2026 · Conference paper
User-Space Dependency-Aware Rehosting for Linux-Based Firmware Binaries
FIRMWELL reconstructs the execution environment of Linux firmware services by running their initialization processes, locating blocking dependencies and repairing missing system-level behavior. It combines containerized QEMU-user emulation with a QEMU-system fallback, using process traces and binary analysis to recover resources needed by the target service.
Scope and limitations
The evaluation concerns selected network services, not complete device or hardware equivalence. HTTP acceptance uses configured response-status and error-content checks; other services need their own criteria. Coverage depends on unpacking, supported architectures, initialization heuristics and peripheral models. Symbolic path explosion, solver timeouts and complex peripheral checks remain failure modes. The paper’s recovery strategy avoids patching target binaries; successful service interaction does not establish recovery of original source code or every device function.
Why it fits this collection
A concrete method for reconstructing the dependencies around shipped firmware binaries, complementing HAL-level and full-system rehosting research.
Publication and review details
- Venue
- NDSS 2026
- Status
- Conference paper
- Publication / posting date
- 2026 (exact date not verified)
- Date source
- The Internet Society’s Crossref deposit and the official NDSS paper identify publication year 2026. No finer publication date is asserted from the conference event dates.
- DOI
- 10.14722/ndss.2026.230249
The nine-author order follows the official paper. Crossref agrees on the DOI but repeats Jian Zhang as a tenth author row. Its appendix lists 1 CPU core, 4 GiB RAM and 100 GiB disk per task, and describes the full firmware corpus as private. The pinned repository declares GPLv3; vendor firmware and dependencies retain separate terms. Its Docker-in-Docker workflow uses an elevated-privilege outer container, and the authors recommend VM isolation; the current inner-container privilege flag defaults off.
Sources reviewed
Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Discussed in the survey
Primary sources
- https://www.ndss-symposium.org/ndss-paper/user-space-dependency-aware-rehosting-for-linux-based-firmware-binaries/
- https://www.ndss-symposium.org/wp-content/uploads/2026-s249-paper.pdf
- https://api.crossref.org/works/10.14722/ndss.2026.230249
- README.md GitHub · qc9c/Firmwell · Revision d46bc75
- LICENSE GitHub · qc9c/Firmwell · Revision d46bc75
- Dockerfile GitHub · qc9c/Firmwell · Revision d46bc75
- firmwell.py GitHub · qc9c/Firmwell · Revision d46bc75
- firmwell/plugins/http_check.py GitHub · qc9c/Firmwell · Revision d46bc75