Bare-metal firmware on an emulated Cortex-M3

The agent writes real embedded C — hand-written linker script and startup code — for a Stellaris LM3S6965 board that exists only inside QEMU. The firmware must build warning-free, boot on the emulator and serve a scripted UART command shell. Every gate compares it with an independent oracle: the Arm toolchain, readelf, Python's zlib.crc32, a known-answer response mask, and checksums of the judge itself.

The real captured UART session, then the crc-poly mutant with the responses that diverge from the oracle highlighted, then the verdicts. Made from real judge output, no illustrative data.

Measured

46 / 46

scripted shell responses byte-exact
all

15 / 15

seeded CRC-32 buffers match zlib.crc32
all

2224 B

.text + .rodata
≤ 8192 B

8 / 8

judge gates passed
all

14/14

known-bad artifacts rejected
self-test, ≥ 90 % required

reproduced Independently reproduced: identical verdicts and self-test figure. Numbers from the demo's README and receipt.

Ask your agent

With the sandbox plugin or any agent that can use a sandbox, paste:

Write bare-metal firmware for a QEMU `lm3s6965evb` board (Cortex-M3, UART0) that boots and serves the command shell in `cookbook/firmware-qemu/SPEC.md` of https://github.com/agent-next/sandbox. Work in a sandbox: run `judge/setup.sh` there, and iterate with `judge/grade.sh` until all 8 gates pass. The judge builds it with `-Wall -Werror` and interrogates it over the emulated UART. Do not edit anything under `judge/`. Kill the sandbox when you are done.

Or run it yourself

Creates a sandbox, installs the pinned tools, runs the judge's self-test, grades the known-good example, prints the verdict and kills the sandbox.

pip install "git+https://github.com/agent-next/sandbox#subdirectory=cli"
export SBX_API_KEY=<your key>  # from the console
git clone --depth 1 https://github.com/agent-next/sandbox && cd sandbox
python3 cookbook/firmware-qemu/run.py

No key? Run the judge on any Debian 12 box

# from cookbook/firmware-qemu/
bash judge/setup.sh
bash judge/selftest.sh
bash judge/grade.sh examples/good --seed 20260814

Results

The judged session: the UART transcript of the good firmware in QEMU beside the 8-gate table with measured values. Full size

Mutant-by-gate matrix from the judge self-test: the known-good firmware plus 14 mutants against all 8 gates. Full size

Why a sandbox

The toolchain, the emulator and the firmware under test are installed from nothing on a machine the agent does not control, and the whole thing is thrown away afterwards; nothing about your host leaks into the verdict.

Measured wall time

Step	Wall time
`judge/setup.sh (toolchain + QEMU, sha256-checked)`	~140–385 s
`judge/selftest.sh (good + 14 mutants + determinism)`	~120–255 s
`judge/grade.sh examples/good`	~7 s

Limits, plainly

Proves behaviour inside QEMU's lm3s6965evb model only; no timing, power or real-silicon behaviour is measured.
QEMU never raises the UART0 interrupt on this machine and zeroes SRAM at reset, so interrupt-path and .bss-clearing faults are invisible here.
The judge catches mistakes, not a hostile artifact: grade untrusted firmware in a fresh disposable sandbox and read the build log.

Source

Demo folder · SPEC · RECEIPT · REPRODUCE — pinned at ba328e6

Run one yourself

Sign in with GitHub for a free key with 10 sandbox-hours. Every demo above finishes in minutes and kills its sandbox when it is done.

Get a free key Quickstart