# Khost: KVM-based Near Native MCU Firmware Rehosting

> Extends KVM with MCU instruction handling, memory mapping and interrupt modeling to rehost firmware on ARMv8-A hosts. An MMIO monitor and firmware wrapper support peripheral interaction and coverage-guided testing.

- Authors: Chunlin Wang; Yicheng Yang; Yuan Zhang; Haoyu Xiao; Yifan Zhang; Jiarun Dai
- Venue: USENIX Security '26
- Status: Conference paper
- Publication / posting date: August 2026
- Date source: Publication month in the official USENIX proceedings BibTeX.
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-10-20
- Original paper: <https://www.usenix.org/conference/usenixsecurity26/presentation/wang-chunlin>
- PDF: <https://www.usenix.org/system/files/usenixsecurity26-wang-chunlin.pdf>
- Code: <https://github.com/seclab-fudan/Khost>
- Project: <https://zenodo.org/records/18195819>
- BibTeX: <https://awesomerea.org/papers/citations/paper-khost.bib>
- Catalog page: <https://awesomerea.org/papers/paper-khost/>
- Record JSON: <https://awesomerea.org/papers/paper-khost/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-khost/index.md)

## Scope and limitations

The prototype needs ARMv8-A with 32-bit compatibility and EL2 virtualization. Some coprocessor operations need added emulation, and entry-point or basic-block recovery can require manual correction. Peripheral approximations can cause false positives; evaluation covers two benchmarks and 12 firmware images, not arbitrary devices.

## Why it fits this collection

Adds a concrete firmware execution-recovery substrate and its architecture constraints.

## Publication and review notes

Official proceedings give August 2026, pages 573–592. Reviewed pinned README and Apache-2.0 root license; dependencies and firmware licensing are separate. The paper-linked Zenodo v1.02 metadata declares CC BY 4.0 and lists a 65.7 MB archive.

## Primary sources

1. <https://www.usenix.org/conference/usenixsecurity26/presentation/wang-chunlin>
2. <https://www.usenix.org/system/files/usenixsecurity26-wang-chunlin.pdf>
3. <https://github.com/seclab-fudan/Khost/blob/7f47e429b8ce53b300b9be5074f1956a418238ab/README.md>
4. <https://github.com/seclab-fudan/Khost/blob/7f47e429b8ce53b300b9be5074f1956a418238ab/LICENSE>
5. <https://zenodo.org/api/records/18195819>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.