2021 · Conference paper
Automatic Firmware Emulation through Invalidity-guided Knowledge Inference
µEmu emulates ARM Cortex-M microcontroller firmware without real hardware or hand-written peripheral models by symbolically executing the image with unknown peripheral registers as symbols. Invalidity-guided exploration detects invalid states such as unexpected infinite loops and steers execution toward valid paths, caching the chosen responses at individual peripheral access points in a tiered knowledge base whose rules range from simple storage to PC- and calling-context-based matching. During dynamic analysis the knowledge base answers peripheral reads while an integrated, modified AFL fuzzer supplies data-register input. The prototype extends S2E 2.0 with Cortex-M support.
Scope and limitations
Targets ARM Cortex-M firmware; the repository lists DMA and other architectures as unsupported help-wanted items. Responses only have to satisfy the firmware's own checks rather than reproduce real peripheral values, so successful emulation does not establish hardware equivalence. Invalidity checks can miss unhandled error paths, data registers can be mis-categorized (3 of 43 were missed against ground truth taken from chip manuals), and long loops whose concrete counters depend on symbols may go undetected. On P2IM's 66 unit tests the final paper reports 63 passes (95%) without manual help, and all after adding one invalid program point to each failure. Across 21 real-world firmware samples, 6 needed a user-defined invalid point and 3 a manually added data register. Coverage counts QEMU translation blocks against IDA-counted basic blocks, following P2IM.
Why it fits this collection
Adds symbolic-execution-based inference of peripheral behaviour for rehosting microcontroller firmware, complementing the catalog's HAL-replacement and MMIO-modelling approaches.
Publication and review details
- Venue
- USENIX Security 2021
- Status
- Conference paper
- Publication / posting date
- August 2021
- Date source
- The BibTeX on the USENIX presentation page gives August 2021 for the 30th USENIX Security Symposium proceedings. Month precision is retained; the symposium dates are not substituted for a publication day, and the July 2021 arXiv dates belong to the extended version.
- First arXiv submission
- July 16, 2021
- arXiv
- 2107.07759
- Reviewed arXiv version
- v2
The USENIX presentation-page BibTeX establishes the four-author order, proceedings title, pages 2007–2024 and August 2021. A footnote in the final PDF points to the authors' extended version on arXiv, titled with an "(Extended Version)" suffix (v1 2021-07-16, v2 2021-07-27), which is recorded as the arXiv identifier; no publisher DOI was found. The presentation-page abstract reports a 93% unit-test passing rate, whereas the final paper and the arXiv abstract report 95%; this record follows the final paper. The MCUSec/uEmu snapshot at c82fc0a (2023-11-20) has mixed terms: its add-on plugins use the Cyberhaven Research License of S2E 2.0 (non-commercial use only), its AFL changes Apache-2.0, QEMU GPL-2.0, and other S2E libraries LGPL-2.1, BSD/MIT or NCSA licenses; GitHub reports NOASSERTION. The README supports Ubuntu 18.04 or 20.04 (64-bit) or a Vagrant VM, fetches sources through a repo manifest, estimates about an hour to build on four cores, keeps unit-test and real-world firmware configurations in separate repositories, and uses an IDA script to count basic blocks for coverage. No firmware, builds or experiments were run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://www.usenix.org/conference/usenixsecurity21/presentation/zhou
- https://www.usenix.org/system/files/sec21-zhou.pdf
- https://arxiv.org/abs/2107.07759
- README.md GitHub · MCUSec/uEmu · Revision c82fc0a
- LICENSE GitHub · MCUSec/uEmu · Revision c82fc0a