# HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation

> HALucinator rehosts monolithic ARM Cortex-M firmware by identifying hardware-abstraction-library functions and replacing them with authored Python handlers and peripheral models. LibMatch locates library interfaces; the QEMU/Avatar2 implementation supports interactive I/O, while the paper-associated HAL-fuzz variant uses AFL-Unicorn for fuzzing.

- Authors: Abraham A Clements; Eric Gustafson; Tobias Scharnowski; Paul Grosen; David Fritz; Christopher Kruegel; Giovanni Vigna; Saurabh Bagchi; Mathias Payer
- Venue: USENIX Security 2020
- Status: Conference paper
- Publication / posting date: August 2020
- Date source: The official USENIX proceedings citation gives August 2020. Month precision is retained; the conference’s event dates are not substituted for a publication day.
- Sources reviewed: 2026-10-17
- Added to the catalog: 2026-10-17
- Original paper: <https://www.usenix.org/conference/usenixsecurity20/presentation/clements>
- PDF: <https://www.usenix.org/system/files/sec20-clements.pdf>
- Code: <https://github.com/embedded-sec/halucinator>
- BibTeX: <https://awesomerea.org/papers/citations/paper-halucinator.bib>
- Catalog page: <https://awesomerea.org/papers/paper-halucinator/>
- Record JSON: <https://awesomerea.org/papers/paper-halucinator/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-halucinator/index.md)

## Scope and limitations

LibMatch requires an available HAL/library and a sufficiently similar compilation environment; compiler variation and inlining limit matching. Rehosting also needs a QEMU-supported architecture, firmware memory layout, interception addresses and authored handlers/models. Unmodeled direct hardware accesses may return zero or ignore writes, and simplified timing and peripheral behavior do not establish hardware equivalence. The authors’ rehosting and fuzzing demonstrations are not universal firmware coverage, complete device reconstruction or original-source recovery.

## Why it fits this collection

Shows how binary library identification and explicit environment models can reconstruct enough of an embedded execution environment to analyze existing firmware, with the abstraction boundary made visible.

## Publication and review notes

Reviewed the final USENIX paper, pages 1201–1218; no DOI or arXiv identifier is asserted. The paper-linked embedded-sec/halucinator repository carries GPLv3, while the separate ucsb-seclab/hal-fuzz implementation carries Apache-2.0; these licenses are not interchangeable. The original README describes a lightly tested Ubuntu 16.04/18.04 and Python 3 environment with Avatar2, QEMU and GDB, and points to a newer project separately. Reproduction needs firmware images, compatible HAL/SDK inputs and configuration; vendor firmware, dependencies and SDK rights remain separate. HAL-fuzz uses simplified handlers and deterministic timers rather than wall-clock equivalence.

## Primary sources

1. <https://www.usenix.org/conference/usenixsecurity20/presentation/clements>
2. <https://www.usenix.org/system/files/sec20-clements.pdf>
3. <https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/README.md>
4. <https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/LICENSE>
5. <https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/dependencies.md>
6. <https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/Developing.md>
7. <https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/doc/tutorial/0_Preqs.md>
8. <https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/doc/tutorial/1_HALucinator_overview.md>
9. <https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/install_deps.sh>
10. <https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/LICENSE>
11. <https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/README.md>
12. <https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/requirements.txt>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.