# Conware: Automated Modeling of Hardware Peripherals > Conware builds reusable software models of hardware peripherals from recordings of real firmware–peripheral interactions. An LLVM pass instruments Arduino source code to log MMIO reads, writes and interrupts on the real board, with existing hardware-in-the-loop recording as an alternative. Each recording becomes a per-peripheral graph whose read values are summarized as simple sub-models such as patterns; graphs are merged and optimized into automata that can be combined across peripherals and run in an Avatar²-based emulator. The authors model ten peripherals on an Arduino Due (SAM3X Cortex-M3) and emulate an uninstrumented smart-door-lock firmware from models trained only on vendor example code. - Authors: Chad Spensky; Aravind Machiry; Nilo Redini; Colin Unger; Graham Foster; Evan Blasband; Hamed Okhravi; Christopher Kruegel; Giovanni Vigna - Venue: ACM ASIA CCS 2021 - Status: Conference paper - Publication / posting date: May 24, 2021 - Date source: ACM's Crossref deposit records published/print publication on 2021-05-24 and online publication on 2021-06-04. This entry uses the print date, not the June 7–11 conference dates. - DOI: 10.1145/3433210.3437532 - Sources reviewed: 2026-10-27 - Added to the catalog: 2026-11-03 - Original paper: - PDF: - Code: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-conware/index.md) ## Scope and limitations Training needs the real board with the peripherals attached, plus source code for the LLVM-based recorder. The evaluation covers bare-metal Arduino Due firmware with ten hobbyist peripherals, and port-mapped I/O systems are out of scope. Models encode only behaviour observed during recording, assume that state transitions follow MMIO writes, and attach interrupts to transitions rather than to the writes that trigger them, so read-triggered transitions and exact interrupt timing are not supported. The unseen-firmware result is a single door-lock program built from six peripheral models. Its UART output matched real hardware, and it executed 362 of the 609 basic blocks (59%) and 58 of the 68 functions (85%) reachable from loop(); the authors measure survivability of execution rather than full peripheral fidelity. Record-and-replay comparisons ran each sample once for 10 minutes, since replays are deterministic. ## Why it fits this collection Adds record-and-model reconstruction of peripherals from real hardware interactions, complementing the catalog's HAL-replacement, firmware-guided and specification-guided rehosting approaches. ## Publication and review notes Crossref records the nine-author order, pages 95–109, print publication on 2021-05-24 and online publication on 2021-06-04. The 15-page copy on Christopher Kruegel's UCSB site carries the ACM reference format and DOI. The paper cites ucsb-seclab/conware for its code; the snapshot at 05dfdf5 (2020-07-19, committed as the submitted version of the code) declares no license. Its README pipeline instruments Arduino code with LLVM, runs it on a real Arduino with the peripheral attached, dumps logs over UART, and then generates, optimizes and emulates models with Avatar² and OpenOCD; the install script builds LLVM. Two submodules, pretender and avatar2-pretender, use SSH URLs on the UCSB lab's own Git server, and the pinned requirements include Python 2 backport packages such as enum34. ## Primary sources 1. 2. 3. 4. 5. 6. 7. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.