## 2 Background
### Vulnerability Detection Methods in Embedded Devices  
In recent years, numerous efforts have been made to identify vulnerabilities in embedded devices. This section provides a detailed analysis of these methods, highlighting their strengths and weaknesses. Furthermore, we point out the shortcomings in the existing research. We use Table 1 to organize existing vulnerability detection literature. The \"Literature\" column records the abbreviation of the literature. The \"Dependence\" column indicates the conditions on which the work relies. The \"Technique\" column represents the core technology used in the work. The \"Purpose\" column indicates the research objectives of the work. The \"Target\" column records the objects analyzed in the work. \begin{table}
\begin{tabular}{c c c c c c c} \hline \multirow{2}{*}{**Category**} & \multirow{2}{*}{**Strategy**} & \multirow{2}{*}{**Literature**} & \multicolumn{2}{c}{**Dependence**} & \multirow{2}{*}{**Target**} & \multirow{2}{*}{**Technology**} & \multirow{2}{*}{**Purpose**} \\ \cline{3-4} \cline{6-7}  & & **Device** & & & & \\ \hline \multirow{8}{*}{Static analysis} & \multirow{8}{*}{KARONTE [11]} & \multirow{8}{*}{✓} & Binary & Multibinary & taint style \\  & & & program & interaction and & vulnerabilities (BOF / CI) \\ \cline{2-7}  & & & & in firmware & taint analysis & Sensitive \\ \cline{2-7}  & \multirow{2}{*}{SainT [18]} & \multirow{2}{*}{✓} & \multirow{2}{*}{✓} & IoT app & \multirow{2}{*}{Taint analysis} & Sensitive \\  & & & & information leak & information \\ \hline \multirow{8}{*}{Static analysis} & \multirow{8}{*}{Taint analysis-method} & \multirow{8}{*}{✓} & Binary & \multirow{2}{*}{Taint analysis} & Taint-style \\  & & & program & & (BOF / CI) \\ \cline{2-7}  & & & in firmware & & & \\ \cline{2-7}  & & & & & (BOF/ CI) \\ \cline{2-7}  & & & & & (BOF/ CI) \\ \hline \multirow{8}{*}{Static analysis} & \multirow{8}{*}{CryptoREX [20]} & \multirow{8}{*}{✓} & Binary & \multirow{2}{*}{IR-based analysis} & \multirow{2}{*}{Crypto misuse} \\  & & & program & & (BOF) \\ \cline{2-7}  & & & in firmware & & & \\ \hline \multirow{8}{*}{\ \begin{tabular}{c} pattern- \\ matching- \\ based \\ method \\ \end{tabular}  } & \multirow{8}{*}{Costin [21]} & \multirow{8}{*}{✓} & \multirow{8}{*}{Firmware} & Correlation analysis & Backdoor \\ \cline{2-7}  & & & & Static data & \multirow{2}{*}{Backdoor} \\ \cline{2-7}  & & & & comparison & \\ \cline{2-7}  & & & & Symbolic execution and & \\ \cline{2-7}  & & & & program slicing & \\ \hline \multirow{8}{*}{ \begin{tabular}{c} analysis \\ basis \\ \end{tabular}  } & \multirow{8}{*}{Firmadyne [24]} & \multirow{8}{*}{✓} & \multirow{8}{*}{Firmadyne} & Full system & Emulation \\  & & & & emulation & purpose \\ \cline{2-7}  & & & & & & \\ \cline{2-7}  & & & & & (BOF/NPD/XSS) \\ \cline{2-7  
According to the technical approach, there are two main categories: dynamic analysis and static analysis. Dynamic analysis involves running the embedded devices in a certain way and conducting analysis during the runtime [32]. Such methods can be divided into two categories based on research strategy: emulation and fuzzing. Emulation focuses on running firmware to mimic the behavior of a real device as closely as possible. FIRMADYNE [24] is a firmware emulation framework designed for automated dynamic analysis in large-scale embedded firmware. Although it is promising, its emulation rate of network reachability and web service availability is considerably low. FIRMAE [25] uses several heuristics to address the problems encountered in FIRMADYNE and increases the emulation success rate. However, it can only handle observed cases and may not handle problems in new devices. AVATAR [26] enables complex dynamic analysis of embedded devices by orchestrating the execution of an emulator, together with the real hardware. FirmFuzz [31] employs a greybox-based generational fuzzing approach coupled with static analysis and system introspection to provide targeted and deterministic bug discovery within a firmware image.