Icicle

Tool

Icicle is a fuzzing-specific, multi-architecture emulation framework for grey-box firmware fuzzing. It enables architecture-agnostic instrumentation added once with low execution overhead, supports a diverse set of ISAs (x86-64, ARM/AArch64, RISC-V, MIPS, MSP430), and has been used to replicate Fuzzware results on ARM firmware, rediscover LAVA-M bugs across multiple ISAs, and find new bugs in MSP430 firmware.

First seen 9/28/2026

Last seen 9/28/2026

Evidence 1 chunks

Wiki v1

WIKI

Overview

Icicle is an emulation framework explicitly re-designed for grey-box firmware fuzzing. Unlike modern emulation-based fuzzers that retro-fit general-purpose emulators with ad-hoc, ISA-specific instrumentation, Icicle is built from the ground up with fuzzing instrumentation as a first-class concern.

Motivation

READ FULL ARTICLE →

NEIGHBORHOOD

12 nodes · 23 edges

graph · Icicle · depth=1

RELATIONSHIPS

12 connections

Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing ← introduces 95% 1e

The authors present and implement a new fuzzing-specific, multi-architecture emulation framework named Icicle.

Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing ← uses 85% 1e

In their experiments, the authors employ Icicle as the emulator component.

Fuzzware ← uses 85% 1e

Within the study, the Fuzzware fuzzer is run using Icicle as its emulator backend.

LAVA-M evaluates → 85% 1e

Using Icicle's instrumentation, the authors run the LAVA-M benchmarks and detect their injected bugs across ISAs.

x86-64 targets ISA → 85% 1e

The evaluation demonstrates Icicle operating across x86-64 among other ISAs.

ARM targets ISA → 85% 1e

ARM is one of the ISAs over which Icicle's fidelity is demonstrated.

AArch64 targets ISA → 85% 1e

AArch64 is explicitly listed among the ISAs exercised with Icicle.

RISC-V targets ISA → 85% 1e

Icicle is demonstrated on RISC-V among other architectures.

MIPS targets ISA → 85% 1e

MIPS is included in the set of ISAs where Icicle operates.

MSP430 targets ISA → 90% 1e

The authors use Icicle to run real-world MSP430 firmware during their evaluation.

Instrumentation implements → 90% 1e

Icicle provides built-in instrumentation that can be added once and applied across ISAs.

Architecture-agnostic instrumentation implements → 90% 1e

Icicle's design enables adding instrumentation once and reusing it across multiple ISAs.

LINKED ENTITIES

11 links

Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing INTRODUCES Extracted graph relationship

Fuzzware USES Extracted graph relationship

LAVA-M EVALUATES Extracted graph relationship

x86-64 TARGETS_ISA Extracted graph relationship

ARM TARGETS_ISA Extracted graph relationship

AArch64 TARGETS_ISA Extracted graph relationship

RISC-V TARGETS_ISA Extracted graph relationship

MIPS TARGETS_ISA Extracted graph relationship

MSP430 TARGETS_ISA Extracted graph relationship

Instrumentation IMPLEMENTS Extracted graph relationship

Architecture-agnostic instrumentation IMPLEMENTS Extracted graph relationship

CITATIONS

6 sources

6 citations — click to expand

[1] Icicle is a fuzzing-specific, multi-architecture emulation framework for grey-box firmware fuzzing, re-designed to make instrumentation a first-class concern rather than ad-hoc ISA-specific additions. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing

[2] Icicle enables instrumentation to be added once, in an architecture-agnostic manner, with low execution overhead. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing

[3] Icicle was used as the emulator for Fuzzware, a state-of-the-art ARM firmware fuzzer, and replicated its results; new instrumentation in Icicle enabled the discovery of new bugs. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing

[4] Icicle discovered LAVA-M benchmark bugs across x86-64, ARM/AArch64, RISC-V, and MIPS, demonstrating fidelity and the efficacy of architecture-agnostic instrumentation. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing

[5] A fuzzing campaign with Icicle against real-world MSP430 firmware binaries discovered 7 new bugs, demonstrating effectiveness on an architecture previously unsupported by emulation-based fuzzers. Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing

[6] The paper was submitted on 31 Jan 2023 and revised on 21 Jun 2023 (v2). Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing