With the rapid proliferation of IoT devices, our cyberspace is nowadays dominated by billions of low-cost computing nodes, which expose an unprecedented heterogeneity to our computing systems. Dynamic analysis, one of the most effective approaches to finding software bugs, has become paralyzed due to the lack of a generic emulator capable of running diverse previously-unseen firmware. In recent years, we have witnessed devastating security breaches targeting IoT devices. These security concerns have significantly hamstrung further evolution of IoT technology. In this work, we present Laelaps, a device emulator specifically designed to run diverse software on low-cost IoT devices. We do not encode into our emulator any specific information about a device. Instead, Laelaps infers the expected behavior of firmware via symbolic-execution-assisted peripheral emulation and generates proper inputs to steer concrete execution on the fly. This unique design feature makes Laelaps the first generic device emulator capable of running diverse firmware with no a priori knowledge about the target device. To demonstrate the capabilities of Laelaps, we deployed two popular dynamic analysis techniques---fuzzing testing and dynamic symbolic execution---on top of our emulator. We successfully identified both self-injected and real-world vulnerabilities. Software-based emulation techniques [1] have demonstrated their pivotal roles in dynamically analyzing binary code. Running a program inside an emulator allows analysts to gain semantically insightful run-time information (e.g., execution path and stack layout) and even dynamically instrument the binaries [2] [3] [4] [5] . However, none of these capabilities have been utilized to analyze firmware of low-end embedded devices such as microcontrollers. A major obstacle of utilizing existing analysis capabilities is the absence of a versatile deviceagnostic software-based emulator that could execute arbitrary firmware of different devices. To implement such an emulator, it has to deal with the vast diversity of microcontroller firmware in terms of hardware architecture (e.g., x86, ARM, MIPS, etc), integrated feature (e.g., network function, DSP, etc.), and the underlying operating system (e.g., bare-metal, Linux, FreeRTOS, etc.). Customizing the emulator for every kind of equipment is nearly impossible. The vast diversity design dates back to the System-on-Chip (SoC) design methodology of embedded systems, where a single integrated circuit (IC) integrates all components of a computer, including processor, memory, and other hardware logics that interface with a bunch of peripherals. Furthermore, in order to make their products most competitive, manufacturers tend to integrate more and more custom-made functions in peripherals. For example, the NXP FRDM-K66F chip incorporates more than 50 different peripherals [6] . If we zoom in a very simple peripheral -the Universal Asynchronous Receiver/-Transmitter (UART) interface, it is controlled by 40 individual registers, let alone other complex peripherals such as Network Interface Controller (NIC). Dynamically analyzing embedded firmware has been studied for a while. Unfortunately, existing solutions are far from mature in many ways. They are either adhoc, designed for a specific operating system, or they must be tightly coupled with real devices. Implementing a generic emulator that deals with different peripherals has to put tremendous efforts. Therefore, existing work [7] [8] [9] [10] [11] forwards peripheral signals to real devices and run the rest of firmware in an emulator. In this way, analysts could execute the firmware and inspect into the inner state of firmware execution. However, this approach is not affordable for testing large-scale firmware images because for every firmware image a real device is needed. Besides, frequent rebooting of the device and signal forwarding are time-consuming. A recent work advances this research direction by modeling the interactions between the original hardware and the firmware [12] . This enables the virtualized execution of any piece of firmware possible without writing a specific back-end peripheral emulator for the hardware. However, this approach still requires the real hardware to "learn" the peripheral interaction model. Previous work also explores ways to emulate Linuxbased firmware [13, 14] . FIRMADYNE [13] extracts the file system of the firmware and mounts it with a generic kernel executed in QEMU [15] . FIRM-AFL [14] further proposes a grey-box fuzzing mechanism. However, both of them only work for Linux-based embedded firmware, while a large number of real-world embedded systems run on microcontrollers wich only support lightweight RTOS or bare-metal systems. In this work, we demonstrate that the obstacles of device-agnostic firmware execution are not insurmountable. We present Laelaps, 1 a generic emulator for ARM Cortex-M based microcontroller units (MCUs). Instead of implementing peripheral logic for every device, we leverage symbolic execution and satisfiability modulo theories (SMT) [16] to reason about the expected inputs from peripherals and feed them to the being-emulated firmware on the fly. Therefore, our approach aims to achieve the ambitious goal of executing non-Linux firmware without relying on real devices. The design of Laelaps combines concrete execution and symbolic execution. Concrete execution runs in a full system emulator, QEMU [15] , to provide the inner state of execution for dynamic analysis. However, the state-of-the-art whole system emulators cannot emulate previously-unseen peripherals. If the firmware accesses unimplemented peripherals, the emulation will become paralyzed. Symbolic execution then kicks in to find a proper input for the current peripheral access operation and guides firmware execution. We found that symbolic execution is particularly good at inferring peripheral inputs, because many of them are used in logical or arithmetical calculations to decide a branch target. In general, Laelaps's concrete execution will be stuck when accessing an unknown peripheral, and then it switches to the symbolic execution to find proper inputs that can guide QEMU to a path that is most likely to be identical with a real execution. One significant practical challenge for automatic test generation is how to effectively explore program paths. Various search heuristics have been proposed to mitigate the path explosion problem in PC software [17] [18] [19] . However, peripherals reveal many distinct features that require special treatment, such as very common infinite loops and interrupt requests. At the heart of our technique is a tunable path selection strategy, called Context Preserving Scanning Algorithm, or CPSA for short. CPSA contains a set of peripheral-specific heuristics to prune the search space and find the most promising path. Peripherals also interact with the firmware through interrupts. In fact, embedded systems are largely driven by interrupts. QEMU has built-in support for interrupt delivering, but it has no knowledge with regard to when to assert an interrupt-this logic should be implemented by periph-1 "Laelaps" was a Greek mythological dog who never failed to hunt his prey. So, in a metaphorical sense, here we use this term to represent the potential versatility of our proposed solution. erals. We address this issue by periodically raising interrupts which have been activated by the firmware. Although our solution may not strictly follow the designed logic, we demonstrate that it is able to properly initialize the execution context for dynamically analyzing the firmware in practice. We have developed Laelaps on top of angr [20] and QEMU [15] . Our prototype focuses on ARM Cortex-M MCUs, which dominate the low-end embedded device market, but the design of Laelaps is applicable to other architectures as well. We evaluate Laelaps by running 30 firmware images built for 4 development boards. The tested firmware spans a wide spectrum of sophistication, including simple synthetic programs as well as real-world IoT programs running FreeRTOS OS [21] . We admit that a small portion of peripheral read operations (e.g., receiving network packets) still need necessary human inputs, nevertheless Laelaps takes a step towards scalable, dynamic IoT firmware analysis. It enables existing dynamic analysis techniques to become directly applicable to analyzing embedded firmware. In particular, 1) our tool makes firmware fuzzing more efficient; this is because after instrumenting the QEMU with heuristics about symptoms of crashes, firmware corruptions can be easily captured [22] ; 2) our tool assists dynamic symbolic execution; with a properly initialized context, symbolic execution can be constrained and thus avoids symbolizing too many variables; 3) analysts can interactively debug the firmware using debuggers such as GDB; 4) the fully initialized device state can be saved as a snapshot for future replayable analysis. Note that we complete all of these dynamic analysis tasks without purchasing any real device or using any proprietary emulators that specifically work for certain devices. In summary, our work makes the following main contributions: • We abstract the system model of ARM Cortex-M based embedded microcontroller devices and distill the missing but essential parts for full system emulation of those devices. • We fill the missing parts of full system device emulation by designing a symbolically-guided emulator, which is capable of running diverse firmware for ARM MCUs with unknown peripherals. • We demonstrate the potential of Laelaps by using it in combination with advanced dynamic analysis tools, including boofuzz [23] , angr [20] , and PANDA [24] . We show that the full emulation environment provided by Laelaps facilitates the execution of these advanced (forms of) dynamic analysis, which enables us to identify both selfinjected and real-world bugs. Laelaps is open source at (URL omitted for doubleblind reviewing). We also release the corresponding demonstration firmware samples analyzed in our experiments. We present Laelaps, a device-agnostic emulator for ARM microcontroller. The high-level idea is to leverage concolic execution to generate proper peripheral inputs to steer device emulator on the fly. Dynamic symbolic execution is a perfect fit for this task based on our observations and experimental validations. To find a right input, the key is to identify the most promising branch. We designed a path selection algorithm based on a set of generally applicable heuristics. We have implemented this idea on top of QEMU and angr, and have conducted extensive experiments. Of all the collected 30 firmware images from different manufacturers, we found that our prototype can successfully boot 20 of them without any human intervention. We also tested fuzzing testing and symbolic execution on top of Laelaps. The results showed that Laelaps is able to correctly boot the system into an analyzable state. As a result, Laelaps can identify both self-injected and real-world bugs. Although our prototype only works for ARM Cortex-M based devices, our design is general. In the future, we plan to extend our prototype to support a border spectrum of devices including ARM Cortex-A and MIPS devices. When transferring processor state from QEMU to angr, we found that the PC register always points to the start of the current translated block, instead of the real PC. We borrow the code from PANDA [24] to address this problem. In particular, we injected into the intermediate language some instructions so that the PC can be updated together with each translated guest instruction.
Device-agnostic Firmware Execution