IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit

Wei Zhou (), Shandian Shen and Peng Liu ()
Additional contact information
Wei Zhou: School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan 430074, China
Shandian Shen: School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan 430074, China
Peng Liu: College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA 16802, USA

Future Internet, 2025, vol. 17, issue 1, 1-20

Abstract: As IoT devices with microcontroller (MCU)-based firmware become more common in our lives, memory corruption vulnerabilities in their firmware are increasingly targeted by adversaries. Fuzzing is a powerful method for detecting these vulnerabilities, but it poses unique challenges when applied to IoT devices. Direct fuzzing on these devices is inefficient, and recent efforts have shifted towards creating emulation environments for dynamic firmware testing. However, unlike traditional software, firmware interactions with peripherals that are significantly more diverse presents new challenges for achieving scalable full-system emulation and effective fuzzing. This paper reviews 27 state-of-the-art works in MCU-based firmware emulation and its applications in fuzzing. Instead of classifying existing techniques based on their capabilities and features, we first identify the fundamental challenges faced by firmware emulation and fuzzing. We then revisit recent studies, organizing them according to the specific challenges they address, and discussing how each specific challenge is addressed. We compare the emulation fidelity and bug detection capabilities of various techniques to clearly demonstrate their strengths and weaknesses, aiding users in selecting or combining tools to meet their needs. Finally, we highlight the remaining technical gaps and point out important future research directions in firmware emulation and fuzzing.

Keywords: IoT devices; MCU; firmware; vulnerability detection; peripheral modeling; firmware emulation; fuzz testing; hardware-in-the-loop (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2025
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/17/1/19/pdf (application/pdf)
https://www.mdpi.com/1999-5903/17/1/19/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:17:y:2025:i:1:p:19-:d:1561106

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().