From Library Portability to Para-rehosting: Natively Executing Microcontroller Software on Commodity Hardware yzxkWenqiang Li∗, zLe Guan, {Jingqiang Lin, zJiameng Shi, kFengjun Li yState Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences zDepartment of Computer Science, the University of Georgia, USA xSchool of Cyber Security, University of Chinese Academy of Sciences {School of Cyber Security, University of Science and Technology of China kDepartment of Electrical Engineering and Computer Science, the University of Kansas, USA
[email protected], fleguan,
[email protected],
[email protected], fl
[email protected] Abstract—Finding bugs in microcontroller (MCU) firmware there will be more than 35 billion MCU shipments [6]. These is challenging, even for device manufacturers who own the small, resource-constraint devices are enabling ubiquitous con- source code. The MCU runs different instruction sets than x86 nections and have changed virtually every aspect of our lives. and exposes a very different development environment. This However, all of these benefits and conveniences come with invalidates many existing sophisticated software testing tools on broader and acute security concerns. IoT devices are connected x86. To maintain a unified developing and testing environment, into the Internet, which directly exposes them to attackers. a straightforward way is to re-compile the source code into the native executable for a commodity machine (called rehosting). Since these devices process and contain confidential data such However, ad-hoc re-hosting is a daunting and tedious task and as people’s health data, home surveillance video, company subject to many issues (library-dependence, kernel-dependence secrets, etc., once compromised, devastating consequences can and hardware-dependence).