AwesomeREA.org

2025 · Conference paper

Target-Centric Firmware Rehosting with Penguin

Andrew Fasano; Zachary Estrada; Luke Craig; Ben Levy; Jordan McLeod; Jacques Becker; Caden Kline; Elysia Witham; Cole DiLorenzo; Ali Bobi; Dinko Dermendzhiev; Tim Leek; Wil Robertson

Penguin rehosts embedded Linux firmware from an extracted filesystem by deriving an editable configuration of emulation transformations, such as file changes, pseudofiles, NVRAM values and network interfaces, from static analysis. Dynamic-analysis plugins expose failures so the configuration can be refined for each target, and a minimizer identifies which transformations a working rehosting needs.

Scope and limitations

Targets embedded Linux firmware through whole-system emulation with kernel replacement, as in Firmadyne and FirmAE; the implementation covers x86, ARM and MIPS and relies on the Linux syscall ABI. In the FirmAE comparison, success means a process binds port 80 or 443; a non-empty HTTP response is a stricter check, and the authors note neither shows full functionality. The 75% gain over FirmAE is author-reported on their own corpus of 13,649 images from vendor websites. Refinement still needs an analyst, and nondeterministic runs were repeated up to ten times. It builds an analysis environment, not a faithful device reproduction or source recovery.

Why it fits this collection

Makes firmware rehosting an explicit, shareable per-target configuration refined from runtime evidence, a reproducible way to rebuild an analyzable execution environment without the original hardware.

Publication and review details

Venue
Workshop on Binary Analysis Research (BAR) 2025
Status
Conference paper
Publication / posting date
2025 (exact date not verified)
Date source
The Internet Society’s Crossref deposit gives publication year 2025. The PDF footer names the 28 February 2025 workshop; no finer publication date is asserted from the event date.
DOI
10.14722/bar.2025.23010

BAR 2025 is a workshop co-located with NDSS Symposium 2025, not the NDSS main track. The 13-author order and the name ‘Wil Robertson’ follow the PDF and the Internet Society’s Crossref deposit; the NDSS paper and program pages list ‘William Robertson’ and place Caden Kline after Cole DiLorenzo. The DOI resolves directly to the PDF, whose footer gives ISBN 979-8-9919276-4-2; no page range was verified. The conclusion says 13,650 images where the abstract and appendix say 13,649. The PDF’s availability section points to rehosting/penguin but names no evaluated release; the curated tool record reviews v3.1.21 (2026-10-06), which postdates the paper. The repository is GPL-2.0-or-later at the pinned commit, and the paper does not describe its firmware corpus as released. Experiments were not rerun for this collection.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://www.ndss-symposium.org/ndss-paper/auto-draft-634/
  2. https://www.ndss-symposium.org/wp-content/uploads/bar2025-final10.pdf
  3. https://doi.org/10.14722/bar.2025.23010
  4. https://api.crossref.org/works/10.14722/bar.2025.23010
  5. https://www.ndss-symposium.org/ndss-program/bar-2025/
  6. https://github.com/rehosting/penguin/blob/b645cd23852a41781181a651779b82a48c0c3fd3/README.md
  7. https://github.com/rehosting/penguin/blob/b645cd23852a41781181a651779b82a48c0c3fd3/LICENSE
  8. https://github.com/rehosting/penguin/releases/tag/v3.1.21