# Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing

> Rehosts monolithic ARM Cortex-M firmware for fuzzing, using locally scoped symbolic execution to model memory-mapped I/O accesses and focus input mutations on values relevant to firmware logic.

- Authors: Tobias Scharnowski; Nils Bars; Moritz Schloegel; Eric Gustafson; Marius Muench; Giovanni Vigna; Christopher Kruegel; Thorsten Holz; Ali Abbasi
- Venue: USENIX Security 2022
- Status: Conference paper
- Publication / posting date: August 2022
- Date source: Publication month in the official USENIX proceedings citation; no exact publication day is asserted.
- Sources reviewed: 2026-10-16
- Added to the catalog: 2026-10-17
- Original paper: <https://www.usenix.org/conference/usenixsecurity22/presentation/scharnowski>
- PDF: <https://www.usenix.org/system/files/sec22-scharnowski.pdf>
- Code: <https://github.com/fuzzware-fuzzer/fuzzware>
- BibTeX: <https://awesomerea.org/papers/citations/paper-fuzzware.bib>
- Catalog page: <https://awesomerea.org/papers/paper-fuzzware/>
- Record JSON: <https://awesomerea.org/papers/paper-fuzzware/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-fuzzware/index.md)

## Scope and limitations

The Cortex-M3/M4 artifact requires memory-map configuration and does not automatically model DMA. Abstracting hardware can produce crashes that are impossible on the physical device. This is an analysis environment, not original-source recovery or faithful full-device reconstruction.

## Why it fits this collection

Shows how firmware logic can be exercised without its original hardware by reconstructing enough of the execution environment for dynamic analysis.

## Publication and review notes

The official proceedings give pages 1239–1256 and nine authors. No paper DOI or arXiv identifier was verified. Zenodo DOI 10.5281/zenodo.6499215 identifies the software artifact, not this paper. The artifact appendix names the sec22-ae-accepted release and declares Apache-2.0 for code and data; third-party components retain their own terms.

## Primary sources

1. <https://www.usenix.org/conference/usenixsecurity22/presentation/scharnowski>
2. <https://www.usenix.org/system/files/sec22-scharnowski.pdf>
3. <https://www.usenix.org/system/files/usenixsecurity22-scharnowski.pdf>
4. <https://github.com/fuzzware-fuzzer/fuzzware/blob/424fce42bbe0cef3928ae589b8f6bbac666857e1/README.md>
5. <https://github.com/fuzzware-fuzzer/fuzzware/blob/424fce42bbe0cef3928ae589b8f6bbac666857e1/LICENSE>
6. <https://github.com/fuzzware-fuzzer/fuzzware-experiments/blob/b6462adfa125ae1664077a0aa912c081cfde1c4a/README.md>
7. <https://github.com/fuzzware-fuzzer/fuzzware-experiments/blob/b6462adfa125ae1664077a0aa912c081cfde1c4a/LICENSE>
8. <https://zenodo.org/records/6499215>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.