Overview
In emulation-based fuzzing, instrumentation refers to the code or hooks inserted into an emulator to extract feedback (for example, coverage information) that guides input mutations toward generating effective test cases. The authors of Icicle describe instrumentation as being "at the core of modern fuzzers" because it enables feedback-driven mutation strategies on binaries that lack source code or that target embedded architectures where direct execution on real hardware is impractical.
Instrumentation in Existing Emulation-Based Fuzzers
Modern emulation-based fuzzers have historically evolved by re-purposing general-purpose emulators. As a consequence, developing and integrating fuzzing techniques — including instrumentation methods — has been difficult and is often performed in an ad-hoc manner, specific to a particular instruction set architecture (ISA). This has limited state-of-the-art fuzzing techniques to a small set of ISAs, primarily:
- x86 / x86-64
- ARM / AArch64
This is a significant problem for firmware fuzzing, where target binaries span a much more diverse range of architectures.
Architecture-Agnostic Instrumentation with Icicle
Icicle re-thinks emulation for fuzzing by designing and implementing a fuzzing-specific, multi-architecture emulation framework. One of its key contributions is the ability to add instrumentation once, in an architecture-agnostic manner, while incurring low execution overhead.
Concrete demonstrations of this capability in the paper include:
- Replicating Fuzzware results on ARM firmware: Icicle is employed as the emulator for the state-of-the-art ARM firmware fuzzer Fuzzware and successfully replicates its results.
- Discovering new bugs via new instrumentation: The availability of new instrumentation mechanisms in Icicle enabled the discovery of new bugs that were not previously reachable with prior tools.
- Cross-ISA LAVA-M bug discovery: Icicle demonstrates the fidelity of its emulation and the efficacy of architecture-agnostic instrumentation by discovering LAVA-M benchmark bugs across a diverse set of ISAs — x86-64, ARM/AArch64, RISC-V, and MIPS — which require a known and specific operational capability of instrumentation techniques.
- MSP430 firmware fuzzing: To demonstrate effectiveness on an architecture not previously supported by emulation-based fuzzers, the authors ran a fuzzing campaign with real-world MSP430 firmware binaries and discovered 7 new bugs.
Significance
By decoupling instrumentation from the underlying ISA, Icicle allows instrumentation techniques — previously confined to x86/x86-64 and ARM/AArch64 — to be applied to firmware binaries targeting a wide variety of embedded architectures. This broadens the practical reach of feedback-driven, coverage-guided fuzzing to firmware ecosystems that were previously unsupported.
Related Tools and Approaches
- Icicle — a fuzzing-specific, multi-architecture emulation framework that implements architecture-agnostic instrumentation.
- SBT-instrumentation — a tool from the Symbiotic toolbox for configurable instrumentation of LLVM bitcode, enabling users to specify instruction patterns and define functions to insert before or after matching instructions, with support for phased instrumentation and external static-analysis plugins. It is primarily developed for inserting memory safety checks but is configurable for many purposes.
- BISM (Bytecode-Level Instrumentation for Software Monitoring) — a lightweight bytecode instrumentation tool that uses an aspect-oriented, control-flow-aware instrumentation language with a joinpoint model, advice inlining, and separate instrumentation mechanisms. BISM supports both build-time and load-time instrumentation and demonstrates low runtime and memory overhead in security and runtime-verification scenarios.