Towards Rehosting Embedded Applications as Linux Applications

Dynamic analysis of embedded firmware is a necessary capability for many security tasks, e.g., vulnerability detection. Rehosting is a technique that enables dynamic analysis by facilitating the execution of firmware in a host environment decoupled from the actual hardware. Current rehosting techniques focus on high-fidelity execution of the entire firmware. Consequently, these techniques try to execute firmware in an emulated environment, with precise models of hardware (i.e., peripheral) interactions. However, these techniques are hard to scale and have various drawbacks.We propose a novel take on rehosting by focusing on the application components and their interactions with the firmware without the need to model hardware dependencies. We achieve this by rehosting the embedded application as a Linux application. In addition to avoiding precise peripheral modeling, our rehosting technique enables the use of existing dynamic analysis techniques on these embedded applications. We provide an overview of our approach and demonstrate its feasibility on three real-world embedded applications. Our testing of these rehosted applications found 2 previously unknown defects in driver components. We discuss challenges in automating our process and present possible future research directions.