Skip to content
STIMSMITH

Instrumentation

Technique

In the context of emulation-based fuzzing, instrumentation refers to the techniques inserted into an emulator to extract feedback and guide input mutations toward effective test cases. The Icicle emulator demonstrates an architecture-agnostic approach to instrumentation that allows instrumentation to be added once and reused across diverse instruction set architectures, addressing a key limitation of prior emulation-based fuzzers that tied instrumentation to specific ISAs such as x86/x86-64 or ARM/AArch64.

First seen 9/28/2026
Last seen 9/28/2026
Evidence 1 chunks
Wiki v1

WIKI

Overview

In emulation-based fuzzing, instrumentation refers to the code or hooks inserted into an emulator to extract feedback (for example, coverage information) that guides input mutations toward generating effective test cases. The authors of Icicle describe instrumentation as being "at the core of modern fuzzers" because it enables feedback-driven mutation strategies on binaries that lack source code or that target embedded architectures where direct execution on real hardware is impractical.

Instrumentation in Existing Emulation-Based Fuzzers

READ FULL ARTICLE →

NEIGHBORHOOD

3 nodes · 4 edges
graph · Instrumentation · depth=1

RELATIONSHIPS

2 connections
The work centers on integrating instrumentation into the emulation framework to provide feedback for fuzzing.
Icicle ← implements 90% 1e
Icicle provides built-in instrumentation that can be added once and applied across ISAs.

CITATIONS

8 sources
8 citations — click to expand
[1] In emulation-based fuzzing, instrumentation techniques are added to extract feedback and guide input mutations toward effective test cases. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing
[2] Modern emulation-based fuzzers evolved by re-purposing general-purpose emulators, which led to ad-hoc, ISA-specific instrumentation and limited state-of-the-art fuzzing to x86/x86-64 and ARM/AArch64. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing
[3] Icicle is a fuzzing-specific, multi-architecture emulation framework that can add instrumentation once in an architecture-agnostic manner with low execution overhead. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing
[4] Icicle replicates Fuzzware results on ARM firmware, and its new instrumentation enabled discovery of new bugs. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing
[5] Icicle discovered LAVA-M benchmark bugs across x86-64, ARM/AArch64, RISC-V, and MIPS, demonstrating the efficacy of architecture-agnostic instrumentation. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing
[6] A fuzzing campaign with Icicle on real-world MSP430 firmware binaries discovered 7 new bugs, demonstrating effectiveness on an architecture previously unsupported by emulation-based fuzzers. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing
[7] SBT-instrumentation is a tool for configurable instrumentation of LLVM bitcode, developed as part of the Symbiotic toolbox for inserting memory safety checks but configurable for many purposes. SBT-instrumentation: A Tool for Configurable Instrumentation of LLVM Bitcode
[8] BISM is a lightweight bytecode-level instrumentation tool that uses an aspect-oriented, control-flow-aware instrumentation language and supports both build-time and load-time instrumentation with low runtime and memory overhead. BISM: Bytecode-Level Instrumentation for Software Monitoring