# Jetset: Targeted Firmware Rehosting for Embedded Systems > Jetset rehosts firmware only as far as an analyst-chosen goal address, such as the point where a fuzzer can inject input. Given the architecture, the MMIO address range, an entry point and the goal, it symbolically executes the firmware with angr against a modified QEMU, treating peripheral reads as symbolic, cycling interrupts, and steering toward the goal with CFG distances and Tabu search. Solved constraints become C peripheral models for QEMU that replay the inferred values and interrupts so the firmware boots concretely to the goal. The authors evaluate 13 targets across x86, ARM and Motorola ColdFire, including Linux on a Raspberry Pi 2, a BeagleBoard-xM bootloader, a SEL-751 relay, a Boeing 737 CMU-900 and nine P²IM firmware, and use the CMU model with AFL to find a privilege escalation in its VRTX kernel. - Authors: Evan Johnson; Maxwell Bland; YiFei Zhu; Joshua Mason; Stephen Checkoway; Stefan Savage; Kirill Levchenko - Venue: USENIX Security 2021 - Status: Conference paper - Publication / posting date: August 2021 - Date source: The official USENIX proceedings citation gives August 2021. Month precision is retained; the August 11–13 symposium dates on the proceedings cover are not substituted for a publication day. - Sources reviewed: 2026-10-19 - Added to the catalog: 2026-10-30 - Original paper: - PDF: - Code: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-jetset/index.md) ## Scope and limitations This is targeted rehosting, not full device emulation or firmware decompilation. The analyst supplies the MMIO range, entry point and goal address, and the synthesized models replay one satisfying path and then the last satisfying value for each address, so they need not match real hardware and may mishandle stateful or complex peripheral interaction after the goal. DMA is unsupported; the two targets that needed it relied on an existing QEMU device model or a manually symbolic memory region. Incomplete CFGs, for example across virtual calls or x86 task switches, weaken the distance heuristic, and the BeagleBoard-xM emulator crashed when synthesized serial data was executed as code. Fidelity checks compare against hardware or a manually built QEMU model for selected targets. The VRTX privilege escalation is described by the authors as primarily of academic interest. ## Why it fits this collection Adds symbolic-execution-based peripheral model synthesis for booting firmware to an analysis point, complementing the section’s HAL replacement, MMIO-modeling fuzzing and Linux user-space rehosting research. ## Publication and review notes The USENIX presentation page and final proceedings PDF give the seven authors in this order, the 30th USENIX Security Symposium, pages 321–338, ISBN 978-1-939133-24-3 and month August; the 19-page PDF includes a proceedings cover page. The page also links a separate prepublication PDF. No DOI or arXiv identifier was found. The paper cites jetset.aerosec.org as its open-source release, but that host did not resolve during review. The aerosec GitHub organization, whose site lists the paper, hosts aerosec/jetset with commits from the first two authors; its README says it contains the code and data to reproduce the paper’s results, except the proprietary or security-critical CMU-900 and ICS binaries. The 2024-03-21 commit is GPL-2.0, and its Makefile clones the jetset_engine, jetset_qemu and jetset_public_data repositories over SSH; GitHub does not identify a single license for the modified-QEMU repository jetset_qemu, and jetset_public_data declares none. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. 9. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.