Ahmed Abdelrazek
Ahmed holds an M.Sc. in Computer Science (IT Security and Reliability) from the University of Passau, where his thesis focused on hybrid symbolic-execution-and-fuzzing techniques for embedded firmware. He worked on NXP Semiconductors' Vulnerability Analysis Team in Hamburg, developing concolic execution engines, AFL++-based fuzzing pipelines, and taint analysis tooling for ARM and RISC-V firmware, and is now focused on vulnerability research.
Session
Embedded systems now sit at the center of automotive, IoT, and critical infrastructure, and the security burden has shifted from the surrounding network to the device itself. But testing embedded binaries is hard: complex conditional logic, architecture-specific quirks, and validation routines make conventional fuzzing struggle, while symbolic execution alone runs into path explosion and expensive constraint solving.
This talk presents a hybrid approach that flips the usual playbook. Instead of fuzzing first and calling in symbolic execution to break through hard branches (as in Driller or SAGE), I use trace-guided symbolic execution, built on angr, as the primary path discovery engine, then hand a comprehensive seed corpus to AFL++ for deep vulnerability hunting. Starting from minimal input, the tool captures execution traces, extracts and negates path constraints, and iteratively solves for new inputs until it's covered every discoverable path, before fuzzing even starts.
On a custom benchmark suite modeled on real embedded targets (ARM and RISC-V), this approach hits 3.6× better code coverage than traditional fuzzing and surfaces bugs buried deep in execution paths that random mutation alone never reaches.
I'll walk through the architecture, the trade-offs of "symbolic-first, fuzz-second," and what it took to make trace-based analysis practical on real hardware-adjacent firmware, plus what didn't work along the way.