一句话：提出 EM 增强的 AFL++ 框架 GAFLERNA，以电磁侧信道反馈补强模糊测试的崩溃判定，无需修改二进制即可发现异常状态。
模糊测试是发现漏洞的有力手段，但其判定 oracle 依赖崩溃这一粗粒度、二值化的信号。现有 sanitizer 虽能强化 oracle，却需要重新编译或二进制改写，且只能覆盖已知漏洞模式。本文探索一种适用于小型（IoT 规模）设备的替代方案：电磁（EM）侧信道分析。作者将 EM 侧信道测量集成进模糊测试流程，通过物理执行模式识别异常的程序状态，实现了 EM 增强的 AFL++ 框架 GAFLERNA。该框架在不需要修改被测可执行文件的前提下，最佳情况下与 sanitizer 的发现结果达到 87% 的一致性，并在四个真实程序中发现 104 条通往已知崩溃的新路径。这表明硬件级反馈有潜力扩展模糊测试的判定能力，尤其适用于仅有二进制代码可用的 IoT 程序分析场景。
Fuzzing, a powerful tool for vulnerability discovery, is limited by the coarse-grained, binary nature of its crash detection oracle. The use of sanitizers strengthens this oracle but requires recompilation or binary rewriting, and is limited to known patterns of vulnerabilities. We investigate an alternative way to strengthen the implicit oracle that is suitable for small (IoT-sized) devices: electromagnetic (EM) side-channel analysis. By integrating this into a fuzzing campaign we are able to detect anomalous program states through physical execution patterns. GAFLERNA, our EM-enhanced AFL++ framework, achieves a 87% correlation with sanitizer findings in the best case, without modifying the executable, while discovering 104 new paths to known crashes across four real-world programs. This reveals the potential for hardware-level feedback to extend fuzzing and analyse IoT programs where only the binary code is available.
@inproceedings{paperbot9110,
title = {GAFLERNA Ahoy! Integrating EM Side-Channel Analysis into Traditional Fuzzing Workflows},
author = {Jorge Barredo and Justyna Petke and David Clark and Daniel Blackwell and Maialen Eceiza and Jose Luis Flores and Mikel Iturbe},
booktitle = {FSE},
year = {2025},
doi = {10.1145/3696630.3728497}
}