{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,3]],"date-time":"2026-09-03T15:42:00Z","timestamp":1788450120417,"version":"build-2803163510"},"reference-count":57,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2023,3,1]],"date-time":"2023-03-01T00:00:00Z","timestamp":1677628800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Research Fund KU Leuven"},{"name":"Flemish Research Programme Cybersecurity"},{"name":"EU","award":["H2020-SU-ICT-03-2018"],"award-info":[{"award-number":["H2020-SU-ICT-03-2018"]}]},{"name":"EU","award":["830929"],"award-info":[{"award-number":["830929"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2023,3,1]]},"DOI":"10.1109\/tdsc.2022.3149371","type":"journal-article","created":{"date-parts":[[2022,2,8]],"date-time":"2022-02-08T20:38:18Z","timestamp":1644352698000},"page":"1124-1138","source":"Crossref","is-referenced-by-count":21,"title":["Discovery and Identification of Memory Corruption Vulnerabilities on Bare-Metal Embedded Devices"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5781-7589","authenticated-orcid":false,"given":"Majid","family":"Salehi","sequence":"first","affiliation":[{"name":"imec-DistriNet, KU Leuven, Leuven, Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6901-3999","authenticated-orcid":false,"given":"Luca","family":"Degani","sequence":"additional","affiliation":[{"name":"University of Trento, Trento, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marco","family":"Roveri","sequence":"additional","affiliation":[{"name":"University of Trento, Trento, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Danny","family":"Hughes","sequence":"additional","affiliation":[{"name":"imec-DistriNet, KU Leuven, Leuven, Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1252-8465","authenticated-orcid":false,"given":"Bruno","family":"Crispo","sequence":"additional","affiliation":[{"name":"University of Trento, Trento, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Internet of Things forecast","year":"2019"},{"key":"ref2","article-title":"Over the air: Exploiting broadcoms Wi-Fi stack","year":"2017"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23166"},{"key":"ref4","first-page":"67","article-title":"Dynamic test generation to find integer bugs in x86 binary linux programs","volume-title":"Proc. 18th Conf. USENIX Secur. Symp.","author":"Molnar"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243804"},{"key":"ref6","first-page":"381","article-title":"SBS: Static binary sanitization of bare-metal embedded devices for fault observability","volume-title":"Proc. Int. Symp. Res. Attacks Intrusions Defenses","author":"Salehi"},{"key":"ref7","article-title":"BooFuzz source code repository","author":"Pereyda","year":"2016"},{"key":"ref8","article-title":"American fuzzing lop (AFL)","author":"Zalewski","year":"2014"},{"key":"ref9","article-title":"HALucinator-fuzzer source code repository","author":"Clements","year":"2020"},{"key":"ref10","article-title":"P2IM: Scalable and hardware-independent firmware testing via automatic peripheral interface modeling","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Feng"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00010"},{"key":"ref12","first-page":"17","article-title":"Using Valgrind to detect undefined value errors with bit-precision","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Seward"},{"key":"ref13","first-page":"309","article-title":"AddressSanitizer: A fast address sanity checker","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Serebryany"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23287"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CGO.2011.5764689"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/1250734.1250746"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23159"},{"key":"ref18","first-page":"1099","article-title":"FIRM-AFL: High-throughput greybox fuzzing of IoT firmware via augmented process emulation","volume-title":"Proc. 28th USENIX Secur. Symp.","author":"Zheng"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3338507.3358616"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00046"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978428"},{"key":"ref22","first-page":"845","article-title":"BYTEWEIGHT: Learning to recognize functions in binary code","volume-title":"Proc. 23rd USENIX Secur. Symp.","author":"Bao"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2002.1173063"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-70545-1_40"},{"key":"ref25","first-page":"583","article-title":"An in-depth analysis of disassembly on full-scale x86\/x64 binaries","volume-title":"Proc. 25th USENIX Secur. Symp.","author":"Andriesse"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/DSC47296.2019.8937667"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23107"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23225"},{"key":"ref29","first-page":"627","article-title":"Reassembleable disassembling","volume-title":"Proc. 24th USENIX Secur. Symp.","author":"Wang"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134627"},{"key":"ref31","article-title":"Capstone: The ultimate disassembler framework","year":"2020"},{"key":"ref32","article-title":"Pyelftools: Parsing ELF and DWARF in Python","author":"Bendersky","year":"2012"},{"key":"ref33","article-title":"Quarkslab Lief project","year":"2020"},{"key":"ref34","article-title":"CTF framework and exploit development library","year":"2020"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-54862-8_26"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.17"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2015.23294"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_24"},{"key":"ref45","article-title":"HALucinator: Firmware re-hosting through abstraction layer emulation","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Clements"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23415"},{"key":"ref47","article-title":"AFL-unicorn","author":"Voss","year":"2017"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23229"},{"key":"ref49","article-title":"SURROGATES: Enabling near-real-time dynamic analyses of embedded systems","volume-title":"Proc. 9th USENIX Conf. Offensive Technol.","author":"Koscher"},{"key":"ref50","first-page":"135","article-title":"Toward the analysis of embedded firmware through automated re-hosting","volume-title":"Proc. 22nd Int. Symp. Res. Attacks Intrusions Defenses","author":"Gustafson"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/1065010.1065034"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40203-6_12"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382216"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00009"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3373376.3378470"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23300"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00121"},{"key":"ref58","article-title":"Fuzzbench","year":"2020"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3428334"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.15"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/2568225.2568293"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/1273463.1273464"},{"key":"ref63","first-page":"49","article-title":"Under-constrained symbolic execution: Correctness checking for real code","volume-title":"Proc. 24th USENIX Secur. Symp.","author":"Ramos"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8858\/10068314\/09707846.pdf?arnumber=9707846","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,17]],"date-time":"2024-01-17T23:40:19Z","timestamp":1705534819000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9707846\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,3,1]]},"references-count":57,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2022.3149371","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,3,1]]}}}