Jorge Barredo Ferreira

TRENTI addresses a fundamental limitation of firmware fuzzing: when no source is available and the target runs on real hardware or emulation, standard coverage signals become unreliable. TRENTI closes this by simultaneously capturing EM, power, and timing signals during a campaign, feeding them back to AFL++ as composite hardware-level coverage.

The framework integrates with Firm-AFL/QEMU for full-system emulation and falls back to direct hardware measurement for bare-metal. A custom feedback bridge translates physical signal deviations — detected via HDBSCAN on EM traces — into edge discovery events guiding AFL++ mutation. Cross-modal triangulation diagnoses anomalies without decompilation.

GAFLERNA treats the device’s electromagnetic field as a real-time anomaly detector. During each AFL++ execution, a near-field probe and SDR record an EM trace, classified by a pre-trained HDBSCAN model. Anomalous traces trigger a virtual crash to AFL++ — preserving the input in the crash corpus without touching the binary or requiring debug symbols.

Evaluated on four programs compiled for STM32, validated against ground-truth ASan findings. Outperforms prior EM monitoring approaches that required labelled datasets — GAFLERNA operates entirely unsupervised, in-loop.

Firmware security outcome: Enables vulnerability discovery in shipping IoT firmware with no source code — directly applicable to closed binary targets in automotive, industrial, and consumer embedded devices.

GJALLARHORN asks: can we detect that firmware contains a vulnerability by observing EM emissions alone, without triggering the bug? The answer is yes — for a broad class of memory and arithmetic flaws. The framework automates trace acquisition, signal conditioning, time-frequency decomposition, and multi-class ML classification.

Key insight: different flaw types produce characteristic EM signatures. Buffer overflows generate irregular DRAM bursts; divide-by-zero creates truncated traces; memory leaks manifest as monotonically growing heap traffic patterns.

Vulnerability detection outcome: Non-invasive pre-deployment screening for 16 flaw categories — reduces the attack surface before firmware ships, without requiring instrumentation or debug access to the target device.

CARNYX establishes the series’ core methodology: classify which type of software vulnerability is present in running firmware using only its power consumption signature — before any crash occurs. A current probe on the supply rail, no firmware modification. An unsupervised HDBSCAN model builds a behavioural baseline; new traces are compared to detect and categorise deviations across 16 distinct flaw categories.

First to quantify how peripheral selection affects SCA leakage quality — a previously underexplored variable. Results directly inform attack surface prioritisation in firmware security assessments.

Security assessment outcome: Identifies vulnerability class from power trace alone — no source, no binary modification, no debug interface. Demonstrated on STM32F4 (99.69% recall) and BeagleBone Black across arithmetic and memory safety flaws.

Built during my Master’s years guided by a simple principle: technology matters when it solves real needs. Statoodle helps instructors make practical use of Moodle data — turning exported reports and logs into actionable teaching information without requiring programming skills.

Presented at EC-TEL 2023 by my colleague Pedro Moreno-Marcos. A free MOOC by Ruth Cobos Pérez, Pedro, Antonio Balderas, Miguel Ángel Conde González, and Manuel Freire has since spread the tool across Spanish universities, with strong uptake in the education community.