Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing
Michael Chesser, Surya Nepal, Damith C. Ranasinghe

TL;DR
Icicle is a new multi-architecture emulator designed specifically for firmware fuzzing, enabling architecture-agnostic instrumentation and bug discovery across diverse ISAs with low overhead.
Contribution
We introduce Icicle, a re-designed emulator that allows architecture-agnostic instrumentation for fuzzing, improving bug detection in diverse embedded firmware architectures.
Findings
Successfully added architecture-agnostic instrumentation with low overhead
Discovered new bugs in ARM, RISC-V, MIPS, and MSP430 firmware
Replicated state-of-the-art fuzzing results with Icicle
Abstract
Emulation-based fuzzers enable testing binaries without source code, and facilitate testing embedded applications where automated execution on the target hardware architecture is difficult and slow. The instrumentation techniques added to extract feedback and guide input mutations towards generating effective test cases is at the core of modern fuzzers. But, modern emulation-based fuzzers have evolved by re-purposing general-purpose emulators; consequently, developing and integrating fuzzing techniques, such as instrumentation methods, are difficult and often added in an ad-hoc manner, specific to an instruction set architecture (ISA). This limits state-of-the-art fuzzing techniques to few ISAs such as x86/x86-64 or ARM/AArch64; a significant problem for firmware fuzzing of diverse ISAs. This study presents our efforts to re-think emulation for fuzzing. We design and implement a…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSoftware Testing and Debugging Techniques · Radiation Effects in Electronics · VLSI and Analog Circuit Testing
