ControlPuc v0: A HID Injection Framework with RP2350

Improvement for Embedded Firmware Emulation Applying FirmAE

Firmware emulation is a key technique for enabling large-scale security analysis of IoT devices and sensing systems without requiring physical hardware. However, existing emulation frameworks often suffer from instability and low success rates owing to mismatches between real device execution environments and virtualized systems, particularly across heterogeneous firmware with different initialization and runtime dependencies. In this study, we investigate failure behaviors in FirmAE, a widely used IoT firmware emulation framework, and identify recurring issues in Boot, Kernel, Network, and nonvolatile random access memory (NVRAM) execution stages. On the basis of this analysis, we propose a set of rule-based improvement strategies that refine boot configurations, Quick Emulator (QEMU) execution parameters, network settings, and NVRAM handling mechanisms to improve emulation stability across diverse firmware types. The main limitation of existing approaches is their reliance on heuristic and incomplete device-specific handling, which reduces robustness when applied to unseen firmware. The proposed method addresses this issue by systematizing failure patterns into actionable repair rules, enabling more consistent emulation behavior. Although the proposed method improves emulation robustness, one limitation of this study is that part of the proposed repair process still depends on manual inspection of firmware logs and runtime behavior, which may limit scalability in fully automated large-scale deployment scenarios. Experimental results on real-world firmware images collected from multiple vendors and architectures demonstrate that the proposed approach improves emulation robustness and enhances the ability to successfully execute previously failing firmware instances, supporting more reliable IoT firmware security analysis

Firmware Reverse Engineering: A Comprehensive Review and Directions

Firmware forms the persistent software layer controlling embedded and Internet-of-Things (IoT) devices, industrial controllers, automotive systems, and cyber-physical infrastructure. Vulnerabilities in firmware enable remote compromise, supply-chain attacks, and long-lived implants that survive operating-system reinstallation. This review synthesises 118 works published from 2014 to 2026—comprising 78 primary research studies; 23 surveys and systematisations of knowledge; and 17 benchmarks, tools, and background references—covering the full firmware reverse engineering (FRE) pipeline: physical acquisition (including fault injection and side-channel extraction), format analysis and unpacking, static analysis (binary code similarity detection, protocol reverse engineering, and patch diffing), dynamic analysis and hardware emulation, fuzzing-based vulnerability discovery, and artificial intelligence (AI) and large language model (LLM)-assisted analysis. Three additional dimensions are surveyed: digital twin-assisted firmware security testing; secure boot, trusted execution environment (TEE), and over-the-air (OTA) update security; and firmware rootkit and implant detection. Coverage spans two axes—the firmware class (Linux-based IoT, microcontroller-unit bare-metal, RTOS, UEFI/BIOS, PLC/ICS, and automotive ECU) and analysis depth (surface scanning to exploit-validated vulnerability chains). We identify ten structural gaps, including the absence of unified evaluation benchmarks, fragmented peripheral modelling, the scalability–fidelity trade-off in re-hosting, and insufficient grounding of LLM tools in firmware-specific realities. We conclude with six research directions for trustworthy, scalable, and infrastructure-aware firmware analysis.

A Lightweight Emulation Infrastructure for Behavioral Threat Modeling using MITRE ATT&CK ⋆

CROSS-TEE: A Distributed Trusted Execution Environment Architecture for Cross-Module Automotive Security

The rapid development of intelligent, connected, and electrified automotive technologies has significantly enhanced convenience, driving substantial growth in the intelligent connected vehicle (ICV) market, and accelerating the replacement of traditional fuel-powered vehicles. However, these advancements have introduced new attack surfaces, giving rise to emerging security threats such as malicious injection attacks on the controller area network (CAN) bus and eavesdropping attacks on in-vehicle Ethernet communications. Existing security solutions face limitations such as lack of holistic defense, insufficient application isolation, absence of security checks for CAN bus invocation requests, and plaintext Ethernet data transmission, which undermine ICV security. To address these problems, we propose CROSS-TEE, the first cross-module distributed customizable trusted execution environment (TEE) architecture designed to manage the interaction between different system modules (e.g., domain controller, central gateway, etc.) in vehicles. CROSS-TEE consists of two levels: one type of Level-1 TEE and three types of Level-2 TEEs, tailored to different application and security requirements. We design a trusted house mechanism to isolate trusted applications (TAs) and a pre-transmission protocol to enable secure data transmission. CROSS-TEE only allows direct CAN bus invocation requests from TAs, while requiring similar requests from applications in the normal world to pass security checks by either secure monitor (SM) or trusted operating system (OS) before approving them. The prototype of CROSS-TEE is built using Renesas RA6M5 and Raspberry Pi 3 Model B development boards. Experimental results demonstrate the effectiveness of CROSS-TEE’s security mechanisms against remote attacks (e.g., arbitrary CAN bus message injections, unauthorized invocations of security-critical applications, and malicious access to in-vehicle Ethernet networks), with average time overheads of approximately 7.8% for CAN bus communication and $1.73\times $ for encrypted Ethernet communication, indicating an acceptable security-performance trade-off.

eFPGA-Enabled Dynamic Access Control for Secure IEEE 1687 (IJTAG) Networks

Modern System on Chip (SoC) designs integrate numerous embedded instruments for testing, debugging, postsilicon validation, and in-field monitoring. The IEEE 1687 (IJTAG) standard provides scalable access through a reconfigurable scan network of Segment Insertion Bits (SIBs), but this flexibility exposes internal resources to unauthorized access through the test infrastructure. Existing protection approaches rely on fixed hardware mechanisms, limiting adaptability across device lifecycle phases. This work proposes a secure IJTAG architecture integrating an eFPGA between the TAP and the IJTAG network as a reconfigurable security layer that controls instrument cluster connectivity through authenticated configuration, enabling lifecycle-aware isolation while preserving IJTAG flexibility. The architecture is evaluated on IJTAG benchmark networks to assess scalability.

A Bridged Sandbox–Honeypot Architecture for Behavioral Analysis of ICS Malware

: The convergence of IT and OT networks has exposed Industrial Control Systems (ICS) to targeted malware that abuses industrial protocols. Standalone sandboxes lack the industrial context required to activate OT-specific payloads, whereas honeypots alone cannot safely execute untrusted binaries. This paper presents an integrated architecture that combines a Cuckoo3 sandbox with a programmable high-interaction honeypot (Honeybus, an extension of LOGistICS, a medium-interaction OT honeypot for Modbus and S7comm) and a forensic visualization tool (ViewMod). We validate the architecture by executing FrostyGoop, a Modbus-based ICS malware, against a simulated water-supply control system. The current evaluation focuses on Modbus and a single malware family. Performance benchmarking, systematic evasion testing, and comparison with other honeypots are explicitly identified as future work.