Paper Info
Title
Effective code discovery for ARM/Thumb mixed ISA binaries in a static binary translator
Abstract
Code discovery has been a main challenge for static binary translation, especially when the source ISA (Instruction Set Architecture) has variable-length instructions, such as the X86 architectures. Due to embedded data such as PC-relative data, jump tables, or paddings in the code section, a binary translator may be misled to translate data as instructions. With variable length instructions, once data is mis-translated as instructions, subsequent decoding of instructions could be wrong. This paper concerns static binary translation for the ARM architectures, which dominate the embedded-system market. Although ARM is considered RISC (Reduced Instruction Set Computing) in many aspects of processors, it does allow the mix of 32-bit instructions (ARM) with 16-bit instructions (Thumb) in the ARM/Thumb mixed executables. Since the instruction lengths of ARM and Thumb are not equal, the locations of the instructions could be 4-byte or 2-byte aligned addresses, respectively. Furthermore, because ARM and Thumb instructions share encoding space, a 4-byte word could be decoded as one ARM instruction or two Thumb instructions. The correct decoding of this 4-byte word is actually determined at run time by the least significant bit of the program counter. For unstripped binaries, mapping symbols can be used to identify ARM code regions and Thumb code regions. However, for stripped binaries, such mapping symbols are not available to assist translation. We have proposed a novel solution to statically translate the stripped executables for the ARM/Thumb mixed ISA. Our static binary translator includes a translation pass which guarantees the correctness of the translated executable by generating multiple versions of translated code for runtime selection. The binary translator also includes a series of optimization analyses which discover and remove most of the code generated in the baseline translation. Based on the SPEC2006 benchmark suite, stripped ARM/Thumb mixed binaries translated by our static binary translator achieve good performance with only 25% of code size increase.
Year
DOI
Venue
2013
10.1109/CASES.2013.6662525
CASES
Keywords
Field
DocType
arm code region,arm code regions,mixed isa binary,thumb instruction,program interpreters,code discovery,spec2006 benchmark suite,instruction set architecture,embedded system market,reduced instruction set computing,x86 architectures,thumb code regions,optimization analysis,static binary translation,variable-length instructions,arm-thumb mixed isa binaries,arm architecture,translation pass,16-bit instructions,data translation,runtime selection,mapping symbol,instruction sets,binary translator,reverse engineering,arm instruction,embedded data,embedded systems,effective code discovery,arm architectures,static binary translator,4-byte word,32-bit instructions,risc,code discovery problem,thumb code region
x86,ARM architecture,Programming language,Computer science,Instruction set,Parallel computing,Program counter,Real-time computing,Reduced instruction set computing,Binary translation,Decoding methods,Executable
Conference
ISBN
Citations 
PageRank 
978-1-4799-1400-5
4
0.40
References 
Authors
16
5
Name
Order
Citations
PageRank
Jiunn-Yeu Chen1151.98
Bor-Yeh Shen2254.00
Quan-Huei Ou340.74
WUU YANG438355.85
Wei-Chung Hsu571958.87