Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing

Paper

First seen 9/28/2026

Last seen 9/28/2026

Evidence 1 chunks

NEIGHBORHOOD

16 nodes · 29 edges

graph · Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing · depth=1

16 connections

Icicle introduces → 95% 1e

The authors present and implement a new fuzzing-specific, multi-architecture emulation framework named Icicle.

Icicle uses → 85% 1e

In their experiments, the authors employ Icicle as the emulator component.

Fuzzware uses → 80% 1e

The study integrates Icicle as the emulator within the Fuzzware fuzzer to replicate prior results.

LAVA-M evaluates → 90% 1e

The study uses the LAVA-M benchmark suite to validate instrumentation fidelity and finds benchmark bugs.

x86-64 targets ISA → 85% 1e

Their cross-ISA evaluation explicitly includes x86-64.

ARM targets ISA → 85% 1e

ARM is listed among the evaluated ISAs.

AArch64 targets ISA → 85% 1e

AArch64 is included in the diverse set of ISAs evaluated.

RISC-V targets ISA → 85% 1e

RISC-V is among the ISAs across which results are demonstrated.

MIPS targets ISA → 85% 1e

MIPS is included among the architectures used in the study.

MSP430 targets ISA → 90% 1e

The authors run a real-world fuzzing campaign on MSP430 firmware binaries.

The abstract opens by describing the role and benefits of emulation-based fuzzers.

Firmware Fuzzing mentions → 80% 1e

The abstract highlights challenges specific to firmware fuzzing across diverse ISAs.

The abstract notes that instrumentation provides feedback to guide input mutations in modern fuzzers.

Instrumentation uses → 85% 1e

The work centers on integrating instrumentation into the emulation framework to provide feedback for fuzzing.

The evaluation demonstrates and relies on the architecture-agnostic instrumentation provided by Icicle.

The work is positioned specifically for grey-box firmware fuzzing, as indicated by the title.