Firmware Reverse Engineering: A Comprehensive Review and Directions
TL;DR
This review synthesises 118 works published from 2014 to 2026 covering the full firmware reverse engineering pipeline and identifies ten structural gaps, including the absence of unified evaluation benchmarks, fragmented peripheral modelling, the scalability–fidelity trade-off in re-hosting, and insufficient grounding of LLM tools in firmware-specific realities.
Abstract
Firmware forms the persistent software layer controlling embedded and Internet-of-Things (IoT) devices, industrial controllers, automotive systems, and cyber-physical infrastructure. Vulnerabilities in firmware enable remote compromise, supply-chain attacks, and long-lived implants that survive operating-system reinstallation. This review synthesises 118 works published from 2014 to 2026—comprising 78 primary research studies; 23 surveys and systematisations of knowledge; and 17 benchmarks, tools, and background references—covering the full firmware reverse engineering (FRE) pipeline: physical acquisition (including fault injection and side-channel extraction), format analysis and unpacking, static analysis (binary code similarity detection, protocol reverse engineering, and patch diffing), dynamic analysis and hardware emulation, fuzzing-based vulnerability discovery, and artificial intelligence (AI) and large language model (LLM)-assisted analysis. Three additional dimensions are surveyed: digital twin-assisted firmware security testing; secure boot, trusted execution environment (TEE), and over-the-air (OTA) update security; and firmware rootkit and implant detection. Coverage spans two axes—the firmware class (Linux-based IoT, microcontroller-unit bare-metal, RTOS, UEFI/BIOS, PLC/ICS, and automotive ECU) and analysis depth (surface scanning to exploit-validated vulnerability chains). We identify ten structural gaps, including the absence of unified evaluation benchmarks, fragmented peripheral modelling, the scalability–fidelity trade-off in re-hosting, and insufficient grounding of LLM tools in firmware-specific realities. We conclude with six research directions for trustworthy, scalable, and infrastructure-aware firmware analysis.