Derive: a tool that automatically reverse-engineers instruction encodings

Many binary tools, such as disassemblers, dynamiccode generation systems, and executable code rewriters, need to understand how machine instructions are encoded. Unfortunately, specifying such encodings is tedious and error-prone. Users must typically specify thousands of details of instruction layout, such as opcode and eld locations values, legal operands, and jump o set encodings. We have built a tool called derive that extracts these details from existing software: the system assembler. Users need only provide the assembly syntax for the instructions for which they want encodings. Derive automatically reverse-engineers instruction encoding knowledge from the assembler by feeding it permutations of instructions and doing equation solving on the output. Derive is robust and general. It derives instruction encodings for SPARC, MIPS, Alpha, PowerPC, ARM, and x86. In the last case, it handles variable-sized instructions, large instructions, instruction encodings determined by operand s...

• Type: Conference
• Year: 2000
• Where: DYNAMO
• Authors: Dawson R. Engler, Wilson C. Hsieh
• Keywords: DYNAMO 2000, Instruction, Instruction Encodings, Tool Called Derive