An LLVM-based hybrid binary translation system

Shen, Bor-Yeh; You, Jyun-Yan; Yang, Wuu; Hsu, Wei-Chung

doi:10.1109/sies.2012.6356589

Cited by 16 publications

(9 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Chen et al [99] proposed validating the static binary translator LLBT [79] and the hybrid binary translator [116], re-targeting ARM programs to x86 programs. First, an ARM program is translated offline to x86 program (via an intermediate translation to LLVM IR).…”

Section: Testing-based Approachesmentioning

confidence: 99%

Scalable validation of binary lifters

Dasgupta

Dinesh

Venkatesh

et al. 2020

Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

The ability to directly reason about binary machine code is desirable, not only because it allows analyzing binaries even when the source code is not available (e.g., legacy code, closed-source software, or malware), but also avoids the need to trust the correctness of compilers. Binary analysis is generally performed by existing decompiler projects by (1) converting raw bytes from the binary into a stream of assembly instructions through disassembly, (2) translating machine code to an intermediate representation (IR) using a binary lifter, and (3) performing various analysis and transformations on the IR pertaining to the specific goals of the decompiler. Many binary analysis frameworks published in academia or as open-source code, use such a lifter as the first step in their pipeline. Validating the correctness of binary lifters is pivotal to gain trust in binary analysis, especially when used in scenarios where correctness is essential. Unfortunately, existing approaches focus on validating the correctness of lifting a single instruction and do not scale to full programs. I believe an effort in the direction would enable both the developers of binary translators, to validate their implementation, and the clients of those translators, to gain trust in their analysis results. The overall goal of my work is to develop formal and informal techniques to achieve high confidence in the correctness of binary lifting by leveraging the semantics of the languages involved (e.g., Intel's x86-64 and LLVM IR). Towards that goal, I made two broad contributions. First, I defined the most complete and thoroughly tested formal semantics of x86-64 to date. The semantics faithfully formalizes all the non-deprecated, sequential user-level instructions of the x86-64 Haswell instruction set architecture. The formal specification covers 3155 instruction variants, corresponding to 774 mnemonics. The semantics is fully executable and has been tested against the GCC C-torture test suite. Moreover, each instruction is individually tested against more than 7,000 instruction-level test cases. This extensive testing paid off, revealing bugs in both the x86-64 reference manual and other existing semantics, which are all acknowledged, and some are fixed. Also, I illustrated potential applications of the semantics in different formal analyses, and discuss how it can be useful for processor verification. Second, I show that formal translation validation of single instructions for a complex ISA like x86-64 is not only practical but can be used as a building block for scalable full-program validation. My work is the first to do translation validation of single instructions on an Coming up to this point is one of the biggest challenges I have ever pursued in my life. This thesis would not have been possible if I did not have the support of the following people. I owe my deepest gratitude to my adviser, Professor Vikram Adve, whose guidance, patience, and encouragement have been pivotal in the successful completion of this thesis. He is one of the ...

show abstract

Section: Testing-based Approachesmentioning

confidence: 99%

Scalable validation of binary lifters

Dasgupta

Dinesh

Venkatesh

et al. 2020

Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

show abstract

“…For the difference in architecture characteristics of source and target platform, QEMU translator only simulates these characteristics through software when processing the floating point instructions [10]. That is, each floating point instruction is processed into a function reference of corresponding functions.…”

Section: Related Workmentioning

confidence: 99%

Floating Point Optimization Based on Binary Translation System QEMU

Shi¹,

Zhao²

2016

Proceedings of the 2016 2nd Workshop on Advanced Research and Technology in Industry Applications

View full text Add to dashboard Cite

Binary translation system, a technique for translating executable binary program, could transform the code operating on a system structure into the command of another system structure. However, in multi-source translation system, the efficiency in floating point instruction translation realized by relying on software is not high. The floating point computation capacity is the important indicator of computer performance. By taking SW processor as the target platform, translation algorithm for floating point optimization based on QEMU translation system is put forward. It mainly includes the following two stages: firstly, the content of identifying floating point computation invoking helper function, the number obtaining parameter and returned value, data type information; secondly, the floating point operation of changing into local floating point operation and reduce the redundant floating points according to the standard of IEEE. According to the experiment of NPB test set, it manifests that the average speed-up ratio of floating point optimization algorithm can reach 30%.

show abstract

“…The static binary translator to be validated is LLBT [4], which translates ARM programs to the target versions through the LLVM infrastructure [10] offline. The dynamic and the hybrid binary translators also translate ARM programs to LLVM IR, and their implementations are described in [7]. In this paper, LLBT, DBT, and HBT denote the static, dynamic, and hybrid binary translator to be validated, respectively.…”

Section: Overview Of Validation Modelmentioning

confidence: 99%

“…UQBT [2], FX!32 [3], and LLBT [4] are considered as static binary translators while Aries [5] and QEMU [6] are dynamic. Shen et al [7] also implement a hybrid binary translator, which runs statically translated code and invokes the dynamic binary translator whenever the codelocation problem [1] is encountered.…”

mentioning

confidence: 99%