SMELL-CPS developed methods to extract interpretable mathematical expressions and semantic structure from low-level CPS control binaries, enabling reverse engineering, assurance analysis, and downstream automated testing workflows.
Overview
Under DARPA ReMATH (AIE), SMELL-CPS established a programmatic workflow for recovering symbolic mathematical structure from firmware-level control logic in cyber-physical systems.
The project combined symbolic execution, static analysis, and modular expression refinement to bridge the gap between binary-level implementations and human-meaningful control semantics.
This research line seeded follow-on work including PERFUME, SensorLoader, and AutoCPS, and informs newer property-guided surrogation workflows for CPS safety analysis.
Capabilities
Recover symbolic expressions from low-level controller binaries and map them into modular semantic components
Link peripheral-level communication behavior to higher-level control semantics across embedded CPS platforms
Generate semantically structured datasets for training and evaluating reverse-engineering pipelines
Support property-oriented analysis workflows that connect semantic recovery with CPS testing and falsification
Use Cases
Firmware-level reverse engineering of embedded CPS controllers when source code is incomplete or unavailable
Extraction of interpretable control math for analyst review and assurance workflows
Automated dataset generation for semantic reverse-engineering models and evaluation benchmarks
Property-guided reduction and surrogation to accelerate safety-focused CPS analysis
Figures
Publications
2021 / Proceedings of the 2021 Research on offensive and defensive techniques in the Context of Man At The End (MATE) Attacks
Nicolaas Weideman, Virginia K Felkner, Wei-Cheng Wu, Jonathan May, et al.
2022 / 2022 IEEE Security and Privacy Workshops (SPW)
Haoda Wang, Christophe Hauser, Luis Garcia
2023 / Proceedings of the First International Workshop on Security and Privacy of Sensing Systems
Anmei Dasbach-Prisk, Cory Dewitt, Luis Garcia
2025 / Security and Privacy in Cyber-Physical Systems and Smart Vehicles: Third EAI International Conference, SmartSP 2025, Salt Lake City, Utah, USA, December 1--2, 2025, Proceedings
Nazmus Shakib Sayom, Luis A Garcia
Related Work
NSF Mid-Scale RI / 2024–2028
SPHERE CPS Enclave is a reconfigurable, remotely accessible industrial-control experimentation environment for repeatable and shareable cybersecurity studies spanning PLC logic, SCADA/HMI interaction, process telemetry, and configurable network behavior.
NSF FMitF / 2022–2025
FMitF develops a provably correct stack that links formal hybrid-system models to PLC implementations, combining verified runtime monitoring with bidirectional model-code translation for industrial control systems.