{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,12]],"date-time":"2026-09-12T01:58:44Z","timestamp":1789178324499,"version":"build-2803163510"},"publisher-location":"Cham","reference-count":37,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031514814","type":"print"},{"value":"9783031514821","type":"electronic"}],"license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2024]]},"DOI":"10.1007\/978-3-031-51482-1_15","type":"book-chapter","created":{"date-parts":[[2024,1,10]],"date-time":"2024-01-10T06:02:47Z","timestamp":1704866567000},"page":"290-310","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["SplITS: Split Input-to-State Mapping for\u00a0Effective Firmware Fuzzing"],"prefix":"10.1007","author":[{"given":"Guy","family":"Farrelly","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Paul","family":"Quirk","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Salil S.","family":"Kanhere","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Seyit","family":"Camtepe","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Damith C.","family":"Ranasinghe","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,1,11]]},"reference":[{"key":"15_CR1","unstructured":"Circumventing fuzzing roadblocks with compiler transformations. https:\/\/lafintel.wordpress.com\/2016\/08\/15\/circumventing-fuzzing-roadblocks-with-compiler-transformations\/ (2016)"},{"key":"15_CR2","doi-asserted-by":"crossref","unstructured":"Aschermann, C., Schumilo, S., Blazytko, T., Gawlik, R., Holz, T.: REDQUEEN: fuzzing with input-to-state correspondence. In: Symposium on Network and Distributed System Security (NDSS) (2019)","DOI":"10.14722\/ndss.2019.23371"},{"key":"15_CR3","unstructured":"Cadar, C., Dunbar, D., Engler, D.: KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs. In: USENIX Symposium on Operating Systems Design and Implementation (OSDI) (2008)"},{"key":"15_CR4","doi-asserted-by":"crossref","unstructured":"Cao, C., Guan, L., Ming, J., Liu, P.: Device-agnostic firmware execution is possible: a concolic execution approach for peripheral emulation. In: Annual Computer Security Applications Conference (ACSAC) (2020)","DOI":"10.1145\/3427228.3427280"},{"key":"15_CR5","doi-asserted-by":"crossref","unstructured":"Chen, D., Egele, M., Woo, M., Brumley, D.: Towards automated dynamic analysis for Linux-based embedded firmware. In: Network and Distributed System Security Symposium (NDSS) (2016)","DOI":"10.14722\/ndss.2016.23415"},{"key":"15_CR6","doi-asserted-by":"crossref","unstructured":"Chen, P., Chen, H.: Angora: efficient fuzzing by principled search. In: 2018 IEEE Symposium on Security and Privacy (SP), pp. 711\u2013725 (2018)","DOI":"10.1109\/SP.2018.00046"},{"key":"15_CR7","doi-asserted-by":"crossref","unstructured":"Chesser, M., Nepal, S., Ranasinghe, D.C.: Icicle: a re-designed emulator for grey-box firmware fuzzing. In: ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) (2023)","DOI":"10.1145\/3597926.3598039"},{"key":"15_CR8","doi-asserted-by":"crossref","unstructured":"Choi, J., Jang, J., Han, C., Cha, S.K.: Grey-Box concolic testing on binary code. In: International Conference on Software Engineering (ICSE), pp. 736\u2013747 (2019)","DOI":"10.1109\/ICSE.2019.00082"},{"key":"15_CR9","unstructured":"Clements, A.A., et al.: HALucinator: firmware re-hosting through abstraction layer emulation. In: USENIX Security Symposium (USENIX Sec) (2020)"},{"key":"15_CR10","unstructured":"Corteggiani, N., Camurati, G., Francillon, A.: Inception: system-wide security testing of real-world embedded systems software. In: USENIX Security Symposium (USENIX Sec) (2018)"},{"key":"15_CR11","unstructured":"Davidson, D., Moench, B., Ristenpart, T., Jha, S.: FIE on Firmware: finding vulnerabilities in embedded systems using symbolic execution. In: USENIX Security Symposium (USENIX Sec) (2013)"},{"key":"15_CR12","doi-asserted-by":"crossref","unstructured":"Farrelly, G., Chesser, M., Ranasinghe, D.C.: Ember-IO: effective firmware fuzzing with model-free memory mapped IO. In: ACM Asia Conference on Computer and Communications Security (ASIA CCS) (2023)","DOI":"10.1145\/3579856.3582840"},{"key":"15_CR13","doi-asserted-by":"crossref","unstructured":"Fasano, A., et al.: SoK: enabling security analyses of embedded systems via rehosting. In: ACM Asia Conference on Computer and Communications Security (ASIA CCS), pp. 687\u2013701 (2021)","DOI":"10.1145\/3433210.3453093"},{"key":"15_CR14","unstructured":"Feng, B., Mera, A., Lu, L.: P2IM: scalable and hardware-independent firmware testing via automatic peripheral interface modeling. In: USENIX Security Symposium (USENIX Sec) (2020)"},{"key":"15_CR15","doi-asserted-by":"crossref","unstructured":"Fioraldi, A., D\u2019Elia, D.C., Coppa, E.: WEIZZ: automatic grey-box fuzzing for structured binary formats. In: ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), pp. 1\u201313 (2020)","DOI":"10.1145\/3395363.3397372"},{"key":"15_CR16","unstructured":"Fioraldi, A., Maier, D., Ei\u00dffeldt, H., Heuse, M.: AFL++: combining incremental steps of fuzzing research. In: USENIX Workshop on Offensive Technologies (WOOT) (2020)"},{"key":"15_CR17","unstructured":"Gan, S., et al.: GREYONE: data flow sensitive fuzzing. In: USENIX Security Symposium (USENIX Sec) (2020)"},{"key":"15_CR18","unstructured":"Gustafson, E., et al.: Toward the analysis of embedded firmware through automated re-hosting. In: International Symposium on Recent Advances in Intrusion Detection (RAID) (2019)"},{"key":"15_CR19","unstructured":"Johnson, E., et al.: Jetset: targeted firmware rehosting for embedded systems. In: USENIX Security Symposium (USENIX Sec) (2021)"},{"key":"15_CR20","doi-asserted-by":"crossref","unstructured":"Kim, M., Kim, D., Kim, E., Kim, S., Jang, Y., Kim, Y.: FirmAE: towards large-scale emulation of IoT firmware for dynamic analysis. In: Annual Computer Security Applications Conference (ACSAC) (2020)","DOI":"10.1145\/3427228.3427294"},{"key":"15_CR21","doi-asserted-by":"crossref","unstructured":"Li, W., Guan, L., Lin, J., Shi, J., Li, F.: From library portability to para-rehosting: natively executing microcontroller software on commodity hardware. In: Network and Distributed System Security Symposium (NDSS) (2021)","DOI":"10.14722\/ndss.2021.24308"},{"key":"15_CR22","doi-asserted-by":"crossref","unstructured":"Liu, Y., Hung, H.W., Sani, A.A.: Mousse: a system for selective symbolic execution of programs with untamed environments. In: European Conference on Computer Systems (EuroSys) (2020)","DOI":"10.1145\/3342195.3387556"},{"key":"15_CR23","doi-asserted-by":"crossref","unstructured":"Mera, A., Feng, B., Lu, L., Kirda, E.: DICE: Automatic emulation of DMA input channels for dynamic firmware analysis. In: IEEE Symposium on Security and Privacy (SP) (2021)","DOI":"10.1109\/SP40001.2021.00018"},{"key":"15_CR24","doi-asserted-by":"crossref","unstructured":"Muench, M., Nisi, D., Francillon, A., Balzarotti, D.: Avatar$$^2$$: a multi-target orchestration platform. In: Workshop on Binary Analysis Research (BAR) (2018)","DOI":"10.14722\/bar.2018.23017"},{"key":"15_CR25","doi-asserted-by":"crossref","unstructured":"Muench, M., Stijohann, J., Kargl, F., Francillon, A., Balzarotti, D.: What you corrupt is not what you crash: challenges in fuzzing embedded devices. In: Network and Distributed System Security Symposium (NDSS) (2018)","DOI":"10.14722\/ndss.2018.23166"},{"key":"15_CR26","doi-asserted-by":"crossref","unstructured":"Rawat, S., Jain, V., Kumar, A., Cojocar, L., Giuffrida, C., Bos, H.: VUzzer: application-aware evolutionary fuzzing. In: Network and Distributed System Security Symposium (NDSS) (2017)","DOI":"10.14722\/ndss.2017.23404"},{"key":"15_CR27","unstructured":"Scharnowski, T., et al.: Fuzzware: using precise MMIO modeling for effective firmware fuzzing. In: USENIX Security Symposium (USENIX Sec) (2022)"},{"key":"15_CR28","unstructured":"Scharnowski, T., W\u00f6rner, S., Buchmann, F., Bars, N., Schloegel, M., Holz, T.: HOEDUR: embedded firmware fuzzing using multi-stream inputs. In: USENIX Security Symposium (USENIX Sec) (2023)"},{"key":"15_CR29","doi-asserted-by":"crossref","unstructured":"Spensky, C., et al.: Conware: automated modeling of hardware peripherals. In: ACM Asia Conference on Computer and Communications Security (ASIA CCS) (2021)","DOI":"10.1145\/3433210.3437532"},{"key":"15_CR30","doi-asserted-by":"crossref","unstructured":"Srivastava, P., Peng, H., Li, J., Okhravi, H., Shrobe, H., Payer, M.: FirmFuzz: automated IoT firmware introspection and analysis. In: International ACM Workshop on Security and Privacy for the Internet-of-Things (IoT SP) (2019)","DOI":"10.1145\/3338507.3358616"},{"key":"15_CR31","doi-asserted-by":"crossref","unstructured":"Stephens, N., et al.: Driller: augmenting fuzzing through selective symbolic execution. In: Network and Distributed System Security Symposium (NDSS) (2016)","DOI":"10.14722\/ndss.2016.23368"},{"key":"15_CR32","doi-asserted-by":"crossref","unstructured":"Wang, T., Wei, T., Gu, G., Zou, W.: TaintScope: a checksum-aware directed fuzzing tool for automatic software vulnerability detection. In: IEEE Symposium on Security and Privacy (SP), pp. 497\u2013512 (2010)","DOI":"10.1109\/SP.2010.37"},{"key":"15_CR33","doi-asserted-by":"crossref","unstructured":"Zaddach, J., Bruno, L., Balzarotti, D., Francillon, A.: AVATAR: a Framework to Support Dynamic Security Analysis of Embedded Systems\u2019 Firmwares. In: Network and Distributed System Security Symposium (NDSS) (2014)","DOI":"10.14722\/ndss.2014.23229"},{"key":"15_CR34","unstructured":"Zheng, Y., Davanian, A., Yin, H., Song, C., Zhu, H., Sun, L.: FIRM-AFL: high-throughput greybox fuzzing of IoT firmware via augmented process emulation. In: USENIX Security Symposium (USENIX Sec) (2019)"},{"key":"15_CR35","doi-asserted-by":"crossref","unstructured":"Zheng, Y., Li, Y., Zhang, C., Zhu, H., Liu, Y., Sun, L.: Efficient greybox fuzzing of applications in Linux-based IoT devices via enhanced user-mode emulation. In: ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) (2022)","DOI":"10.1145\/3533767.3534414"},{"key":"15_CR36","unstructured":"Zhou, W., Guan, L., Liu, P., Zhang, Y.: Automatic firmware emulation through invalidity-guided knowledge inference. In: USENIX Security Symposium (USENIX Sec) (2021)"},{"key":"15_CR37","doi-asserted-by":"crossref","unstructured":"Zhou, W., Zhang, L., Guan, L., Liu, P., Zhang, Y.: What your firmware tells you is not how you should emulate it: a specification-guided approach for firmware emulation. In: ACM SIGSAC Conference on Computer and Communications Security (CCS) (2022)","DOI":"10.1145\/3548606.3559386"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2023"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-51482-1_15","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,10]],"date-time":"2024-01-10T06:06:46Z","timestamp":1704866806000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-51482-1_15"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"ISBN":["9783031514814","9783031514821"],"references-count":37,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-51482-1_15","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]},"assertion":[{"value":"11 January 2024","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"The Hague","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"The Netherlands","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2023","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"25 September 2023","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"29 September 2023","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"28","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2023","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/esorics2023.org\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Easychair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"478","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"93","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"19% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3-4","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"10","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"No","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}