Examiner: Automatically Locating Inconsistent Instructions Between Real Devices and CPU Emulators for ARM

by   Muhui Jiang, et al.

Emulator is widely used to build dynamic analysis frameworks due to its fine-grained tracing capability, full system monitoring functionality, and scalability of running on different operating systemsand architectures. However, whether the emulator is consistent with real devices is unknown. To understand this problem, we aim to automatically locate inconsistent instructions, which behave differently between emulators and real devices. We target ARM architecture, which provides machine readable specification. Based on the specification, we propose a test case generator by designing and implementing the first symbolic execution engine for ARM architecture specification language (ASL). We generate 2,774,649 representative instruction streams and conduct differential testing with these instruction streams between four ARM real devices in different architecture versions (i.e., ARMv5, ARMv6, ARMv7-a, and ARMv8-a) and the state-of-the-art emulators (i.e., QEMU). We locate 155,642 inconsistent instruction streams, which cover 30 instruction encodings and 47.8 implementation in ARM manual and implementation bugs of QEMU are the major causes of inconsistencies. Furthermore, we discover four QEMU bugs, which are confirmed and patched by thedevelopers, covering 13 instruction encodings including the most commonly used ones (e.g.,STR,BLX). With the inconsistent instructions, we build three security applications and demonstrate thecapability of these instructions on detecting emulators, anti-emulation, and anti-fuzzing.


page 1

page 2

page 3

page 4


An Automatic Debugging Tool of Instruction-Driven Multicore Systems with Synchronization Points

Tracing back the instruction execution sequence to debug a multicore sys...

ICICLE: A Re-Designed Emulator for Grey-Box Firmware Fuzzing

Emulation-based fuzzers enable testing binaries without source code, and...

On the Evaluation of Vision-and-Language Navigation Instructions

Vision-and-Language Navigation wayfinding agents can be enhanced by expl...

Towards Porting Operating Systems with Program Synthesis

The end of Moore's Law has ushered in a diversity of hardware not seen i...

μAFL: Non-intrusive Feedback-driven Fuzzing for Microcontroller Firmware

Fuzzing is one of the most effective approaches to finding software flaw...

A short introduction to program algebra with instructions for Boolean registers

A parameterized algebraic theory of instruction sequences, objects that ...

Autovesk: Automatic vectorization of unstructured static kernels by graph transformations

Leveraging the SIMD capability of modern CPU architectures is mandatory ...

Please sign up or login with your details

Forgot password? Click here to reset