Abstract:ARM has become the most competitive processor architecture. Many platforms or tools are developed to execute or analyze ARM instructions, including various commercial CPUs, emulators, and binary analysis tools. However, they have deviations when processing the same ARM instructions, and little attention has been paid to systematically analyze such semantic deviations, not to mention the security implications of such deviations. In this paper, we conduct an empirical study on the ARM Instruction Semantic Deviation (ISDev) issue. First, we classify this issue into several categories and analyze the security implications behind them. Then, we further demonstrate several novel attacks which utilize the ISDev issue, including stealthy targeted attacks and targeted defense evasion. Such attacks could exploit the semantic deviations to generate malware that is specific to certain platforms or able to detect and bypass certain detection solutions. We have developed a framework iDEV to systematically explore the ISDev issue in existing ARM instructions processing tools and platforms via differential testing. We have evaluated iDEV on four hardware devices, the QEMU emulator, and five disassemblers which could process the ARMv7-A instruction set. The evaluation results show that, over six million instructions could cause dynamic executors (i.e., CPUs and QEMU) to present different runtime behaviors, and over eight million instructions could cause static disassemblers yielding different decoding results, and over one million instructions cause inconsistency between dynamic executors and static disassemblers. After analyzing the root causes of each type of deviation, we point out they are mostly due to ARM unpredictable instructions and program defects.

Decoder of x86 instruction for ARM-based embedded platform

A Hardware Non-Invasive Mapping Method for Condition Bits in Binary Translation

Research of dictionary compression scheme based on ARMv4 instruction set

SoC Design of X86 Based on ARM Embedded Platform

SPC-Indexed Indirect Branch Hardware Cache Redirecting Technique in Binary Translation

Design of a Media-Enhanced and Reconfigurable RISC ,Microprocessor

An instruction decoder for x86_64 based on specification language

TransARM: an Efficient Instruction Set Architecture Emulator

Simulation to ARM Processors Based on the Instruction's Eigenvalue

FPGA based hardware-software co-designed dynamic binary translation system

A Decoder for MPEG2 and AC3 with Embedded RISC Core

Differential Testing of X86 Instruction Decoders with Instruction Operand Inferring Algorithm

An Emulator for Executing IA-32 Applications on ARM-Based Systems.

A Parallel Implementation of MP3 Decoding Algorithm on Reconfigurable Computing Systems

D-ARM: Disassembling ARM Binaries by Lightweight Superset Instruction Interpretation and Graph Modeling.

Exploiting SIMD Asymmetry in ARM-to-x86 Dynamic Binary Translation

Analysis and Mapping of Video Decoding Algorithm on Coarse-Grain Reconfigurable Array

Software and Hardware Co-Design for Mp3 Decoder

Design of Instruction Decoder for Use in China for an Embedded MPU

Design and Implementation of ARM7 Instruction Set Based on GDB Framework

Idev: Exploring and Exploiting Semantic Deviations in ARM Instruction Processing