一句话：结合厂商手册语义与固件二进制执行证据，自动合成可执行的 MCU 外设模型，提升固件重宿主保真度。
可执行外设建模是 MCU 固件重宿主（rehosting）的主要瓶颈：参考手册提供宽泛但不可执行的语义描述，二进制分析给出基于执行却往往不完整的观察。PELSE 联合利用这两类非对称证据源，其核心思想是在统一的寄存器/字段抽象下，让手册推导的语义结构与二进制推导的执行见证相互约束。方法上，PELSE 用大语言模型从厂商手册抽取语义候选并组织为手册推导的有限状态机骨架，同时执行 MMIO 感知的符号执行，从固件二进制收集寄存器/字段级见证片段；随后在统一命名空间中进行证据引导的融合，交叉验证并具体化兼容的手册迁移，恢复骨架中缺失的良构轨迹迁移，隔离矛盾，构建带证据标签的融合 FSM，再编译为 QEMU 兼容外设模型。评估采用 QEMU 参照的 MMIO/IRQ 一致性测试与增强的 106 项 P2IM 测试套件：在 42 项重叠集上达到 97.0% 一致性，比 PERRY 高 6.4 个百分点；全部 106 项通过率 96.2%，比 FUZZWARE 高 5.6 个百分点。下游证据表明，该重宿主能力可复现已知漏洞并发现 15 个此前未知的真实漏洞。
Faithful executable peripheral modeling remains a major bottleneck in microcontroller unit (MCU) firmware rehosting. Reference manuals provide broad but non-executable semantic descriptions, while binary analysis yields execution-grounded but incomplete observations. We present PELSE, a framework that synthesizes executable peripheral models by jointly leveraging these two asymmetric evidence sources. Our key insight is that manual-derived semantic structures and binary-derived execution witnesses can be unified under a shared register/field abstraction to mutually constrain model construction. Specifically, PELSE uses large language models (LLMs) to extract semantic candidates from vendor manuals and organize them into manual-derived finite-state machine (FSM) scaffolds, and performs memory-mapped I/O (MMIO)-aware symbolic execution to collect register/field-level witness fragments from firmware binaries. It then applies evidence-guided fusion in a unified register/field namespace to cross-validate and concretize compatible manual-derived transitions, recover well-formed trace-extracted transitions absent from the FSM scaffolds, isolate contradictions, and construct evidence-labeled fused FSMs before compiling them into QEMU-compatible peripheral models. We evaluate PELSE using QEMU-referenced MMIO/IRQ conformance and an enhanced 106-test P2IM suite. PELSE achieves 97.0% conformance on a 42-test overlap set, improving over PERRY by 6.4 percentage points, and a 96.2% pass rate across all 106 tests, outperforming FUZZWARE by 5.6 percentage points. As downstream evidence of improved rehosting fidelity, PELSE-enabled rehosting supports security analyses that reproduce known vulnerabilities and uncover 15 previously unknown real-world vulnerabilities.
@inproceedings{paperbot12201,
title = {PELSE: Asymmetric-Evidence-Guided MCU Peripheral Model Synthesis},
author = {Guohao Wu and Chunlin Wang and Rui Yao and Feng Hong and Hongliang Liang and Qiuping Yi},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837541}
}