{
  "added_at": "2026-10-17",
  "arxiv_id": null,
  "arxiv_version_reviewed": null,
  "authors": [
    "Andrew Fasano",
    "Zachary Estrada",
    "Luke Craig",
    "Ben Levy",
    "Jordan McLeod",
    "Jacques Becker",
    "Caden Kline",
    "Elysia Witham",
    "Cole DiLorenzo",
    "Ali Bobi",
    "Dinko Dermendzhiev",
    "Tim Leek",
    "Wil Robertson"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-penguin.bib",
  "code_url": "https://github.com/rehosting/penguin",
  "date_basis": "The Internet Society’s Crossref deposit gives publication year 2025. The PDF footer names the 28 February 2025 workshop; no finer publication date is asserted from the event date.",
  "date_basis_zh": "Internet Society 向 Crossref 提交的元数据给出出版年份 2025。PDF 页脚标注研讨会于 2025 年 2 月 28 日举行；不据此推定更精确的出版日期。",
  "date_precision": "year",
  "description_en": "Penguin rehosts embedded Linux firmware from an extracted filesystem by deriving an editable configuration of emulation transformations, such as file changes, pseudofiles, NVRAM values and network interfaces, from static analysis. Dynamic-analysis plugins expose failures so the configuration can be refined for each target, and a minimizer identifies which transformations a working rehosting needs.",
  "description_zh": "Penguin 以提取出的固件文件系统为输入，通过静态分析生成可编辑的仿真变换配置（如文件修改、伪文件、NVRAM 值和网络接口），用于重托管嵌入式 Linux 固件。动态分析插件揭示运行失败，便于针对具体目标完善配置；配置最小化工具则找出可用的重托管所必需的变换。",
  "doi": "10.14722/bar.2025.23010",
  "entry_url": "https://awesomerea.org/papers/paper-penguin/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-penguin/",
  "evidence_urls": [
    "https://www.ndss-symposium.org/ndss-paper/auto-draft-634/",
    "https://www.ndss-symposium.org/wp-content/uploads/bar2025-final10.pdf",
    "https://doi.org/10.14722/bar.2025.23010",
    "https://api.crossref.org/works/10.14722/bar.2025.23010",
    "https://www.ndss-symposium.org/ndss-program/bar-2025/",
    "https://github.com/rehosting/penguin/blob/b645cd23852a41781181a651779b82a48c0c3fd3/README.md",
    "https://github.com/rehosting/penguin/blob/b645cd23852a41781181a651779b82a48c0c3fd3/LICENSE",
    "https://github.com/rehosting/penguin/releases/tag/v3.1.21"
  ],
  "first_arxiv_date": null,
  "id": "paper-penguin",
  "json_url": "https://awesomerea.org/papers/paper-penguin/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-penguin/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-penguin/index.md",
  "metadata_notes": "BAR 2025 is a workshop co-located with NDSS Symposium 2025, not the NDSS main track. The 13-author order and the name ‘Wil Robertson’ follow the PDF and the Internet Society’s Crossref deposit; the NDSS paper and program pages list ‘William Robertson’ and place Caden Kline after Cole DiLorenzo. The DOI resolves directly to the PDF, whose footer gives ISBN 979-8-9919276-4-2; no page range was verified. The conclusion says 13,650 images where the abstract and appendix say 13,649. The PDF’s availability section points to rehosting/penguin but names no evaluated release; the curated tool record reviews v3.1.21 (2026-10-06), which postdates the paper. The repository is GPL-2.0-or-later at the pinned commit, and the paper does not describe its firmware corpus as released.",
  "metadata_notes_zh": "BAR 2025 是与 NDSS Symposium 2025 同期举办的研讨会，并非 NDSS 主会。13 位作者的顺序及“Wil Robertson”的写法以 PDF 和 Internet Society 向 Crossref 提交的元数据为准；NDSS 论文页和日程页写作“William Robertson”，并将 Caden Kline 排在 Cole DiLorenzo 之后。该 DOI 直接解析到 PDF，PDF 页脚标注 ISBN 979-8-9919276-4-2；未核实页码范围。论文结论写作 13,650 个镜像，摘要和附录则为 13,649 个。PDF 的“可用性”一节指向 rehosting/penguin 仓库，但未注明评测所用版本；精选工具条目审阅的 v3.1.21（2026-10-06）晚于论文发表。固定提交中的仓库采用 GPL-2.0-or-later，论文也未说明公开其固件语料。",
  "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/bar2025-final10.pdf",
  "project_url": null,
  "publication_date": null,
  "publication_status": "conference-paper",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "Targets embedded Linux firmware through whole-system emulation with kernel replacement, as in Firmadyne and FirmAE; the implementation covers x86, ARM and MIPS and relies on the Linux syscall ABI. In the FirmAE comparison, success means a process binds port 80 or 443; a non-empty HTTP response is a stricter check, and the authors note neither shows full functionality. The 75% gain over FirmAE is author-reported on their own corpus of 13,649 images from vendor websites. Refinement still needs an analyst, and nondeterministic runs were repeated up to ten times. It builds an analysis environment, not a faithful device reproduction or source recovery.",
  "scope_limitations_zh": "面向嵌入式 Linux 固件，沿用 Firmadyne 和 FirmAE 的思路，采用替换内核的整机仿真；实现支持 x86、ARM 和 MIPS，并依赖 Linux 系统调用 ABI。与 FirmAE 对比时，判定成功的标准是有进程绑定 80 或 443 端口，更严格的检查是 HTTP 返回非空响应；作者指出两者都不代表系统功能完整。比 FirmAE 多出 75% 的结果由作者在其自建语料（13,649 个取自厂商网站的镜像）上报告。完善配置仍需分析人员参与；运行结果不完全确定，作者对配置最多重复运行十次。该工作构建的是分析环境，不代表忠实复现设备或恢复源代码。",
  "targets": [
    "firmware"
  ],
  "title": "Target-Centric Firmware Rehosting with Penguin",
  "title_zh": "使用 Penguin 进行以目标为中心的固件重托管",
  "url": "https://www.ndss-symposium.org/ndss-paper/auto-draft-634/",
  "venue": "Workshop on Binary Analysis Research (BAR) 2025",
  "verification": "source-reviewed",
  "verified_at": "2026-10-17",
  "why_fits_en": "Makes firmware rehosting an explicit, shareable per-target configuration refined from runtime evidence, a reproducible way to rebuild an analyzable execution environment without the original hardware.",
  "why_fits_zh": "将固件重托管表达为明确、可共享并针对具体目标的配置，依据运行时证据逐步完善，以可复现的方式在脱离原始硬件的条件下重建可分析的执行环境。",
  "year": 2025
}