Safety-critical cyber-physical systems, such as autonomous vehicles and medical devices, are often driven by notions of state provided by sensor information translated through embedded firmware. This sensor pipeline is often a fragmented supply chain across vendors, and analyzing the associated security properties entails semantic reverse engineering of third-party software, i.e., mapping low-level software representations to cyber-physical models without access to source code. This mapping is a manual, time-consu…