Linux Firmware Rehosting.

We are surrounded by devices that are functioning computers connected to networks, known popularly as the 'Internet of Things' (IoT). Those embedded devices are projected to grow to more than 40 billion in number by 2030 [1]. Unfortunately, embedded devices have continued to be riddled with software vulnerabilities that have been exploited by bad actors. One reason for this is that the current tooling for finding bugs in traditional software is not compatible with embedded devices.

One approach to that bug finding challenge is firmware rehosting, the process of taking firmware images and making them run in an emulated environment. This allows security researchers to analyze the firmware in a controlled environment, without needing access to the physical device. In this dojo, we will explore the basics of Linux firmware rehosting with the penguin rehosting framework [2,3]. You'll learn the fundamentals of how to set up a rehosting environment, troubleshoot common issues, and analyze firmware under execution.

[1] https://iot-analytics.com/number-connected-iot-devices/

[2] https://github.com/rehosting/penguin

[3] https://www.ndss-symposium.org/wp-content/uploads/bar2025-final10.pdf

Chat

https://discord.com/channels/750635557666816031/1409929735135563877

Acknowledgements

DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.

This material is based upon work supported under Air Force Contract No. FA8702-15-D-0001 or FA8702-25-D-B002. Any opinions, findings, conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S. Air Force.

The software/firmware is provided to you on an As-Is basis.

Delivered to the U.S. Government with Unlimited Rights, as defined in DFARS Part 252.227-7013 or 7014 (Feb 2014). Notwithstanding any copyright notice, U.S. Government rights in this work are defined by DFARS 252.227-7013 or DFARS 252.227-7014 as detailed above. Use of this work other than as specifically authorized by the U.S. Government may violate any copyrights that exist in this work.