Fuzz'EMup: Leveraging EM Side-Channel Emanation to Guide Black-Box Embedded Firmware Fuzzing

2026-07-17

AI Summary

This work addresses the inefficiency of traditional fuzzing in purely black-box embedded devices, where the absence of coverage feedback severely limits effectiveness. To overcome this challenge, the authors propose a novel black-box fuzzing approach that leverages electromagnetic (EM) side-channel emissions as a proxy for execution feedback. The method identifies sensitive frequency bands through activity-idle comparisons, aligns input-level EM traces using dynamic time warping (DTW) to mitigate noise and timing jitter, and constructs an execution tree based on divergence times to enhance scalability. Experimental evaluation on four real-world firmware images demonstrates that the proposed technique substantially outperforms feedback-free fuzzing, achieving significant improvements in both path exploration and code coverage.

Abstract

As IoT and embedded devices proliferate across various domains, securing their firmware has become critical. Fuzzing offers a systematic approach to uncovering vulnerabilities in firmware, and coverage feedback can improve its effectiveness by guiding exploration. However, many devices make coverage information impossible to obtain by preventing firmware extraction, instrumentation, or accurate emulation; in such cases, testers are left with only inefficient black-box fuzzing. In this paper, we present an approach that leverages electromagnetic (EM) side-channel emanations to guide firmware fuzzing in purely black-box settings. However, turning raw EM measurements into reliable guidance is challenging: EM traces are noisy, and timing jitter causes corresponding features in different traces to shift in time. We address these challenges by combining frequency band selection based on the activity-to-idle signal contrast with dynamic time warping to align per-input traces and detect sustained divergence, while maintaining scalability by organizing executions in a tree structure based on their divergence times. We evaluate our approach on four real firmware targets and demonstrate that EM-derived feedback enhances path exploration, yielding higher code coverage than unguided fuzzing.

Problem

• black-box fuzzing
• firmware security
• EM side-channel
• coverage guidance
• embedded systems

Innovation

• electromagnetic side-channel
• black-box fuzzing
• dynamic time warping
• firmware security
• coverage guidance