2026 · Preprint
POZZER: A Power Side Channel-guided Fuzzer for Black-Box Embedded Systems
Builds a noise-tolerant pseudo execution-flow graph from one power trace per test input, using newly observed behavior as LibAFL feedback. It explores embedded firmware without access to its binary, source or instrumentation.
Scope and limitations
Requires physical power measurement, known input pins and setup calibration. Evaluation covers 15 targets on two Cortex-M platforms and two commercial devices; benchmark coverage is measured by later instrumented replay, not recovered directly from power traces. Results depend on seeds and hardware, and long traces reduce throughput. The graph is not a proven control-flow graph or recovered program. Real-device harnesses are withheld.
Why it fits this collection
Provides evidence-driven behavior exploration when firmware bytes and conventional tracing are unavailable.
Publication and review details
- Venue
- arXiv
- Status
- Preprint
- Publication / posting date
- September 20, 2026
- Date source
- First arXiv submission; the reviewed version is v1, not a verified proceedings publication.
- First arXiv submission
- September 20, 2026
- arXiv
- 2609.23583
- Reviewed arXiv version
- v1
The first submission is September 20, not the later announcement date. Reviewed the full eight-author v1 list. Open Science promises code and results after acceptance; no dedicated public artifact or license was verified. No target, fuzzer or hardware was run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.