{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T19:44:49Z","timestamp":1782848689213,"version":"3.54.5"},"reference-count":38,"publisher":"Association for Computing Machinery (ACM)","issue":"FSE","license":[{"start":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T00:00:00Z","timestamp":1782777600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62232001"],"award-info":[{"award-number":["62232001"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"National Key R&D Program","award":["2024YFB2505604"],"award-info":[{"award-number":["2024YFB2505604"]}]},{"DOI":"10.13039\/501100005145","name":"Basic Research Program of Jiangsu Province","doi-asserted-by":"publisher","award":["BK20251425"],"award-info":[{"award-number":["BK20251425"]}],"id":[{"id":"10.13039\/501100005145","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002858","name":"China Postdoctoral Science Foundation","doi-asserted-by":"crossref","award":["2024M761397"],"award-info":[{"award-number":["2024M761397"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Collaborative Innovation Center of Novel Software Technology and Industrialization","award":["-"],"award-info":[{"award-number":["-"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. ACM Softw. Eng."],"published-print":{"date-parts":[[2026,6,30]]},"abstract":"<jats:p>Control-flow reconstruction is a fundamental yet challenging problem in firmware analysis, particularly for stripped or raw-format binaries that lack symbolic metadata. Existing methods typically rely on syntax heuristics or format-specific patterns, which are often inadequate for real-world firmware that includes indirect jumps, manually crafted assembly, and limited metadata.<\/jats:p>\n                  <jats:p>We present a semantics-guided static analysis framework for accurate control-flow reconstruction in stripped ELF and raw-format firmware binaries. Our approach consists of two complementary components: (i) an intra-procedural control-flow reconstruction method that incrementally recovers direct branches, indirect jumps, and call-return flows via fixpoint-guided value-flow analysis; and (ii) an inter-procedural analysis that resolves indirect calls through cross-function value tracking and loop-structure matching. By decoupling control-flow reasoning from instruction semantics and function abstraction, our framework robustly handles tightly intertwined control-flow patterns and mitigates the impact of misanalysis.<\/jats:p>\n                  <jats:p>\n                    We implement our approach in Scarf (S\n                    <jats:italic toggle=\"yes\">emantics-guided<\/jats:italic>\n                    C\n                    <jats:italic toggle=\"yes\">ontrol-flow<\/jats:italic>\n                    A\n                    <jats:italic toggle=\"yes\">nalysis<\/jats:italic>\n                    for R\n                    <jats:italic toggle=\"yes\">aw and<\/jats:italic>\n                    F\n                    <jats:italic toggle=\"yes\">irmware binaries<\/jats:italic>\n                    ) and evaluate it on over 300 real-world firmware binaries in both ELF and raw formats. Compared with state-of-the-art reverse engineering tools, Scarf consistently achieves higher precision in control-flow recovery and demonstrates clear advantages on raw firmware, especially in resolving indirect jumps, call\u2013return flows, and indirect calls. These results demonstrate that semantics-guided analysis provides a robust and scalable foundation for control flow reconstruction in metadata-deficient firmware.\n                  <\/jats:p>","DOI":"10.1145\/3797130","type":"journal-article","created":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T17:06:14Z","timestamp":1782839174000},"page":"766-785","source":"Crossref","is-referenced-by-count":0,"title":["Semantics-Guided Control-Flow Reconstruction for Firmware Binaries via Static Analysis"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8185-0573","authenticated-orcid":false,"given":"Fengjuan","family":"Gao","sequence":"first","affiliation":[{"name":"Nanjing University of Science and Technology, Nanjing, China"},{"name":"Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-5280-6781","authenticated-orcid":false,"given":"Qingjie","family":"Zhu","sequence":"additional","affiliation":[{"name":"Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8159-9160","authenticated-orcid":false,"given":"Yi","family":"Zhang","sequence":"additional","affiliation":[{"name":"Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7216-6929","authenticated-orcid":false,"given":"Yu","family":"Wang","sequence":"additional","affiliation":[{"name":"Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3090-9568","authenticated-orcid":false,"given":"Xuandong","family":"Li","sequence":"additional","affiliation":[{"name":"Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0844-5023","authenticated-orcid":false,"given":"Ke","family":"Wang","sequence":"additional","affiliation":[{"name":"Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,30]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24723-4_2"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23300"},{"key":"e_1_2_1_3_1","first-page":"1665","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Chen Sanchuan","year":"2021","unstructured":"Sanchuan Chen, Zhiqiang Lin, and Yinqian Zhang. 2021. {SelectiveTaint}: Efficient data flow tracking with static binary rewriting. In 30th USENIX Security Symposium (USENIX Security 21). 1665-1682."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598062"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-62105-0_12"},{"key":"e_1_2_1_6_1","unstructured":"The Radare2 Contributors. 2026. Radare2. https:\/\/www.radare.org\/n\/"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_24"},{"key":"e_1_2_1_8_1","unstructured":"Arm Developer. 2025. Arm Architecture Reference Manual for A-Profile Architecture. https:\/\/developer.arm.com\/ documentation\/ddi0487\/latest\/"},{"key":"e_1_2_1_9_1","unstructured":"Arm Developer. 2025. Armv8-M Architecture Reference Manual. https:\/\/developer.arm.com\/documentation\/ddi0553\/ latest\/"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3033019.3033028"},{"key":"e_1_2_1_11_1","unstructured":"GNU. 2025. Binutils-objdump. https:\/\/www.gnu.org\/software\/binutils\/"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE55347.2025.00053"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24386"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3497776.3517776"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-27940-9_18"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-70545-1_40"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/357062.357071"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2931037.2931047"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3650212.3680301"},{"key":"e_1_2_1_21_1","unstructured":"NSA. 2025. Ghidra. https:\/\/ghidra-sre.org\/"},{"key":"e_1_2_1_22_1","first-page":"2479","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Pang Chengbin","year":"2022","unstructured":"Chengbin Pang, Tiantai Zhang, Ruotong Yu, Bing Mao, and Jun Xu. 2022. Ground truth for binary disassembly is not easy. In 31st USENIX Security Symposium (USENIX Security 22). 2479-2495."},{"key":"e_1_2_1_23_1","unstructured":"Hex Rays. 2025. IDA Pro. https:\/\/hex-rays.com\/ida-pro\/"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-22038-9_23"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1111542.1111560"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/73560.73562"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2002.1173063"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.17"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2018.2875240"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-80515-9_3"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/199448.199464"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.60"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-99-8761-0_19"},{"key":"e_1_2_1_34_1","first-page":"627","volume-title":"24th USENIX Security Symposium (USENIX Security 15)","author":"Wang Shuai","year":"2015","unstructured":"Shuai Wang, Pei Wang, and Dinghao Wu. 2015. Reassembleable disassembling. In 24th USENIX Security Symposium (USENIX Security 15). 627-642."},{"key":"e_1_2_1_35_1","first-page":"3997","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Wen Haohuang","year":"2023","unstructured":"Haohuang Wen and Zhiqiang Lin. 2023. Egg hunt in tesla infotainment: A first look at reverse engineering of qt binaries. In 32nd USENIX Security Symposium (USENIX Security 23). 3997-4014."},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179307"},{"key":"e_1_2_1_37_1","first-page":"337","volume-title":"Control Flow Integrity for COTS Binaries. In 22nd USENIX Security Symposium (USENIX Security 13)","author":"Zhang Mingwei","year":"2013","unstructured":"Mingwei Zhang and R Sekar. 2013. Control Flow Integrity for COTS Binaries. In 22nd USENIX Security Symposium (USENIX Security 13). 337-352."},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3360563"}],"container-title":["Proceedings of the ACM on Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3797130","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T18:50:13Z","timestamp":1782845413000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3797130"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,30]]},"references-count":38,"journal-issue":{"issue":"FSE","published-print":{"date-parts":[[2026,6,30]]}},"alternative-id":["10.1145\/3797130"],"URL":"https:\/\/doi.org\/10.1145\/3797130","relation":{},"ISSN":["2994-970X"],"issn-type":[{"value":"2994-970X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,30]]}}}