2021 · Conference paper
SoK: Enabling Security Analyses of Embedded Systems via Rehosting
Systematizes rehosting: moving embedded firmware from its physical hardware into a virtual environment that models enough hardware behavior for dynamic analysis such as fuzzing and symbolic execution. The authors measure why whole-system emulation does not scale using 2,574 hardware configurations, 1,956 device tree blobs from Linux 5.11.4 and 618 vendor ARM Cortex SVD files. They compare corpus CPU models with QEMU support, count unique peripherals, use driver source lines as a complexity proxy, and run a Monte Carlo simulation of adding peripheral models SoC by SoC. Supporting a random 10% of the SoCs would need about 3,947 peripherals for the Linux corpus and 1,730 for the ARM Cortex corpus, against 1,083 implemented in QEMU 5.2. The paper then classifies prior systems by how they emulate, replace, symbolically model, pass through to hardware or leave each layer unmodified, describes an iterative rehosting process with fidelity evaluation, and sets out open problems.
Scope and limitations
This is a systematization with a measurement study, not a new rehosting tool. The measurements use hardware descriptions rather than firmware images: device trees cover Linux-based (Type-1) systems and SVD files cover only ARM Cortex hardware, and only architectures or vendors with ten or more samples are counted. Driver source lines are an explicitly rough proxy for the effort of modeling a peripheral, and closed-source drivers are assigned an architecture average. The conclusion that manually written hardware emulators will not scale rests on these proxies and on QEMU 5.2 and OVPsim as of early 2021. The authors note that rehosting fidelity lacks a formal definition and that no large-scale fidelity evaluations exist, so the taxonomy compares approaches qualitatively; a concurrent survey covers fidelity in more detail.
Why it fits this collection
Adds a field-defining survey of firmware rehosting, giving the collection's individual rehosting systems such as Firmadyne, FirmAE and HALucinator a shared vocabulary and taxonomy.
Publication and review details
- Venue
- ACM ASIA CCS 2021
- Status
- Conference paper
- Publication / posting date
- May 24, 2021
- Date source
- ACM-deposited Crossref print-publication date; the online-publication date is recorded separately in metadata notes. The June 7–11 conference dates are not used.
- DOI
- 10.1145/3433210.3453093
ACM metadata records print publication on 2021-05-24 and online publication on 2021-06-04, pages 687–701, with the twelve-author order shown here. The paper is published under CC BY 4.0. dl.acm.org refused automated requests during this review, so the 15-page ACM PDF was read from a Wayback Machine capture of its own URL. Footnote 3 links igloo-re/rehosting_sok, which now redirects to rehosting/rehosting_sok. The reviewed 2021-06-08 commit is MIT-licensed and builds an Ubuntu 20.04 Docker image with QEMU 5.2.0, generates the 1,956 DTBs and prints the data behind Tables 1–3 and the Monte Carlo results. Its SVD analysis clones the current posborne/cmsis-svd repository, and the README warns that results change slightly as that repository grows. The repository reproduces these measurements; it is not a rehosting tool. Nothing was built or run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://dl.acm.org/doi/10.1145/3433210.3453093
- https://api.crossref.org/works/10.1145/3433210.3453093
- https://web.archive.org/web/20250427221838/https://dl.acm.org/doi/pdf/10.1145/3433210.3453093
- README.md GitHub · rehosting/rehosting_sok · Revision 499b625
- LICENSE GitHub · rehosting/rehosting_sok · Revision 499b625
- Dockerfile GitHub · rehosting/rehosting_sok · Revision 499b625