VFF: Precise Identification of Firmware Validator Functions Based on Basic Block Layout Patterns and LLM-based Semantic Validation

Internet of Things (IoT) devices are becoming increasingly ubiquitous, and taint-style vulnerabilities in firmware pose serious security threats. Existing advanced static analysis tools, such as OctopusTaint, rely on branch condition recovery, backward tracking over Data Dependency Graphs, and fixed whitelists to identify validator functions along sensitive data flow paths. This reliance may cause structurally complex or irregularly named validator functions to be missed. Moreover, without secondary semantic verification of whether identified validator functions truly neutralize threats, unprotected paths may be mistakenly classified as safe. To address these limitations, we propose Validator Function Finder (VFF), an enhancement module designed to improve the identification and verification of validator functions along sensitive data flow paths. The key contributions of this work include: (1) VFF introduces heuristic rules based on Basic Block Layout Patterns to discover validator functions that may be overlooked by traditional techniques. (2) VFF further leverages LLM-based semantic analysis of decompiled firmware functions to overcome the limitations of fixed validator whitelists and identify vendor-specific validator functions. (3) VFF incorporates an LLM-based secondary semantic verification mechanism to reassess the effectiveness of validator functions along data flow paths. Evaluation on 24 real-world firmware images from five major vendors shows that VFF improves the recall of identifying validator-protected data flow paths from 27.50% to 85.00% and reduces the vulnerability false negative rate from 11.96% to 8.70%, compared with OctopusTaint.