2026 · Preprint
SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version)
Organizes 24 MCU analysis tools into configuration recovery, emulation, fuzzing and diagnosis stages, then evaluates the runnable, pipeline-compatible subset on 4,571 filtered Cortex-M firmware images. Studies where recovered configurations and emulation artifacts fail to support later analysis.
Scope and limitations
Excludes tools requiring unavailable manuals, source or hardware context, so this is not a uniform execution comparison of all 24 tools. ISA identification, admission thresholds and sampled crash diagnosis involve empirical judgments; findings do not generalize to other architectures. Reported crashes are not confirmed vulnerabilities.
Why it fits this collection
Adds evidence on the practical limits of reconstructing executable environments for black-box firmware.
Publication and review details
- Venue
- arXiv (extended version)
- Status
- Preprint
- Publication / posting date
- September 30, 2026
- Date source
- Dates this extended arXiv release. Author-reported NDSS 2027 acceptance is recorded separately and is not a 2027 publication claim.
- First arXiv submission
- September 30, 2026
- arXiv
- 2609.38872
- Reviewed arXiv version
- v1
The arXiv comment calls this an extended version of a paper accepted to NDSS 2027; the manuscript has a placeholder DOI and no final proceedings date is assigned. Pinned framework README describes a 20-image functional check. Firmware is not redistributed; OTACap access is under NDA. No root code license was established.
Sources reviewed
Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://arxiv.org/abs/2609.38872v1
- https://arxiv.org/html/2609.38872v1
- README.md GitHub · IoTS-P/LargeRehostingTesting · Revision 4950719
- https://api.github.com/repos/IoTS-P/LargeRehostingTesting/git/trees/c477332e0c123a6140df36f7b9298992c6c28e29