一句话：通过运行时分析自动推断 DMA 内存访问模式，为重托管固件模糊测试自动注入 DMA 输入。
重托管环境下的固件模糊测试有望实现大规模自动化，但固件代码与微控制器外设紧耦合，现有框架只关注内存映射 I/O 与中断，忽略了绕过 CPU 的高吞吐接口——直接内存访问（DMA）。本文提出 DyMA-Fuzz，将基于流的模糊输入注入扩展到 DMA 驱动接口，用运行时分析推断 DMA 内存访问模式，解决厂商特定描述符、异构 DMA 设计与描述符位置多变等难题，自动向目标缓冲区注入测试数据，无需人工配置或数据手册。在 94 个固件样本与 8 个 DMA 防护 CVE 基准上，DyMA-Fuzz 发现了现有先进工具遗漏的漏洞与执行路径，代码覆盖率最高提升 122%。
The rise of smart devices in critical domains--including automotive, medical, industrial--demands robust firmware testing. Fuzzing firmware in re-hosted environments is a promising method for automated testing at scale, but remains difficult due to the tight coupling of code with a microcontroller's peripherals. Existing fuzzing frameworks primarily address input challenges in providing inputs for Memory-Mapped I/O or interrupts, but largely overlook Direct Memory Access (DMA), a key high-throughput interface used that bypasses the CPU. We introduce DyMA-Fuzz to extend recent advances in stream-based fuzz input injection to DMA-driven interfaces in re-hosted environments. It tackles key challenges--vendor-specific descriptors, heterogeneous DMA designs, and varying descriptor locations--using runtime analysis techniques to infer DMA memory access patterns and automatically inject fuzzing data into target buffers, without manual configuration or datasheets. Evaluated on 94 firmware samples and 8 DMA-guarded CVE benchmarks, DyMA-Fuzz reveals vulnerabilities and execution paths missed by state-of-the-art tools and achieves up to 122% higher code coverage. These results highlight DyMA-Fuzz as a practical and effective advancement in automated firmware testing and a scalable solution for fuzzing complex embedded systems.
@inproceedings{paperbot11889,
title = {DyMA-Fuzz: Dynamic Direct Memory Access Abstraction for Re-hosted Monolithic Firmware Fuzzing},
author = {Guy Farrelly and Michael Chesser and Seyit Camtepe and Damith C. Ranasinghe},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3787828}
}