# IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit
## 1 Introduction  
A microcontroller unit (MCU) is a compact computer on a single integrated circuit, containing one or more CPUs (processor cores), memory like flash, ROM, or RAM, and programmable peripherals. MCUs are widely used in constrained IoT devices due to their low power consumption, compact size, cost-effectiveness, and ability to integrate peripherals for specific tasks. A recent report [1] states that over half of constrained IoT devices use MCUs. However, due to resource constraints, on-chip MCUs lack the security mechanisms present in general computers like x64, x86, and ARM Cortex-A, as well as systems like Windows and Linux [2, 3]. For instance, most microcontrollers (MCUs) lack a memory management unit (MMU), which translates virtual memory addresses to physical ones. As a result, firmware on MCUs typically cannot support task isolation or address space randomization protection. In addition, firmware on MCU-based devices, often written in memory-unsafe languages like C/C++, is prone to memory bugs. Due to market pressure and cost constraints, these devices are frequently released without thorough codeauditing or security testing, leaving many vulnerabilities. Consequently, MCU-based devices are easily compromised, posing significant risks. The American Information Security Conference in April 2023 reported that over 50% of Distributed Denial of Service (DDoS) attacks stem from the growing number of compromised IoT devices [4]. The rise in vulnerabilities within MCU firmware has led researchers to adapt general software vulnerability detection techniques, particularly for fuzzing. Fuzzing has proven to be a highly effective tool for vulnerability detection over the past decade [5], uncovering thousands of security bugs in various software applications. However, directly applying fuzzing tests to MCU based devices is impractical for firmware due to the slow fuzzing speeds resulting from limited hardware resources. Researchers have attempted dynamic testing in emulated environments, but fuzzing firmware without the original device is difficult due to its tight integration with hardware interfaces (i.e., peripherals). Unlike traditional system-based programs that use well-defined I/O interfaces like POSIX APIs (e.g., read(fd, buf, len)), firmware must directly interact with peripheral registers and interfaces. For instance, while a Linux program reads input using scan or fread(buf, 1, size, fd), MCU firmware must first poll peripheral status registers (Line 3), read input from registers (Line 5), and check for errors (Line 6), as shown in Listing 1. The diverse configurations of peripherals across devices make universal emulation difficult. Consequently, there are still significant research gaps in developing automatic, high-fidelity firmware emulation environments and efficient fuzzing techniques. ```
1 uint8_tread(...){
2...
3 while(1(USART1->SR&USART_SR_RXNE));
4 uint8_tdata=USART1->DR;
5 if(USART1->SR&USART_SR_FE)return-1;
6 elsereturndata;
7}
```  
**Listing 1**Code snippnet of external input reading from UART peripheral in a real-world MCU firmware. Our paper reviews MCU firmware emulation and its fuzzing applications, focusing on works from top international computer security conferences and journals over the past decade (2014-2024), including IEEE S&P, CCS, USENIX Security, NDSS, ACSAC, ASIA CCS, RAID, DSN, ESORICS, IEEE TIFS, and IEEE TDSC. Previous surveys only include works up to 2022 [6; 7; 8]. With recent advancements in embedded device emulation technology, especially from 2021 (as shown in Figure 1), it is crucial to revisit the state-of-the-art in MCU-based firmware emulation and its applications. Unlike previous surveys, such as those by [PERSON] et al. [8], which summarize vulnerability detection methods across all firmware types, including Linux-based and MCU-based, on real devices and emulators, our study specifically targets MCU firmware emulation and its fuzzing applications. We deliberately exclude Linux-based firmware and real device fuzzing applications to focus on MCU firmware.