AwesomeREA.org

2026 · Preprint

SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version)

Hongyuan Li; Ke Wang; Wei Zhou; Le Guan

Organizes 24 MCU analysis tools into configuration recovery, emulation, fuzzing and diagnosis stages, then evaluates the runnable, pipeline-compatible subset on 4,571 filtered Cortex-M firmware images. Studies where recovered configurations and emulation artifacts fail to support later analysis.

Scope and limitations

Excludes tools requiring unavailable manuals, source or hardware context, so this is not a uniform execution comparison of all 24 tools. ISA identification, admission thresholds and sampled crash diagnosis involve empirical judgments; findings do not generalize to other architectures. Reported crashes are not confirmed vulnerabilities.

Why it fits this collection

Adds evidence on the practical limits of reconstructing executable environments for black-box firmware.

Publication and review details

Venue
arXiv (extended version)
Status
Preprint
Publication / posting date
September 30, 2026
Date source
Dates this extended arXiv release. Author-reported NDSS 2027 acceptance is recorded separately and is not a 2027 publication claim.
First arXiv submission
September 30, 2026
arXiv
2609.38872
Reviewed arXiv version
v1

The arXiv comment calls this an extended version of a paper accepted to NDSS 2027; the manuscript has a placeholder DOI and no final proceedings date is assigned. Pinned framework README describes a 20-image functional check, not full-corpus replication. Firmware is not redistributed; OTACap access is under NDA. No root code license was established, and no firmware or tools were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://arxiv.org/abs/2609.38872v1
  2. https://arxiv.org/html/2609.38872v1
  3. README.md GitHub · IoTS-P/LargeRehostingTesting · Revision 4950719
  4. https://api.github.com/repos/IoTS-P/LargeRehostingTesting/git/trees/c477332e0c123a6140df36f7b9298992c6c28e29