MetaEmu: An Architecture Agnostic Rehosting Framework for Automotive Firmware
Zitai Chen, Sam L. Thomas, Flavio D. Garcia

TL;DR
MetaEmu is a versatile, architecture-agnostic emulator synthesizer that enables rehosting and security analysis of automotive firmware across multiple architectures, overcoming limitations of existing tools.
Contribution
It introduces a generic VXE synthesis approach from Ghidra definitions and supports multi-architecture rehosting with inter-device analysis, enhancing flexibility and extensibility.
Findings
Successfully emulated five different architectures.
Enabled diverse analyses including fuzzing and symbolic execution.
Achieved performance comparable to existing emulators.
Abstract
In this paper we present MetaEmu, an architecture-agnostic emulator synthesizer geared towards rehosting and security analysis of automotive firmware. MetaEmu improves over existing rehosting environments in two ways: Firstly, it solves the hitherto open-problem of a lack of generic Virtual Execution Environments (VXEs) for rehosting by synthesizing processor simulators from Ghidra's language definitions. In doing so, MetaEmu can simulate any processor supported by a vast and growing library of open-source definitions. In MetaEmu, we use a specification-based approach to cover peripherals, execution models, and analyses, which allows our framework to be easily extended. Secondly, MetaEmu can rehost and analyze multiple targets, each of different architecture, simultaneously, and share analysis facts between each target's analysis environment, a technique we call inter-device analysis.…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsReal-Time Systems Scheduling · Security and Verification in Computing · Embedded Systems Design Techniques
