Abstract:Code discovery has been a main challenge for static binary translation, especially when the source instruction set architecture has variable-length instructions, such as the x86 architectures. Due to embedded data such as PC (program counter)-relative data, jump tables, or paddings in the code section, a binary translator may be misled to translate data as instructions. For variable-length instructions, once a piece of data is mis-translated as instructions, decoding subsequent bytes could also go wrong. We are concerned with static binary translation for the very popular Advanced RISC Machine (ARM) architectures. Although ARM is considered a reduced instruction set computer architecture, it does allow the mix of 32-bit (ARM) instructions and 16-bit (Thumb) instructions in the same executables. In addition to different instruction lengths, the ARM and Thumb instructions are located at 4-byte or 2-byte aligned addresses, respectively. Furthermore, because ARM and Thumb instructions share the same encoding space, a 4-byte word could sometimes be decoded as one ARM instruction or two Thumb instructions. The correct decoding of this 4-byte word is actually determined at runtime by the least-significant bit of the program counter. For unstripped binaries, the mapping symbols can be used to identify ARM code regions and Thumb code regions. However, for stripped binaries, such mapping symbols are unavailable. We propose a novel solution to statically translate stripped ARM/Thumb mixed executables. Our solution is implemented in a static binary translator. The binary translator further generates multiple versions of translated code for the code regions whose types cannot be determined with our solution. One of the code versions is selected during runtime. The binary translator also includes a series of analyses that enable the removal of most useless code versions. Based on the experimental results on stripped ARM/Thumb mixed binaries in the SPEC2006 and Embedded Microprocessor Benchmark Consortium (EEMBC) benchmark suites, our static binary translator achieves impressive performance when migrating them to run on x86 machines and the space overhead is no more than 10%.

Security Testing of Software on Embedded Devices Using x86 Platform.

EXAMINER-PRO: Testing Arm Emulators Across Different Privileges

Armlock: Hardware-Based Fault Isolation For Arm

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

Hardware-Assisted Monitoring For Instruction Security In Embedded System

On Static Binary Translation of ARM/Thumb Mixed ISA Binaries

On a Consistency Testing Model and Strategy for Revealing RISC Processor's Dark Instructions and Vulnerabilities

On a Consistency Testing Model and Strategy for Revealing RISC Processor’s Dark Instructions and Vulnerabilities

SAPPX: Securing COTS Binaries with Automatic Program Partitioning for Intel SGX

A High-Coverage and Efficient Instruction-Level Testing Approach for X86 Processors

Dynamic Analysis and Debugging of Binary Code for Security Applications

Distributed Shielded Execution for Transmissible Cyber Threats Analysis

Firmware Re-hosting Through Static Binary-level Porting

A Comprehensive Study on ARM Disassembly Tools

A Comprehensive and Cross-Platform Test Suite for Memory Safety -- Towards an Open Framework for Testing Processor Hardware Supported Security Extensions

Securing Embedded System from Code Reuse Attacks: A Lightweight Scheme with Hardware Assistance

A Quantitative Study of Energy Consumption for Embedded Security.

A Dynamic Detective Method Against ROP Attack on ARM Platform

Exploiting SIMD Asymmetry in ARM-to-x86 Dynamic Binary Translation

Idev: Exploring and Exploiting Semantic Deviations in ARM Instruction Processing

A practical approach for finding anti-debugging routines in the Arm-Linux using hardware tracing