2016 · Conference paper
Towards Automated Dynamic Analysis for Linux-based Embedded Firmware
Firmadyne crawls, extracts and emulates Linux-based firmware for network-connected commercial devices such as routers and IP cameras. It replaces the vendor kernel with pre-built, instrumented kernels for little-endian ARM and little- and big-endian MIPS, boots the extracted filesystem under QEMU full-system emulation with a userspace NVRAM library, infers the network configuration, then runs automated analyses including 60 known and 14 newly found exploits. From 23,035 images across 42 vendors, the authors extracted 9,486 and report 887 of the 1,971 network-reachable images vulnerable to at least one sampled exploit.
Scope and limitations
The work targets Linux-based firmware on little-endian ARM and little- and big-endian MIPS, which made up 90.8% of the dataset; x86, VxWorks and other real-time operating systems are outside the system. Its pre-built kernels do not load vendor out-of-tree kernel modules, so vendor kernels and modules cannot be checked, and instrumented emulation is not identical device behavior. The emulation funnel narrows sharply: of 8,591 images that initially emulated, 2,797 had a network configuration inferred and 1,971 answered ping. NVRAM semantics, interface naming and a single emulated Ethernet device on ARM are among the reported causes. WAN and LAN ports are not distinguished, so remote exploitability is not established, and results count firmware images rather than unique products and are skewed by vendor composition. FirmAE, already in this bibliography, extends Firmadyne to address such emulation failures; these 2016 rates are not current emulation figures.
Why it fits this collection
Adds the full-system firmware-emulation framework, with kernel replacement and userspace NVRAM, that later rehosting research such as FirmAE builds on.
Publication and review details
- Venue
- NDSS 2016
- Status
- Conference paper
- Publication / posting date
- 2016 (exact date not verified)
- Date source
- Internet Society-deposited Crossref metadata supplies only publication year 2016; the publisher PDF separately identifies the 21–24 February 2016 symposium, which is not used to assert a publication month or day.
- DOI
- 10.14722/ndss.2016.23415
Crossref gives only the year and no pages; the PDF footer identifies NDSS ’16, 21–24 February 2016, San Diego, with ISBN 1-891562-41-X and the DOI. The DOI resolves directly to the NDSS PDF, so the DOI URL serves as the paper page. Figures differ between sources: the paper's per-vendor appendix table totals 8,893 extracted images where its abstract and body give 9,486, and the repository README reports 846 of 1,971 (43%) vulnerable images where the paper reports 887 (45%). This record follows the paper body. The reviewed 2024-07-21 snapshot of firmadyne/firmadyne is MIT-licensed, calls itself a research tool that is not production ready, and says the paper's results used pre-release toolchains, kernels and components that it lists by version or commit. Its current Dockerfile uses Ubuntu 22.04 and runs in privileged mode, and download.sh fetches pre-built kernels, console and libnvram binaries from GitHub releases. Vendor firmware images and Metasploit exploits carry their own terms. No firmware, binaries or exploits were downloaded, and nothing was run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://doi.org/10.14722/ndss.2016.23415
- https://api.crossref.org/works/10.14722/ndss.2016.23415
- https://www.ndss-symposium.org/wp-content/uploads/2017/09/towards-automated-dynamic-analysis-linux-based-embedded-firmware.pdf
- README.md GitHub · firmadyne/firmadyne · Revision 11cb574
- LICENSE.txt GitHub · firmadyne/firmadyne · Revision 11cb574
- Dockerfile GitHub · firmadyne/firmadyne · Revision 11cb574
- download.sh GitHub · firmadyne/firmadyne · Revision 11cb574