# IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit
## 4 State-of-the-Art Firmware Emulation and Its Application in Fuzzing
### Solutions to Peripheral Interaction Support
#### 4.2.2 Peripheral Interaction Modeling  
To emulate diverse peripheral hardware with minimal manual effort, existing research proposes various automatic peripheral interaction modeling methods. **Hardware Record-based method. **_Pretender_[25] enhances hardware-in-the-loop solutions for full-system emulation by recording real hardware feedback and using machine learning to create peripheral emulation models. However, _Pretender_ still needs the same hardware as the firmware, which is often hard to access for practical firmware analysis. Similarly, _Conware_[26] relies on hardware peripheral operation logs to build peripheral models. **Human Heuristic-based method. **_P\({}^{2}\)IM_[27] introduces the first hardware-independent automated method for creating peripheral emulation models. It infers peripheral register types from firmware peripheral access patterns and establishes feedback models based on these types. While effective for simple interactions, its reliance on human assumptions limits its success with complex peripherals. _DICE_[28] uses a similar approach by modeling DMA access patterns to automate DMA emulation models, supporting firmware emulation with DMA-based peripherals. However, it is also constrained by human assumptions, making it unsuitable for complex devices like Ethernet and USB DMA. _FirmWire_[29] offers human-crafted peripheral models for baseband firmware. **Symbolic Constraints-based method. ** Peripheral modeling using symbolic contrarians is a common approach in current emulation solutions to address the limitations of human heuristics-based approach. _Laelaps_[30] uses symbolic execution to handle unknown peripheral reads by returning symbolic values and exploring program paths. However, it requires continuous symbolic execution, leading to high overhead. To address this, \(\mu Emu\)[31] automatically determines execution paths by analyzing execution states. It uses symbolic execution to learn path constraints on valid execution state and create a peripheral feedback knowledge base, which is used during dynamic execution, eliminating the need for continuous symbolic execution and reducing overhead. _Jetset_[32] employs a search strategy with incremental control flow graphs to guide symbolic execution for firmware execution, similar to \(\mu Emu\). _Fuzzware_[33] pinpoints models based on single or few path constraints for overly restricting reachable paths. It uses symbolic execution to generate broad peripheral feedback constraints, allowing more mutations during fuzz testing to explore additional paths. This increases code coverage compared to previous models but also results in more false positives than real hardware. Note that continuous symbolic execution for peripheral input can lead to path explosion and high overhead, so current solutions use local symbolic execution within functions handling peripheral input without exploring all paths. **Fuzzing Feedback-based method. **_Ember-IO_[34] introduces a feedback peripheral access method using a fuzz testing feedback scheme. Instead of generating complete peripheral models, it generates all hardware inputs through fuzz testing, caching only those valuesthat achieve higher code coverage to accelerate execution. This method increases code coverage quickly but also results in more false positives and negatives. **External Information-based method. ** In 2022, [PERSON] et al. [35] noted that previous methods for generating peripheral models relied solely on firmware, which lacks complete peripheral logic, such as interrupt timing. This limitation leads to false positives in firmware-oriented peripheral modeling. To enhance the accuracy of peripheral emulation models without hardware reliance, they introduced \(SEmu\). \(SEmu\) uses natural language processing (NLP) to learn peripheral behavior from hardware manuals, converting this information into structured conditional-action rules.