2026 · Conference paper
Khost: KVM-based Near Native MCU Firmware Rehosting
Extends KVM with MCU instruction handling, memory mapping and interrupt modeling to rehost firmware on ARMv8-A hosts. An MMIO monitor and firmware wrapper support peripheral interaction and coverage-guided testing.
Scope and limitations
The prototype needs ARMv8-A with 32-bit compatibility and EL2 virtualization. Some coprocessor operations need added emulation, and entry-point or basic-block recovery can require manual correction. Peripheral approximations can cause false positives; evaluation covers two benchmarks and 12 firmware images, not arbitrary devices.
Why it fits this collection
Adds a concrete firmware execution-recovery substrate and its architecture constraints.
Publication and review details
- Venue
- USENIX Security '26
- Status
- Conference paper
- Publication / posting date
- August 2026
- Date source
- Publication month in the official USENIX proceedings BibTeX.
Official proceedings give August 2026, pages 573–592. Reviewed pinned README and Apache-2.0 root license; dependencies and firmware licensing are separate. The paper-linked Zenodo v1.02 metadata declares CC BY 4.0 and lists a 65.7 MB archive; the archive was not downloaded. No firmware or tool was executed.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://www.usenix.org/conference/usenixsecurity26/presentation/wang-chunlin
- https://www.usenix.org/system/files/usenixsecurity26-wang-chunlin.pdf
- README.md GitHub · seclab-fudan/Khost · Revision 7f47e42
- LICENSE GitHub · seclab-fudan/Khost · Revision 7f47e42
- https://zenodo.org/api/records/18195819