Restoring Transparency in CPS Firmware through Protocol Recovery, Device Inference, and Component Recovery

Abstract

Cyber-physical systems (CPS) underpin modern infrastructure, yet their firmware remains opaque due to stripped binaries, heterogeneous hardware, and deeply intertwined software–hardware interactions. This lack of transparency complicates efforts to understand system behavior, identify vulnerabilities, and analyze failures in safetycritical environments. This research addresses these challenges through three complementary thrusts. The first introduces ProtoReveal, a static analysis framework that automatically recovers in-use MMIO registers and low-level communication protocols from stripped firmware. The second contributes DevHunt, which combines static analysis with targeted symbolic execution to infer peripheral device types and reveal hidden or unauthorized hardware interactions. The third introduces DroneStrip, a framework that reconstructs software architecture from stripped firmware through component boundary recovery, enabling mission-aware firmware debloating without requiring source code, symbols, or build metadata. Together, these contributions advance firmware transparency by improving visibility at the protocol, device, and software-architecture levels, providing a foundation for more analyzable, understandable, and secure cyber-physical systems.