Tool

Penguin

Rehost embedded Linux firmware from an extracted root filesystem using a generated, editable configuration of emulation transformations, then refine it through a guest root shell, forwarded network services and recorded dynamic-analysis output.

Requirements and limitations

Reviewed release: v3.1.21, published 2026-10-06 and tagged at the reviewed commit. Install by pulling the rehosting/penguin container from Docker Hub and installing its penguin wrapper script; source and Nix builds are documented separately.
Input is a root-filesystem tarball with permissions and ownership preserved, made with the bundled fw2tar or by hand. Penguin uses whole-system emulation with a replacement kernel selected for the detected architecture; it does not reproduce the original device faithfully or recover source code. Failed rehostings are refined by editing the configuration and rerunning.
The BAR 2025 workshop paper, co-located with NDSS, reports author-run results on 13,649 embedded Linux images from 69 vendors, with working rehostings for 75% more firmware than the prior state of the art. That evaluation predates this release and is not a property of the current version.
GPL-2.0-or-later; the README also carries a U.S. Government rights notice. Findings from the emulated system need analyst interpretation. No container was pulled and no firmware was run.

About this entry

Type: Tool
Category: Firmware tools
Relationship: Foundation tool
Targets: Firmware

Sources reviewed 2026-10-17

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Requirements and limitations

About this entry

Primary sources