Binary Translation Research Articles

EFACT: An External Function Auto-Completion Tool to strengthen static binary lifting

Static binary lifting is essential in binary rewriting frameworks. Existing tools overlook the impact of External Function Completion (EXFC) in static binary lifting. EXFC recovers the declarations of External Functions (EXFs, functions defined in standard shared libraries) using only the function symbols available. Incorrect EXFC can misinterpret the source binary, or cause memory overflows in static binary translation, which eventually results in program crashes. Notably, existing tools struggle to recover the declarations of mangled EXFs originating from binaries compiled from C++. Moreover, they require time-consuming manual processing to support new libraries.This paper presents EFACT, an External Function Auto-Completion Tool for static binary lifting. Our EXF recovery algorithm better recovers the declarations of mangled EXFs, particularly addressing the template specialization mechanism in C++. EFACT is designed as a lightweight plugin to strengthen other static binary rewriting frameworks in EXFC. Our evaluation shows that EFACT outperforms RetDec and McSema in mangled EXF recovery by 96.4% and 97.3% on SPECrate 2017.Furthermore, we delve deeper into static binary translation and address several cross-ISA EXFC problems. When integrated with McSema, EFACT correctly translates 36.7% more benchmarks from x86-64 to x86-64 and 93.6% more from x86-64 to AArch64 than McSema alone on EEMBC.

Performance Improvements via Peephole Optimization in Dynamic Binary Translation

The emergence of new instruction set architectures (ISAs) poses challenges in ensuring compatibility with legacy applications. Dynamic binary translation (DBT) serves as a crucial approach for achieving cross-ISA compatibility, enabling legacy applications to run compatibly with cross-ISAs. However, software-based translation encounters significant performance overhead, including substantial memory access and insufficient exploitation of target architecture features. The significant performance overhead challenges hinder the practical implementation of DBT. In this paper, we investigate a novel peephole optimization approach. First, we perform peephole analysis to identify redundant memory access and suboptimal instruction sequences. Next, we leverage live variable analysis to eliminate redundant memory-access instructions. Additionally, we bridge the gaps between cross-ISAs by exploiting ISA-specific features through instruction fusion. Finally, we implement the proposed optimization design using the open-source QEMU and extensively evaluate it on both ARM64 and SW64 platforms. The experimental results reveal that SPEC2006 benchmark effectively gets a maximum performance speedup of 1.52×, alongside a reduction in code size of up to 13.98%. These results affirm the effectiveness of our optimization approach in DBT performance and code sizes.

SPC-Indexed Indirect Branch Hardware Cache Redirecting Technique in Binary Translation

In the domain of process virtual machine (PVM) binary translation, the difference in address space layout between the guest program and the translated program requires the recalculation of jump instruction targets, resulting in suboptimal execution efficiency. This paper presents a novel method called SPC-Indexed Indirect Branch Hardware Cache Redirecting (SPCIC) technique. SPCIC utilizes specialized branch instruction to represent indirect branches from guest programs while frequently-used target addresses are cached in a customized hardware mapping table. When translating an indirect branch, SPCIC queries the jump target cache first to achieve a fast redirection unless the destination address is not cached. Besides, SPCIC merely falls back to the software-based remapping approach when the query fails, improving the translation efficiency to the greatest extent. SPCIC is implemented on the QEMU platform to accelerate the translation of ARM payloads into RISC-V. Experiments are carried on SPEC2006 to demonstrate the effectiveness of SPCIC for reducing the runtime overhead of indirect branch translation. The experimental results indicate up to 11% average improvement and 35% maximum improvement are obtained on the selected benchmark.

An Instruction Inflation Analyzing Framework for Dynamic Binary Translators

Dynamic binary translators (DBTs) are widely used to migrate applications between different instruction set architectures (ISAs). Despite extensive research to improve DBT performance, noticeable overhead remains, preventing near-native performance, especially when translating from complex instruction set computer (CISC) to reduced instruction set computer (RISC). For computational workloads, the main overhead stems from translated code quality. Experimental data show that state-of-the-art DBT products have dynamic code inflation of at least 1.46. This indicates that on average, more than 1.46 host instructions are needed to emulate one guest instruction. Worse, inflation closely correlates with translated code quality. However, the detailed sources of instruction inflation remain unclear. To understand the sources of inflation, we present Deflater , an instruction inflation analysis framework comprising a mathematical model, a collection of black-box unit tests called BenchMIAOes , and a trace-based simulator called InflatSim . The mathematical model calculates overall inflation based on the inflation of individual instructions and translation block optimizations. BenchMIAOes extract model parameters from DBTs without accessing DBT source code. InflatSim implements the model and uses the extracted parameters from BenchMIAOes to simulate a given DBT’s behavior. Deflater is a valuable tool to guide DBT analysis and improvement. Using Deflater, we simulated inflation for three state-of-the-art CISC-to-RISC DBTs: ExaGear, Rosetta2, and LATX, with inflation errors of 5.63%, 5.15%, and 3.44%, respectively for SPEC CPU 2017, gaining insights into these commercial DBTs. Deflater also efficiently models inflation for the open source DBT QEMU and suggests optimizations that can substantially reduce inflation. Implementing the suggested optimizations confirms Deflater’s effective guidance, with 4.65% inflation error, and gains 5.47x performance improvement.

Enhancing Building Energy Efficiency through Building Information Modeling (BIM) and Building Energy Modeling (BEM) Integration: A Systematic Review

With the ever-increasing population and historic highest energy demand, the energy efficiency of buildings is becoming crucial. Architectural firms are moving from traditional Computer-Aided Design (CAD) to BIM. However, nearly 40% of the energy consumption is due to buildings. Therefore, there is a need to integrate BIM with Building Energy Modeling (BEM), which presents an innovative opportunity to demonstrate the potential of BIM to minimize energy consumption by integrating building information software with data from existing energy-efficient building automation systems (EBAS). BEM is a form of computational analysis that can be used in conjunction with BIM or Computer-Aided Engineering (CAE) systems. In this paper, an attempt has been made to explore the existing literature on BIM and BEM and identify the effect of the integration of BEM in BIM in the design phase of the project. A recent survey from the last ten years (2012 to 2023) was carried out on Google Scholar, Web of Science, Science Direct, and Scopus databases. Inclusion/exclusion criteria were applied, and papers were scrutinized. From the results, it can be observed that the convergence of BIM and BEM is found to be useful in practical applications; however, projects with short life cycles might not be suitable for this solution. Challenges exist in the interoperability tools which have restrictions on data exchange. Binary translation is found to be the most suitable candidate for data exchange. The analysis further showed that the most used program for integrating BIM/BEM is Green Building Studio developed by Autodesk to improve construction and operational efficiencies.

Towards Efficient Dynamic Binary Translation Optimizations Based on RISC Architectural Features

Dynamic binary translation (DBT) is a core technology that enables the migration of legacy software to different instruction set architectures while maintaining the original semantics. However, the development and maintenance of an efficient cross-DBT system are challenging. Key challenges include memory access overhead, inefficient instruction simulation, and frequent context switches. In this paper, we propose three novel optimization techniques. First, we formalize a register mapping cost model and investigate a hierarchical register mapping approach to bridge the memory access overhead. Second, we accelerate floating point (FP) emulation by surrounding the use of hardware FP unit with high-efficiency non-FP code. Third, we present a function inlining approach to alleviating the overhead associated with indirect control lookup. On the system side, we implement our approach on ARM64 and SW64 architectures based on QEMU and extensively evaluate the effectiveness with the SPEC2006 benchmark suite. The experimental results show that an average of 1.28× performance speedup and 13.41% code size reduction can be achieved on SW64. Similarly, on ARM64, we achieve an average of 1.15× performance speedup and 11.48% code size reduction.

Management of Hardware Vulnerabilities in the Life Cycle Stages of Microprocessors and Computers

This article discusses the topical issues of managing information security vulnerabilities in the life cycle stages of processors and computer equipment. An analysis of the experience of identifying vulnerabilities in the course of the joint design of the processor, computing module and computing complex was carried out. A number of actions have been developed and presented to ensure the control of hardware vulnerabilities in the development stage. The use of the binary translation technology of the Elbrus platform is proposed to prevent the execution of malicious software. A method has been developed to eliminate vulnerabilities in computer equipment for automated systems used for various purposes by using the Lintel binary translation system component. An experiment is described, the purpose of which was to successfully exploit the Meltdown vulnerability on a computer with an Elbrus processor. The experiment showed that, due to the peculiarities of the microarchitecture of Elbrus processors, the exploitation of Meltdown-type vulnerabilities is impossible.

A Dynamic and Static Binary Translation Method Based on Branch Prediction

Binary translation is an important technique for achieving cross-architecture software migration. However, mainstream dynamic binary translation frameworks, such as QEMU, often generate a large amount of redundant code, which degrades the efficiency of the target code. To this end, we propose a dynamic–static binary translation method based on branch prediction. It first identifies parts of translation blocks following static branch prediction techniques. Then it translates these translation blocks into less-redundant native code blocks by canonical static translation algorithms. Finally, it executes all code blocks that are translated either statically or dynamically by correctly maintaining and switching their running contexts. In order to correctly weave the two types of translation activities, the proposed method only translates the next translation block that is data-independent from the current one by the active variable analysis algorithm, and records and shares the intermediate states of the dynamic and static translation activities via a carefully designed data structure. In particular, a shadow register-based context recovery mechanism is proposed to correctly record the running context of static translation blocks, and to correctly recover the context for dynamically translating and running blocks that were not statically translated. We also designed an adaptive memory optimization mechanism to dynamically release the memory of the mispredicted translation blocks. We implemented a dynamic–static binary translation framework by extending QEMU, called BP-QEMU (QEMU with branch prediction). We evaluated the translation correctness of BP-QEMU using the testing programs for the ARM and PPC instruction sets from QEMU, and evaluated the performance of BP-QEMU using the CoreMark benchmark code. The experimental results show that BP-QEMU can translate the instructions from the ARM and PPC architectures correctly; moreover, the average execution efficiency of the CoreMark code on BP-QEMU improves by 13.3% compared to that of QEMU.

A Hardware Non-Invasive Mapping Method for Condition Bits in Binary Translation

Binary translation, as an important bridge for application compatibility between different instruction set architectures (ISAs), has attracted much attention in the industry. However, due to hardware resource limitations of the target ISA, the translation efficiency and the practicability are poor. Recently, Apple has made it possible to run x86 programs on ARM through a translation technology called Rosetta based on software-hardware collaboration. In this paper, we proposed a hardware non-invasive mapping method for condition bits (HNIMCB) in binary translation, which innovatively implements the setting and referencing operations of the condition bits without changing the original instruction encoding and function of the target processor. This method is applicable for binary translation from source architectures with condition bit operations to target architectures without condition bit operations. It eliminates the difference of conditional bit resources between the source and target ISAs, reduces the computational instructions and memory access operations after translation from the source to the target ISA, and dramatically improves the translation efficiency. We conducted this experiment on a functional simulation level using the QEMU binary translator from ARM to RISC-V. A series of benchmark tests revealed that the total number of instructions decreased by 41%, while the number of memory access instructions decreased by 37% after the translation applying with the HNIMCB.

La traducción y lo lúdico en el cambio social

Abstract Gender-inclusive language, both binary and non-binary, advocates for wider visibility of non-dominant genders. However, in the Spanish context, this language, especially the binary variant, has been received with much opposition led by the institution establishing linguistic norms. This paper addresses the possibility of using gender-inclusive language as a political practice in translation and explores how entertainment genres, particularly comics, and information on the social goals of heterodox linguistic practices may be conducive to relaxing the adherence to dominant doxas. By priming responses based on two gender-inclusive (one binary and one non-binary) translations of the comic Morgane by Kansara and Fert, differences between four focus groups were analyzed. Two of them received a briefing session detailing the social agenda of gender-inclusive language, and two were offered no such sessions before reading and discussing the translations. Results showed how the briefing sessions relaxed adherence to the dominant doxa even though the social purpose of gender-inclusive language was widely questioned. Further, results evinced that binary translation was more strongly opposed than the non-binary variant. It is argued that translation can be used as a tool for political and social change and become instrumental in advocating for equal opportunities for all genders.

Identifying Light Verb Constructions in Indonesian: A Direct Translation Approach

This study aimed to identify light verb constructions (LVCs) in Indonesian based on machine translation methods, namely binary translation or direct translation. Based on the method, the LVCs of the source language (SL) were selected and utilized to construct the LVCs counterpart of the target language (TL). The SL instrument has been developed using previous studies on English and Hungarian, namely the LVCs matrix formulated by Vincze (2011). The TL data were in the equivalent forms of LVCs in Indonesian. Data analysis was carried out based on morphosemantics and morphosyntax. Based on the study, the result was stated as follows, i.e. (i) there were translation work procedures that needed to be carried out to process LVCs from SL to TL regarding the type of translator, limited text selection, and final counterpart assignation; (ii) there were changes in the morphosemantic features of LVCs from SL to TL during the translation process; and (iii) there were grammatical exceptions that cannot be resolved through binary translation methods. This study also suggested a further analysis of LVCs identification through another method, for instance, information retrieval (IR) and information extraction (IE), in the light of computational linguistics.

Hyperchaining for LLVM-Based Binary Translators on the x86-64 Platform

Hyperchaining for LLVM-Based Binary Translators on the x86-64 Platform

Dynamic Binary Translation for SGX Enclaves

Enclaves, such as those enabled by Intel SGX, offer a hardware primitive for shielding user-level applications from the OS. While enclaves are a useful starting point, code running in the enclave requires additional checks whenever control or data is transferred to/from the untrusted OS. The enclave-OS interface on SGX, however, can be extremely large if we wish to run existing unmodified binaries inside enclaves. This article presents Ratel , a dynamic binary translation engine running inside SGX enclaves on Linux. Ratel offers complete interposition , the ability to interpose on all executed instructions in the enclave and monitor all interactions with the OS. Instruction-level interposition offers a general foundation for implementing a large variety of inline security monitors in thefuture. We take a principled approach in explaining why complete interposition on SGX is challenging. We draw attention to five design decisions in SGX that create fundamental trade-offs between performance and ensuring complete interposition, and we explain how to resolve them in the favor of complete interposition. To illustrate the utility of the Ratel framework, we present the first attempt to offer binary compatibility with existing software on SGX. We report that Ratel offers binary compatibility with over 200 programs we tested, including micro-benchmarks and real applications, such as Linux shell utilities. Runtimes for two programming languages, namely, Python and R, tested with standard benchmarks work out-of-the-box on Ratel without any specialized handling.

A Binary Translator to Accelerate Development of Deep Learning Processing Library for AArch64 CPU

A Binary Translator to Accelerate Development of Deep Learning Processing Library for AArch64 CPU

Profile-guided optimisation for indirect branches in a binary translator

Binary translators, which translate the binary executables from one instruction set to another, are useful tools. Indirect branches are one of the key factors that affect the efficiency of binary translators. In the previous research, our lab developed an LLVM-based binary translation framework, called Rabbit. Rabbit introduces novel optimisations: platform-dependent hyperchaining and platform-independent hyperchaining for improving the emulation of the indirect branch instructions. Indirect branch instructions may have several destinations, and these destinations are not known until runtime. Both platform-independent and platform-dependent hyperchaining establish a search table for each indirect branch instruction to record the visited branch destinations at runtime. In this work, we focus on the translation from AArch64 binary to RISC-V binary and further develop the profile-guided optimisation for indirect branch, which collects runtime information, including branch destinations and execution frequency of each destination for each indirect branch instruction, and then use the information to improve hyperchaining (i.e. accelerate the process of finding the branch destination). The profile-guided optimisation can be divided to profile-guided platform-independent hyperchaining and profile-guided platform-dependent hyperchaining. We finally use SPEC CPU 2006 CINT benchmark to evaluate the optimisations. The experiment results indicate that compared with (1) no chaining, (2) platform-independent hyperchaining and (3) platform-dependent hyperchaining, profile-guided platform-independent hyperchaining provides 1.123×, 1.066× and 1.098× speedup respectively. Similarly, profile-guided platform-dependent hyperchaining achieves 1.106×, 1.047× and 1.083× speedup with respect to the above three configurations, respectively.

Feeling foreign: A trust-based compromise model of translation reception

ABSTRACT Contributions to translation reception often examine the readers’ responses to binary translation solutions (e.g. foreignisation and domestication). Scant attention has been paid to the ethical causes of readers’ acceptance of translated foreignness. This quasi-experimental study attempts to illustrate how a heterogeneous readership engages with varying degrees of translator intervention to handle foreignness. It offers insights into the ways in which trust relates to translation reception. Empirical evidence indicates that what readers tend to accept is not any deterministic, textual solution but rather a set of options that are deemed ethically trusted. Readers might refuse a norm-conforming, fluent translation because they feel manipulated. On the other hand, a literal translation of foreign elements may be accepted if the text is regarded as “authentic” or as “objective”. This article conceptualises translation reception using a trust-based compromise model, in which readers calculate losses and gains within mediated, intercultural communication.

WDBT: Non-volatile memory wear characterization and mitigation for DBT systems

Emerging high-capacity and byte-addressable non-volatile memory (NVM) is promising for the next-generation memory system. However, NVM suffers from limited write endurance, as an NVM cell will wear out very soon after a certain number of writes, making NVM undependable. To address this issue, many wear reduction and leveling mechanisms have been proposed. Nevertheless, most of these mechanisms are developed without the knowledge of application semantics and behaviors. In this paper, we advocate application-level wear management, which allows us to create effective and flexible wear reduction and leveling techniques for specific application domains. Particularly, we find that applications running with dynamic binary translation (DBT) exhibit significantly more writes. This is because DBT systems need to handle architectural differences when translating instructions across different architectures. In this paper, we present WDBT, which focuses on wear reduction and leveling for DBT systems on NVM. WDBT is designed based on common practices of DBT systems to reduce the majority of writes introduced by DBT. We also implement a prototype of WDBT using a real-world DBT system, QEMU, for multiple popular instruction sets. Experimental results on SPEC CPU 2017 show that WDBT can effectively reduce writes by 52.09% and 34.48% for x86-64 and RISC-V, respectively. Moreover, the performance overhead of WDBT is negligible.

An energy efficient multi-target binary translator for instruction and data level parallelism exploitation

An energy efficient multi-target binary translator for instruction and data level parallelism exploitation

Traduire l’histoire : entre paroles et images

In an age when the global dissemination of digital information is transforming the way we read and write by foregrounding the interdependence of visual/verbal elements and languages, the reconstruction of identity and history in digital environments challenges binary translation processes. From this perspective, we interrogate the integration of visual and verbal elements in three Wikipedia articles, written in Polish, English, and Portuguese, about the topic “Polish death camp”. What is the role of translation in the semiotic construction of historical discourses in these articles? What are the conflicts generated by translated denominations? How do Wikipedia communities engage with the production of these cognitiverepresentations? This paper attempts to answer these questions.

EmuID: Detecting presence of emulation through microarchitectural characteristic on ARM

Software emulation is at the core of efficient automated software analysis. It allows efficient use of computing resources by running multiple instances on a single machine. Also, software emulation naturally provides a strong sandboxing that contains the analyzed target software. Software emulation techniques and principles have been implemented in dynamic binary translators (DBI) and emulators used extensively in practice. Transparency of emulation is one of the essential aspects of emulation engines. That is, hiding the presence of emulation from the software that is being emulated is vital in many use cases of software emulation (e.g., malware analysis). Detecting the presence of emulation through various methods and preventing such exploits have been an important topic in the field. Emulation detection is commonly used in protecting commercial software against reverse engineering or abused by malware developers who intend to sabotage their malware analysis. Many works have proposed methods for emulation detection, while others introduced mitigations. In this paper, we present EmuID that exploits a peculiar microarchitectural caveat of the ARM architecture to detect emulation. Our method is accurate, implementation-agnostic, and robust. Our evaluations show that our method detects ARM execution in well-known emulation engines on ARM (i.e., ARM-on-ARM) as well as cross-architecture ARM emulation on the x86 architecture (i.e., ARM-on-x86. Also, mitigation of our approach would require non-trivial modifications to emulation engines, unlike the heuristics-based detection methods that can be readily mitigated once the mechanisms are known.