AwesomeREA.org

2026 · Conference paper

User-Space Dependency-Aware Rehosting for Linux-Based Firmware Binaries

Chuan Qin; Cen Zhang; Yaowen Zheng; Puzhuo Liu; Jian Zhang; Yeting Li; Weidong Zhang; Yang Liu; Limin Sun

FIRMWELL reconstructs the execution environment of Linux firmware services by running their initialization processes, locating blocking dependencies and repairing missing system-level behavior. It combines containerized QEMU-user emulation with a QEMU-system fallback, using process traces and binary analysis to recover resources needed by the target service.

Scope and limitations

The evaluation concerns selected network services, not complete device or hardware equivalence. HTTP acceptance uses configured response-status and error-content checks; other services need their own criteria. Coverage depends on unpacking, supported architectures, initialization heuristics and peripheral models. Symbolic path explosion, solver timeouts and complex peripheral checks remain failure modes. The paper’s recovery strategy avoids patching target binaries; successful service interaction does not establish recovery of original source code or every device function.

Why it fits this collection

A concrete method for reconstructing the dependencies around shipped firmware binaries, complementing HAL-level and full-system rehosting research.

Publication and review details

Venue
NDSS 2026
Status
Conference paper
Publication / posting date
2026 (exact date not verified)
Date source
The Internet Society’s Crossref deposit and the official NDSS paper identify publication year 2026. No finer publication date is asserted from the conference event dates.
DOI
10.14722/ndss.2026.230249

The nine-author order follows the official paper. Crossref agrees on the DOI but repeats Jian Zhang as a tenth author row; that duplicate is not reproduced here. Its appendix lists 1 CPU core, 4 GiB RAM and 100 GiB disk per task, and describes the full firmware corpus as private. The pinned repository declares GPLv3; vendor firmware and dependencies retain separate terms. Its Docker-in-Docker workflow uses an elevated-privilege outer container, and the authors recommend VM isolation; the current inner-container privilege flag defaults off. Mutable container tags mean the source pin alone does not fix the execution environment. Experiments were not rerun for this collection.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://www.ndss-symposium.org/ndss-paper/user-space-dependency-aware-rehosting-for-linux-based-firmware-binaries/
  2. https://www.ndss-symposium.org/wp-content/uploads/2026-s249-paper.pdf
  3. https://api.crossref.org/works/10.14722/ndss.2026.230249
  4. https://github.com/qc9c/Firmwell/blob/d46bc7552c463a08387125a346397e9866e5889e/README.md
  5. https://github.com/qc9c/Firmwell/blob/d46bc7552c463a08387125a346397e9866e5889e/LICENSE
  6. https://github.com/qc9c/Firmwell/blob/d46bc7552c463a08387125a346397e9866e5889e/Dockerfile
  7. https://github.com/qc9c/Firmwell/blob/d46bc7552c463a08387125a346397e9866e5889e/firmwell.py
  8. https://github.com/qc9c/Firmwell/blob/d46bc7552c463a08387125a346397e9866e5889e/firmwell/plugins/http_check.py