Fuzzware: Automating & Scaling Fuzzing For Firmware by Tobias Scharnowski & Marius Muench | Nullcon
Outlines fuzzware: Automating & Scaling Fuzzing For Firmware by Tobias Scharnowski & Marius Muench | Nullcon and evaluates key implications for security practitioners.
Summary
Firmware Beyond Linux Routers
Tobias Scharnowski presents Fuzzware, a framework for automated rehosting and fuzzing of embedded firmware ranging from PLCs and ECUs to IoT appliances. Many devices lack Linux shells, making traditional on-device fuzzers impractical and physically risky—one audience member reportedly overheated a router during fuzzing.
Hardware Interaction Primitives
Bare-metal firmware communicates via memory-mapped I/O, interrupts, and DMA rather than file descriptors. A simple getchar on serial may touch multiple MMIO registers, complicating input injection for fuzzers accustomed to stdin and syscalls.
Rehosting in the Cloud
Fuzzware automatically builds virtual execution environments that emulate peripherals so firmware can run on general-purpose systems. Cloud-scale deployment accelerates campaigns that would be slow or destructive on physical hardware, aligning with prior sessions on making systems fuzz-friendly.
Pipeline Overview
The workflow ingests firmware binaries, models MMIO and interrupt behavior, and feeds mutated inputs through rehosted images to find crashes. Scharnowski positions Fuzzware as infrastructure for scaling firmware security research across diverse embedded targets beyond consumer Wi-Fi routers.
Related talks
Village Interviews·3 min
The DEF CON Video Team showcases a restored 1988 Japanese slot machine featured as an interactive puzzle in the DEF CON Scavenger Hunt.
Village Interviews·7 min
The DEF CON Video Team tours the Car Hacking Village to highlight hands-on test rigs, vehicle telemetry research, and community workshops.