ARM TrustZone is a dominant security technology in embedded processors, mobile devices, Cyber-Physical Systems, and the Internet of Things. TrustZone enables software isolation, allowing critical code to execute in a ‘secure world’ that is protected from direct access by less critical code. However, side-channel vulnerabilities fall outside of this isolation model: secret-dependent behavior in vulnerable programs may be observed from the normal world, compromising the confidentiality of secure-world programs. In this paper we present a tool that uses symbolic execution and static analysis to detect timing side channels in compiled programs for ARM’s lightweight Cortex-M processors. We evaluate our approach on previously published benchmarks and attacks, demonstrating that our tool, SCFARM, exhibits high accuracy in detecting a range of side-channel vulnerabilities, specifically in the TrustZone secure world. To the best of our knowledge, SCFARM is the first side-channel detection tool tailored for ARM TrustZone, which we make available under an open-source license.