{
  "added_at": "2026-10-20",
  "arxiv_id": "2609.38872",
  "arxiv_version_reviewed": "v1",
  "authors": [
    "Hongyuan Li",
    "Ke Wang",
    "Wei Zhou",
    "Le Guan"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-cortexm-emulation-sok.bib",
  "code_url": "https://github.com/IoTS-P/LargeRehostingTesting",
  "date_basis": "Dates this extended arXiv release. Author-reported NDSS 2027 acceptance is recorded separately and is not a 2027 publication claim.",
  "date_basis_zh": "日期指此扩展版的 arXiv 发布；另行注明作者报告的 NDSS 2027 录用，不作 2027 年已出版声明。",
  "date_precision": "day",
  "description_en": "Organizes 24 MCU analysis tools into configuration recovery, emulation, fuzzing and diagnosis stages, then evaluates the runnable, pipeline-compatible subset on 4,571 filtered Cortex-M firmware images. Studies where recovered configurations and emulation artifacts fail to support later analysis.",
  "description_zh": "将 24 项 MCU 分析工具组织为配置恢复、仿真、模糊测试及诊断阶段，并在 4,571 个筛选后的 Cortex-M 固件镜像上评估可运行且兼容流程的子集，研究恢复的配置和仿真产物为何无法支撑后续分析。",
  "doi": null,
  "entry_url": "https://awesomerea.org/papers/paper-cortexm-emulation-sok/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-cortexm-emulation-sok/",
  "evidence_urls": [
    "https://arxiv.org/abs/2609.38872v1",
    "https://arxiv.org/html/2609.38872v1",
    "https://github.com/IoTS-P/LargeRehostingTesting/blob/4950719b50c973624ba7cc4444ccacd9e23d88d3/README.md",
    "https://api.github.com/repos/IoTS-P/LargeRehostingTesting/git/trees/c477332e0c123a6140df36f7b9298992c6c28e29"
  ],
  "first_arxiv_date": "2026-09-30",
  "id": "paper-cortexm-emulation-sok",
  "json_url": "https://awesomerea.org/papers/paper-cortexm-emulation-sok/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-cortexm-emulation-sok/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-cortexm-emulation-sok/index.md",
  "metadata_notes": "The arXiv comment calls this an extended version of a paper accepted to NDSS 2027; the manuscript has a placeholder DOI and no final proceedings date is assigned. Pinned framework README describes a 20-image functional check. Firmware is not redistributed; OTACap access is under NDA. No root code license was established.",
  "metadata_notes_zh": "arXiv 备注称这是 NDSS 2027 已录用论文的扩展版，手稿 DOI 仍为占位值，未填写最终会议录日期。固定框架 README 描述 20 镜像功能检查。固件不随仓库重分发，OTACap 访问受保密协议约束。未确立根代码许可证。",
  "pdf_url": "https://arxiv.org/pdf/2609.38872v1",
  "project_url": null,
  "publication_date": "2026-09-30",
  "publication_status": "preprint",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "Excludes tools requiring unavailable manuals, source or hardware context, so this is not a uniform execution comparison of all 24 tools. ISA identification, admission thresholds and sampled crash diagnosis involve empirical judgments; findings do not generalize to other architectures. Reported crashes are not confirmed vulnerabilities.",
  "scope_limitations_zh": "排除需要无法取得的手册、源码或硬件上下文的工具，因此不是对全部 24 项工具的统一执行比较。指令集识别、准入阈值及抽样崩溃诊断含经验判断，结论不能直接泛化到其他架构；报告的崩溃不等于已确认漏洞。",
  "targets": [
    "firmware",
    "binary"
  ],
  "title": "SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version)",
  "title_zh": "ARM Cortex-M 固件仿真动态分析研究的大规模实证综述（扩展版）",
  "url": "https://arxiv.org/abs/2609.38872",
  "venue": "arXiv (extended version)",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20",
  "why_fits_en": "Adds evidence on the practical limits of reconstructing executable environments for black-box firmware.",
  "why_fits_zh": "补充为黑盒固件重建可执行环境时实际能力边界的证据。",
  "year": 2026
}