PowerFuzz: Power-Based Black-Box Firmware Fuzzing

• URL: http://arxiv.org/abs/2606.24692v1
• Date: Tue, 23 Jun 2026 15:21:40 GMT
• Title: PowerFuzz: Power-Based Black-Box Firmware Fuzzing
• Abstract summary: We introduce PowerFuzz, a statistical black-box fuzzing framework that leverages power side-channel measurements as a substitute for binary instrumentation.<n>A central challenge in black-box firmware fuzzing is determining the executed branches during test execution.<n>We show that PowerFuzz can provide branch coverage comparable to gray-box fuzzers while significantly outperforming (up to 22%) state-of-the-art black-box fuzzers.
• Score: 2.175752761257231
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Fuzzing is widely used for software and hardware verification, offering an effective alternative to random testing. While gray-box fuzzers benefit from full visibility into the system under test and can leverage execution feedback such as branch coverage, these approaches are not applicable when verifying systems whose firmware or binaries are not publicly available. In such scenarios, obtaining coverage information for guiding the fuzzer becomes infeasible. In this paper, we introduce PowerFuzz, a statistical black-box fuzzing framework that leverages power side-channel measurements as a substitute for binary instrumentation, requiring no internal visibility into the target firmware. A central challenge in black-box firmware fuzzing is determining the executed branches during test execution. To address this challenge, we use power traces to identify branches utilizing a sliding window followed by a growing window full-trace correlation method. This approach also enables the construction of a high-level control-flow graph of the black-box firmware, which we utilize to drive the fuzzer to unexplored execution paths. Extensive evaluation using three embedded hardware platforms and ten firmware benchmarks demonstrates that PowerFuzz can provide branch coverage comparable (within 13.5%) to gray-box fuzzers while significantly outperforming (up to 22%) state-of-the-art black-box fuzzers.

Related papers

• Fuzz'EMup: Leveraging EM Side-Channel Emanation to Guide Black-Box Embedded Firmware Fuzzing [8.83241136220859]
  We present an approach that leverages electromagnetic (EM) side-channel emanations to guide firmware fuzzing in purely black-box settings.<n> EM traces are noisy, and timing jitter causes corresponding features in different traces to shift in time.<n>We evaluate our approach on four real firmware targets and demonstrate that EM-derived feedback enhances path exploration, yielding higher code coverage than unguided fuzzing.
  arXiv  Detail & Related papers  (2026-07-17T20:25:03Z)
• SAM-Deep-EIoU: Selective Mask Propagation for Multi-Object Tracking [51.56484100374058]
  We propose selective mask propagation, a tracking algorithm that dispatches from a base tracker to a VOS model only on windows where an assignment-uncertainty signal fires.<n>The method is training-free, treats both the base tracker and the VOS model as black boxes, and can benefit from replacing the VOS component with a more capable model.
  arXiv  Detail & Related papers  (2026-06-11T08:09:32Z)
• Gated Condition Injection without Multimodal Attention: Towards Controllable Linear-Attention Transformers [69.60693631859411]
  This paper explores controllable diffusion models built upon linear attention architectures.<n>We propose a novel controllable diffusion framework tailored for linear attention backbones like SANA.<n>Our approach achieves state-of-the-art controllable generation performance based on linear-attention models.
  arXiv  Detail & Related papers  (2026-03-29T12:31:34Z)
• UNBOX: Unveiling Black-box visual models with Natural-language [50.433977345786055]
  We introduce UNBOX, a framework for class-wise model dissection under fully data-free, gradient-free, and backpropagation-free constraints.<n>We evaluate UNBOX on ImageNet-1K, Waterbirds, and CelebA through semantic fidelity tests, visual-feature correlation analyses, and slice-discovery auditing.
  arXiv  Detail & Related papers  (2026-03-09T17:16:39Z)
• SysFuSS: System-Level Firmware Fuzzing with Selective Symbolic Execution [4.92575823723555]
  Existing fuzzers focus on user-level fuzzing, which is not suitable for detecting kernel-level vulnerabilities.<n>We present an efficient firmware verification framework, SysFuSS, that integrates system-level fuzzing with selective symbolic execution.<n> SysFuSS significantly outperforms state-of-the-art fuzzers in terms of both branch coverage and detection of firmware vulnerabilities.
  arXiv  Detail & Related papers  (2026-02-02T15:52:20Z)
• InsightQL: Advancing Human-Assisted Fuzzing with a Unified Code Database and Parameterized Query Interface [8.846926306547646]
  InsightQL is the first human-assisting framework for fuzz blocker analysis.<n>Powered by a unified database and an intuitive parameterized query interface, InsightQL aids developers in systematically extracting insights.<n>Our experiments on 14 popular real-world libraries from the FuzzBench benchmark demonstrate the effectiveness of InsightQL.
  arXiv  Detail & Related papers  (2025-10-06T14:18:35Z)
• Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis [5.029193774082768]
  Hardware fuzzing is one of the crucial techniques for finding security flaws in modern hardware designs.<n>Coverage-Guided Fuzzing (CGF) methods help explore designs more effectively, but they struggle to focus on specific parts of the hardware.<n>Existing Directed Gray-box Fuzzing (DGF) techniques like DirectFuzz try to solve this by generating targeted tests.<n>We introduce a novel framework, PROFUZZ, that follows the DGF approach and combines fuzzing with Automatic Test Pattern Generation (ATPG) for more efficient fuzzing.
  arXiv  Detail & Related papers  (2025-09-25T06:46:19Z)
• FuzzBox: Blending Fuzzing into Emulation for Binary-Only Embedded Targets [2.5193108033256117]
  Coverage-guided fuzzing has been widely applied to address zero-day vulnerabilities in general-purpose software and operating systems.<n>Applying it to industrial systems remains challenging, due to proprietary and closed-source compiler toolchains and lack of access to source code.<n>FuzzBox addresses these limitations by integrating emulation with fuzzing.
  arXiv  Detail & Related papers  (2025-09-06T08:31:36Z)
• FuzzRDUCC: Fuzzing with Reconstructed Def-Use Chain Coverage [6.827408090670258]
  Binary-only fuzzing often struggles with achieving thorough code coverage and uncovering hidden vulnerabilities.<n>We introduce FuzzRDUCC, a novel fuzzing framework that employs symbolic execution to reconstruct definition-use (def-use) chains directly from binary executables.
  arXiv  Detail & Related papers  (2025-09-05T09:47:34Z)
• G-Fuzz: A Directed Fuzzing Framework for gVisor [48.85077340822625]
  G-Fuzz is a directed fuzzing framework for gVisor. G-Fuzz has been deployed in industry and has detected multiple serious vulnerabilities.
  arXiv  Detail & Related papers  (2024-09-20T01:00:22Z)
• FuzzCoder: Byte-level Fuzzing Test via Large Language Model [46.18191648883695]
  We propose to adopt fine-tuned large language models (FuzzCoder) to learn patterns in the input files from successful attacks. FuzzCoder can predict mutation locations and strategies locations in input files to trigger abnormal behaviors of the program.
  arXiv  Detail & Related papers  (2024-09-03T14:40:31Z)
• OpenBox: A Python Toolkit for Generalized Black-box Optimization [50.88355903338381]
  Black-box optimization (BBO) has a broad range of applications, including automatic machine learning, experimental design, and database knob tuning. This paper presents OpenBox, an open-source BBO toolkit with improved usability. It implements user-friendly interfaces and visualization for users to define and manage their tasks.
  arXiv  Detail & Related papers  (2023-04-26T07:13:50Z)
• Spanning Attack: Reinforce Black-box Attacks with Unlabeled Data [96.92837098305898]
  Black-box attacks aim to craft adversarial perturbations by querying input-output pairs of machine learning models. Black-box attacks often suffer from the issue of query inefficiency due to the high dimensionality of the input space. We propose a novel technique called the spanning attack, which constrains adversarial perturbations in a low-dimensional subspace via spanning an auxiliary unlabeled dataset.
  arXiv  Detail & Related papers  (2020-05-11T05:57:15Z)
• Siamese Box Adaptive Network for Visual Tracking [100.46025199664642]
  We propose a simple yet effective visual tracking framework (named Siamese Box Adaptive Network, SiamBAN) SiamBAN directly classifies objects and regresses their bounding boxes in a unified convolutional network (FCN) SiamBAN achieves state-of-the-art performance and runs at 40 FPS, confirming its effectiveness and efficiency.
  arXiv  Detail & Related papers  (2020-03-15T05:58:12Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.