Abstract:Embedded systems are prone to leak information via side-channels associated with their physical internal activity, such as power consumption, timing, and faults. Leaked information can be analyzed to extract sensitive data and devices should be assessed for such vulnerabilities. Side-channel power-supply leakage from embedded devices can also provide information regarding instruction-level activity for control code executed on these devices. Methods proposed to disassemble instruction-level activity via side-channel leakage have not addressed issues related to pipelined multi-clock-cycle architectures, nor have proven robustness or reliability. The problem of detecting malicious code modifications while not obstructing the sequence of instructions being executed needs to be addressed. In this article, instruction sequences being executed on a general-purpose pipelined computing platform are identified and instructions that make up these sequences are classified based on hardware utilization. Individual instruction classification results using a fine-grained classifier is also presented. A dynamic programming algorithm was applied to detect the boundaries of instructions in a sequence with a 100 percent accuracy. A unique aspect of this technique is the use of multiple power supply pin measurements to increase precision and accuracy. To demonstrate the robustness of this technique, power leakage data from ten target FPGAs programmed with a prototype of the pipelined architecture was analyzed and classification accuracies averaging 99 percent were achieved with instructions labeled based on hardware utilization. Individual instruction classification accuracies above 90 percent were achieved using a fine-grained classifier. Classification accuracies were also verified when a target FPGA was subjected to different controlled temperatures. The classification accuracies on discrete (ASIC) pipelined-architecture microcontrollers was 97 percent.

Differential Testing of X86 Instruction Decoders with Instruction Operand Inferring Algorithm

In-depth Testing of X86 Instruction Disassemblers with Feedback Controlled DFS Algorithm

A Hardware Non-Invasive Mapping Method for Condition Bits in Binary Translation

A High-Coverage and Efficient Instruction-Level Testing Approach for X86 Processors

EXAMINER-PRO: Testing Arm Emulators Across Different Privileges

Idev: Exploring and Exploiting Semantic Deviations in ARM Instruction Processing

An instruction decoder for x86_64 based on specification language

Automatically Locating ARM Instructions Deviation between Real Devices and CPU Emulators

On a Consistency Testing Model and Strategy for Revealing RISC Processor's Dark Instructions and Vulnerabilities

On a Consistency Testing Model and Strategy for Revealing RISC Processor’s Dark Instructions and Vulnerabilities

Instruction Sequence Identification and Disassembly Using Power Supply Side-Channel Analysis

Instruction-level Hardware/software Partition Through DFG Exploration

An Instruction Inflation Analyzing Framework for Dynamic Binary Translators

A Fast Low-Level Error Detection Technique

Further Decimating the Inductive Programming Search Space with Instruction Digrams

Multimodal Instruction Disassembly with Covariate Shift Adaptation and Real-time Implementation

An Efficient Method for Custom Instruction Mapping under the Safety Assurance of Code Generation

Exploring Predictable Redundant Instruction Parallelism in Fault Tolerant Microprocessors

IntFinder: automatically detecting integer bugs in x86 binary program

Level Based Binary Translation System Back-end Instruction Indexing Strategy

WADIFF: A Differential Testing Framework for WebAssembly Runtimes