AI 中文总结
研究针对物联网固件重新托管管道脆弱问题，提出证据引导多智能体框架FirmPilot，通过迭代环境重建解决跨层依赖，经实验验证其能提升可达性、增加检测服务数并支持下游分析，提高了固件重新托管的成功率和效用。
AI 中文摘要
固件重新托管在诸如QEMU等模拟环境中执行固件镜像，以实现对物联网设备的可扩展动态分析。但在实际中，重新托管管道在面对各种现实世界固件镜像时仍然脆弱，因为达到外部可观察的执行状态依赖于紧密耦合的工件，包括启动脚本、持久配置和网络设置。模板驱动框架常无法适应长尾供应商惯例，而无约束使用大语言模型存在风险。我们引入了FirmPilot，一个用于固件重新托管中环境恢复的证据引导多智能体框架。它将重新托管重新表述为迭代环境重建，通过基于相似性检索的搜索智能体、协调执行接受转换的规划智能体以及恢复文件系统/初始化工件、持久状态和网络暴露的专门智能体。在大规模真实世界的LFwC固件语料库上评估，FirmPilot提高了网络服务可达性和网络可达性，增加了每个固件检测到的服务平均数量，并支持下游分析工作流程。评估表明，基于证据和反馈的智能体协调提高了自动固件重新托管中的重新托管成功率、服务恢复和下游效用。
英文摘要
Firmware rehosting executes firmware images in emulated environments such as QEMU to enable scalable dynamic analysis of Internet of Things (IoT) devices. In practice, rehosting pipelines remain fragile across diverse real-world firmware images, as reaching an externally observable execution state depends on tightly coupled artifacts spanning boot scripts, persistent configuration (e.g., NVRAM-like key-value state), and network setup. Template-driven frameworks often fail to accommodate long-tail vendor conventions, while unconstrained use of large language models (LLMs) risks unsupported modifications and irreproducible executions. We introduce FirmPilot, an evidence-guided multi-agent framework for environment recovery in firmware rehosting. FirmPilot reformulates rehosting as iterative environment reconstruction in which a search agent grounds decisions through similarity-based retrieval, a planner coordinates execution-accepted transitions, and specialized agents recover filesystem/init artifacts, persistent state, and network exposure. Through repeated execution and evidence-grounded artifact deltas, the system resolves cross-layer dependencies across boot, state, and networking that otherwise prevent firmware executions from reaching a stable, externally reachable state in emulation. Evaluated on the large-scale, real-world LFwC firmware corpus, FirmPilot improves web-service reachability over FirmAE from 25.49% to 52.39% and network reachability from 39.30% to 71.93%. The resulting rehosts raise the average number of detected services per firmware from 0.86 to 1.62 and support downstream analysis workflows, including RouterSploit interaction and protocol-aware fuzzing over recovered service surfaces. The evaluation shows that evidence- and feedback-grounded agent coordination improves rehosting success, service recovery, and downstream utility in automated firmware rehosting.
Comments11 pages, 10 figures, 7 tables
