Pith. sign in

REVIEW 4 major objections 5 minor 56 references

This paper claims that electromagnetic side-channel traces can reliably guide black-box firmware fuzzing as a coverage proxy, without needing binary extraction, instrumentation, or accurate emulation.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

EM side-channel traces, aligned with dynamic time warping, provide a coverage-like signal that guides black-box firmware fuzzing to higher code coverage than random fuzzing.

T0 review reviewed 2026-08-01 challenge →

load-bearing objection A genuinely new EM-side-channel fuzzing feedback path, but the evaluation doesn't isolate the EM signal from the scheduler, so the headline claim is not yet proven. the 4 major comments →

arxiv 2607.16487 v1 pith:MCZ756HA submitted 2026-07-17 cs.CR

Fuzz'EMup: Leveraging EM Side-Channel Emanation to Guide Black-Box Embedded Firmware Fuzzing

Fatemeh Moradihaghighi , Zihao Zhan , Yanan Guo , Ziming Zhao , Mashrur Chowdhury , Zhenkai Zhang This is my paper
classification cs.CR
keywords embedded firmware fuzzingEM side-channelblack-box fuzzingcoverage proxydynamic time warpingdivergence treeIoT securityfuzzing guidance
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a fuzzer can use electromagnetic (EM) side-channel traces as a coverage proxy when firmware cannot be extracted, instrumented, or accurately emulated. Because raw EM traces are noisy and timing-jittered, the authors filter each trace to a frequency band with strong idle-to-active contrast, align traces with dynamic time warping, and detect where the warping offset begins drifting persistently—the point where control flow diverges. These divergence points are organized in a tree so new inputs are compared only against a few representative traces, keeping the comparison cost scalable. On four real firmware targets, EM-guided selection reaches higher instruction and edge coverage with fewer inputs than unguided random selection, and discovers code regions random fuzzing misses. If true, this makes coverage-like guidance available in settings previously limited to inefficient black-box fuzzing.

Core claim

The central claim is that sustained drift in the dynamic time warping offset between an EM trace and a previously observed reference trace marks a genuine control-flow divergence, and that using these divergence times as a coverage proxy can guide a black-box fuzzer. On four bare-metal microcontroller firmware targets spanning parser, control-loop, and DMA-driven code, EM-guided selection outperforms random selection under identical mutation operators: higher final instruction and edge coverage, lower input count to reach baseline coverage, and substantially higher novelty hit-rate, defined as the fraction of inputs reaching previously unseen instructions or edges. The method never observes

What carries the argument

The central mechanism is the DTW-based divergence detector. After band-pass filtering and demodulating the EM trace into an activity envelope, dynamic time warping—a standard alignment that stretches or compresses time axes to match similar signals—aligns a candidate trace to a node representative. The offset profile offset[k]=i_k−j_k is monitored across the warping path, and a sustained change in its local mean, computed with a pre-window and post-window of length L and threshold τ, marks the divergence time. A divergence tree organizes traces by these divergence times so each insertion aligns only along one root-to-leaf path, and a multi-armed bandit scheduler (ε-greedy with Upper Confiden

Load-bearing premise

The load-bearing premise is that the DTW offset-drift detector, with its unspecified window length L and threshold τ, reliably separates genuine control-flow divergence from noise and jitter, and that the rehosted emulator used to measure ground-truth coverage faithfully reproduces hardware execution; if either gives way the central claim collapses.

What would settle it

Replay a set of inputs where the true execution path is known—some pairs that definitely execute identical code and some that definitely diverge—and test whether the sustained-drift criterion with the paper's chosen L and τ separates them without false positives or false negatives. The paper does not report such a calibration experiment, nor does it specify concrete values for τ and L; an independent run that fails to separate known same-path and different-path traces would disprove the coverage proxy.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If EM guidance works as reported, coverage-like fuzzing becomes possible on devices with read-out protection, encrypted firmware, or proprietary cores, where existing coverage methods are unavailable.
  • The divergence tree keeps per-input comparison cost roughly constant as the corpus grows, making the guidance scalable to long fuzzing campaigns.
  • Because the same mutation operators and initial seeds are used in both modes, the measured coverage gains are attributable to seed selection driven by EM divergence, not to differences in mutation.
  • The paper reports that inputs discarded by the divergence tree, when replayed separately, add no additional coverage; this suggests the divergence criterion is not over-eagerly accepting redundant inputs.
  • The approach is application-agnostic and depends mainly on EM emission sensitivity, so it should extend to other microcontroller firmware beyond the four evaluated targets.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • An obvious extension the authors leave implicit is testing whether EM-guided coverage actually translates into more discovered bugs; injecting known vulnerabilities and measuring detection rates would connect the coverage gains to security outcomes.
  • The method uses only an external probe and a serial bridge, so it could plausibly be combined with conventional black-box signals such as resets, timeouts, or output codes to build a fully unattended black-box fuzzer; the paper deliberately omits those signals from the guidance.
  • The divergence tree could serve as a state machine for regression testing or replay: inputs that branch at the same point form equivalence classes, which might help deduplicate failures and triage crashes in black-box settings.
  • The one-time frequency-band and probe-position calibration could likely be automated, reducing setup effort and making the method easier to deploy across different boards.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes Fuzz'EMup, a black-box embedded-firmware fuzzer that uses EM side-channel emanations as a coverage proxy. The pipeline selects an informative carrier band via an idle/active Welch t-statistic, converts each trace to a band-limited envelope, aligns traces with banded DTW, and detects sustained divergence from the DTW offset profile. Executions are organized in a divergence tree to keep comparison costs sublinear. A scheduler combining four node-selection strategies with an ε-greedy + UCB bandit chooses which seeds to mutate. The evaluation runs four real firmware targets on an STM32L476RG board, compares EM-guided selection against uniform random selection, and measures coverage by replaying hardware inputs in a custom QEMU model. The paper claims that EM-derived feedback yields higher instruction and edge coverage, reaches baseline coverage with fewer inputs, and produces a higher novelty hit-rate than unguided fuzzing.

Significance. If the causal claim is confirmed, this would be a meaningful step for black-box embedded fuzzing: guidance from a physical side channel without binary extraction, instrumentation, or accurate emulation, with a scalable trace-indexing scheme. The paper has real strengths: it uses physical hardware and EM capture, it attempts an independent QEMU-based coverage ground truth, and it keeps mutation operators and initial seeds matched between modes. The divergence-tree idea is a sensible answer to the scalability challenge. However, the current evidence does not yet isolate the EM feedback from the scheduler, and the load-bearing DTW parameters are undisclosed. These issues are fixable with additional experiments and disclosures, but they are central to the paper's claim.

major comments (4)
  1. [§5.2 and §4.4] The treatment differs from the control in two variables simultaneously. EM-guided mode consists of the DTW divergence tree plus the ε-greedy/UCB scheduler and four node-selection strategies; the 'random unguided' baseline is uniform random seed selection without any tree. The observed coverage gains could be due entirely to the scheduler, e.g., the frontier-leaf and most-descendants heuristics diversify exploration even if the tree topology carried no EM information. The statement in §5.2.2 that mutation operators, initial seeds, and budget are identical does not isolate the EM signal. Please add a control condition in which the same scheduler runs on a tree whose node assignments are random or on a round-robin selector over the same nodes, and show that EM-derived topology is necessary for the gains.
  2. [§4.2–§4.4] The offset-drift detector is load-bearing, but τ, L, the Sakoe–Chiba half-width W, the divergence-time proximity window, and the scheduler hyperparameters ε, c, α, λ, k are never specified or justified. The text says L is 'small' and W is 'large enough to cover typical jitter with a safety margin,' which is not a calibration procedure. If τ and L were chosen using the same targets' QEMU coverage, the evaluation is circular; if chosen a priori, report values and sensitivity. Without this, the claimed reliability of the 'sustained divergence' signal cannot be assessed or reproduced.
  3. [§5.2, Table 3] The empirical basis is a single run per mode. No repeated runs, variance, or confidence intervals are reported, and Table 3 omits the EM-guided row for Soldering Station — the only target for which the 'consistent' claim is therefore not directly shown. The CNC unique-instruction gap (989 vs. 8) is large but, without variance or a complete table, could be a stochastic artifact or a reporting omission. Please report all rows and provide repeated runs or otherwise justify that the observed gap cannot be attributed to randomness.
  4. [§5.1] Coverage ground truth comes from replaying hardware inputs in a custom QEMU STM32L476RG model. No validation of the model's fidelity is given (e.g., matching UART/DMA/timer behavior or instruction traces on a known input). If the model diverges from hardware, all coverage numbers and therefore the central comparison are unreliable. Please validate the model, or at minimum document the modeled peripherals and show that representative inputs produce the same control flow as on hardware.
minor comments (5)
  1. [§4] In the Challenge 2 heading, 'divregence' should be 'divergence'.
  2. [§4.1] 'Welcht' should be 'Welch'. Equation (1) is also typeset incorrectly: 'µact(f)−µ idle(f)s' appears garbled and the denominator needs parentheses and a radical.
  3. [§4.3] The 'microsecond-scale window' for divergence proximity is described qualitatively. A concrete value or derivation would improve reproducibility.
  4. [Figure 7] The legend uses 'tree' where 'EM-guided' is clearer, and the y-axis scales differ across subplots. Please state this explicitly or use normalized axes so cross-target comparisons are not misleading.
  5. [References] Reference [4] contains the placeholder 'accessed: YYYY-MM-DD' and should be completed.

Circularity Check

0 steps flagged

No significant circularity: the EM-derived divergence signal is an independent heuristic, and coverage is measured externally in QEMU; remaining weaknesses (unspecified DTW thresholds, single-run evaluation, scheduler-vs-EM confound) are methodological limitations, not circular reductions.

full rationale

The derivation chain is self-contained. The guidance signal is an independent heuristic: divergence is detected from the DTW warping-path offset profile and is never fitted to, or defined in terms of, the QEMU instruction/edge coverage used for evaluation. Band selection (Eq. 1) is calibrated on idle-vs-active contrast, not on coverage. The tree and the ε-greedy+UCB scheduler optimize a reward defined as 'new child in the divergence tree' (an EM-derived novelty signal), and the paper checks externally via QEMU replay whether EM-novel inputs correspond to new instructions/edges (§5.2.2). The authors' self-citations [27]–[29] are background evidence for EM information leakage and are not load-bearing for the DTW divergence detector or the evaluation. The remaining issues are validity concerns, not circularity: the DTW threshold τ and window L in §4.2 are never specified (so their tuning status is unknown; if tuned on the targets, the evaluation could be partially forced), the evaluation appears single-run without repeated trials, Table 3 omits the EM-guided row for Soldering Station, and the §5.2 comparison conflates the EM divergence tree with the sophisticated node-selection/scheduling policy (the 'random unguided selection' baseline uses only uniform random seed selection, so coverage gains cannot be attributed to EM information alone without a control-tree ablation). These are attribution and reporting limitations, not instances of a prediction being equivalent to its inputs by construction.

Axiom & Free-Parameter Ledger

6 free parameters · 3 axioms · 0 invented entities

The method rests on signal-processing choices and evaluation infrastructure. The free parameters are mostly unreported, and the key divergence threshold is load-bearing. No new physical or conceptual entities are invented.

free parameters (6)
  • Carrier frequency f_c = ~15 MHz for the representative trace
    Chosen per device via Welch t-statistic between idle and active signals; a design choice, not coverage-fitted.
  • DTW Sakoe-Chiba band half-width W = not reported
    Chosen to cover typical jitter; value not given, affects alignment and cost.
  • Offset window length L = not reported
    Controls smoothing scale of the divergence detector; load-bearing but unspecified.
  • Divergence threshold τ = not reported
    Threshold on Δµ[k] that determines when a sustained divergence is recorded; the core of the coverage proxy, unspecified.
  • Divergence tree proximity window = described as microsecond-scale, exact value not reported
    Window for descending to existing children; derived from clock frequency and trace resolution, but no concrete value.
  • Scheduler hyperparameters ε, c, α, λ, k = not reported
    UCB exploration constant, node score weights, and top-k sizes are not specified.
axioms (3)
  • domain assumption EM emanations of the MCU correlate sufficiently with firmware instruction/control-flow activity to distinguish different execution paths.
    Stated in §4 as the core assumption of the approach; standard in side-channel analysis but not proven for these targets.
  • ad hoc to paper The DTW offset-drift detector with threshold τ and window L reliably separates genuine control-flow divergence from noise and timing jitter.
    §4.2 introduces this heuristic without specifying τ/L or demonstrating robustness across noise levels.
  • domain assumption The custom QEMU model of the STM32L476RG faithfully reproduces the hardware execution behavior for the measured inputs.
    §5 states they added a custom board model to QEMU for coverage evaluation; accuracy is not validated against hardware-level ground truth.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Fuzz'EMup: Leveraging EM Side-Channel Emanation to Guide Black-Box Embedded Firmware Fuzzing." pith.science (2026). https://pith.science/paper/MCZ756HA

@misc{pith2026260716487,
  author       = {Pith},
  title        = {Pith review of: Fuzz'EMup: Leveraging EM Side-Channel Emanation to Guide Black-Box Embedded Firmware Fuzzing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MCZ756HA}},
  note         = {Machine review of arXiv:2607.16487}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

As IoT and embedded devices proliferate across various domains, securing their firmware has become critical. Fuzzing offers a systematic approach to uncovering vulnerabilities in firmware, and coverage feedback can improve its effectiveness by guiding exploration. However, many devices make coverage information impossible to obtain by preventing firmware extraction, instrumentation, or accurate emulation; in such cases, testers are left with only inefficient black-box fuzzing. In this paper, we present an approach that leverages electromagnetic (EM) side-channel emanations to guide firmware fuzzing in purely black-box settings. However, turning raw EM measurements into reliable guidance is challenging: EM traces are noisy, and timing jitter causes corresponding features in different traces to shift in time. We address these challenges by combining frequency band selection based on the activity-to-idle signal contrast with dynamic time warping to align per-input traces and detect sustained divergence, while maintaining scalability by organizing executions in a tree structure based on their divergence times. We evaluate our approach on four real firmware targets and demonstrate that EM-derived feedback enhances path exploration, yielding higher code coverage than unguided fuzzing.

Figures

Figures reproduced from arXiv: 2607.16487 by Fatemeh Moradihaghighi, Mashrur Chowdhury, Yanan Guo, Zhenkai Zhang, Zihao Zhan, Ziming Zhao.

Figure 1
Figure 1. Figure 1: Engine sends inputs to the Pi; the Pi forwards via UART to [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Welch statistic |t(f)| over frequency for a representative trace. The peak near 15 MHz marks a band with strong separation between idle and active states. the execution-related bursts are less pronounced, so the correlation with the activation window is weaker and the underlying shape is less well preserved [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Demodulated envelopes at (a) 15 MHz and (b) 78 MHz, and [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: DTW-aligned divergence example. (a–b) Aligned reference and [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Per-input wall-clock time for (a) EM-guided clustering and (b) [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: shows the experimental setup we used to col￾lect the electromagnetic side channel traces. The inputs are sent over UART from a Raspberry Pi bridge, which simultaneously triggers EM capture on a Rigol MHO5104. The signal is measured with an RF-R 50-1 H-field probe positioned at the MCU’s rear-left corner, where the mea￾surment has the highest SNR. The probe output is ampli￾fied using a PA-306 with a 30 dB g… view at source ↗
Figure 7
Figure 7. Figure 7: Coverage growth vs. inputs for EM-guided vs. Random selections. Y-axes differ across subplots. [PITH_FULL_IMAGE:figures/full_fig_p009_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

56 extracted references

  1. [1]

    What you corrupt is not what you crash: Challenges in fuzzing embedded devices

    M. Muench, J. Stijohann, F. Kargl, A. Francillon, and D. Balzarotti, “What you corrupt is not what you crash: Challenges in fuzzing embedded devices.” inNDSS, 2018

    2018

  2. [2]

    Fuzzing: a survey for roadmap,

    X. Zhu, S. Wen, S. Camtepe, and Y . Xiang, “Fuzzing: a survey for roadmap,”ACM Computing Surveys (CSUR), vol. 54, no. 11s, pp. 1–36, 2022

    2022

  3. [3]

    Sutton, A

    M. Sutton, A. Greene, and P. Amini,Fuzzing: brute force vulner- ability discovery. Pearson Education, 2007

    2007

  4. [4]

    American fuzzy lop (afl),

    M. Zalewski, “American fuzzy lop (afl),” https://github.com/ google/AFL, 2013, accessed: YYYY-MM-DD

    2013

  5. [5]

    {SHiFT}: Semi- hosted fuzz testing for embedded applications,

    A. Mera, C. Liu, R. Sun, E. Kirda, and L. Lu, “{SHiFT}: Semi- hosted fuzz testing for embedded applications,” in33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 5323–5340

    2024

  6. [6]

    {HALucinator}: Firmware re-hosting through abstraction layer emulation,

    A. A. Clements, E. Gustafson, T. Scharnowski, P. Grosen, D. Fritz, C. Kruegel, G. Vigna, S. Bagchi, and M. Payer, “{HALucinator}: Firmware re-hosting through abstraction layer emulation,” in29th USENIX Security Symposium (USENIX Security 20), 2020, pp. 1201–1218

    2020

  7. [7]

    Toward the analysis of embedded firmware through auto- mated re-hosting,

    E. Gustafson, M. Muench, C. Spensky, N. Redini, A. Machiry, Y . Fratantonio, D. Balzarotti, A. Francillon, Y . R. Choe, C. Kruegel et al., “Toward the analysis of embedded firmware through auto- mated re-hosting,” in22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019), 2019, pp. 135– 150

    2019

  8. [8]

    Unicorefuzz: On the viability of emulation for kernelspace fuzzing,

    D. Maier, B. Radtke, and B. Harren, “Unicorefuzz: On the viability of emulation for kernelspace fuzzing,” in13th USENIX workshop on offensive technologies (WOOT 19), 2019

    2019

  9. [9]

    Dynamic taint analysis for auto- matic detection, analysis, and signaturegeneration of exploits on commodity software

    J. Newsome and D. X. Song, “Dynamic taint analysis for auto- matic detection, analysis, and signaturegeneration of exploits on commodity software.” inNDSS, vol. 5, 2005, pp. 3–4

    2005

  10. [10]

    Iot security: An end-to-end view and case study,

    Z. Ling, K. Liu, Y . Xu, C. Gao, Y . Jin, C. Zou, X. Fu, and W. Zhao, “Iot security: An end-to-end view and case study,” in2017 IEEE Global Communications Conference (GLOBECOM). IEEE, 2017, pp. 1–6

    2017

  11. [11]

    Understanding the security of discrete gpus,

    Z. Zhu, S. Kim, Y . Rozhanski, Y . Hu, E. Witchel, and M. Silber- stein, “Understanding the security of discrete gpus,” inProceedings of the General Purpose GPUs, 2017, pp. 1–11

    2017

  12. [12]

    Vuzzer: Application-aware evolutionary fuzzing,

    S. Rawat, V . Jain, A. Kumar, L. Cojocar, C. Giuffrida, and H. Bos, “Vuzzer: Application-aware evolutionary fuzzing,” in 2017 Network and Distributed System Security (NDSS) Sympo- sium:[Proceedings]. Internet Society, 2017, pp. 1–14

    2017

  13. [13]

    Directed greybox fuzzing,

    M. B ¨ohme, V .-T. Pham, M.-D. Nguyen, and A. Roychoudhury, “Directed greybox fuzzing,” inProceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017, pp. 2329–2344

    2017

  14. [14]

    Fuzzing: a survey,

    J. Li, B. Zhao, and C. Zhang, “Fuzzing: a survey,”Cybersecurity, vol. 1, no. 1, p. 6, 2018

    2018

  15. [15]

    {AFL++}: Combining incremental steps of fuzzing research,

    A. Fioraldi, D. Maier, H. Eißfeldt, and M. Heuse, “{AFL++}: Combining incremental steps of fuzzing research,” in14th USENIX workshop on offensive technologies (WOOT 20), 2020

    2020

  16. [16]

    Coverage-based greybox fuzzing as markov chain,

    M. B ¨ohme, V .-T. Pham, and A. Roychoudhury, “Coverage-based greybox fuzzing as markov chain,” inProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, pp. 1032–1043

    2016

  17. [17]

    Arm-afl: coverage-guided fuzzing framework for arm-based iot devices,

    R. Fan, J. Pan, and S. Huang, “Arm-afl: coverage-guided fuzzing framework for arm-based iot devices,” inInternational Conference on Applied Cryptography and Network Security. Springer, 2020, pp. 239–254

    2020

  18. [18]

    Periscope: An effective probing and fuzzing framework for the hardware- os boundary,

    D. Song, F. Hetzelt, D. Das, C. Spensky, Y . Na, S. V olckaert, G. Vigna, C. Kruegel, J.-P. Seifert, and M. Franz, “Periscope: An effective probing and fuzzing framework for the hardware- os boundary,” in2019 Network and Distributed Systems Security Symposium (NDSS). Internet Society, 2019, pp. 1–15

    2019

  19. [19]

    {PHMon}: A programmable hardware monitor and its security use cases,

    L. Delshadtehrani, S. Canakci, B. Zhou, S. Eldridge, A. Joshi, and M. Egele, “{PHMon}: A programmable hardware monitor and its security use cases,” in29th USENIX Security Symposium (USENIX Security 20), 2020, pp. 807–824

    2020

  20. [20]

    Os-less dynamic binary instrumentation for embedded firmware,

    J. Oh, S. Kim, E. Jeong, and S.-M. Moon, “Os-less dynamic binary instrumentation for embedded firmware,” in2015 IEEE Symposium in Low-Power and High-Speed Chips (COOL CHIPS XVIII). IEEE, 2015, pp. 1–3

    2015

  21. [21]

    {P2IM}: Scalable and hardware- independent firmware testing via automatic peripheral interface modeling,

    B. Feng, A. Mera, and L. Lu, “{P2IM}: Scalable and hardware- independent firmware testing via automatic peripheral interface modeling,” in29th USENIX Security Symposium (USENIX Security 20), 2020, pp. 1237–1254

    2020

  22. [22]

    Dice: Automatic emulation of dma input channels for dynamic firmware analysis,

    A. Mera, B. Feng, L. Lu, and E. Kirda, “Dice: Automatic emulation of dma input channels for dynamic firmware analysis,” in2021 IEEE Symposium on Security and Privacy (SP). IEEE, 2021, pp. 1938–1954

    2021

  23. [23]

    Towards automated dynamic analysis for linux-based embedded firmware

    D. D. Chen, M. Woo, D. Brumley, and M. Egele, “Towards automated dynamic analysis for linux-based embedded firmware.” inNDSS, vol. 1, 2016, pp. 1–1

    2016

  24. [24]

    {FIRM-AFL}:{High-Throughput}greybox fuzzing of{IoT} firmware via augmented process emulation,

    Y . Zheng, A. Davanian, H. Yin, C. Song, H. Zhu, and L. Sun, “{FIRM-AFL}:{High-Throughput}greybox fuzzing of{IoT} firmware via augmented process emulation,” in28th USENIX Security Symposium (USENIX Security 19), 2019, pp. 1099–1114

    2019

  25. [25]

    Iotfuzzer: Discovering memory corruptions in iot through app-based fuzzing

    J. Chen, W. Diao, Q. Zhao, C. Zuo, Z. Lin, X. Wang, W. C. Lau, M. Sun, R. Yang, and K. Zhang, “Iotfuzzer: Discovering memory corruptions in iot through app-based fuzzing.” inNDSS, 2018, pp. 1–15

    2018

  26. [26]

    Experimental demonstration of elec- tromagnetic information leakage from modern processor-memory systems,

    A. Zaji ´c and M. Prvulovic, “Experimental demonstration of elec- tromagnetic information leakage from modern processor-memory systems,”IEEE Transactions on Electromagnetic Compatibility, vol. 56, no. 4, pp. 885–893, 2014

    2014

  27. [27]

    Leveraging EM side-channel information to detect Rowhammer attacks,

    Z. Zhang, Z. Zhan, D. Balasubramanian, B. Li, P. V olgyesi, and X. Koutsoukos, “Leveraging EM side-channel information to detect Rowhammer attacks,” in2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020, pp. 729–746

    2020

  28. [28]

    BitJabber: The world’s fastest electromagnetic covert channel,

    Z. Zhan, Z. Zhang, and X. Koutsoukos, “BitJabber: The world’s fastest electromagnetic covert channel,” in2020 IEEE International Symposium on Hardware Oriented Security and Trust (HOST). IEEE, 2020, pp. 35–45

    2020

  29. [29]

    Graphics peeping unit: Exploiting EM side-channel information of GPUs to eavesdrop on your neighbors,

    Z. Zhan, Z. Zhang, S. Liang, F. Yao, and X. Koutsoukos, “Graphics peeping unit: Exploiting EM side-channel information of GPUs to eavesdrop on your neighbors,” in2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 1440–1457

    2022

  30. [30]

    Watch me, but don’t touch me! contactless control flow monitoring via electromagnetic emanations,

    Y . Han, S. Etigowni, H. Liu, S. Zonouz, and A. Petropulu, “Watch me, but don’t touch me! contactless control flow monitoring via electromagnetic emanations,” inProceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017, pp. 1095–1108

    2017

  31. [31]

    Zero- overhead profiling via em emanations,

    R. Callan, F. Behrang, A. Zajic, M. Prvulovic, and A. Orso, “Zero- overhead profiling via em emanations,” inProceedings of the 25th international symposium on software testing and analysis, 2016, pp. 401–412

    2016

  32. [32]

    Scandalee: a side-channel-based disassembler using local elec- tromagnetic emanations,

    D. Strobel, F. Bache, D. Oswald, F. Schellenberg, and C. Paar, “Scandalee: a side-channel-based disassembler using local elec- tromagnetic emanations,” in2015 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 2015, pp. 139– 144

    2015

  33. [33]

    Ecdh key- extraction via low-bandwidth electromagnetic attacks on pcs,

    D. Genkin, L. Pachmanov, I. Pipman, and E. Tromer, “Ecdh key- extraction via low-bandwidth electromagnetic attacks on pcs,” in Cryptographers’ Track at the RSA Conference. Springer, 2016, pp. 219–235

    2016

  34. [34]

    Ecdsa key extraction from mobile devices via nonintrusive phys- ical side channels,

    D. Genkin, L. Pachmanov, I. Pipman, E. Tromer, and Y . Yarom, “Ecdsa key extraction from mobile devices via nonintrusive phys- ical side channels,” inProceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 1626–1638

    2016

  35. [35]

    A practical methodology for measuring the side-channel signal available to the attacker for instruction-level events,

    R. Callan, A. Zajic, and M. Prvulovic, “A practical methodology for measuring the side-channel signal available to the attacker for instruction-level events,” in2014 47th Annual IEEE/ACM Interna- tional Symposium on Microarchitecture. IEEE, 2014, pp. 242–254

    2014

  36. [36]

    Fase: Finding amplitude- modulated side-channel emanations,

    R. Callan, A. Zaji ´c, and M. Prvulovic, “Fase: Finding amplitude- modulated side-channel emanations,”ACM SIGARCH Computer Architecture News, vol. 43, no. 3S, pp. 592–603, 2015

    2015

  37. [37]

    Eddie: Em-based detection of deviations in program execution,

    A. Nazari, N. Sehatbakhsh, M. Alam, A. Zajic, and M. Prvulovic, “Eddie: Em-based detection of deviations in program execution,” inProceedings of the 44th Annual International Symposium on Computer Architecture, 2017, pp. 333–346

    2017

  38. [38]

    Remote: Robust external malware detection framework by using electromagnetic signals,

    N. Sehatbakhsh, A. Nazari, M. Alam, F. Werner, Y . Zhu, A. Zajic, and M. Prvulovic, “Remote: Robust external malware detection framework by using electromagnetic signals,”IEEE Transactions on Computers, vol. 69, no. 3, pp. 312–326, 2019

    2019

  39. [39]

    Dynamic programming algorithm op- timization for spoken word recognition,

    H. Sakoe and S. Chiba, “Dynamic programming algorithm op- timization for spoken word recognition,”IEEE transactions on acoustics, speech, and signal processing, vol. 26, no. 1, pp. 43–49, 2003

    2003

  40. [40]

    Improving differential power analysis by elastic alignment,

    J. G. Van Woudenberg, M. F. Witteman, and B. Bakker, “Improving differential power analysis by elastic alignment,” inCryptogra- phers’ Track at the RSA Conference. Springer, 2011, pp. 104–119

    2011

  41. [41]

    Collafl: Path sensitive fuzzing,

    S. Gan, C. Zhang, X. Qin, X. Tu, K. Li, Z. Pei, and Z. Chen, “Collafl: Path sensitive fuzzing,” in2018 IEEE Symposium on Security and Privacy (SP). IEEE, 2018, pp. 679–696

    2018

  42. [42]

    Bandit problems: sequential al- location of experiments (monographs on statistics and applied probability),

    D. A. Berry and B. Fristedt, “Bandit problems: sequential al- location of experiments (monographs on statistics and applied probability),”London: Chapman and Hall, vol. 5, no. 71-87, pp. 7–7, 1985

    1985

  43. [43]

    {EcoFuzz}: Adaptive{Energy-Saving}greybox fuzzing as a variant of the adversarial{Multi-Armed}bandit,

    T. Yue, P. Wang, Y . Tang, E. Wang, B. Yu, K. Lu, and X. Zhou, “{EcoFuzz}: Adaptive{Energy-Saving}greybox fuzzing as a variant of the adversarial{Multi-Armed}bandit,” in29th USENIX Security Symposium (USENIX Security 20), 2020, pp. 2307–2324

    2020

  44. [44]

    Qemu, a fast and portable dynamic translator

    F. Bellard, “Qemu, a fast and portable dynamic translator.” in USENIX annual technical conference, FREENIX Track, vol. 41, no. 46. California, USA, 2005, pp. 10–55

    2005

  45. [45]

    Libafl: A framework to build modular and reusable fuzzers,

    A. Fioraldi, D. C. Maier, D. Zhang, and D. Balzarotti, “Libafl: A framework to build modular and reusable fuzzers,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Commu- nications Security, 2022, pp. 1051–1065

    2022

  46. [46]

    Avatar: A framework to support dynamic security analysis of embedded systems’ firmwares

    J. Zaddach, L. Bruno, A. Francillon, D. Balzarottiet al., “Avatar: A framework to support dynamic security analysis of embedded systems’ firmwares.” inNDSS, vol. 14, no. 2014, 2014, pp. 1–16

    2014

  47. [47]

    Automatic firmware emulation through invalidity-guided knowledge inference,

    W. Zhou, L. Guan, P. Liu, and Y . Zhang, “Automatic firmware emulation through invalidity-guided knowledge inference,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2007–2024

    2021

  48. [48]

    Fuzzware: Using precise{MMIO}modeling for effective firmware fuzzing,

    T. Scharnowski, N. Bars, M. Schloegel, E. Gustafson, M. Muench, G. Vigna, C. Kruegel, T. Holz, and A. Abbasi, “Fuzzware: Using precise{MMIO}modeling for effective firmware fuzzing,” in31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 1239–1256

    2022

  49. [49]

    Hoedur: Embedded firmware fuzzing using multi- stream inputs

    T. Scharnowski, S. W ¨orner, F. Buchmann, N. Bars, M. Schloegel, and T. Holz, “Hoedur: Embedded firmware fuzzing using multi- stream inputs.” 2023

    2023

  50. [50]

    Firmalice-automatic detection of authentication bypass vulnera- bilities in binary firmware

    Y . Shoshitaishvili, R. Wang, C. Hauser, C. Kruegel, and G. Vigna, “Firmalice-automatic detection of authentication bypass vulnera- bilities in binary firmware.” inNDSS, vol. 1, 2015, pp. 1–1

    2015

  51. [51]

    Karonte: Detecting insecure multi-binary interactions in embedded firmware,

    N. Redini, A. Machiry, R. Wang, C. Spensky, A. Continella, Y . Shoshitaishvili, C. Kruegel, and G. Vigna, “Karonte: Detecting insecure multi-binary interactions in embedded firmware,” in2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020, pp. 1544–1561

    2020

  52. [52]

    Fuzzing can packets into automobiles,

    H. Lee, K. Choi, K. Chung, J. Kim, and K. Yim, “Fuzzing can packets into automobiles,” in2015 IEEE 29th International Con- ference on Advanced Information Networking and Applications. IEEE, 2015, pp. 817–821

    2015

  53. [53]

    Side-channel aware fuzzing,

    P. Sperl and K. B ¨ottinger, “Side-channel aware fuzzing,” inEuro- pean Symposium on Research in Computer Security. Springer, 2019, pp. 259–278

    2019

  54. [54]

    Powertrace-based fuzzing of can connected hardware,

    M. Dunne and S. Fischmeister, “Powertrace-based fuzzing of can connected hardware,” in2022 IEEE International Conference on Cyber Security and Resilience (CSR). IEEE, 2022, pp. 239–244

    2022

  55. [55]

    Diffuzz: differen- tial fuzzing for side-channel analysis,

    S. Nilizadeh, Y . Noller, and C. S. Pasareanu, “Diffuzz: differen- tial fuzzing for side-channel analysis,” in2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE). IEEE, 2019, pp. 176–187

    2019

  56. [56]

    Emfuzz: Use electromagnetic fuzzing for automated attack sur- face assessment of actuators,

    S. Dong, Z. Li, J. Liu, H. Li, D. Fang, S. Lv, H. Wang, and L. Sun, “Emfuzz: Use electromagnetic fuzzing for automated attack sur- face assessment of actuators,”IEEE Transactions on Information Forensics and Security, 2025

    2025

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.