As IoT devices with microcontroller (MCU)-based firmware become more common in our lives, memory corruption vulnerabilities in their firmware are increasingly targeted by adversaries. Fuzzing is a powerful method for detecting these vulnerabilities, but it poses unique challenges when applied to IoT devices. Direct fuzzing on these devices is inefficient, and recent efforts have shifted towards creating emulation environments for dynamic firmware testing. However, unlike traditional software, firmware interactions with peripherals that are significantly more diverse presents new challenges for achieving scalable full-system emulation and effective fuzzing. This paper reviews 27 state-of-the-art works in MCU-based firmware emulation and its applications in fuzzing. Instead of classifying existing techniques based on their capabilities and features, we first identify the fundamental challenges faced by firmware emulation and fuzzing. We then revisit recent studies, organizing them according to the specific challenges they address, and discussing how each specific challenge is addressed. We compare the emulation fidelity and bug detection capabilities of various techniques to clearly demonstrate their strengths and weaknesses, aiding users in selecting or combining tools to meet their needs. Finally, we highlight the remaining technical gaps and point out important future research directions in firmware emulation and fuzzing.

Failures recovery is essential for forensic analysis and bug diagnosis, yet remains challenging for resource-constrained IoT devices in deployment. These devices lack facilities to record incorrect program states, and advanced hardware tracing mechanisms are typically unavailable. Production environments further restrict their already limited resources. We present Reverb , a lightweight ex-vivo IoT device failure recovery system tailored for edge-centric IoT deployments. Reverb leverages the fact that most external inputs pass through a centralized edge, enabling edge-side input recording without modifying device runtime behavior. For device-local and non-deterministic events not observable at the edge devices, we use recorded external input-guided program analysis to deduce missing local inputs. By combining recorded and inferred data, the cloud can faithfully replay complete device executions on demand. We implemented a prototype and evaluated it in both smart home and industrial scenarios. Reverb introduces no runtime overhead on devices and incurs minimal long-term storage cost. Across 19 failing executions on 13 real-world devices, it successfully reconstructed traces with high consistency to real hardware. The recovered traces further enabled automated bug diagnosis to identify root causes.