Hardware‐assisted software event tracing

Verge, A. Roig; Ezzati‐Jivan, Naser; Dagenais, Michel R.

doi:10.1002/cpe.4069

Cited by 15 publications

(5 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Table V is introduced by non-deterministic events (such as context switches). Verge et al [23] showed that an execution time overhead could occur if traces are stored in the ETB. In this work, as shown in Table V, the time overhead of CoreSight components is negligible for two main reasons.…”

Section: Implementation Resultsmentioning

confidence: 99%

ARMHEx: A hardware extension for DIFT on ARM-based SoCs

Wahab¹,

Cotret²,

Allah³

et al. 2017

2017 27th International Conference on Field Programmable Logic and Applications (FPL)

View full text Add to dashboard Cite

Abstract-Security is a major issue nowadays for the embedded systems community. Untrustworthy authorities may use a wide range of attacks in order to retrieve critical information. This paper introduces ARMHEx, a practical solution targeting DIFT (Dynamic Information Flow Tracking) on ARM-based SoCs (e.g. Xilinx Zynq). Current DIFT implementations suffer from two major drawbacks. First, recovering required information for DIFT is generally based on software instrumentation leading to high time overheads. ARMHEx takes profit of ARM CoreSight debug components and static analysis to drastically reduce instrumentation time overhead (up to 90% compared to existing works). Then, security of the DIFT hardware extension itself is not considered in related works. In this work, we tackle this issue by proposing a solution based on ARM Trustzone.

show abstract

Section: Implementation Resultsmentioning

confidence: 99%

ARMHEx: A hardware extension for DIFT on ARM-based SoCs

Wahab¹,

Cotret²,

Allah³

et al. 2017

2017 27th International Conference on Field Programmable Logic and Applications (FPL)

View full text Add to dashboard Cite

show abstract

“…In the first part, we discuss the CPU-level tracing functionality designed for debugging and optimizing systems and processes 14 , as in analyzing bugs or crashes and checking control flow integrity for safe execution. Diverse research efforts have been made to analyze crashes and bugs [15][16][17][18][19][20] .…”

Section: Related Workmentioning

confidence: 99%

A practical approach for finding anti-debugging routines in the Arm-Linux using hardware tracing

Park,

Choi,

Choi

et al. 2024

Sci Rep

View full text Add to dashboard Cite

As IoT devices are being widely used, malicious code is increasingly appearing in Linux environments. Sophisticated Linux malware employs various evasive techniques to deter analysis. The embedded trace microcell (ETM) supported by modern Arm CPUs is a suitable hardware tracer for analyzing evasive malware because it is almost artifact-free and has negligible overhead. In this paper, we present an efficient method to automatically find debugger-detection routines using the ETM hardware tracer. The proposed scheme reconstructs the execution flow of the compiled binary code from ETM trace data. In addition, it automatically identifies and patches the debugger-detection routine by comparing two traces (with and without the debugger). The proposed method was implemented using the Ghidra plug-in program, which is one of the most widely used disassemblers. To verify its effectiveness, 15 debugger-detection techniques were investigated in the Arm-Linux environment to determine whether they could be detected. We also confirmed that our implementation works successfully for the popular malicious Mirai malware in Linux. Experiments were further conducted on 423 malware samples collected from the Internet, demonstrating that our implementation works well for real malware samples.

show abstract

“…Moreover, we used LTTng (Linux Tracing Toolkit Next Generation) [17] for sampling and collecting packet information from traffic. The details of collecting data from LTTng and modeling them at multiple levels to be used for advance attack analysis can be found at [32,29].…”

Section: Setup Configurationmentioning

confidence: 99%