Conference:
6th International Workshop on Security Testing and Monitoring (STAM 2026) co-located with the 21st International Conference on Availability, Reliability and Security (ARES 2026)
24-27. August 2026, Linköping, Sweden
Authors:
Jungnickel L, Isakovic K, Barakat R, Schneider M.
Abstract:
Memory sanitization is a key technique for detecting memory corruption bugs during fuzzing. While tools such as AddressSanitizer are widely used in OS-hosted environments, they cannot be applied to bare-metal firmware due to the absence of operating system abstractions. We propose a sanitization architecture for bare-metal firmware fuzzing that combines static analysis of the firmware binary with runtime memory access observation inside an emulator. Built on top of the Hoedur firmware fuzzer, our approach tracks accesses to global, stack, and heap memory regions without requiring source-code instrumentation. Evaluation on 22 real-world firmware targets demonstrates that the architecture correctly reconstructs program flow and intercepts memory accesses that remain invisible to conventional crash- and hang-based fuzzing. The program flow reconstruction correctly handles diverse control-flow patterns including tail calls, loop functions, and multi-threaded execution across all targets. We trace the remaining imprecisions to incomplete pointer resolution and unhandled bulk memory operations in the static analysis, both of which represent solvable engineering challenges. We systematically analyze the sources of imprecision encountered and identify concrete directions for achieving practical detection accuracy in future work.
