Randomized instruction set emulation to disrupt binary code injection attacks

Chapter Two - Emulation: Interpretation and Binary Translation

In the era of mobile and cloud computing, cross-ISA (Instruction Set Architecture) binary translation attracts increasing attentions due to the ISA diversity of computing platforms. To easily adapt to vast guest- and host-ISAs with minimal porting efforts, existing cross-ISA binary translators (e.g., QEMU) are typically built upon ISA-independent Intermediate Representation (IR). Although IR conceals the architectural details of different IS As, it also prevents enforcing several effective ISA-specific optimizations, which results in severe performance degradation. To improve the performance of cross-ISA binary translation without loss of portability, we present a fast cross-ISA binary translator, Hermes, by conducting post-optimization on the translated code, rather than on the IR as conventional binary translators do. The proposed post-optimization technique uses Host-specific Data Dependence Graph (HDDG) to significantly eliminate redundant instructions, including arithmetic, load/store and call/return-emulation instructions. To validate our approach, we implement Hermes on a commercial MIPS host system for both ×86 and ARM guest. Compared with QEMU dynamic binary translator, HERMES improves the performance by a factor of 3.14× and 5.18× for ×86 and ARM guest, respectively. Compared with state-of-the-art static binary translator, HERMES achieves comparable performance, while it reduces the translation overhead by 185×.

Architecture specifications such as Armv8-A and RISC-V are the ultimate foundation for software verification and the correctness criteria for hardware verification. They should define the allowed sequential and relaxed-memory concurrency behaviour of programs, but hitherto there has been no integration of full-scale instruction-set architecture (ISA) semantics with axiomatic concurrency models, either in mathematics or in tools. These ISA semantics can be surprisingly large and intricate, e.g. 100k+\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$+$$\\end{document} lines for Armv8-A. In this paper we present a tool, Isla, for computing the allowed behaviours of concurrent litmus tests with respect to full-scale ISA definitions, in the Sail language, and arbitrary axiomatic relaxed-memory concurrency models, in the Cat language. It is based on a generic symbolic engine for Sail ISA specifications. We equip the tool with a web interface to make it widely accessible, and illustrate and evaluate it for Armv8-A and RISC-V. The symbolic execution engine is valuable also for other verification tasks: it has been used in automated ISA test generation for the Arm Morello prototype architecture, extending Armv8-A with CHERI capabilities, and for Iris program-logic reasoning about binary code above the Armv8-A and RISC-V ISA specifications. By using full-scale and authoritative ISA semantics, Isla lets one evaluate litmus tests using arbitrary user instructions with high confidence. Moreover, because these ISA specifications give detailed and validated definitions of the sequential aspects of systems functionality, as used by hypervisors and operating systems, e.g. instruction fetch, exceptions, and address translation, our tool provides a basis for developing concurrency semantics for these. We demonstrate this for the Armv8-A instruction-fetch and virtual-memory models and examples of Simner et al.

We describe the design issues in an implementation of the ESA/390 architecture based on binary translation to a very long instruction word (VLIW) processor. During binary translation, complex ESA/390 instructions are decomposed into instruction “primitives” which are then scheduled onto a wide-issue machine. The aim is to achieve high instruction level parallelism due to the increased scheduling and optimization opportunities which can be exploited by binary translation software, combined with the efficiency of long instruction word architectures. A further aim is to study the feasibility of a common execution platform for different instruction set architectures, such as ESA/390, RS?6000, AS/400 and the Java Virtual Machine, so that multiple systems can be built around a common execution platform.

The University of Queensland Binary Translator (UQBT) is a static binary translation framework that allows for the translation of binary, executable programs, from one architecture to another one. Using different specification files, the UQBT can be easily tailored for either a new source or target architecture. UQBT employs sophisticated analyses in order to abstract the binary code front the features of the source architecture. In static binary translation, it is not always possible to decode and translate all paths of a program statically, as instructions like computed jumps and indexed calls rely on runtime values. An interpreter is commonly used at runtime to translate such pieces of code, at the expense of runtime. In this paper we present a technique to statically recover the code of virtual method dispatchers, which enhances the abstraction front the binary code. We also show how the statically recovered information is then used by a dynamic environment to analyse virtual tables in order to increase the code coverage for the binary translator. The technique has been tested on SPARC(R) and Pentium machines using binaries of different C++ compilers, and preliminary results are presented.

The reflected (Gray) binary code has previously been used primarily in analog-to-digital conversion applications. However, the reflected binary code has, in addition, characteristics which strongly recommend it as a design factor in the synthesis of digital elements within closed-loop control systems. This paper describes several designs of typical reflected binary switching circuits. These switching circuits are, specifically, a reflected-to-conventional binary translator, reflected binary-to-analog converters, and a reflected binary contactor comparator. All of the circuit designs are logically related to the form of the reflected-to-conventional binary translator. These switching circuits can be used as digital control elements in the described original types of digital positional servomechanisms and digital accumulators.

Static binary translation (SBT) systems and dynamic binary translation (DBT) systems have their own merits and disadvantages. SBT can perform whole-program optimizations and do not incur run-time overheads. However, the code discovery and the code location problems caused by indirect branches make SBT systems hard to develop. On the other hand, DBT can perform optimizations based on program's runtime behaviors and can handle indirect branches easily. However, because the translation time accounts for a part of the execution time, DBT systems cannot perform aggressive optimizations. Therefore, quality of the code generated by DBT is not as good as that by SBT. In this paper, we present a hybrid binary translation (HBT) system which combines the merits of both SBT and DBT. It leverages the LLVM infrastructure to translate source binary code, optimize, and generate target binary code. It first translates binary statically. If a run-time exception happens, the HBT system switches to dynamic translation. On the EEMBC benchmark suite, our experimental result shows that the HBT system can run about 4 to 20 times faster than a LLVM-based DBT system.

Currently, multicore processors are widely used, and processing performance can be improved on many machines by exploiting thread level parallelism. However, for parallelizing a program, it takes much time and effort to analyze effect of parallel processing and to rewrite the source code, so sequential programs still remain around the world, and they can not fully bring out performance of multicore processors. To improve execution performance of existing sequential programs by effectively utilizing processing power of multicore processors, it is quite useful to automatically and directly parallelize a machine language code (binary code) by using binary translation. Based on this background, an automatic parallel processing system that parallelizes and optimizes a sequential binary code using LLVM was proposed. In this paper, we introduce parallelization directives for LLVM IR (Intermediate Representation), and implement an LLVM compiler pass for parallel code generation based on the directives. Our research makes it possible to implement analysis and code generation as versatile programs, and to generate an optimal code according to the multiple analysis results. Evaluation results show that the implemented pass can generate a parallelized IR code and can achieve speedup as highly as the parallelization using source code does.

CPU contains the most critical technology of computer. At present, popular processors use not only X86 instruction set such as Intel and AMD, but also MIPS instruction set such as Loongson, Alpha instruction set such as Shenwei, and ARM instruction set such as Phytium. Aiming at the requirement of high performance computing and high bandwidth communication, a high performance server used four channel S2500 processors is proposed based on CC-NUMA parallel processing architecture. In the present paper, the characteristics of S2500 processor are analyzed, the typical operation mode of instruction pipeline is studied, and the topology of 4 way S2500 processors is proposed. While the parallel computing performance of the system is improved, TOE technology is applied to the system in order to minimize the occupancy of CPU resources in full-load communication of 10G Ethernet interface. By the test of comparing the computing performance of single processor and four channel processors, and the CPU occupancy rate of common network card and TOE network card, the results show that the server can achieve efficient parallel computing capability by using CC-NUMA architecture and 4 way S2500 processors. The TOE chip can guarantee 10G Ethernet communication capability while occupying CPU resources as little as possible. The designed system is suitable for application scenarios of high performance computing and high communication bandwidth.

Dynamic test generation approach is becoming increasingly popular to find security vulnerabilities in software. More and more research institutes and organizations use this approach to find security vulnerabilities in binary code. However, the existing binary level dynamic test generation approaches and tools are not retargetable, and can only find vulnerabilities in binaries for a specific ISA. This paper presents a new binary-level dynamic test generation technique and a tool, ReTBLDTG, short for retargetable binary-level dynamic test generation, that implements this technique. Unlike other such techniques that can operate only on binaries in a specific ISA, ReTBLDTG takes binaries of any ISAs as input and dynamically generates new inputs that exercise different control paths in the program, which may lead to security vulnerabilities. ReTBLDTG defines a meta instruction set architecture (MetalSA); ReTBLDTG maps the execution information, which is collected during the binary source code execution, to MetalSA; and symbolic execution, constraint collection and constraint solver operates on MetalSA, thus making these processes ISA-independent. We have implemented our ReTBLDTG, retargeted it to 32-bit x86, PowerPC and Sparc ISAs, and used it to automatically find the six known bugs in the six benchmarks. Our results indicate that our ReTBLDTG can be easily retargeted to any ISA with only a few overheads; and ReTBLDTG can effectively find bugs located deep within large applications from their binaries for 32-bit x86, PowerPC or Sparc ISA.

This tutorial offers a pedagogical guide to hybrid quantum processors that integrate discrete-variable (DV) qubits and continuous-variable (CV) oscillators. Aimed at computer scientists, engineers, and physicists, it provides an overview of the experimental, algorithmic, and architectural aspects of this novel and rapidly developing hardware model. Experimental realizations of this model include superconducting, trapped-ion, and neutral-atom platforms. By combining DV and CV components, hybrid oscillator-qubit processors enable a powerful new paradigm that offers complementary strengths for quantum control, error correction, computation, and simulation. Working toward the goal of a full-stack system connecting applications to CV-DV hardware, we define and formulate abstract machine models and instruction set architectures. These essential abstractions enable codesign of hardware and software, and resource estimation for exploring the potential of current and future hardware for computational and simulation tasks. Using these abstractions, we present both new and existing examples that illustrate the benefits of hybrid CV-DV processors relative to traditional DV-only hardware in computation as well as quantum simulation of physical models. Examples include algorithms for transferring states between DV and CV systems, performing the quantum Fourier transform, and simulation of lattice gauge theories. Relative to qubit-only hardware, the bosonic degrees of freedom natively available in hybrid architectures can substantially reduce the circuit complexity of simulations for physical models containing bosons. A key technique is the extension of quantum signal processing ideas to CV-DV systems. This work is intended to serve as a timely and comprehensive guide to this relatively unexplored yet promising approach to quantum computation and to provide a road map to guide future development.

Computer languages design is a fundamental subject in Computer Science and instruction sets are not an exception. Considering concurrency, and particularly superscalar processing, an important fact is to identify those characteristics of the instruction set architecture that may cause extra code coupling. Because of its current extended use, the x86 instruction set was chosen for analysis. We present a study of the use distribution of architectonic registers, including implicit usage, taken from execution traces of a test bench. Then we identify as potential coupling sources the implicit and dedicated use of certain registers, condition codes utilization and some mechanisms of effective memory address computation.

Dynamic binary translation (DBT) is a core technologyto many important applications such as system virtualization, dynamic binary instrumentation, and security. However, there are several factors that often impede its performance: 1) emulation overhead before translation; 2) translation and optimization overhead; and 3) translated code quality. The issues also include its retargetabilitythat supports guest applications from different instruction-set architectures (ISAs) to host machines also with different ISAs-an important feature to system virtualization. In this work, we take advantage of the ubiquitous multicore platforms, and use a multithreaded approach to implement DBT. By running the translator and the dynamic binary optimizer on different cores with different threads, it could off-load the overhead incurred by DBT on the target applications; thus, afford DBT of more sophisticated optimization techniques as well as its retargetability. Using QEMU (a popular retargetable DBT for system virtualization) and Low-Level Virtual Machine (LLVM) as our building blocks, we demonstrated in a multithreaded DBT prototype, called Hybrid-QEMU (HQEMU), that it could improve QEMU performance by a factor of 2.6x and 4.1x on the SPEC CPU2006 integer and floating point benchmarks, respectively, for dynamic translation of x86 code to run on x86-64 platforms. For ARM codes to x86-64 platforms, HQEMU can gain a factor of 2.5x speedup over QEMU for the SPEC CPU2006 integer benchmarks. We also address the performance scalability issue of multithreaded applications across ISAs. We identify two major impediments to performance scalability in QEMU: 1) coarse-grained locks used to protect shared data structures, and 2) inefficient emulation of atomic instructions across ISAs. We proposed two techniques to mitigate those problems: 1) using indirect branch translation caching (IBTC) to avoid frequent accesses to locks, and 2) using lightweight memory transactions to emulate atomic instructions across ISAs. Our experimental results show that for multithread applications, HQEMU achieves 25X speedups over QEMU for the PARSEC benchmarks.

Binary translators, which translate the binary executables from one instruction set to another, are useful tools. Indirect branches are one of the key factors that affect the efficiency of binary translators. In the previous research, our lab developed an LLVM-based binary translation framework, called Rabbit. Rabbit introduces novel optimisations: platform-dependent hyperchaining and platform-independent hyperchaining for improving the emulation of the indirect branch instructions. Indirect branch instructions may have several destinations, and these destinations are not known until runtime. Both platform-independent and platform-dependent hyperchaining establish a search table for each indirect branch instruction to record the visited branch destinations at runtime. In this work, we focus on the translation from AArch64 binary to RISC-V binary and further develop the profile-guided optimisation for indirect branch, which collects runtime information, including branch destinations and execution frequency of each destination for each indirect branch instruction, and then use the information to improve hyperchaining (i.e. accelerate the process of finding the branch destination). The profile-guided optimisation can be divided to profile-guided platform-independent hyperchaining and profile-guided platform-dependent hyperchaining. We finally use SPEC CPU 2006 CINT benchmark to evaluate the optimisations. The experiment results indicate that compared with (1) no chaining, (2) platform-independent hyperchaining and (3) platform-dependent hyperchaining, profile-guided platform-independent hyperchaining provides 1.123×, 1.066× and 1.098× speedup respectively. Similarly, profile-guided platform-dependent hyperchaining achieves 1.106×, 1.047× and 1.083× speedup with respect to the above three configurations, respectively.

One of the fundamental problems with the analysis of binary (executable) code is that of recognizing, in a machine-independent way, the target addresses of n-conditional branches implemented via a jump table. Without these addresses, the decoding of the machine instructions for a given procedure is incomplete, as well as any analysis on that procedure. We present a technique for recovering jump tables and their target addresses in a machine and compiler independent way. The technique is based on slicing and expression substitution. The assembly code of a procedure that contains an indexed jump is transformed into a normal form which allows us to determine where the jump table is located and what information it contains (e.g. offsets from the table or absolute addresses). The technique has been tested on SPARC and Pentium code generated by C, C++, Fortran and Pascal compilers. Our tests show that up to 90% more of the code in a text segment can be found by using this technique.