BoardRunner
Automatic firmware rehosting using high-fidelity compositional device models.
BoardRunner is a framework for automatic firmware rehosting built on high-fidelity, compositional device models. Rather than hand-writing a peripheral model per target, BoardRunner composes device models that are faithful enough to run unmodified firmware, which makes rehosting — and the dynamic analysis that depends on it — scale across microcontroller platforms.
The work has been evaluated across 5+ MCU platforms, including STM32 and NXP families, and will appear at ACM CCS 2026.
Related engineering work in the same line:
- Ported the open-source HALucinator rehosting framework to an in-house QEMU execution backend, replacing its Avatar²/GDB debugger-in-the-loop architecture. This removed the per-basic-block round trip between emulator and debugger and produced up to 12× faster rehosted execution on HALucinator’s bundled example targets.