An Automated Approach to Re-Hosting Embedded Firmware Through Removing Hardware Dependencies.
Austin Ketterer, Asha Shekar, Edgardo Barsallo Yi, Saurabh Bagchi, Abraham Anthony Clements · 2022
HALucinatorEnables replacing HALs and other libraries with high level implementations.This transforms the re-hosting scaling problem from supporting 10,000's of devices to dozens of HALs. Contributions of this Paper1. We aid high level emulation in deciding which functions to model.This enables one to partition a firmware such that it is decoupled from its hardware dependencies yet retains its core functionality.2. We provide a policy-driven approach for users to indicate what part of the emulation needs to be performed with fidelity and what parts can be skipped.3. We perform binary analysis on the firmware to determine the types of dependencies present and decide which need to be removed.4. We show that our approach enables high level emulation of various firmware from Atmel and STMicroelectronics using HALucinator. Key Intuition #1-This algorithm is based off of the idea that the firmware can be represented as a graph, where each node is a function and each edge is a call.-In this graph, if we can identify what nodes need to be removed, we can come up with the best way to remove them Functions to be replaced by proxies/models Key Intuition #2 -The difficulty to remove the node is not constant across nodes.-Some nodes are more complex, or have more data dependencies that escape their context.-This means we need both a Control Flow Graph (CFG) for functions and calls, and a Data Flow Graph (DFG) to look at data dependencies.Function to be replaced by proxies/models How difficult is it to model E?