Overview
Icicle is an emulation framework explicitly re-designed for grey-box firmware fuzzing. Unlike modern emulation-based fuzzers that retro-fit general-purpose emulators with ad-hoc, ISA-specific instrumentation, Icicle is built from the ground up with fuzzing instrumentation as a first-class concern.
Motivation
Emulation-based fuzzers allow testing of binaries without source code and are particularly useful for embedded firmware, where running on the target hardware is difficult and slow. However, the instrumentation that extracts feedback and guides input mutations — the core of modern grey-box fuzzing — is typically bolted onto general-purpose emulators in an architecture-specific, ad-hoc manner. As a result, state-of-the-art fuzzing techniques have been limited to a small number of ISAs (primarily x86/x86-64 and ARM/AArch64), which is a significant limitation for firmware that targets more diverse architectures.
Design and Implementation
Icicle is a fuzzing-specific, multi-architecture emulation framework. Its key design property is that instrumentation can be added once, in an architecture-agnostic manner, while incurring low execution overhead. This decouples instrumentation development from ISA support and lets new instrumentation techniques become available uniformly across all supported architectures.
Supported Instruction Set Architectures
Icicle targets a broad set of ISAs relevant to embedded firmware:
- x86-64
- ARM / AArch64
- RISC-V
- MIPS
- MSP430 (notably an architecture not commonly supported by existing emulation-based fuzzers)
Evaluation and Findings
The authors evaluated Icicle in three ways:
- Replication with Fuzzware. Icicle was used as the emulator for Fuzzware, a state-of-the-art ARM firmware fuzzer, and the published results were replicated.
- LAVA-M bugs across diverse ISAs. The fidelity of Icicle and the efficacy of its architecture-agnostic instrumentation were demonstrated by discovering LAVA-M benchmark bugs across x86-64, ARM/AArch64, RISC-V, and MIPS. These bugs require a known and specific operational capability of instrumentation techniques, showing that Icicle's instrumentation is functionally equivalent across architectures.
- New MSP430 bugs. In a fuzzing campaign against real-world MSP430 firmware binaries — an architecture previously unsupported by emulation-based fuzzers — Icicle discovered 7 new bugs, illustrating both the practical reach of the framework to new targets and the bug-finding value of newly available instrumentation.
The paper also notes that the availability of new instrumentation in Icicle enabled the discovery of new bugs beyond what prior emulators could surface.
Origin and Publication
Icicle is introduced in the paper "Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing" by Michael Chesser and colleagues, hosted on arXiv (submitted 31 Jan 2023, revised 21 Jun 2023 as v2).
Key Properties
- Fuzzing-specific emulator (not a general-purpose emulator retro-fitted).
- Architecture-agnostic instrumentation added once with low overhead.
- Multi-architecture: x86-64, ARM/AArch64, RISC-V, MIPS, MSP430.
- Empirically validated on Fuzzware, the LAVA-M benchmarks, and real-world MSP430 firmware.