Abstract:Embedded systems are prone to leak information via side-channels associated with their physical internal activity, such as power consumption, timing, and faults. Leaked information can be analyzed to extract sensitive data and devices should be assessed for such vulnerabilities. Side-channel power-supply leakage from embedded devices can also provide information regarding instruction-level activity for control code executed on these devices. Methods proposed to disassemble instruction-level activity via side-channel leakage have not addressed issues related to pipelined multi-clock-cycle architectures, nor have proven robustness or reliability. The problem of detecting malicious code modifications while not obstructing the sequence of instructions being executed needs to be addressed. In this article, instruction sequences being executed on a general-purpose pipelined computing platform are identified and instructions that make up these sequences are classified based on hardware utilization. Individual instruction classification results using a fine-grained classifier is also presented. A dynamic programming algorithm was applied to detect the boundaries of instructions in a sequence with a 100 percent accuracy. A unique aspect of this technique is the use of multiple power supply pin measurements to increase precision and accuracy. To demonstrate the robustness of this technique, power leakage data from ten target FPGAs programmed with a prototype of the pipelined architecture was analyzed and classification accuracies averaging 99 percent were achieved with instructions labeled based on hardware utilization. Individual instruction classification accuracies above 90 percent were achieved using a fine-grained classifier. Classification accuracies were also verified when a target FPGA was subjected to different controlled temperatures. The classification accuracies on discrete (ASIC) pipelined-architecture microcontrollers was 97 percent.

A High-Coverage and Efficient Instruction-Level Testing Approach for X86 Processors

SPC-Indexed Indirect Branch Hardware Cache Redirecting Technique in Binary Translation

EXAMINER-PRO: Testing Arm Emulators Across Different Privileges

Differential Testing of X86 Instruction Decoders with Instruction Operand Inferring Algorithm

On a Consistency Testing Model and Strategy for Revealing RISC Processor's Dark Instructions and Vulnerabilities

On a Consistency Testing Model and Strategy for Revealing RISC Processor’s Dark Instructions and Vulnerabilities

In-depth Testing of X86 Instruction Disassemblers with Feedback Controlled DFS Algorithm

Shesha: Multi-head Microarchitectural Leakage Discovery in new-generation Intel Processors

Security Testing of Software on Embedded Devices Using x86 Platform.

Mitigating Code-Reuse Attacks On Cisc Architectures In A Hardware Approach

Idev: Exploring and Exploiting Semantic Deviations in ARM Instruction Processing

From Speculation to Security: Practical and Efficient Information Flow Tracking Using Speculative Hardware

Exploiting SIMD Asymmetry in ARM-to-x86 Dynamic Binary Translation

BETA: Automated Black-box Exploration for Timing Attacks in Processors

Overtake: Achieving Meltdown-type Attacks with One Instruction

Instruction Sequence Identification and Disassembly Using Power Supply Side-Channel Analysis

From Speculation to Security

Uncovering and Exploiting AMD Speculative Memory Access Predictors for Fun and Profit

A Comprehensive and Cross-Platform Test Suite for Memory Safety -- Towards an Open Framework for Testing Processor Hardware Supported Security Extensions

PERDICE: Towards Discovering Software Inefficiencies Leading to Cache Misses and Branch Mispredictions

Automatically Locating ARM Instructions Deviation between Real Devices and CPU Emulators