💻 computer science

PowerFuzz: Power-Based Black-Box Firmware Fuzzing

PowerFuzz is a statistical black-box firmware fuzzing framework that utilizes power side-channel measurements to reconstruct control-flow graphs and guide test generation, achieving branch coverage comparable to gray-box fuzzers while significantly outperforming existing black-box approaches.

Original authors: Dakshina Tharindu, Sahan Sanjaya, Philip Baptist, Prabhat Mishra

Published 2026-06-24

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Dakshina Tharindu, Sahan Sanjaya, Philip Baptist, Prabhat Mishra

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a brand new, locked black box (a piece of computer firmware) that controls a device like a medical implant or a smart thermostat. You want to break it to find hidden weaknesses, but you can't open the box, you don't have the blueprints (source code), and you can't even see inside while it's running. This is the "Black Box" problem.

Usually, to test software effectively, experts use a "Gray Box" approach. They have a window into the code. They can see every turn the software makes, like a GPS tracking a driver's route. If the driver takes a new road, the GPS says, "Great! We found a new path!" and the tester focuses on that area.

But with a locked black box, the tester is blind. They throw random inputs at the box and hope something interesting happens. This is like throwing darts at a wall in the dark; you might hit something eventually, but it's incredibly inefficient.

Enter PowerFuzz: The "Power Detective"

The researchers at the University of Florida came up with a clever trick called PowerFuzz. Instead of trying to see inside the box, they listen to how much electricity the box uses.

Here is the core idea: Every time the computer inside the box makes a decision (like "if the temperature is high, turn on the fan"), it uses a tiny, unique amount of power. It's like a person's heartbeat changing slightly depending on whether they are walking, running, or sleeping.

How PowerFuzz Works (The Analogy)

Imagine you are trying to map a maze, but you can't see the walls. You have a friend inside the maze who can't talk to you, but you can hear their footsteps through the floor.

Listening to the Footsteps (Power Traces):
PowerFuzz sends a test message (a "dart") to the device. As the device processes this message, PowerFuzz records a graph of its power consumption. This graph is the "footprint" of the device's thoughts.
The "Sliding Window" Detective (Finding the Turn):
The system compares the new power graph with old ones.
- The Problem: Sometimes the device runs the same path, but the power graph looks slightly different because of tiny electrical "noise" (like a friend walking on a creaky floor).
- The Solution: PowerFuzz uses a mathematical tool called Dynamic Time Warping. Think of this as a flexible ruler that stretches or shrinks the graphs to line them up perfectly, ignoring the tiny creaks and focusing on the big picture.
- The "Growing Window": Once it finds a rough spot where the graphs might differ, it zooms in with a "growing window" to pinpoint the exact moment the device took a different turn.
Drawing the Map (The TCFG):
Every time PowerFuzz finds a new turn (a new branch in the code), it draws a node on a map called a Trace-guided Control Flow Graph (TCFG).
- At first, the map is just a single line.
- As it finds new paths, the map branches out like a tree.
- Crucially, this map is built entirely from listening to electricity, without ever seeing the code.
The Smart Guide (Branch Selection):
Now that PowerFuzz has a map, it stops throwing darts randomly. It looks at the map and says, "Hey, we haven't explored that deep, dark branch at the bottom of the tree yet. Let's aim our next darts there." It prioritizes the hardest-to-reach paths, just like a smart explorer would.

The Results: How Well Did It Work?

The researchers tested this on real hardware (like microcontrollers found in routers and medical devices) using ten different software programs. They compared PowerFuzz against:

Random Testing: Throwing darts in the dark.
Fuzz'EMup: The current best "black box" method, which uses electromagnetic waves (like a radio) instead of power.
Gray-Box Fuzzing: The "gold standard" where they could see the code (used as a benchmark for the best possible result).

The Findings:

Beating the Competition: PowerFuzz found significantly more hidden paths than the random testers and the electromagnetic method (Fuzz'EMup). In some cases, it found 22% more of the code than the previous best black-box method.
Catching Up to the "God Mode": Even though PowerFuzz couldn't see the code, it managed to find almost as many paths as the "Gray-Box" method that could see the code. It was within 13.5% of the perfect score.
Universal Application: It worked just as well on different types of computer chips (ARM and AVR), proving it's a versatile tool.

In Summary

PowerFuzz is like a detective who solves a mystery not by reading the suspect's diary (the code), but by listening to the rhythm of their footsteps (power usage). By mapping these rhythms, it builds a mental map of the software's logic, allowing it to hunt down hidden weaknesses much faster and more effectively than guessing in the dark. It proves that you don't need to see inside a black box to understand how it thinks; you just need to listen to how it powers up.

Technical Summary: PowerFuzz

Problem Statement

Embedded systems form the backbone of critical infrastructure, yet their firmware remains significantly understudied compared to traditional software due to the difficulty of observing execution behavior without direct access to binaries or debugging infrastructure. Modern firmware is often proprietary, encrypted, or obfuscated, and hardware protections (e.g., locked fuse bits, secure boot) prevent binary extraction. Consequently, standard coverage-guided fuzzing techniques—which rely on binary instrumentation to monitor branch coverage—are inapplicable.

Existing black-box approaches lack effective feedback loops. Random testing is inefficient for state-dependent firmware, and prior attempts to use side-channels (e.g., electromagnetic emanations) often require expensive, specialized near-field probing equipment. The core challenge is reconstructing a coverage-guided feedback loop for a "fully black-box" target where the internal control flow is opaque, without modifying the firmware or accessing its binary.

Methodology

The paper introduces PowerFuzz, a statistical black-box fuzzing framework that substitutes binary instrumentation with power side-channel measurements. The framework operates on the insight that a microcontroller's (MCU) power consumption encodes fine-grained information about its internal execution, varying measurably based on executed instructions and branch decisions.

Core Components

Power Trace Acquisition:
- The system synchronously captures the MCU's power consumption as a time-series signal ( $P = \langle p_1, p_2, \dots, p_n \rangle$ ) whenever a new input is dispatched to the target.
- To mitigate measurement noise, $N=10$ traces are captured per input and averaged.
Similarity Analysis (Branch Identification):
- To determine if a new input triggers a different execution path, PowerFuzz compares the new trace against previously captured traces using a two-stage algorithm:
  - Stage 1: Dynamic Time Warping (DTW) with Sliding Window: DTW aligns the two time-series sequences to handle timing jitter. A sliding window analysis is applied to the resulting offset profile to detect sustained divergences (indicative of a branch transition) while filtering out transient noise.
  - Stage 2: Pearson Correlation with Growing Window: Once a coarse divergence window is identified, a Pearson correlation analysis is performed. A sliding window first locates the approximate deviation, followed by a growing-window analysis that incrementally expands from the start of the divergence until the correlation drops below a threshold. This pinpoints the precise sample index where the execution paths diverge.
Trace-guided Control Flow Graph (TCFG) Construction:
- PowerFuzz dynamically constructs a hierarchical tree structure called the TCFG, which serves as a proxy for the Control Flow Graph (CFG).
- Node Structure: Each node represents a basic block and stores: (1) the power trace segment corresponding to that block, (2) the input that reached it, and (3) left/right child pointers representing branch-taken and branch-not-taken paths.
- Update Mechanism: When a new trace is analyzed, the algorithm recursively traverses the TCFG. If the new trace diverges within an existing node, that node is split: a new parent node stores the shared prefix, while the original node and the new divergent path become left and right children, respectively. This allows the graph to grow incrementally without prior knowledge of the firmware.
Branch Selection and Mutation:
- The TCFG guides the fuzzing engine (built on LibAFL) in selecting which branches to explore.
- Random Selection: Used in early stages when the TCFG is sparse.
- Depth-Prioritized Selection: As the TCFG grows, the fuzzer prioritizes nodes at greater depths, targeting nested conditional logic and complex state-dependent behaviors that are harder to reach.
- Inputs that result in a TCFG update (new coverage) are retained in the seed corpus; others are discarded.

Key Contributions

The paper claims the following contributions:

First Power-Based Black-Box Framework: It presents the first framework to use power side-channel measurements to enable coverage-guided fuzzing for fully black-box firmware, requiring no internal visibility.
Novel Branch Identification: It implements a method combining sliding-window analysis, growing-window full-trace correlation, and Dynamic Time Warping to identify executed branches from power traces.
Dynamic TCFG Generation: It enables the runtime construction of a trace-guided control flow graph without binary access, using accumulated power traces to infer structural relationships.
Empirical Validation: It demonstrates through extensive evaluation that PowerFuzz can achieve branch coverage comparable to gray-box fuzzers while significantly outperforming state-of-the-art black-box alternatives.

Experimental Results

The framework was evaluated on three embedded hardware platforms (STM32F0, STM32F3, and XMEGA) using ten firmware benchmarks, including large-scale applications (GPS, Stepper Controller, CNC, Soldering Station) and smaller libraries (cjson, zlib, crypto implementations).

Coverage Comparison:
- vs. Gray-Box: PowerFuzz achieved branch coverage within 13.5% of state-of-the-art gray-box fuzzers (which have full binary visibility).
- vs. Black-Box (Fuzz'EMup): PowerFuzz significantly outperformed Fuzz'EMup (a black-box fuzzer using electromagnetic emanations) by up to 22% in branch coverage across benchmarks.
- vs. Random Testing: PowerFuzz consistently reached higher coverage plateaus much faster than random testing, with coverage advantages ranging from 20% to 30% across platforms.
Structural Accuracy:
- When compared against ground-truth CFGs extracted via angr, the inferred TCFGs showed a 97.66% node precision and 77.61% node recall. The high precision indicates that the divergence detection rarely creates false splits, while the lower recall is attributed to the conservative design required to avoid noise-induced fragmentation.
Cross-Architecture Applicability:
- PowerFuzz demonstrated consistent performance across 32-bit ARM and 8-bit AVR architectures without architecture-specific tuning, achieving stable coverage rates across different MCU types.

Significance and Claims

The paper positions PowerFuzz as a critical advancement for embedded systems security, addressing the "fundamental challenge" of verifying proprietary or encrypted firmware where traditional instrumentation is impossible. By leveraging power consumption as a substitute for binary instrumentation, PowerFuzz enables a coverage-guided feedback loop in a fully black-box setting.

The authors claim that PowerFuzz bridges the gap between the blind inefficiency of random testing and the inaccessibility of gray-box fuzzing. The results suggest that physical side-channel measurements can effectively approximate the structural insights gained from binary analysis, making rigorous automated testing feasible for a broader class of embedded devices, including those in safety-critical and security-sensitive environments. The work establishes that power traces, traditionally used for cryptographic attacks, can be repurposed as a robust mechanism for software verification.