# IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit
## 6 Bug Detection Capability of Emulator's Fuzzing Application
### False Negatives  
False negatives in firmware fuzzing can have serious consequences, particularly for security-sensitive devices in applications such as automotive, healthcare, and industry. False negatives can be caused by two reasons: limited code coverage and bug detection capabilities. Greater coverage means more parts of the firmware have been tested, which typically results in fewer false negatives, and the ability to detect more types of bugs in less time also reduces false negatives. Coverage relies on both emulation capability and fuzzing strategies. If peripheral emulation fails, the firmware may stall, resulting in limited coverage. Improving emulation fidelity can increase coverage and reduce false negatives. Lower fidelity emulation can increase error handling coverage in firmware, but it may mislead fuzzing mutations to focus more on error handling rather than normal operations. For fuzzing strategies, many fuzzing applications rely on general-purpose fuzzers like AFL [47], AFL++ [48], or libafl [49]. Many fuzzing applications use general-purpose fuzzers such as AFL [47], AFL++ [48], and libafl [49]. To achieve higher coverage, recent research [34; 43; 44; 45] has enhanced general fuzzing technologies for real firmware targets by improving input generation, mutation, and coverage feedback. For instance, _Hoodur_ enhances libfuzzer [50] by handling multiple peripheral input streams and applying mutation techniques specific to firmware, such as recognizing peripheral input types and performing cross-input stream mutations, resulting in higher coverage than previous methods. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Tools** & **Mutation and Generation** & **Input** & **Coverage Feedback** & **Bug Detection** & **FP** & **FN** \\ \hline _HALAcintator_[24] & AFL & Specified Func./None & Edge & Basic Mem. Error+ & Moderate-low & Moderate \\ _SAFRETUZZ_[20] & LibRAFL & Specified Func./None & Non-colliding Edge & Basic Mem. Error & Moderate-low & Moderate \\ \hline _PIM_[27] & AFL & Identified Data IO/None & Edge & Basic Mem. Error & Moderate-high & Moderate \\ _\(\mu\)Erm_[31] & AFL & Identified Data IO/None & Edge & Basic Mem. Error & Moderate & Moderate \\ _DICE_[28] & AFL & Identified Data IO/None & Edge & Basic Mem. Error & Moderate & Moderate \\ _EnEnvir-JO_[34] & AFL/AFL++ & MMO/Vrazzche & Functionally & Basic Mem. Error & High & Moderate \\ _Envirzer_[33] & AFL/AFL++ & MMO/Modeling & Edge & Basic Mem. Error & Moderate-high & Moderate \\ _SEmm_[35] & AFL/AFL++ & Identified Data IO/None & Edge & Basic Mem. Error & Moderate-low & Moderate \\ _Parry_[36] & AFL & Specified Func./None & Edge & Basic Mem. Error & Moderate-low & Moderate \\ \hline _Hodur_[44] & LibFuzzer + \(\Delta\) & MMC/Multi-Stream & Functionally & Basic Mem. Error & Moderate-low & Moderate-low \\ \(\mu\)_StriITS_[43] & AFL + 2S & MMO/Multi-Stream & Edge + Comparison & Basic Mem. Error & Expanded & Moderate-low \\ \(\mu\)_Strize_[45] & AFL + 2S+ & *Modeling & *Lem. & & & \\ _MultiFuzzer_[46] & AFL + 2S+ & *Specified Func./None & Block & Basic Mem. Error & Moderate-low & Moderate-low \\ \(\mu\)_StriSS_[46] & & & & & & \\ \multicolumn{6}{c}{Fuzzer front-end Depended} & Memory Sanitizer * & Moderate-low \\ \hline _SFuzz_[39] & AFL++ & Specified Func./None & Edge & Basic Mem. Error & Moderate & Moderate \\ _FermiWire_[29] & AFL++ & Specified Func./Protocol & Edge + Fert-task & Basic Mem. Error & Moderate-low & Moderate-low \\ \multicolumn{6}{c}{Special} \\ _MaleRun_[19] & LibRAFL & Function/None & Edge & Basic Mem. Error & Moderate-low & Moderate \\ _AutoMorp_[41] & AFL & Identified Data IO/None & Edge & Basic Mem. Error & Moderate-low & Moderate-high \\ \hline \hline \end{tabular}  
* \(\Delta\): Len Extension
* includes Null Pointer Developere, Sack/Heap-based buffer overflow, format string, and double free detection.  
\end{table} 
Table 4: Comparison of firmware emulation’s fuzzing applications in bug finding capability.