2022 · Conference paper
What Your Firmware Tells You Is Not How You Should Emulate It: A Specification-Guided Approach for Firmware Emulation
SEmu builds microcontroller peripheral models from vendor reference manuals rather than from the firmware itself. An NLP pipeline built on the Stanford tagger and parser turns register descriptions, interrupt tables and DMA channel tables taken from the manuals into structured condition-action rules, which the emulator checks, executes and chains at run time to answer MMIO accesses and raise interrupts or DMA requests. A symbolic-execution diagnostic tool built on S2E and µEmu traces invalid states back to the rules likely responsible, so that a person can correct them. The authors also use the models for fuzzing and to check driver code against specification rules.
Scope and limitations
Rule extraction is not fully automatic. The NLP engine mishandles cross-sentence references and nested conditions, and the raw rules for the clock peripherals of all three unit-test chips broke booting, so every one of P2IM's 66 unit tests failed until those rules were revised. After diagnosis-guided manual correction (26 rules added, 21 fixed and 3 removed, against 3,602 rules extracted from 23,424 sentences), the authors report that all 66 unit tests and 17 additional samples were emulated. Users must identify the MCU, configure memory maps and copy the needed manual sections into the pipeline, and diagnosis needs prepared test firmware; three developers took about two hours on average to fix the F103 I2C rules. The prototype covers 26 peripherals on five boards from three vendors (STM32F1, F4 and L1, NXP K64 and Atmel SAM3X), and trace-fidelity comparisons used real-hardware traces from only the K64F and F103RB boards. Rules model documented behaviour and do not establish equivalence with the silicon.
Why it fits this collection
Adds specification-derived peripheral modelling for rehosting microcontroller firmware, complementing firmware-guided approaches such as MMIO modelling and invalidity-guided inference.
Publication and review details
- Venue
- ACM CCS 2022
- Status
- Conference paper
- Publication / posting date
- November 7, 2022
- Date source
- ACM's Crossref deposit gives 2022-11-07 for both print and online publication. The conference dates are not substituted.
- First arXiv submission
- August 16, 2022
- arXiv
- 2208.07833
- Reviewed arXiv version
- v3
- DOI
- 10.1145/3548606.3559386
Crossref records the title, subtitle, five-author order, pages 3269–3283 and print and online publication on 2022-11-07; the ACM full text is not open access and was not retrieved. arXiv v3 (2022-10-11; v1 2022-08-16) is the authors' 18-page extended version and states that Wei Zhou and Lan Zhang contributed equally; the figures in this record come from it and are not asserted to match the proceedings text exactly. The MCUSec/SEmu snapshot at 6dc8be9 (2025-04-22) declares Apache-2.0 for the rule extractor and the non-commercial Cyberhaven Research License of S2E 2.0 for the S2E-based rule doctor, and points to IoTS-P/SEmu-Fuzz, which is Apache-2.0, for fuzzing; GitHub reports NOASSERTION for the main repository. The repository also redistributes vendor reference-manual PDFs, whose terms are separate, and directs users to a Google Drive copy of the Stanford tagger and parser. Building the rule doctor follows µEmu's S2E 2.0 package list and repo manifest, with an estimated 30–60 minutes on four cores. No manuals, firmware or code were downloaded or run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://dl.acm.org/doi/10.1145/3548606.3559386
- https://api.crossref.org/works/10.1145/3548606.3559386
- https://arxiv.org/abs/2208.07833
- https://arxiv.org/pdf/2208.07833v3
- README.md GitHub · MCUSec/SEmu · Revision 6dc8be9
- LICENSE GitHub · MCUSec/SEmu · Revision 6dc8be9
- Manual GitHub · MCUSec/SEmu · Revision 6dc8be9