{ "added_at": "2026-10-17", "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Abraham A Clements", "Eric Gustafson", "Tobias Scharnowski", "Paul Grosen", "David Fritz", "Christopher Kruegel", "Giovanni Vigna", "Saurabh Bagchi", "Mathias Payer" ], "bibtex_url": "https://awesomerea.org/papers/citations/paper-halucinator.bib", "citation": { "container_title": "29th USENIX Security Symposium (USENIX Security 20)", "pages": "1201-1218", "publisher": "USENIX Association", "sources": [ "https://www.usenix.org/conference/usenixsecurity20/presentation/clements" ] }, "code_url": "https://github.com/embedded-sec/halucinator", "date_basis": "The official USENIX proceedings citation gives August 2020. Month precision is retained; the conference’s event dates are not substituted for a publication day.", "date_basis_zh": "USENIX 官方论文集引用信息给出 2020 年 8 月。保留月份精度，不把会议举办日期当作具体出版日。", "date_precision": "month", "description_en": "HALucinator rehosts monolithic ARM Cortex-M firmware by identifying hardware-abstraction-library functions and replacing them with authored Python handlers and peripheral models. LibMatch locates library interfaces; the QEMU/Avatar2 implementation supports interactive I/O, while the paper-associated HAL-fuzz variant uses AFL-Unicorn for fuzzing.", "description_zh": "HALucinator 识别单体 ARM Cortex-M 固件中的硬件抽象库函数，并用人工编写的 Python 处理函数和外设模型替换它们，从而重托管固件。LibMatch 定位库接口；QEMU/Avatar2 实现支持交互式输入输出，与论文关联的 HAL-fuzz 变体则使用 AFL-Unicorn 进行模糊测试。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-halucinator/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-halucinator/", "evidence_urls": [ "https://www.usenix.org/conference/usenixsecurity20/presentation/clements", "https://www.usenix.org/system/files/sec20-clements.pdf", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/README.md", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/LICENSE", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/dependencies.md", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/Developing.md", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/doc/tutorial/0_Preqs.md", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/doc/tutorial/1_HALucinator_overview.md", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/install_deps.sh", "https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/LICENSE", "https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/README.md", "https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/requirements.txt" ], "first_arxiv_date": null, "id": "paper-halucinator", "json_url": "https://awesomerea.org/papers/paper-halucinator/record.json", "kind": "research", "markdown_url": "https://awesomerea.org/papers/paper-halucinator/index.md", "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-halucinator/index.md", "metadata_notes": "Reviewed the final USENIX paper, pages 1201–1218; no DOI or arXiv identifier is asserted. The paper-linked embedded-sec/halucinator repository carries GPLv3, while the separate ucsb-seclab/hal-fuzz implementation carries Apache-2.0; these licenses are not interchangeable. The original README describes a lightly tested Ubuntu 16.04/18.04 and Python 3 environment with Avatar2, QEMU and GDB, and points to a newer project separately. Reproduction needs firmware images, compatible HAL/SDK inputs and configuration; vendor firmware, dependencies and SDK rights remain separate. HAL-fuzz uses simplified handlers and deterministic timers rather than wall-clock equivalence.", "metadata_notes_zh": "核查的是 USENIX 正式论文，页码 1201–1218；不推定 DOI 或 arXiv 标识。论文链接的 embedded-sec/halucinator 仓库采用 GPLv3，独立的 ucsb-seclab/hal-fuzz 实现采用 Apache-2.0，两者许可不可混同。原始 README 记载了仅经有限测试的 Ubuntu 16.04/18.04 与 Python 3 环境，依赖 Avatar2、QEMU 和 GDB，并另行指向较新项目。复现需要固件镜像、兼容的 HAL/SDK 输入及配置；厂商固件、依赖项和 SDK 的使用权需分别处理。HAL-fuzz 使用简化处理函数和确定性计时器，不保证与真实时钟等价。", "pdf_url": "https://www.usenix.org/system/files/sec20-clements.pdf", "project_url": null, "publication_date": "2020-08", "publication_status": "conference-paper", "record_type": "paper", "runtime_tested": false, "scope_limitations_en": "LibMatch requires an available HAL/library and a sufficiently similar compilation environment; compiler variation and inlining limit matching. Rehosting also needs a QEMU-supported architecture, firmware memory layout, interception addresses and authored handlers/models. Unmodeled direct hardware accesses may return zero or ignore writes, and simplified timing and peripheral behavior do not establish hardware equivalence. The authors’ rehosting and fuzzing demonstrations are not universal firmware coverage, complete device reconstruction or original-source recovery.", "scope_limitations_zh": "LibMatch 需要可获取的硬件抽象层或库，以及足够相似的编译环境；编译器差异与内联会限制匹配效果。重托管还需要 QEMU 支持的架构、固件内存布局、拦截地址及人工编写的处理函数和模型。未建模的直接硬件访问可能在读取时返回零、在写入时被忽略；简化的时序与外设行为不能证明硬件等价。作者的重托管与模糊测试演示不代表普遍覆盖所有固件、完整重建设备或恢复原始源代码。", "targets": [ "firmware" ], "title": "HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation", "title_zh": "HALucinator：通过抽象层仿真实现固件重托管", "url": "https://www.usenix.org/conference/usenixsecurity20/presentation/clements", "venue": "USENIX Security 2020", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Shows how binary library identification and explicit environment models can reconstruct enough of an embedded execution environment to analyze existing firmware, with the abstraction boundary made visible.", "why_fits_zh": "展示如何通过二进制库识别与显式环境模型，重建分析已有固件所需的嵌入式执行环境，并明确其抽象边界。", "year": 2020 }