2021 · Conference paper
Conware: Automated Modeling of Hardware Peripherals
Conware builds reusable software models of hardware peripherals from recordings of real firmware–peripheral interactions. An LLVM pass instruments Arduino source code to log MMIO reads, writes and interrupts on the real board, with existing hardware-in-the-loop recording as an alternative. Each recording becomes a per-peripheral graph whose read values are summarized as simple sub-models such as patterns; graphs are merged and optimized into automata that can be combined across peripherals and run in an Avatar²-based emulator. The authors model ten peripherals on an Arduino Due (SAM3X Cortex-M3) and emulate an uninstrumented smart-door-lock firmware from models trained only on vendor example code.
Scope and limitations
Training needs the real board with the peripherals attached, plus source code for the LLVM-based recorder. The evaluation covers bare-metal Arduino Due firmware with ten hobbyist peripherals, and port-mapped I/O systems are out of scope. Models encode only behaviour observed during recording, assume that state transitions follow MMIO writes, and attach interrupts to transitions rather than to the writes that trigger them, so read-triggered transitions and exact interrupt timing are not supported. The unseen-firmware result is a single door-lock program built from six peripheral models. Its UART output matched real hardware, and it executed 362 of the 609 basic blocks (59%) and 58 of the 68 functions (85%) reachable from loop(); the authors measure survivability of execution rather than full peripheral fidelity. Record-and-replay comparisons ran each sample once for 10 minutes, since replays are deterministic.
Why it fits this collection
Adds record-and-model reconstruction of peripherals from real hardware interactions, complementing the catalog's HAL-replacement, firmware-guided and specification-guided rehosting approaches.
Publication and review details
- Venue
- ACM ASIA CCS 2021
- Status
- Conference paper
- Publication / posting date
- May 24, 2021
- Date source
- ACM's Crossref deposit records published/print publication on 2021-05-24 and online publication on 2021-06-04. This entry uses the print date, not the June 7–11 conference dates.
- DOI
- 10.1145/3433210.3437532
Crossref records the nine-author order, pages 95–109, print publication on 2021-05-24 and online publication on 2021-06-04. The reviewed 15-page copy on Christopher Kruegel's UCSB site carries the ACM reference format and DOI but is not asserted to be identical to the ACM PDF. The paper cites ucsb-seclab/conware for its code; the snapshot at 05dfdf5 (2020-07-19, committed as the submitted version of the code) declares no license, so no reuse rights are implied. Its README pipeline instruments Arduino code with LLVM, runs it on a real Arduino with the peripheral attached, dumps logs over UART, and then generates, optimizes and emulates models with Avatar² and OpenOCD; the install script builds LLVM. Two submodules, pretender and avatar2-pretender, use SSH URLs on the UCSB lab's own Git server, and the pinned requirements include Python 2 backport packages such as enum34. No hardware, firmware or code was used.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://dl.acm.org/doi/10.1145/3433210.3437532
- https://api.crossref.org/works/10.1145/3433210.3437532
- https://sites.cs.ucsb.edu/~chris/research/doc/asiaccs21_conware.pdf
- https://seclab.cs.ucsb.edu/publications/2021spenskyconware/
- README.md GitHub · ucsb-seclab/conware · Revision 05dfdf5
- .gitmodules GitHub · ucsb-seclab/conware · Revision 05dfdf5
- requirements.txt GitHub · ucsb-seclab/conware · Revision 05dfdf5