Leveraging SystemC-TLM-based Virtual Prototypes for Embedded Software Fuzzing

SystemC-based virtual prototypes have emerged as widely adopted tools to test software ahead of hardware availability, reducing the time-to-market and improving software reliability. Recently, fuzzing has become a popular method for automated software testing due to its ability to quickly identify corner-case errors. However, its application to embedded software is still limited. Simulator tools can help bridge this gap by providing a more powerful and controlled execution environment for testing. Existing solutions, however, often tightly couple fuzzers with built-in simulators that lack support for hardware peripherals and offer limited flexibility, restricting their ability to test embedded software. To address these limitations, we present a framework that allows the integration of American-Fuzzy-Lop-based fuzzers and SystemC-based simulators. The framework provides a harness to decouple the adopted fuzzer and simulator. In addition, it intercepts peripheral accesses and queries the fuzzer for values, effectively linking peripheral behavior to the fuzzer. This solution enables flexible interchangeability of peripherals within the simulation environment and supports the interfacing of different SystemC-based virtual prototypes. The flexibility of the proposed solution is demonstrated by integrating the harness with different simulators and by testing various softwares.