf

  16. [24]

    In: 2015 Design, Automation Test in Europe Conference Exhibition (DATE)

    Strobel, D., Bache, F., Oswald, D., Schellenberg, F., Paar, C.: SCANDALee: A side- ChANnel-based DisAssembLer using local electromagnetic emanations. In: 2015 Design, Automation Test in Europe Conference Exhibition (DATE). pp. 139–144 (March 2015)

    2015

  17. [25]

    In: D’Agostino, G., Scala, A

    Van Aubel, P., Papagiannopoulos, K., Chmielewski, L., Doerr, C.: Side-channel based intrusion detection for industrial control systems. In: D’Agostino, G., Scala, A. (eds.) Critical Information Infrastructures Security. pp. 207–224. Springer In- ternational Publishing, Cham (2018)

    2018

  18. [26]

    In: NDSS 2014, Network and Distributed System Security Symposium, 23- 26 February 2014, San Diego, USA

    Zaddach, J., Bruno, L., Francillon, A., Balzarotti, D.: AVATAR: A frame- work to support dynamic security analysis of embedded systems’ firmwares. In: NDSS 2014, Network and Distributed System Security Symposium, 23- 26 February 2014, San Diego, USA. San Diego, UNITED STATES (0...

    2014

  19. [27]

    http://lcamtuf.coredump.cx/afl/

    Zalewski, M.: American Fuzzy Lop. http://lcamtuf.coredump.cx/afl/

  20. [224]

    org/citation.cfm?id=1855741.1855756

    OSDI’08, USENIX Association, Berkeley, CA, USA (2008), http://dl.acm. org/citation.cfm?id=1855741.1855756

    2008

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.