FirmPilot: Evidence-Guided Multi-Agent Environment Recovery for IoT Firmware Rehosting

2026-07-16

AI Summary

This work addresses the challenge of unstable execution in real-world IoT firmware rehosting, where cross-layer dependencies—such as boot scripts, persistent configurations, and network settings—often prevent the system from reaching an externally observable state. To overcome this, the authors propose an evidence-guided multi-agent collaborative framework that reframes rehosting as an iterative environment reconstruction process. By integrating similarity-based retrieval with execution feedback, the framework dynamically restores the file system, initialization scripts, persistent states, and network configurations while avoiding arbitrary modifications by large language models, thereby resolving dependency conflicts. Experimental results on the LFwC dataset demonstrate significant improvements: web service reachability increases from 25.49% to 52.39%, network reachability rises from 39.30% to 71.93%, and the average number of detectable services per firmware grows from 0.86 to 1.62, enabling effective RouterSploit interaction and protocol-aware fuzz testing.

Abstract

Firmware rehosting executes firmware images in emulated environments such as QEMU to enable scalable dynamic analysis of Internet of Things (IoT) devices. In practice, rehosting pipelines remain fragile across diverse real-world firmware images, as reaching an externally observable execution state depends on tightly coupled artifacts spanning boot scripts, persistent configuration (e.g., NVRAM-like key-value state), and network setup. Template-driven frameworks often fail to accommodate long-tail vendor conventions, while unconstrained use of large language models (LLMs) risks unsupported modifications and irreproducible executions. We introduce FirmPilot, an evidence-guided multi-agent framework for environment recovery in firmware rehosting. FirmPilot reformulates rehosting as iterative environment reconstruction in which a search agent grounds decisions through similarity-based retrieval, a planner coordinates execution-accepted transitions, and specialized agents recover filesystem/init artifacts, persistent state, and network exposure. Through repeated execution and evidence-grounded artifact deltas, the system resolves cross-layer dependencies across boot, state, and networking that otherwise prevent firmware executions from reaching a stable, externally reachable state in emulation. Evaluated on the large-scale, real-world LFwC firmware corpus, FirmPilot improves web-service reachability over FirmAE from 25.49% to 52.39% and network reachability from 39.30% to 71.93%. The resulting rehosts raise the average number of detected services per firmware from 0.86 to 1.62 and support downstream analysis workflows, including RouterSploit interaction and protocol-aware fuzzing over recovered service surfaces. The evaluation shows that evidence- and feedback-grounded agent coordination improves rehosting success, service recovery, and downstream utility in automated firmware rehosting.

Problem

• firmware rehosting
• IoT
• environment recovery
• emulation
• cross-layer dependencies

Innovation

• firmware rehosting
• multi-agent system
• evidence-guided recovery
• IoT security
• environment reconstruction