Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM

Muhui Jiang, Tianyi Xu, Yajin Zhou, Yufeng Hu, Ming Zhong, Lei Wu, Xiapu Luo, Kui Ren

Research output: Chapter in book / Conference proceedingConference article published in proceeding or bookAcademic researchpeer-review

Abstract

Emulators are widely used to build dynamic analysis frameworks due to its fine-grained tracing capability, full system monitoring functionality, and scalability of running on different operating systems and architectures. However, whether emulators are consistent with real devices is unknown. To understand this problem, we aim to automatically locate inconsistent instructions, which behave differently between emulators and real devices. We target the ARM architecture, which provides machine-readable specifications. Based on the specification, we propose a sufficient test case generator by designing and implementing the first symbolic execution engine for the ARM architecture specification language (ASL). We generate 2,774,649 representative instruction streams and conduct differential testing between four ARM real devices in different architecture versions (i.e., ARMv5, ARMv6, ARMv7, and ARMv8) and three state-of-The-Art emulators (i.e., QEMU, Unicorn, and Angr). We locate a huge number of inconsistent instruction streams (171,858 for QEMU, 223,264 for unicorn, and 120,169 for Angr). We find that undefined implementation in ARM manual and bugs of emulators are the major causes of inconsistencies. Furthermore, we discover 12 bugs, which influence commonly used instructions (e.g., BLX). With the inconsistent instructions, we build three security applications and demonstrate the capability of these instructions on detecting emulators, anti-emulation, and anti-fuzzing.

Original languageEnglish
Title of host publicationASPLOS 2022 - Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems
EditorsBabak Falsafi, Michael Ferdman, Shan Lu, Thomas F. Wenisch
PublisherAssociation for Computing Machinery
Pages846-858
Number of pages13
ISBN (Electronic)9781450392051
DOIs
Publication statusPublished - 28 Feb 2022
Event27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS 2022 - Virtual, Online, Switzerland
Duration: 28 Feb 20224 Mar 2022

Publication series

NameInternational Conference on Architectural Support for Programming Languages and Operating Systems - ASPLOS

Conference

Conference27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS 2022
Country/TerritorySwitzerland
CityVirtual, Online
Period28/02/224/03/22

Keywords

  • Differential Testing
  • Emulator
  • Inconsistent Instructions

ASJC Scopus subject areas

  • Software
  • Information Systems
  • Hardware and Architecture

Cite this