{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T23:47:03Z","timestamp":1792799223058,"version":"4.5.0"},"reference-count":147,"publisher":"Association for Computing Machinery (ACM)","issue":"7","license":[{"start":{"date-parts":[[2022,12,15]],"date-time":"2022-12-15T00:00:00Z","timestamp":1671062400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Ministry of Science and ICT (MSIT), South Korea","id":[{"id":"https:\/\/ror.org\/01wpjm123","id-type":"ROR","asserted-by":"crossref"}]},{"name":"Information Technology Research Center"},{"name":"Institute for Information and Communications Technology Planning and Evaluation","award":["IITP-2022-2018-0-01423"],"award-info":[{"award-number":["IITP-2022-2018-0-01423"]}],"id":[{"id":"https:\/\/ror.org\/01g0hqq23","id-type":"ROR","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100003725","name":"National Research Foundation of Korea","doi-asserted-by":"crossref","award":["2020R1F1A1065539"],"award-info":[{"award-number":["2020R1F1A1065539"]}],"id":[{"id":"10.13039\/501100003725","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Ministry of Education","award":["2021R1F1A1051251"],"award-info":[{"award-number":["2021R1F1A1051251"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,7,31]]},"abstract":"<jats:p>Security attacks abuse software vulnerabilities of IoT devices; hence, detecting and eliminating these vulnerabilities immediately are crucial. Fuzzing is an efficient method to identify vulnerabilities automatically, and many publications have been released to date. However, fuzzing for embedded systems has not been studied extensively owing to various obstacles, such as multi-architecture support, crash detection difficulties, and limited resources. Thus, the article introduces fuzzing techniques for embedded systems and the fuzzing differences for desktop and embedded systems. Further, we collect state-of-the-art technologies, discuss their advantages and disadvantages, and classify embedded system fuzzing tools. Finally, future directions for fuzzing research of embedded systems are predicted and discussed.<\/jats:p>","DOI":"10.1145\/3538644","type":"journal-article","created":{"date-parts":[[2022,7,28]],"date-time":"2022-07-28T07:33:02Z","timestamp":1658993582000},"page":"1-33","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":60,"title":["Fuzzing of Embedded Systems: A Survey"],"prefix":"10.1145","volume":"55","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7264-2446","authenticated-orcid":false,"given":"Joobeom","family":"Yun","sequence":"first","affiliation":[{"name":"Sejong University, Gwangjin-gu, Seoul, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0082-4996","authenticated-orcid":false,"given":"Fayozbek","family":"Rustamov","sequence":"additional","affiliation":[{"name":"Sejong University, Gwangjin-gu, Seoul, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1308-4499","authenticated-orcid":false,"given":"Juhwan","family":"Kim","sequence":"additional","affiliation":[{"name":"Sejong University, Gwangjin-gu, Seoul, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4831-7392","authenticated-orcid":false,"given":"Youngjoo","family":"Shin","sequence":"additional","affiliation":[{"name":"Korea University, Seongbuk-gu, Seoul, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,12,15]]},"reference":[{"key":"e_1_3_4_2_2","first-page":"2759","volume-title":"30th USENIX Security Symposium (USENIX Security\u201921)","author":"Aafer Yousra","year":"2021","unstructured":"Yousra Aafer, Wei You, Yi Sun, Yu Shi, Xiangyu Zhang, and Heng Yin. 2021. Android SmartTVs Vulnerability discovery via \\(Log-Guided\\) fuzzing. In 30th USENIX Security Symposium (USENIX Security\u201921). 2759\u20132776."},{"key":"e_1_3_4_3_2","unstructured":"Amazon. [n.d.]. Amazon Prime Air. Retrieved February 1 2022 from https:\/\/www.amazon.com\/Amazon-Prime-Air\/b?ie=UTF8&node=8037720011."},{"key":"e_1_3_4_4_2","unstructured":"Amazon. [n.d.]. Google X-wing. Retrieved February 1 2022 from http:https:\/\/x.company\/projects\/wing\/."},{"key":"e_1_3_4_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/JSEN.2016.2519924"},{"key":"e_1_3_4_6_2","unstructured":"Erik Andersen. [n.d.]. uClibc. Retrieved June 10 2020 from https:\/\/www.uclibc.org\/."},{"key":"e_1_3_4_7_2","unstructured":"Arduino. [n.d.]. arduino. Retrieved June 10 2020 from https:\/\/www.arduino.cc\/."},{"key":"e_1_3_4_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2911526"},{"key":"e_1_3_4_9_2","first-page":"1","volume-title":"Network and Distributed System Security Symposium (NDSS)","author":"Aschermann Cornelius","year":"2019","unstructured":"Cornelius Aschermann, Sergej Schumilo, Tim Blazytko, Robert Gawlik, and Thorsten Holz. 2019. REDQUEEN: Fuzzing with input-to-state correspondence. In Network and Distributed System Security Symposium (NDSS), Vol. 19. 1\u201315."},{"key":"e_1_3_4_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/3182657"},{"key":"e_1_3_4_11_2","first-page":"46","volume-title":"USENIX Annual Technical Conference, FREENIX Track","volume":"41","author":"Bellard Fabrice","year":"2005","unstructured":"Fabrice Bellard. 2005. QEMU, a fast and portable dynamic translator. In USENIX Annual Technical Conference, FREENIX Track, Vol. 41. 46."},{"key":"e_1_3_4_12_2","doi-asserted-by":"publisher","DOI":"10.1201\/9781482280715"},{"key":"e_1_3_4_13_2","unstructured":"beSTORM. [n.d.]. Dynamic Black Box Testing on the High Speed Universal Asynchronous Receiver\/Transmitter (High Speed UART). Retrieved April 5 2020 from https:\/\/beyondsecurity.com\/dynamic-fuzzing-testing-high-speed-universal-asynchronous-receiver-transmitter-uart.html?cn-reloaded=1."},{"key":"e_1_3_4_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/106972.107003"},{"key":"e_1_3_4_15_2","first-page":"153","volume-title":"Proceedings of the 10th ACM Conference on Data and Application Security and Privacy","author":"Fadilah Mohammad Shameel bin Mohammad","year":"2020","unstructured":"Mohammad Shameel bin Mohammad Fadilah, Vivek Balachandran, Peter Loh, and Melissa Chua. 2020. DRAT: A drone attack tool for vulnerability assessment. In Proceedings of the 10th ACM Conference on Data and Application Security and Privacy. 153\u2013155."},{"key":"e_1_3_4_16_2","unstructured":"BlackBerry. [n.d.]. QNX. Retrieved June 10 2020 from https:\/\/blackberry.qnx.com\/en\/software-solutions\/embedded-software\/qnx-neutrino-rtos."},{"key":"e_1_3_4_17_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134020"},{"key":"e_1_3_4_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2017.2785841"},{"key":"e_1_3_4_19_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.compind.2018.04.015"},{"key":"e_1_3_4_20_2","first-page":"209","volume-title":"USENIX conference on Operating Systems Design and Implementation (OSDI)","author":"Cadar Cristian","year":"2008","unstructured":"Cristian Cadar, Daniel Dunbar, Dawson Engler. 2008. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In USENIX conference on Operating Systems Design and Implementation (OSDI), Vol. 8. 209\u2013224."},{"key":"e_1_3_4_21_2","first-page":"1","volume-title":"NDSS","author":"Chen Daming D.","year":"2016","unstructured":"Daming D. Chen, Maverick Woo, David Brumley, and Manuel Egele. 2016. Towards automated dynamic analysis for linux-based embedded firmware. In NDSS, Vol. 16. 1\u201316."},{"key":"e_1_3_4_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243849"},{"key":"e_1_3_4_23_2","volume-title":"NDSS","author":"Chen Jiongyi","year":"2018","unstructured":"Jiongyi Chen, Wenrui Diao, Qingchuan Zhao, Chaoshun Zuo, Zhiqiang Lin, XiaoFeng Wang, Wing Cheong Lau, Menghan Sun, Ronghai Yang, and Kehuan Zhang. 2018. IoTFuzzer: Discovering memory corruptions in IoT through app-based fuzzing. In NDSS."},{"key":"e_1_3_4_24_2","doi-asserted-by":"crossref","first-page":"711","DOI":"10.1109\/SP.2018.00046","volume-title":"2018 IEEE Symposium on Security and Privacy (SP\u201918)","author":"Chen Peng","year":"2018","unstructured":"Peng Chen and Hao Chen. 2018. Angora: Efficient fuzzing by principled search. In 2018 IEEE Symposium on Security and Privacy (SP\u201918). IEEE, 711\u2013725."},{"key":"e_1_3_4_25_2","unstructured":"Yaohui Chen Mansour Ahmadi Reza Mirzazade farkhani Boyu Wang and Long Lu. 2020. MEUZZ: Smart Seed Scheduling for Hybrid Fuzzing. In 23rd International Symposium on Research in Attacks Intrusions and Defenses (RAID\u201920) . 77\u201392."},{"key":"e_1_3_4_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/13.275191"},{"key":"e_1_3_4_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/2110356.2110358"},{"key":"e_1_3_4_28_2","first-page":"1","volume-title":"29th USENIX Security Symposium (USENIX Sec\u201920)","author":"Clements Abraham A.","year":"2020","unstructured":"Abraham A. Clements, Eric Gustafson, Tobias Scharnowski, Paul Grosen, David Fritz, Christopher Kruegel, Giovanni Vigna, Saurabh Bagchi, and Mathias Payer. 2020. HALucinator: Firmware re-hosting through abstraction layer emulation. In 29th USENIX Security Symposium (USENIX Sec\u201920). 1\u201318."},{"key":"e_1_3_4_29_2","first-page":"95","volume-title":"23rd USENIX Security Symposium (USENIX Security\u201914)","author":"Costin Andrei","year":"2014","unstructured":"Andrei Costin, Jonas Zaddach, Aur\u00e9lien Francillon, and Davide Balzarotti. 2014. A large-scale analysis of the security of embedded firmwares. In 23rd USENIX Security Symposium (USENIX Security\u201914). 95\u2013110."},{"key":"e_1_3_4_30_2","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897900"},{"key":"e_1_3_4_31_2","unstructured":"CVE. [n.d.]. Common Vulnerabilities and Exposures. Retrieved March 1 2020 from https:\/\/cve.mitre.org\/cgi-bin\/cvekey.cgi?keyword=QEMU."},{"key":"e_1_3_4_32_2","unstructured":"The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC). [n.d.]. Mirai Botnet. Retrieved January 17 2022 from https:\/\/www.cyber.nj.gov\/threat-profiles\/botnet-variants\/mirai-botnet."},{"key":"e_1_3_4_33_2","first-page":"463","volume-title":"Presented as Part of the 22nd USENIX Security Symposium (USENIX Security\u201913)","author":"Davidson Drew","year":"2013","unstructured":"Drew Davidson, Benjamin Moench, Thomas Ristenpart, and Somesh Jha. 2013. FIE on firmware: Finding vulnerabilities in embedded systems using symbolic execution. In Presented as Part of the 22nd USENIX Security Symposium (USENIX Security\u201913). 463\u2013478."},{"key":"e_1_3_4_34_2","unstructured":"Angelo Dell\u2019Aera. [n.d.]. libemu. Retrieved June 10 2020 from https:\/\/github.com\/buffer\/libemu."},{"key":"e_1_3_4_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/2843859.2843867"},{"key":"e_1_3_4_36_2","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1109\/SP.2016.15","volume-title":"2016 IEEE Symposium on Security and Privacy (SP\u201916)","author":"Dolan-Gavitt Brendan","year":"2016","unstructured":"Brendan Dolan-Gavitt, Patrick Hulin, Engin Kirda, Tim Leek, Andrea Mambretti, Wil Robertson, Frederick Ulrich, and Ryan Whelan. 2016. Lava: Large-scale automated vulnerability addition. In 2016 IEEE Symposium on Security and Privacy (SP\u201916). IEEE, 110\u2013121."},{"key":"e_1_3_4_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2018.2822842"},{"key":"e_1_3_4_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/2393596.2393651"},{"key":"e_1_3_4_39_2","volume-title":"Proceedings of the 29th USENIX Security Symposium","author":"Feng Bo","year":"2020","unstructured":"Bo Feng, Alejandro Mera, and Long Lu. 2020. P2IM: Scalable and hardware-independent firmware testing via automatic peripheral interface modeling. In Proceedings of the 29th USENIX Security Symposium."},{"key":"e_1_3_4_40_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484543"},{"key":"e_1_3_4_41_2","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2012.071812.00124"},{"key":"e_1_3_4_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2009.5070546"},{"key":"e_1_3_4_43_2","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2020.3013046"},{"key":"e_1_3_4_44_2","article-title":"Fw-fuzz: A code coverage-guided fuzzing framework for network protocols on firmware","author":"Gao Zicong","year":"2020","unstructured":"Zicong Gao, Weiyu Dong, Rui Chang, and Yisen Wang. 2020. Fw-fuzz: A code coverage-guided fuzzing framework for network protocols on firmware. Concurrency and Computation: Practice and Experience 34, 16 (2020), e5756.","journal-title":"Concurrency and Computation: Practice and Experience"},{"key":"e_1_3_4_45_2","unstructured":"Github. [n.d.]. libcpu. Retrieved June 10 2020 from https:\/\/github.com\/libcpu\/libcpu."},{"key":"e_1_3_4_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/1292414.1292416"},{"key":"e_1_3_4_47_2","doi-asserted-by":"publisher","DOI":"10.1145\/2090147.2094081"},{"key":"e_1_3_4_48_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2017.8115618"},{"key":"e_1_3_4_49_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11933-5_13"},{"key":"e_1_3_4_50_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2973043"},{"key":"e_1_3_4_51_2","first-page":"135","volume-title":"22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID\u201919)","author":"Gustafson Eric","year":"2019","unstructured":"Eric Gustafson, Marius Muench, Chad Spensky, Nilo Redini, Aravind Machiry, Yanick Fratantonio, Davide Balzarotti, Aur\u00e9lien Francillon, Yung Ryn Choe, Christophe Kruegel, and Giovanni Vigna. 2019. Toward the analysis of embedded firmware through automated re-hosting. In 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID\u201919). 135\u2013150."},{"key":"e_1_3_4_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICESC.2014.15"},{"key":"e_1_3_4_53_2","doi-asserted-by":"publisher","DOI":"10.5555\/515384"},{"key":"e_1_3_4_54_2","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2007.364"},{"key":"e_1_3_4_55_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134050"},{"key":"e_1_3_4_56_2","first-page":"1","volume-title":"NDSS","author":"Hernandez Grant","year":"2022","unstructured":"Grant Hernandez, Marius Muench, Dominik Maier, Alyssa Milburn, Shinjo Park, Tobias Scharnowski, Tyler Tucker, Patrick Traynor, and Kevin R. B. Butler. 2022. FIRMWIRE: Transparent dynamic analysis for cellular baseband firmware. In NDSS, Vol. 22. 1\u201319."},{"key":"e_1_3_4_57_2","doi-asserted-by":"crossref","first-page":"1613","DOI":"10.1109\/SP40000.2020.00063","volume-title":"2020 IEEE Symposium on Security and Privacy (SP\u201920)","author":"Huang Heqing","year":"2020","unstructured":"Heqing Huang, Peisen Yao, Rongxin Wu, Qingkai Shi, and Charles Zhang. 2020. PANGOLIN: Incremental hybrid fuzzing with polyhedral path abstraction. In 2020 IEEE Symposium on Security and Privacy (SP\u201920). IEEE, 1613\u20131627."},{"key":"e_1_3_4_58_2","unstructured":"IBM. [n.d.]. Source Code Instrumentation Overview. Retrieved March 7 2020 from https:\/\/www.ibm.com\/support\/knowledgecenter\/SSSHUF_8.0.0\/com.ibm.rational.testrt.doc\/topics\/cinstruovw.html."},{"key":"e_1_3_4_59_2","unstructured":"IDA. [n.d.]. IDA-x86emu. Retrieved June 10 2020 from http:\/\/www.idabook.com\/x86emu\/index.html."},{"key":"e_1_3_4_60_2","first-page":"321","volume-title":"30th USENIX Security Symposium (USENIX Security\u201921)","author":"Johnson Evan","year":"2021","unstructured":"Evan Johnson, Maxwell Bland, YiFei Zhu, Joshua Mason, Stephen Checkoway, Stefan Savage, and Kirill Levchenko. 2021. Jetset: Targeted firmware rehosting for embedded systems. In 30th USENIX Security Symposium (USENIX Security\u201921). 321\u2013338."},{"key":"e_1_3_4_61_2","volume-title":"10th International Conference on Emerging Security Information, Systems and Technologies (SECUWARE\u201916)","author":"Kammerstetter Markus","year":"2016","unstructured":"Markus Kammerstetter, Daniel Burian, and Wolfgang Kastner. 2016. Embedded security testing with peripheral device caching and runtime program state approximation. In 10th International Conference on Emerging Security Information, Systems and Technologies (SECUWARE\u201916)."},{"key":"e_1_3_4_62_2","doi-asserted-by":"publisher","DOI":"10.1145\/2590296.2590301"},{"key":"e_1_3_4_63_2","doi-asserted-by":"publisher","DOI":"10.1109\/MDT.2008.142"},{"key":"e_1_3_4_64_2","volume-title":"Network and Distributed System Security Symposium","author":"Kim Hyungsub","year":"2021","unstructured":"Hyungsub Kim, Muslum Ozgur Ozmen, Antonio Bianchi, Z. Berkay Celik, and Dongyan Xu. 2021. PGFUZZ: Policy-guided fuzzing for robotic vehicles. In Network and Distributed System Security Symposium."},{"key":"e_1_3_4_65_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3097807"},{"key":"e_1_3_4_66_2","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427294"},{"key":"e_1_3_4_67_2","first-page":"249","volume-title":"30th USENIX Security Symposium (USENIX Security\u201921)","author":"Kim Taegyu","year":"2021","unstructured":"Taegyu Kim, Vireshwar Kumar, Junghwan Rhee, Jizhou Chen, Kyungtae Kim, Chung Hwan Kim, Dongyan Xu, and Dave Jing Tian. 2021. PASAN: Detecting peripheral access concurrency bugs within Bare-Metal embedded applications. In 30th USENIX Security Symposium (USENIX Security\u201921). 249\u2013266."},{"issue":"2004","key":"e_1_3_4_68_2","first-page":"1","article-title":"Procedures for performing systematic reviews","volume":"33","author":"Kitchenham Barbara","year":"2004","unstructured":"Barbara Kitchenham. 2004. Procedures for performing systematic reviews. Keele, UK, Keele University 33, 2004 (2004), 1\u201326.","journal-title":"Keele, UK, Keele University"},{"key":"e_1_3_4_69_2","volume-title":"12th USENIX Workshop on Offensive Technologies (WOOT\u201918)","author":"Kleber Stephan","year":"2018","unstructured":"Stephan Kleber, Henning Kopp, and Frank Kargl. 2018. NEMESYS: Network message syntax reverse engineering by analysis of the intrinsic structure of individual messages. In 12th USENIX Workshop on Offensive Technologies (WOOT\u201918)."},{"key":"e_1_3_4_70_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.34"},{"key":"e_1_3_4_71_2","volume-title":"9th USENIX Workshop on Offensive Technologies (WOOT\u201915)","author":"Koscher Karl","year":"2015","unstructured":"Karl Koscher, Tadayoshi Kohno, and David Molnar. 2015. SURROGATES: Enabling near-real-time dynamic analyses of embedded systems. In 9th USENIX Workshop on Offensive Technologies (WOOT\u201915)."},{"key":"e_1_3_4_72_2","doi-asserted-by":"publisher","DOI":"10.1109\/ATS.2010.19"},{"key":"e_1_3_4_73_2","volume-title":"Introduction to Embedded Systems: A Cyber-physical Systems Approach","author":"Lee Edward Ashford","year":"2017","unstructured":"Edward Ashford Lee and Sanjit A. Seshia. 2017. Introduction to Embedded Systems: A Cyber-physical Systems Approach. MIT Press."},{"key":"e_1_3_4_74_2","unstructured":"Michael Ley. [n.d.]. The dblp Computer Science Bibliography. Retrieved April 5 2020 from https:\/\/dblp.org\/faq\/What+is+dblp\/."},{"key":"e_1_3_4_75_2","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-018-0002-y"},{"key":"e_1_3_4_76_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-30619-9_10"},{"key":"e_1_3_4_77_2","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2018.2834476"},{"key":"e_1_3_4_78_2","doi-asserted-by":"publisher","DOI":"10.1145\/1064978.1065034"},{"key":"e_1_3_4_79_2","doi-asserted-by":"publisher","DOI":"10.1145\/3358227"},{"key":"e_1_3_4_80_2","doi-asserted-by":"publisher","DOI":"10.1109\/2.982916"},{"key":"e_1_3_4_81_2","volume-title":"13th USENIX Workshop on Offensive Technologies (WOOT\u201919)","author":"Maier Dominik","year":"2019","unstructured":"Dominik Maier, Benedikt Radtke, and Bastian Harren. 2019. Unicorefuzz: On the viability of emulation for kernelspace fuzzing. In 13th USENIX Workshop on Offensive Technologies (WOOT\u201919)."},{"key":"e_1_3_4_82_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2007.41"},{"key":"e_1_3_4_83_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2019.2946563"},{"key":"e_1_3_4_84_2","unstructured":"MDSec. [n.d.]. An Arduino UARTFuzzer. Retrieved April 5 2020 from https:\/\/github.com\/mdsecresearch\/UARTFuzz."},{"key":"e_1_3_4_85_2","doi-asserted-by":"publisher","DOI":"10.1109\/WESCON.1997.632381"},{"key":"e_1_3_4_86_2","doi-asserted-by":"publisher","DOI":"10.1145\/96267.96279"},{"key":"e_1_3_4_87_2","first-page":"1","volume-title":"Proc. Workshop Binary Anal. Res. (Colocated NDSS Symp.\u201918)","author":"Muench Marius","year":"2018","unstructured":"Marius Muench, Dario Nisi, Aur\u00e9lien Francillon, and Davide Balzarotti. 2018. Avatar2: A multi-target orchestration platform. In Proc. Workshop Binary Anal. Res. (Colocated NDSS Symp.\u201918), Vol. 18. 1\u201311."},{"key":"e_1_3_4_88_2","volume-title":"NDSS","author":"Muench Marius","year":"2018","unstructured":"Marius Muench, Jan Stijohann, Frank Kargl, Aur\u00e9lien Francillon, and Davide Balzarotti. 2018. What you corrupt is not what you crash: Challenges in fuzzing embedded devices. In NDSS."},{"key":"e_1_3_4_89_2","volume-title":"USENIX Security Symposium","author":"Mulliner Collin","year":"2011","unstructured":"Collin Mulliner, Nico Golde, and Jean-Pierre Seifert. 2011. SMS of death: From analyzing to attacking mobile phones on a large scale. In USENIX Security Symposium, Vol. 168."},{"key":"e_1_3_4_90_2","doi-asserted-by":"publisher","DOI":"10.1145\/1273442.1250746"},{"key":"e_1_3_4_91_2","first-page":"1","volume-title":"NDSS","author":"Newsome James","year":"2005","unstructured":"James Newsome and Dawn Xiaodong Song. 2005. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In NDSS, Vol. 5. Citeseer, 1\u201317."},{"key":"e_1_3_4_92_2","volume-title":"Proceedings of the 2015 Blackhat USA Conference","author":"Nguyen Anh Quynh","year":"2015","unstructured":"Anh Quynh Nguyen and Hoang Vu Dang. 2015. Unicorn: Next generation CPU emulator framework. In Proceedings of the 2015 Blackhat USA Conference."},{"key":"e_1_3_4_93_2","doi-asserted-by":"publisher","DOI":"10.5121\/ijesa.2012.2204"},{"key":"e_1_3_4_94_2","unstructured":"Amy Nordrum. [n.d.]. Popular Internet of Things Forecast of 50 Billion Devices by 2020 Is Outdated. Retrieved December 10 2021 from https:\/\/spectrum.ieee.org\/techtalk\/telecom\/internet\/popular-internet-of-things-forecast-of-50-billion-devices-by-2020-is-outdated."},{"key":"e_1_3_4_95_2","doi-asserted-by":"publisher","DOI":"10.1109\/APACE.2005.1607831"},{"key":"e_1_3_4_96_2","unstructured":"NSA. [n.d.]. Ghidra. Retrieved August 10 2020 from https:\/\/ghidra-sre.org\/."},{"key":"e_1_3_4_97_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2005.55"},{"key":"e_1_3_4_98_2","article-title":"Hybrid fuzz testing: Discovering software bugs via fuzzing and symbolic execution","author":"Pak Brian S.","year":"2012","unstructured":"Brian S. Pak. 2012. Hybrid fuzz testing: Discovering software bugs via fuzzing and symbolic execution. School of Computer Science Carnegie Mellon University (2012).","journal-title":"School of Computer Science Carnegie Mellon University"},{"key":"e_1_3_4_99_2","unstructured":"J. Pereyda. [n.d.]. boofuzz. Retrieved March 1 2020 from https:\/\/github.com\/jtpereyda\/boofuzz."},{"key":"e_1_3_4_100_2","unstructured":"Cody Pierce. [n.d.]. PyEmu. Retrieved June 10 2020 from https:\/\/github.com\/codypierce\/pyemu."},{"key":"e_1_3_4_101_2","unstructured":"GNU project. [n.d.]. GNU Binutils. Retrieved August 10 2020 from https:\/\/www.gnu.org\/software\/binutils\/."},{"key":"e_1_3_4_102_2","doi-asserted-by":"publisher","DOI":"10.1145\/1015047.1015049"},{"key":"e_1_3_4_103_2","first-page":"1","volume-title":"NDSS","author":"Rawat Sanjay","year":"2017","unstructured":"Sanjay Rawat, Vivek Jain, Ashish Kumar, Lucian Cojocar, Cristiano Giuffrida, and Herbert Bos. 2017. VUzzer: Application-aware evolutionary fuzzing. In NDSS, Vol. 17. 1\u201314."},{"key":"e_1_3_4_104_2","doi-asserted-by":"crossref","first-page":"484","DOI":"10.1109\/SP40001.2021.00066","volume-title":"2021 IEEE Symposium on Security and Privacy (SP\u201921)","author":"Redini Nilo","year":"2021","unstructured":"Nilo Redini, Andrea Continella, Dipanjan Das, Giulio De Pasquale, Noah Spahn, Aravind Machiry, Antonio Bianchi, Christopher Kruegel, and Giovanni Vigna. 2021. DIANE: Identifying fuzzing triggers in Apps to generate under-constrained inputs for IoT devices. In 2021 IEEE Symposium on Security and Privacy (SP\u201921). IEEE, 484\u2013500."},{"key":"e_1_3_4_105_2","first-page":"1544","volume-title":"2020 IEEE Symposium on Security and Privacy (SP\u201915)","author":"Redini Nilo","year":"2015","unstructured":"Nilo Redini, Aravind Machiry, Ruoyu Wang, Chad Spensky, Andrea Continella, Yan Shoshitaishvili, Christopher Kruegel, and Giovanni Vigna. 2015. KARONTE: Detecting insecure multi-binary interactions in embedded firmware. In 2020 IEEE Symposium on Security and Privacy (SP\u201915). 1544\u20131561."},{"key":"e_1_3_4_106_2","unstructured":"Wind River. [n.d.]. Wind River Simics. Retrieved December 3 2021 from https:\/\/resources.windriver.com\/i\/1183368-wind-river-simics-product-note\/0?."},{"key":"e_1_3_4_107_2","doi-asserted-by":"publisher","DOI":"10.1109\/MDT.2010.9"},{"key":"e_1_3_4_108_2","unstructured":"Hex-Rays SA.[n.d.]. IDA Pro. Retrieved June 10 2020 from https:\/\/www.hex-rays.com\/products\/ida\/index.shtml."},{"key":"e_1_3_4_109_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2019.102481"},{"key":"e_1_3_4_110_2","first-page":"309","volume-title":"Presented as Part of the 2012 USENIX Annual Technical Conference (USENIX ATC\u201912)","author":"Serebryany Konstantin","year":"2012","unstructured":"Konstantin Serebryany, Derek Bruening, Alexander Potapenko, and Dmitriy Vyukov. 2012. AddressSanitizer: A fast address sanity checker. In Presented as Part of the 2012 USENIX Annual Technical Conference (USENIX ATC\u201912). 309\u2013318."},{"key":"e_1_3_4_111_2","doi-asserted-by":"publisher","DOI":"10.1145\/1791194.1791203"},{"key":"e_1_3_4_112_2","unstructured":"Y. Shoshitaishvili. [n.d.]. angr. Retrieved June 10 2020 from http:\/\/fuse.sourceforge.net."},{"key":"e_1_3_4_113_2","volume-title":"NDSS","author":"Shoshitaishvili Yan","year":"2015","unstructured":"Yan Shoshitaishvili, Ruoyu Wang, Christophe Hauser, Christopher Kruegel, and Giovanni Vigna. 2015. Firmalice-automatic detection of authentication bypass vulnerabilities in binary firmware. In NDSS."},{"key":"e_1_3_4_114_2","first-page":"881","volume-title":"24th USENIX Security Symposium (USENIX Security\u201915)","author":"Son Yunmok","year":"2015","unstructured":"Yunmok Son, Hocheol Shin, Dongkwan Kim, Youngseok Park, Juhwan Noh, Kibum Choi, Jungwoo Choi, and Yongdae Kim. 2015. Rocking drones with intentional sound noise on gyroscopic sensors. In 24th USENIX Security Symposium (USENIX Security\u201915). 881\u2013896."},{"key":"e_1_3_4_115_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2015.132"},{"key":"e_1_3_4_116_2","doi-asserted-by":"publisher","DOI":"10.1145\/3338507.3358616"},{"key":"e_1_3_4_117_2","first-page":"46","volume-title":"2015 IEEE\/ACM International Symposium on Code Generation and Optimization (CGO\u201915)","author":"Stepanov Evgeniy","year":"2015","unstructured":"Evgeniy Stepanov and Konstantin Serebryany. 2015. MemorySanitizer: Fast detector of uninitialized memory use in C++. In 2015 IEEE\/ACM International Symposium on Code Generation and Optimization (CGO\u201915). IEEE, 46\u201355."},{"key":"e_1_3_4_118_2","first-page":"1","volume-title":"NDSS","author":"Stephens Nick","year":"2016","unstructured":"Nick Stephens, John Grosen, Christopher Salls, Andrew Dutcher, Ruoyu Wang, Jacopo Corbetta, Yan Shoshitaishvili, Christopher Kruegel, and Giovanni Vigna. 2016. Driller: Augmenting fuzzing through selective symbolic execution. In NDSS, Vol. 16. 1\u201316."},{"key":"e_1_3_4_119_2","doi-asserted-by":"publisher","DOI":"10.1145\/1111320.1111070"},{"key":"e_1_3_4_120_2","volume-title":"Embedded Systems Firmware Demystified","author":"Sutter Ed","year":"2002","unstructured":"Ed Sutter. 2002. Embedded Systems Firmware Demystified. CMP Books."},{"key":"e_1_3_4_121_2","unstructured":"Trenton Systems. [n.d.]. What Are Embedded Systems? Retrieved December 10 2021 from https:\/\/www.trentonsystems.com\/blog\/what-are-embedded-systems."},{"key":"e_1_3_4_122_2","doi-asserted-by":"publisher","DOI":"10.5555\/3275309"},{"key":"e_1_3_4_123_2","volume-title":"Modern Operating Systems","author":"Tanenbaum Andrew S.","year":"2015","unstructured":"Andrew S. Tanenbaum and Herbert Bos. 2015. Modern Operating Systems. Pearson."},{"key":"e_1_3_4_124_2","unstructured":"TechRepublic. [n.d.]. IoT Device Attacks Double in the First Half of 2021 and Remote Work May Shoulder Some of the Blame. Retrieved January 17 2022 from https:\/\/www.techrepublic.com\/article\/iot-device-attacks-double-in-the-first-half-of-2021-and-remote-work-may-shoulder-some-of-the-blame\/."},{"key":"e_1_3_4_125_2","first-page":"171","volume-title":"International Conference on Smart Card Research and Advanced Applications","author":"Vasile Sebastian","year":"2018","unstructured":"Sebastian Vasile, David Oswald, and Tom Chothia. 2018. Breaking all the things\u2013A systematic survey of firmware extraction techniques for IoT devices. In International Conference on Smart Card Research and Advanced Applications. Springer, 171\u2013185."},{"key":"e_1_3_4_126_2","doi-asserted-by":"publisher","DOI":"10.1109\/ETFA.2015.7301400"},{"key":"e_1_3_4_127_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.37"},{"key":"e_1_3_4_128_2","doi-asserted-by":"publisher","DOI":"10.1145\/1368088.1368112"},{"key":"e_1_3_4_129_2","doi-asserted-by":"publisher","DOI":"10.5555\/1859554"},{"issue":"78","key":"e_1_3_4_130_2","first-page":"10\u2013es","article-title":"Busybox: A Swiss army knife for Linux","volume":"2000","author":"Wells Nicholas","year":"2000","unstructured":"Nicholas Wells. 2000. Busybox: A Swiss army knife for Linux. Linux Journal 2000, 78es (2000), 10\u2013es.","journal-title":"Linux Journal"},{"key":"e_1_3_4_131_2","unstructured":"Wikipedia. [n.d.]. jtag. Retrieved June 10 2020 from https:\/\/en.wikipedia.org\/wiki\/JTAG."},{"key":"e_1_3_4_132_2","unstructured":"Wikipedia. [n.d.]. uart. Retrieved June 10 2020 from https:\/\/en.wikipedia.org\/wiki\/Universal_asynchronous_receiver-transmitter."},{"key":"e_1_3_4_133_2","unstructured":"Windriver. [n.d.]. simics. Retrieved June 10 2020 from https:\/\/www.windriver.com\/products\/simics\/."},{"key":"e_1_3_4_134_2","unstructured":"Windriver. [n.d.]. VxWorks. Retrieved June 10 2020 from https:\/\/www.windriver.com\/products\/vxworks\/."},{"key":"e_1_3_4_135_2","unstructured":"wirehoul. [n.d.]. Doona. Retrieved December 10 2021 from https:\/\/github.com\/wireghoul\/doona."},{"key":"e_1_3_4_136_2","doi-asserted-by":"publisher","DOI":"10.1145\/3423167"},{"key":"e_1_3_4_137_2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2014.2300753"},{"key":"e_1_3_4_138_2","first-page":"745","volume-title":"27th USENIX Security Symposium (USENIX Security\u201918)","author":"Yun Insu","year":"2018","unstructured":"Insu Yun, Sangho Lee, Meng Xu, Yeongjin Jang, and Taesoo Kim. 2018. QSYM: A practical concolic execution engine tailored for hybrid fuzzing. In 27th USENIX Security Symposium (USENIX Security\u201918). 745\u2013761."},{"key":"e_1_3_4_139_2","first-page":"1","volume-title":"NDSS","author":"Zaddach Jonas","year":"2014","unstructured":"Jonas Zaddach, Luca Bruno, Aurelien Francillon, and Davide Balzarotti. 2014. AVATAR: A framework to support dynamic security analysis of embedded systems\u2019 firmwares. In NDSS, Vol. 14. 1\u201316."},{"key":"e_1_3_4_140_2","unstructured":"Michal Zalewski. [n.d.]. American Fuzzy Lop. Retrieved March 1 2020 from http:\/\/http:\/\/lcamtuf.coredump.cx\/afl\/."},{"key":"e_1_3_4_141_2","first-page":"1527","volume-title":"27th USENIX Security Symposium (USENIX Security\u201918)","author":"Zeng Kexiong Curtis","year":"2018","unstructured":"Kexiong Curtis Zeng, Shinan Liu, Yuanchao Shu, Dong Wang, Haoyu Li, Yanzhi Dou, Gang Wang, and Yaling Yang. 2018. All your GPS are belong to us: Towards stealthy manipulation of road navigation systems. In 27th USENIX Security Symposium (USENIX Security\u201918). 1527\u20131544."},{"key":"e_1_3_4_142_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICRMS.2011.5979375"},{"key":"e_1_3_4_143_2","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2012.6415722"},{"key":"e_1_3_4_144_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2019.00016"},{"key":"e_1_3_4_145_2","volume-title":"NDSS","author":"Zhao Lei","year":"2019","unstructured":"Lei Zhao, Yue Duan, Heng Yin, and Jifeng Xuan. 2019. Send hardest problems my way: Probabilistic path prioritization for hybrid fuzzing. In NDSS."},{"key":"e_1_3_4_146_2","first-page":"1099","volume-title":"28th USENIX Security Symposium (USENIX Security\u201919)","author":"Zheng Yaowen","year":"2019","unstructured":"Yaowen Zheng, Ali Davanian, Heng Yin, Chengyu Song, Hongsong Zhu, and Limin Sun. 2019. FIRM-AFL: High-throughput greybox fuzzing of IoT firmware via augmented process emulation. In 28th USENIX Security Symposium (USENIX Security\u201919). USENIX Association, Santa Clara, CA, 1099\u20131114. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/zheng."},{"key":"e_1_3_4_147_2","doi-asserted-by":"publisher","DOI":"10.1109\/IPCCC47392.2019.8958740"},{"key":"e_1_3_4_148_2","first-page":"2007","volume-title":"USENIX Security Symposium","author":"Zhou Wei","year":"2021","unstructured":"Wei Zhou, Le Guan, Peng Liu, and Yuqing Zhang. 2021. Automatic firmware emulation through invalidity-guided knowledge inference. In USENIX Security Symposium. 2007\u20132024."}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3538644","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3538644","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T15:03:03Z","timestamp":1750172583000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3538644"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,15]]},"references-count":147,"journal-issue":{"issue":"7","published-print":{"date-parts":[[2023,7,31]]}},"alternative-id":["10.1145\/3538644"],"URL":"https:\/\/doi.org\/10.1145\/3538644","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,15]]},"assertion":[{"value":"2021-02-12","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-05-16","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-12-15","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}