Search papers, labs, and topics across Lattice.
FirmCure introduces an LLM-driven framework for the autonomous and adaptive rehosting of Linux-based firmware, addressing the limitations of existing methods that require expert intervention due to initialization and runtime challenges. By employing an Adaptive Perception Inference mechanism for static analysis, a Reflective Synthesis module for configuration optimization, and an Autonomous Runtime Intervention module for real-time error remediation, FirmCure significantly enhances rehosting efficiency. Evaluations on 21 IoT firmware images demonstrated a 100% network port opening rate and 90.5% service interactivity, outperforming existing solutions and revealing both known and new security vulnerabilities.
Achieving a 100% network port opening rate, FirmCure revolutionizes the rehosting of Linux firmware by eliminating expert dependency and enhancing efficiency.
Full-system rehosting plays a critical role in the security analysis of Linux-based firmware. It matches commonly deployed firmware with sufficient background knowledge. However, for custom devices, existing approaches struggle to handle initialization and runtime obstacles in the rehosting process caused by specialized architectures and hardware-dependent configuration, which heavily rely on expert intervention. This ultimately creates fundamental bottlenecks and results in low rehosting efficiency. To address the above challenges, we propose FirmCure, the first LLM-driven full-system rehosting framework designed for autonomous and adaptive rehosting of Linux-based firmware. FirmCure develops an Adaptive Perception Inference mechanism to extract firmware structural dependencies via static analysis, followed by a Reflective Synthesis module for iterative configuration optimization, and finally an Autonomous Runtime Intervention module for real-time error remediation through runtime fault diagnosis and monitoring. We evaluated 21 IoT firmware images from 10 vendors across 5 architectures, while FirmCure achieved a 100% network port opening rate and 90.5% service interactivity, substantially outperforming state-of-the-art baselines. Our experiments confirm that FirmCure's intervention strategies generalize across heterogeneous firmware. The framework successfully reproduces known vulnerabilities and discovers new security flaws.
