FirmCross: Detecting Taint-style Vulnerabilities in Modern C-Lua Hybrid Web Services of Linux-based Firmware

FirmCross: Detecting Taint-style Vulnerabilities in Modern C-Lua Hybrid Web Services of Linux-based Firmware

Speakers: Runhao Liu (presenting on behalf of the authors)

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=HsBVc6iKWUU

Overview

This talk presents FirmCross, a static analysis tool for detecting taint-style vulnerabilities in C-Lua hybrid web services found in Linux-based IoT firmware. The research addresses a critical blind spot in firmware security: while existing vulnerability detectors focus on C binaries, 38% of analyzed firmware samples use C-Lua hybrid architectures, and the Lua-invoked attack surfaces have been systematically neglected. Making matters worse, 34% of Lua services are distributed as vendor-customized obfuscated bytecode, preventing conventional analysis.

FirmCross introduces three core techniques: automated Lua bytecode deobfuscation using environment-based structure recovery and static diffing, Lua-specific source identification via URI handler registration patterns, and C-Lua cross-language communication modeling covering both API and IPC channels. Evaluated across 73 firmware images from 11 vendors, FirmCross detected 696 vulnerabilities -- achieving 6.82x and 14.5x improvements over state-of-the-art tools SaTC/MongoDFA and LuaTaint respectively. Of these, 610 are previously unknown zero-day vulnerabilities, with 492 confirmed by vendors including Xiaomi, TP-Link, Tenda, and D-Link, and 59 official CVE identifiers assigned to date.

Background

▶ Watch: IoT firmware landscape: 40 billion devices by 2030 (0:00)

The number of IoT devices is projected to reach 40 billion by 2030, and IoT vulnerabilities typically arise from web services in Linux-based firmware. These vulnerabilities can enable remote code execution, command injection, and other critical attacks against consumer and enterprise networking equipment.

Existing static taint analysis approaches for firmware web services over-simplify the composition of these services. They focus on C binary analysis while neglecting Lua components that handle significant portions of the web service logic. A large-scale empirical study using FirmDNA scraper across 2,461 firmware images from six major vendors revealed the scale of this gap: C-Lua hybrid services are prevalent (38% of samples), existing tools miss attack surfaces in Lua components entirely, and a significant portion of Lua services use vendor-customized obfuscated bytecode.

The standard workflow for static taint-based vulnerability detection involves two phases: source-to-sink identification (finding where attacker-controlled input enters and where dangerous operations occur) and taint propagation (tracking data flow between them). FirmCross extends this workflow to handle the cross-language boundary between C and Lua, which no previous tool addressed.

Lua bytecode obfuscation falls into two categories: structure obfuscation (reordering metadata fields within function prototypes) and data obfuscation (altering specific values within fields). Vendors implement these by customizing the Lua interpreter or compiler. Prior work like LuaHunt required manual reverse engineering to understand the obfuscation and could only handle structure obfuscation plus a single data obfuscation technique.

Key Findings

▶ Watch: Three key limitations of existing firmware analysis tools (4:00)

Lua attack surfaces are massively under-analyzed: The empirical study of 2,461 firmware images found that 38% use C-Lua hybrid web services, yet no existing vulnerability detection tool could analyze the Lua components or model the C-Lua communication boundary. This represents a systematic blind spot in IoT firmware security.

610 zero-day vulnerabilities discovered: FirmCross found 696 total vulnerabilities across 73 firmware images from 11 vendors, of which 610 were previously unknown. 492 have been confirmed by affected vendors, and 59 CVE identifiers have been assigned.

100% deobfuscation pass rate: Tested against 316 firmware images containing obfuscated bytecode, FirmCross achieved a 100% pass rate on deobfuscation verification. LuaHunt passed on zero images, demonstrating the complete inadequacy of manual approaches at scale.

14.5x improvement over prior Lua analysis: FirmCross detected 14.5 times more vulnerabilities than LuaTaint (the state-of-the-art Lua firmware vulnerability detector) and 6.82 times more than MongoDFA (the state-of-the-art C binary firmware detector).

Automated handling of six obfuscation types: FirmCross automatically handles six types of existing Lua bytecode obfuscation techniques, compared to LuaHunt's manual handling of only two types.

Technical Deep Dive

▶ Watch: Environment-based bytecode structure deobfuscation (8:00)

Lua Bytecode Deobfuscation leverages three invariant environment features that persist even when bytecode is obfuscated:

1. Length headers and fixed termination: The Lua specification mandates that all array structures within bytecode begin with a length header, and all instruction regions terminate with a fixed return instruction.
2. Size-preserving characteristics: Obfuscation does not modify the length indicators for array structures.
3. Prototype structure consistency: All prototypes within bytecode maintain identical field ordering.

For structure deobfuscation, FirmCross extracts signatures of field environment features from pre-constructed Lua source gadgets, then matches these signatures in obfuscated bytecode compiled from the same source gadgets to identify corresponding structure fields.

For data deobfuscation, a static diffing approach compares value differences in the same fields between obfuscated and normal bytecode generated from identical source gadgets, inferring the data transformation rules for each field. Together, these techniques enable fully automated deobfuscation without manual reverse engineering.

Lua-Specific Source Identification observes that Lua-specific taint sources are commonly received as table-structured parameters of URI handling functions, and that Lua URI handlers strictly follow registration-callback mechanisms. FirmCross identifies registered URI handlers, then distinguishes attacker-controllable table structure parameters as taint sources. This approach works across different Lua web frameworks, unlike prior approaches that relied on LUCI-specific file paths or function names (which produced many false positives and could not scale).

C-Lua Communication Modeling identifies that despite the diversity of C-Lua communication patterns in real-world firmware, they all follow standards defined by the operating system or the C/Lua specifications. FirmCross designs deterministic patterns to identify and model both API-based communication (C code calling Lua functions or vice versa through the Lua C API) and IPC-based communication (inter-process communication between C and Lua processes). This cross-language modeling is the first of its kind for firmware analysis.

Demo / Proof of Concept

▶ Watch: URI handler registration for Lua source identification (10:00)

No live demo was performed. The evaluation used a carefully constructed representative dataset of 73 firmware images across 11 vendors, combining existing public firmware datasets with newly collected firmware. The presentation focused on quantitative results: 696 vulnerabilities detected, 610 zero-days, 492 vendor-confirmed, 59 CVEs assigned. Vendor acknowledgements were received from Xiaomi, TP-Link, Tenda, and D-Link.

The deobfuscation evaluation tested against 316 images with obfuscated bytecode, achieving 100% pass rate versus LuaHunt's 0%. The code and dataset are released on GitHub and Zenodo, and the artifact passed functional and reproducibility badges in the artifact evaluation process.

Defensive Implications

▶ Watch: Conclusion and open-source release on GitHub (14:00)

FirmCross has immediate implications for IoT security practitioners:

New attack surface awareness: Security teams assessing IoT firmware must now consider Lua components as first-class attack surfaces. The finding that 38% of firmware uses C-Lua hybrid architectures means a significant portion of the IoT ecosystem has been under-analyzed by existing tools.

Vendor firmware auditing: The 610 zero-days across 11 vendors demonstrate that even major manufacturers (Xiaomi, TP-Link, Tenda, D-Link) have significant vulnerability exposure in their Lua-based web service components. Procurement teams should factor Lua component security into vendor risk assessments.

Obfuscation is not security: The 100% deobfuscation pass rate demonstrates that vendor-customized bytecode obfuscation provides no meaningful security benefit against automated analysis. Vendors relying on Lua bytecode obfuscation for security-through-obscurity should reconsider their approach.

Open-source tooling: FirmCross's release on GitHub and Zenodo, with reproducibility badges, means defenders can immediately integrate this into firmware security assessment workflows. This is particularly valuable for organizations performing IoT device security evaluations.

Key Takeaways

• 38% of analyzed IoT firmware uses C-Lua hybrid web services, creating a massive under-analyzed attack surface
• FirmCross detected 696 vulnerabilities across 73 firmware images from 11 vendors, including 610 previously unknown zero-days
• 492 vulnerabilities confirmed by vendors (Xiaomi, TP-Link, Tenda, D-Link) with 59 CVEs assigned
• Automated Lua bytecode deobfuscation achieves 100% pass rate on 316 obfuscated firmware images, handling six obfuscation types automatically
• Cross-language C-Lua communication modeling via API and IPC patterns enables the first taint analysis spanning both language boundaries
• 14.5x improvement over LuaTaint and 6.82x over MongoDFA in vulnerability detection counts
• Code and dataset publicly available on GitHub and Zenodo with reproducibility badges

About the Speaker(s)

Runhao Liu presented this work on behalf of the original authors, who could not attend due to visa restrictions. The research team focuses on firmware security analysis, with particular expertise in static taint analysis, Lua bytecode reverse engineering, and cross-language vulnerability detection. The team has established responsible disclosure relationships with major IoT vendors and has contributed significantly to IoT vulnerability discovery.