Fuzz'EMup: Leveraging EM Side-Channel Emanation to Guide Black-Box Embedded Firmware Fuzzing

• URL: http://arxiv.org/abs/2607.16487v1
• Date: Fri, 17 Jul 2026 20:25:03 GMT
• Title: Fuzz'EMup: Leveraging EM Side-Channel Emanation to Guide Black-Box Embedded Firmware Fuzzing
• Abstract summary: We present an approach that leverages electromagnetic (EM) side-channel emanations to guide firmware fuzzing in purely black-box settings.<n> EM traces are noisy, and timing jitter causes corresponding features in different traces to shift in time.<n>We evaluate our approach on four real firmware targets and demonstrate that EM-derived feedback enhances path exploration, yielding higher code coverage than unguided fuzzing.
• Score: 8.83241136220859
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: As IoT and embedded devices proliferate across various domains, securing their firmware has become critical. Fuzzing offers a systematic approach to uncovering vulnerabilities in firmware, and coverage feedback can improve its effectiveness by guiding exploration. However, many devices make coverage information impossible to obtain by preventing firmware extraction, instrumentation, or accurate emulation; in such cases, testers are left with only inefficient black-box fuzzing. In this paper, we present an approach that leverages electromagnetic (EM) side-channel emanations to guide firmware fuzzing in purely black-box settings. However, turning raw EM measurements into reliable guidance is challenging: EM traces are noisy, and timing jitter causes corresponding features in different traces to shift in time. We address these challenges by combining frequency band selection based on the activity-to-idle signal contrast with dynamic time warping to align per-input traces and detect sustained divergence, while maintaining scalability by organizing executions in a tree structure based on their divergence times. We evaluate our approach on four real firmware targets and demonstrate that EM-derived feedback enhances path exploration, yielding higher code coverage than unguided fuzzing.

Related papers

• AmbSentry: Mitigating Sensing Eavesdropping in ISAC Systems by Harnessing Ambient IoT Devices [60.083979780396014]
  Integrated sensing and communication (ISAC) has emerged as a pivotal paradigm for 6G networks.<n>This paper proposes AmbSentry, an ISAC system that prevents the leakage of sensing information to sensing eavesdroppers.
  arXiv  Detail & Related papers  (2026-08-12T08:42:05Z)
• Focusing on What Matters: Saliency-Harnessing Accurate Routing for Diffusion MoE [49.45064510462232]
  Mixture-of-Experts (MoE) architectures have emerged as a powerful paradigm for scaling diffusion models in visual generation.<n>We propose SharpMoE, a post-training framework with a saliency-harnessing accurate routing mechanism.<n>By bypassing the noise-distorted inputs, SharpMoE provides the router with clear saliency guidance.
  arXiv  Detail & Related papers  (2026-06-25T12:13:40Z)
• PowerFuzz: Power-Based Black-Box Firmware Fuzzing [2.175752761257231]
  We introduce PowerFuzz, a statistical black-box fuzzing framework that leverages power side-channel measurements as a substitute for binary instrumentation.<n>A central challenge in black-box firmware fuzzing is determining the executed branches during test execution.<n>We show that PowerFuzz can provide branch coverage comparable to gray-box fuzzers while significantly outperforming (up to 22%) state-of-the-art black-box fuzzers.
  arXiv  Detail & Related papers  (2026-06-23T15:21:40Z)
• Stop Starving or Stuffing Me: Boosting Firmware Fuzzing Efficiency with On-demand Input Delivery [8.656747574799786]
  General software receives input as it encounters I/O functions, but firmware input can be received asynchronously and independently of the firmware's execution.<n>Our prototype, named FIDO, can serve as an add-on to existing firmware fuzzers to enhance their test-case delivery effectiveness.
  arXiv  Detail & Related papers  (2026-05-16T04:00:17Z)
• DyMA-Fuzz: Dynamic Direct Memory Access Abstraction for Re-hosted Monolithic Firmware Fuzzing [10.760871707398218]
  We introduce DyMA-Fuzz to extend recent advances in stream-based fuzz input injection to DMA-driven interfaces in re-hosted environments.<n>It tackles key challenges--vendor-specific descriptors, heterogeneous DMA designs, and varying descriptor locations--using runtime analysis techniques.<n>DyMA-Fuzz reveals vulnerabilities and execution paths missed by state-of-the-art tools and achieves up to 122% higher code coverage.
  arXiv  Detail & Related papers  (2026-02-09T14:52:57Z)
• E-FuzzEdge: Optimizing Embedded Device Security with Scalable In-Place Fuzzing [2.15053459390808]
  E-FuzzEdge addresses the inefficiencies of hardware-in-the-loop fuzzing for microcontrollers by optimizing execution speed.<n>A key advantage of E-FuzzEdge is its compatibility with other embedded fuzzing techniques that perform on device testing instead of firmware emulation.
  arXiv  Detail & Related papers  (2025-10-01T19:24:35Z)
• Tracking the Unstable: Appearance-Guided Motion Modeling for Robust Multi-Object Tracking in UAV-Captured Videos [58.156141601478794]
  Multi-object tracking (UAVT) aims to track multiple objects while maintaining consistent identities across frames of a given video.<n>Existing methods typically model motion cues and appearance separately, overlooking their interplay and resulting in suboptimal tracking performance.<n>We propose AMOT, which exploits appearance and motion cues through two key components: an Appearance-Motion Consistency (AMC) matrix and a Motion-aware Track Continuation (MTC) module.
  arXiv  Detail & Related papers  (2025-08-03T12:06:47Z)
• Improving Black-Box Generative Attacks via Generator Semantic Consistency [51.470649503929344]
  generative attacks produce adversarial examples in a single forward pass at test time.<n>We enforce semantic consistency by aligning the early generator's intermediate features to an EMA teacher.<n>Our approach can be seamlessly integrated into existing generative attacks with consistent improvements in black-box transfer.
  arXiv  Detail & Related papers  (2025-06-23T02:35:09Z)
• EmbedFuzz: High Speed Fuzzing Through Transplantation [21.875588930207943]
  This paper introduces EmbedFuzz, an efficient fuzzing framework for embedded firmware on low-end Microcontroller Units (MCUs)<n>Our novel firmware transplantation technique converts binary MCU firmware to a functionally equivalent and fuzzing-enhanced version of the firmware which executes on a compatible high-end device at native performance.<n>In our evaluation against state-of-the-art MCU fuzzers, EmbedFuzz exhibits up to eight-fold fuzzing throughput while consuming at most a fourth of the energy thanks to its native execution.
  arXiv  Detail & Related papers  (2024-12-17T10:09:55Z)
• Joint Attention-Guided Feature Fusion Network for Saliency Detection of Surface Defects [69.39099029406248]
  We propose a joint attention-guided feature fusion network (JAFFNet) for saliency detection of surface defects based on the encoder-decoder network. JAFFNet mainly incorporates a joint attention-guided feature fusion (JAFF) module into decoding stages to adaptively fuse low-level and high-level features. Experiments conducted on SD-saliency-900, Magnetic tile, and DAGM 2007 indicate that our method achieves promising performance in comparison with other state-of-the-art methods.
  arXiv  Detail & Related papers  (2024-02-05T08:10:16Z)
• Improving Adversarial Robustness of Masked Autoencoders via Test-time Frequency-domain Prompting [133.55037976429088]
  We investigate the adversarial robustness of vision transformers equipped with BERT pretraining (e.g., BEiT, MAE) A surprising observation is that MAE has significantly worse adversarial robustness than other BERT pretraining methods. We propose a simple yet effective way to boost the adversarial robustness of MAE.
  arXiv  Detail & Related papers  (2023-08-20T16:27:17Z)
• Uncertainty-aware Unsupervised Multi-Object Tracking [33.53331700312752]
  unsupervised multi-object trackers are inferior to learning reliable feature embeddings. Recent self-supervised techniques are adopted, whereas they failed to capture temporal relations. This paper argues that though the uncertainty problem is inevitable, it is possible to leverage the uncertainty itself to improve the learned consistency in turn.
  arXiv  Detail & Related papers  (2023-07-28T09:03:06Z)
• iffDetector: Inference-aware Feature Filtering for Object Detection [70.8678270164057]
  We introduce a generic Inference-aware Feature Filtering (IFF) module that can easily be combined with modern detectors. IFF performs closed-loop optimization by leveraging high-level semantics to enhance the convolutional features. IFF can be fused with CNN-based object detectors in a plug-and-play manner with negligible computational cost overhead.
  arXiv  Detail & Related papers  (2020-06-23T02:57:29Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.