{
  "added_at": "2026-10-20",
  "arxiv_id": null,
  "arxiv_version_reviewed": null,
  "authors": [
    "Chunlin Wang",
    "Yicheng Yang",
    "Yuan Zhang",
    "Haoyu Xiao",
    "Yifan Zhang",
    "Jiarun Dai"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-khost.bib",
  "citation": {
    "container_title": "35th USENIX Security Symposium (USENIX Security 26)",
    "pages": "573-592",
    "publisher": "USENIX Association",
    "sources": [
      "https://www.usenix.org/conference/usenixsecurity26/presentation/wang-chunlin"
    ]
  },
  "code_url": "https://github.com/seclab-fudan/Khost",
  "date_basis": "Publication month in the official USENIX proceedings BibTeX.",
  "date_basis_zh": "采用 USENIX 官方会议录 BibTeX 的出版月份。",
  "date_precision": "month",
  "description_en": "Extends KVM with MCU instruction handling, memory mapping and interrupt modeling to rehost firmware on ARMv8-A hosts. An MMIO monitor and firmware wrapper support peripheral interaction and coverage-guided testing.",
  "description_zh": "扩展 KVM 的 MCU 指令处理、内存映射及中断建模，在 ARMv8-A 主机上重托管固件；MMIO 监控器与固件包装层支持外设交互及覆盖率引导测试。",
  "doi": null,
  "entry_url": "https://awesomerea.org/papers/paper-khost/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-khost/",
  "evidence_urls": [
    "https://www.usenix.org/conference/usenixsecurity26/presentation/wang-chunlin",
    "https://www.usenix.org/system/files/usenixsecurity26-wang-chunlin.pdf",
    "https://github.com/seclab-fudan/Khost/blob/7f47e429b8ce53b300b9be5074f1956a418238ab/README.md",
    "https://github.com/seclab-fudan/Khost/blob/7f47e429b8ce53b300b9be5074f1956a418238ab/LICENSE",
    "https://zenodo.org/api/records/18195819"
  ],
  "first_arxiv_date": null,
  "id": "paper-khost",
  "json_url": "https://awesomerea.org/papers/paper-khost/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-khost/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-khost/index.md",
  "metadata_notes": "Official proceedings give August 2026, pages 573–592. Reviewed pinned README and Apache-2.0 root license; dependencies and firmware licensing are separate. The paper-linked Zenodo v1.02 metadata declares CC BY 4.0 and lists a 65.7 MB archive.",
  "metadata_notes_zh": "官方会议录列出 2026 年 8 月及 573–592 页。已读固定 README 与 Apache-2.0 根许可证，依赖及固件许可另计。论文所链 Zenodo v1.02 元数据声明 CC BY 4.0，并列出 65.7 MB 归档。",
  "pdf_url": "https://www.usenix.org/system/files/usenixsecurity26-wang-chunlin.pdf",
  "project_url": "https://zenodo.org/records/18195819",
  "publication_date": "2026-08",
  "publication_status": "conference-paper",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "The prototype needs ARMv8-A with 32-bit compatibility and EL2 virtualization. Some coprocessor operations need added emulation, and entry-point or basic-block recovery can require manual correction. Peripheral approximations can cause false positives; evaluation covers two benchmarks and 12 firmware images, not arbitrary devices.",
  "scope_limitations_zh": "原型需要支持 32 位兼容和 EL2 虚拟化的 ARMv8-A。部分协处理器操作需补充模拟，入口或基本块恢复可能需要人工修正。外设近似可能造成误报；评测覆盖两个基准及 12 个固件镜像，并非任意设备。",
  "targets": [
    "firmware",
    "binary"
  ],
  "title": "Khost: KVM-based Near Native MCU Firmware Rehosting",
  "title_zh": "Khost：基于 KVM 的近原生 MCU 固件重托管",
  "url": "https://www.usenix.org/conference/usenixsecurity26/presentation/wang-chunlin",
  "venue": "USENIX Security '26",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20",
  "why_fits_en": "Adds a concrete firmware execution-recovery substrate and its architecture constraints.",
  "why_fits_zh": "补充固件执行环境恢复的具体基础设施及架构限制。",
  "year": 2026
}