# Target-Centric Firmware Rehosting with Penguin

> Penguin rehosts embedded Linux firmware from an extracted filesystem by deriving an editable configuration of emulation transformations, such as file changes, pseudofiles, NVRAM values and network interfaces, from static analysis. Dynamic-analysis plugins expose failures so the configuration can be refined for each target, and a minimizer identifies which transformations a working rehosting needs.

- Authors: Andrew Fasano; Zachary Estrada; Luke Craig; Ben Levy; Jordan McLeod; Jacques Becker; Caden Kline; Elysia Witham; Cole DiLorenzo; Ali Bobi; Dinko Dermendzhiev; Tim Leek; Wil Robertson
- Venue: Workshop on Binary Analysis Research (BAR) 2025
- Status: Conference paper
- Publication / posting date: 2025 (exact date not verified)
- Date source: The Internet Society’s Crossref deposit gives publication year 2025. The PDF footer names the 28 February 2025 workshop; no finer publication date is asserted from the event date.
- DOI: 10.14722/bar.2025.23010
- Sources reviewed: 2026-10-17
- Added to the catalog: 2026-10-17
- Original paper: <https://www.ndss-symposium.org/ndss-paper/auto-draft-634/>
- PDF: <https://www.ndss-symposium.org/wp-content/uploads/bar2025-final10.pdf>
- Code: <https://github.com/rehosting/penguin>
- BibTeX: <https://awesomerea.org/papers/citations/paper-penguin.bib>
- Catalog page: <https://awesomerea.org/papers/paper-penguin/>
- Record JSON: <https://awesomerea.org/papers/paper-penguin/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-penguin/index.md)

## Scope and limitations

Targets embedded Linux firmware through whole-system emulation with kernel replacement, as in Firmadyne and FirmAE; the implementation covers x86, ARM and MIPS and relies on the Linux syscall ABI. In the FirmAE comparison, success means a process binds port 80 or 443; a non-empty HTTP response is a stricter check, and the authors note neither shows full functionality. The 75% gain over FirmAE is author-reported on their own corpus of 13,649 images from vendor websites. Refinement still needs an analyst, and nondeterministic runs were repeated up to ten times. It builds an analysis environment, not a faithful device reproduction or source recovery.

## Why it fits this collection

Makes firmware rehosting an explicit, shareable per-target configuration refined from runtime evidence, a reproducible way to rebuild an analyzable execution environment without the original hardware.

## Publication and review notes

BAR 2025 is a workshop co-located with NDSS Symposium 2025, not the NDSS main track. The 13-author order and the name ‘Wil Robertson’ follow the PDF and the Internet Society’s Crossref deposit; the NDSS paper and program pages list ‘William Robertson’ and place Caden Kline after Cole DiLorenzo. The DOI resolves directly to the PDF, whose footer gives ISBN 979-8-9919276-4-2; no page range was verified. The conclusion says 13,650 images where the abstract and appendix say 13,649. The PDF’s availability section points to rehosting/penguin but names no evaluated release; the curated tool record reviews v3.1.21 (2026-10-06), which postdates the paper. The repository is GPL-2.0-or-later at the pinned commit, and the paper does not describe its firmware corpus as released.

## Primary sources

1. <https://www.ndss-symposium.org/ndss-paper/auto-draft-634/>
2. <https://www.ndss-symposium.org/wp-content/uploads/bar2025-final10.pdf>
3. <https://doi.org/10.14722/bar.2025.23010>
4. <https://api.crossref.org/works/10.14722/bar.2025.23010>
5. <https://www.ndss-symposium.org/ndss-program/bar-2025/>
6. <https://github.com/rehosting/penguin/blob/b645cd23852a41781181a651779b82a48c0c3fd3/README.md>
7. <https://github.com/rehosting/penguin/blob/b645cd23852a41781181a651779b82a48c0c3fd3/LICENSE>
8. <https://github.com/rehosting/penguin/releases/tag/v3.1.21>

## Related entries

- [Penguin](https://awesomerea.org/resources/penguin/index.md) · Curated resource

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.