AwesomeREA.org

2020 · Conference paper

HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation

Abraham A Clements; Eric Gustafson; Tobias Scharnowski; Paul Grosen; David Fritz; Christopher Kruegel; Giovanni Vigna; Saurabh Bagchi; Mathias Payer

HALucinator rehosts monolithic ARM Cortex-M firmware by identifying hardware-abstraction-library functions and replacing them with authored Python handlers and peripheral models. LibMatch locates library interfaces; the QEMU/Avatar2 implementation supports interactive I/O, while the paper-associated HAL-fuzz variant uses AFL-Unicorn for fuzzing.

Scope and limitations

LibMatch requires an available HAL/library and a sufficiently similar compilation environment; compiler variation and inlining limit matching. Rehosting also needs a QEMU-supported architecture, firmware memory layout, interception addresses and authored handlers/models. Unmodeled direct hardware accesses may return zero or ignore writes, and simplified timing and peripheral behavior do not establish hardware equivalence. The authors’ rehosting and fuzzing demonstrations are not universal firmware coverage, complete device reconstruction or original-source recovery.

Why it fits this collection

Shows how binary library identification and explicit environment models can reconstruct enough of an embedded execution environment to analyze existing firmware, with the abstraction boundary made visible.

Publication and review details

Venue
USENIX Security 2020
Status
Conference paper
Publication / posting date
August 2020
Date source
The official USENIX proceedings citation gives August 2020. Month precision is retained; the conference’s event dates are not substituted for a publication day.

Reviewed the final USENIX paper, pages 1201–1218; no DOI or arXiv identifier is asserted. The paper-linked embedded-sec/halucinator repository carries GPLv3, while the separate ucsb-seclab/hal-fuzz implementation carries Apache-2.0; these licenses are not interchangeable. The original README describes a lightly tested Ubuntu 16.04/18.04 and Python 3 environment with Avatar2, QEMU and GDB, and points to a newer project separately. Reproduction needs firmware images, compatible HAL/SDK inputs and configuration; vendor firmware, dependencies and SDK rights remain separate. HAL-fuzz uses simplified handlers and deterministic timers rather than wall-clock equivalence. No firmware binaries were retrieved and no upstream runtime or experiment was executed.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://www.usenix.org/conference/usenixsecurity20/presentation/clements
  2. https://www.usenix.org/system/files/sec20-clements.pdf
  3. https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/README.md
  4. https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/LICENSE
  5. https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/dependencies.md
  6. https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/Developing.md
  7. https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/doc/tutorial/0_Preqs.md
  8. https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/doc/tutorial/1_HALucinator_overview.md
  9. https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/install_deps.sh
  10. https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/LICENSE
  11. https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/README.md
  12. https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/requirements.txt