CN116089019B

CN116089019B - Hexagon architecture-oriented fine-grained CPU simulator

Info

Publication number: CN116089019B
Application number: CN202310206614.4A
Authority: CN
Inventors: 马文聪
Original assignee: Suzhou Hongcunxinjie Technology Co ltd
Current assignee: Suzhou Hongcunxinjie Technology Co ltd
Priority date: 2023-03-07
Filing date: 2023-03-07
Publication date: 2023-06-06
Anticipated expiration: 2043-03-07
Also published as: CN116089019A

Abstract

The invention discloses a Hexagon architecture-oriented fine-grained CPU simulator, and belongs to the technical field of computer systems. The method comprises the steps of constructing an executable file shell, a patch script and simulating operation, wherein the patch script writes an execution context and a function to be simulated into the executable file shell, and the method specifically comprises four modules of configuration, an initialization register, a memory application and firmware file loading. After an executable file with a function to be simulated is generated, performing simulation operation through a simulator provided by a Hexagon SDK, acquiring a data stream in an execution process by using a command line parameter, and acquiring the data stream of a fragment to be simulated through an execution stream information extraction module. The invention has the advantages of fine granularity, high simulation speed and low resource consumption. The whole framework is not required to be simulated, only the interested part is extracted for simulation, the code execution flow and the data flow are obtained, the corresponding functions are verified, and the method is wide in application range, simple and easy to use.

Description

Hexagon architecture-oriented fine-grained CPU simulator

Technical Field

The invention relates to a Hexagon architecture-oriented fine-grained CPU simulator, and belongs to the technical field of computer systems.

Background

Along with the rapid development of science and technology, the embedded system gradually becomes an important component part of daily life, industrial production, traffic control, power transportation and the like due to the characteristics of simple structure, low power consumption, high customization degree and the like, and the safety of the embedded system is also receiving wide attention.

Simulators play an important role in embedded system security, and can help analyze instruction streams and data streams, and also can perform fuzzy testing (Fuzzing) on firmware. A common simulation framework is unicor, which is a lightweight, multi-platform, multi-architecture CPU simulator. However, uniicorn does not support the Hexagon architecture. Another common open source machine simulator is Qemu, which integrates the Hexagon-like function in version 7.2, but it cannot execute a certain code fragment in firmware, requiring full system simulation.

The Hexagon architecture was originally used for high-pass specific digital signal processing and later developed into a fully functional general-purpose architecture. The Hexagon architecture is a 32-bit architecture with a memory structure that stores on a small end, all instructions being 32 bits in size, and employs a VLIW architecture (Very Long Instruction Word, very long instruction set architecture) with 32-bit general purpose registers (named R0 to R31) and a 32-bit address space. Hexagon SDK is a set of software development tool kit, so that embedded developers can access embedded computing resources on Hexagon DSP, can develop more applications, and enriches the characteristics and performances of multimedia software. The Hexagon SDK toolkit includes a complete set of compilation toolchains and simulators.

The simulator provides a simulation environment for the Hexagon executable, and provides functions including interactive debugging, analysis, generation of execution tracking and statistics, collaborative simulation with external devices, timing, maintenance of processor caches, simulation of client control, and the like. However, the prior art lacks sophisticated emulation techniques oriented to the Hexagon processor architecture.

Disclosure of Invention

Aiming at the technical problems of huge instruction quantity, excessive consumption of computing resources, overlong simulation time and the like existing in the prior simulation technology, the invention creatively provides a Hexagon-architecture-oriented fine-granularity CPU simulator capable of simulating an operation function fragment.

The technical scheme adopted by the invention is as follows.

A Hexagon architecture-oriented fine-grained CPU simulator comprises an executable file shell construction module, a patch script construction module and a simulation running module;

the executable file shell construction module is used for constructing a source code file, compiling links and reversely positioning;

the executable file shell construction module is used for reversing the executable file through IDA Pro software and a reverse Hexagon tool and positioning a storage address of a function to be simulated and a return address of the function to be simulated; providing enough storage space for the function fragment to be simulated in the source code file; and compiling and linking the source code by means of the Hexagon SDK to generate the executable file.

The patch script construction module is used for writing the execution context and the function to be simulated into the executable file shell in a patch mode and comprises a configuration module, an initialization register module, a memory application module and a firmware file loading module; in the configuration module, configuring the related information of a register, a memory and a firmware file; in the initialization register module, the register to be used is assigned; in a memory application module, applying for a required memory address and initializing the memory; in the firmware file loading module, the offset and the length of the function fragment to be simulated are positioned, and the function fragment is loaded into an executable file shell.

The simulation running module comprises a simulator provided by the Hexagon SDK and an execution flow information extraction module; after an executable file with a function to be simulated is generated, performing simulation operation through a simulator provided by a Hexagon SDK, wherein command line parameters are used for acquiring a data stream in an execution process, and acquiring an instruction data stream of a fragment to be simulated through an execution stream information extraction module;

in the simulation operation module, the modified executable file is simulated through a command hexagon-sim, the data stream in the execution process is obtained through a command line parameter pctrace, and the instruction data stream of the fragment to be simulated is obtained through an execution stream information extraction module.

The output end of the executable file shell construction module is connected with the input end of the patch script construction module, and the output end of the patch script construction module is connected with the input end of the simulation operation module.

Hexagon architecture oriented fine-grained CPU simulator, the running simulation comprising the steps of:

step 1: installing IDA Pro software, a reverse Hexagon tool and a Hexagon SDK;

step 2: creating an executable file shell;

step 2.1: creating a c language source code, wherein an asm empty instruction is embedded and assembled, and the actual position of the empty instruction is used for storing a function to be simulated, so that an instruction area is opened up;

step 2.2: compiling and linking the c file into an executable file;

step 2.3: disassembling the executable file shell through IDA Pro, and positioning the executable file shell to a main function;

step 3: creating a patch script;

step 3.1: inputting configuration information, including initial values of registers, memory addresses and data to be mapped, offset and length of functions to be simulated in firmware; the configuration information is transmitted to the script in the form of parameters;

step 3.2: constructing assembly codes for assigning values to registers;

step 3.3: constructing an assembly code for initializing the memory;

step 3.4: patching;

step 4: the simulation operation is carried out, and a complete execution flow of the executable file shell is obtained; and reading the execution stream file, and extracting the instruction data stream of the fragment to be simulated according to the address of the instruction.

Advantageous effects

1. The invention realizes the function fragment simulation based on Hexagon SDK, performs granularity refinement, and has the advantages of high simulation speed and low resource consumption. The invention does not need to simulate the whole framework, extracts the interested part to simulate, acquires the code execution flow and the data flow, and verifies the corresponding functions.

2. The invention provides a brand new firmware fragment simulation idea for other processor architectures. The function fragment simulation is realized through the script and the compiling tool chain of the processor without depending on the existing simulator platform, and the application range is wide.

3. The invention is realized based on Python script, realizes customizable simulation through command line parameters, and is simple and easy to use.

Drawings

FIG. 1 is a general architecture diagram of the present invention;

FIG. 2 is an assembler instruction corresponding to a function to be modeled;

FIG. 3 is an instruction corresponding to a main function after disassembly of an executable file shell;

FIG. 4 is an instruction corresponding to an inlineExpmple function after disassembly of an executable file shell;

FIG. 5 is an exemplary diagram of assembler instruction transcoding in accordance with the present invention;

FIG. 6 is an instruction corresponding to an inlineExpmple function after disassembly of an executable shell after embedding a function to be simulated into the executable shell;

FIG. 7 is an instruction data flow of a fragment to be emulated.

Detailed Description

The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.

As shown in FIG. 1, the fine-grained CPU simulator facing the Hexagon architecture comprises an executable file shell construction module, a patch script construction module and a simulation running module.

As one embodiment of the invention, an executable file shell construction module is used for constructing source code files, compiling links and reversely positioning.

Specifically, in the source code file, enough storage space is provided for the function fragment to be simulated. And compiling and linking the source code by means of the Hexagon SDK to generate the executable file. The executable file can be reversed through IDA Pro software and a reverse Hexagon tool, and the storage address of the function to be simulated and the return address of the function to be simulated are positioned.

As one implementation mode of the invention, the patch script construction module comprises a configuration module, an initialization register module, a memory application module and a firmware file loading module. Specifically, in the configuration module, relevant information of a register, a memory and a firmware file is configured; in the initialization register module, the register to be used is assigned; in a memory application module, applying for a required memory address and initializing the memory; in the firmware file loading module, the offset and the length of the function fragment to be simulated are positioned, and the function fragment is loaded into an executable file shell.

As an implementation mode of the invention, the simulation running module can simulate the modified executable file through a command hexagon-sim, acquire the data stream in the execution process through a command line parameter pctrace, and acquire the instruction data stream of the fragment to be simulated through an execution stream information extraction module.

Further details are provided below in connection with the examples.

Examples

As shown in fig. 2, for the assembly stream corresponding to the selected function, the firmware where it is located is Snapdragon888.Elf, the offset of the function in the firmware is 0x278FE4, and the length of the function is 0x18.

Step 1: IDA Pro software, inverse Hexagon's tool and Hexagon SDK are installed.

Step 2: an executable file shell is created.

Specifically, the method comprises the following steps:

step 2.1: the c language source code is created as shown below, with embedded assembly asm null instructions. The actual location of the null instruction is used to store the function to be simulated. Here, an instruction area of 1000 x4 bytes is opened up. The method comprises the following steps:

void inlineExample(){

asm ("nop");

……

asm ("nop");

}

int main(){

inlineExample();

}

step 2.2: compiling and linking the c file into an executable file. This can be achieved by the following commands:

hexagon-clang xx.c -o xx

step 2.3: the executable shell is disassembled by IDA Pro, as shown in fig. 3, to locate at the main () function. The instruction call inlineExample is for calling a function inlineExample. Address 0x6090 is the position returned after the simulation function is executed.

As shown in fig. 4, the function inlineExample () is disassembled code, wherein nop instructions are replaced by instructions corresponding to the function to be simulated.

Step 3: a patch script is created.

Specifically, step 3 includes the steps of:

step 3.1: configuration information is input.

The configuration information comprises initial values of registers, memory addresses and data to be mapped, and offsets and lengths of functions to be simulated in firmware.

Taking the above functions as an example, the values of registers R0, R31 (LR) and the values of memory addresses (r0+0), (r0+4), and (r0+8) need to be initialized. The register R31 points to the address of the next instruction calling the inlineExample () function, which is 0x6090.

The configuration information is passed to the script in the form of parameters.

For example:

python patcher.py -R0 0x9E100000 -R31 6090 w 0x9E100000 0x11111111 0x9E100004 0x22222222 0x9E100008 0x33333333 snapdrgon888.elf 0x278FE4 0x18

the parameter Ri assigns a value to the register Ri, the memory is assigned by the format of the parameter w addr data, snapdrgon888.Elf is the path of the firmware, 0x278FE4 is the offset of the function in the firmware, and 0x18 is the length of the function.

Step 3.2: the assembly code for assigning the register is composed of an immext instruction and an assignment statement as follows:

{immext

R0=0x9E100000}

{immext

R31=0x6090}

the Hexagon instruction is fixed to 32 bits and therefore, like arm, cannot encode many immediate numbers. Hexagon provides a constant spread instruction to solve this problem. Its syntax is immext (# # constant), located before the instruction of the immediate to be extended, extended to any 32-bit immediate. The 16-ary code corresponding to immex is shown in fig. 5. The original function of the assignment instruction is to extend the 16-bit signed immediate value to 32 bits and assign the value to the target register, and the 16-ary code corresponding to the assignment instruction is shown in fig. 5, where i represents the immediate value, d represents the register Rd, s represents the register Rs, P is related to the packet (01, 10 represents that it is not the end of the packet, 11 represents the end of the packet, and 00 represents the duplex instruction).

After the two instructions are put together, the final immediate is the first 26 bits in the immext instruction + the last 6 bits in the instruction that allocated the immediate.

The patch. Py script generates the machine code according to the rules described above as: 00 40 E1 09 00 C0 00 78 C2 41 00 00 1F C2 00 78.

Step 3.3: as shown below, is a memory initialization code. The R0 register and the R1 register are assigned by an immext instruction and an assignment statement, respectively. The 32-bit contents of the R1 register are written into the memory address represented by the R0 register by the memw instruction.

{immext

R0=0x9E100000}

{immext

R1=0x11111111}

{memw(R0+0)=R1}

{immext

R0=0x9E100004}

{immext

R1=0x22222222}

{memw(R0+0)=R1}

{immext

R0=0x9E100008}

{immext

R1=0x33333333}

{memw(R0+0)=R1}

The 16-ary code corresponding to memw (rs+#s11:2) =rt is shown in fig. 5. In the patch. Py script, for simplicity, the fixed Rs register is R0, # u is 0x0, and #S8 is determined by the input parameters. The final machine code generated is: 00 40 E1 09 00 C0 00 78 4444 11 01 21 C2 00 78 00 C1 80 A1 00 40 E1 09 80 C0 00 78 88 48 22 02 41 C4 00 78 00 C1 80 A1 00 40 E1 09 00 C1 00 78 CC 4C 33 03 61 C6 00 78 00 C1 80 A1.

Step 3.4: patching. The memory initialization machine code is first written into the executable file shell, then the register initialization code is written, and finally the machine code is written into the instruction area according to the given offset and the corresponding len, locating the selected function in the snapdragon888.Elf file.

As shown in fig. 6, the effect of the initialization instruction and the instructions to be simulated after being embedded in the executable file shell is shown.

Step 4: and (5) performing simulation operation. The complete execution flow of the executable file shell is obtained by the following commands:

hexagon-sim input_file --pctrace filename

here, input_file is an executable file, and parameter pctrace generates a program counter trace file containing the following information:

a Program Counter (PC) value record for each period (including all pause periods) in the target application.

The instruction packet executed at each PC value (only applicable to committed cycles).

The contents of all processor registers after each cycle.

The execution flow information extraction module reads the execution flow file, extracts the instruction data flow of the fragment to be simulated according to the address of the instruction, and the obtained result is as follows: after the last instruction is executed, the value of the R0 register is 0x44444444, which meets the requirements. As shown in fig. 7.

The foregoing has shown and described the basic principles, principal features and advantages of the invention. It will be understood by those skilled in the art that the present invention is not limited to the embodiments described above, and that the above embodiments and descriptions are merely illustrative of the principles of the present invention, and various changes and modifications may be made without departing from the spirit and scope of the invention, which is defined in the appended claims.

Claims

1. The Hexagon-architecture-oriented fine-grained CPU simulator is characterized by comprising an executable file shell construction module, a patch script construction module and a simulation running module;

the patch script construction module is used for writing the execution context and the function to be simulated into the executable file shell in a patch mode and comprises a configuration module, an initialization register module, a memory application module and a firmware file loading module; in the configuration module, configuring the related information of a register, a memory and a firmware file; in the initialization register module, the register to be used is assigned; in a memory application module, applying for a required memory address and initializing the memory; in a firmware file loading module, positioning the offset and the length of a function fragment to be simulated, and loading the function fragment into an executable file shell;

2. The Hexagon-oriented fine-grained CPU simulator of claim 1, wherein the executable file is reversed by IDA Pro software and a reverse Hexagon tool to locate the function deposit address to be simulated and the function return address to be simulated.

3. The Hexagon-oriented architecture fine-grained CPU simulator of claim 1, wherein sufficient storage space is provided for function fragments to be simulated in a source code file; and compiling and linking the source code by means of the Hexagon SDK to generate the executable file.

4. The Hexagon-oriented fine-grained CPU simulator of claim 1, wherein the simulation run module simulates the modified executable file by commanding Hexagon-sim, obtains the data stream during execution by commanding line parameters pctrace, and obtains the instruction data stream of the fragment to be simulated by the execution stream information extraction module.

5. The Hexagon-oriented architecture fine-grained CPU simulator of claim 1, wherein running the simulation comprises the steps of:

step 1: installing IDA Pro software, a reverse Hexagon tool and a Hexagon SDK;

step 2: creating an executable file shell;

step 2.2: compiling and linking the c file into an executable file;

step 3: creating a patch script;

step 3.2: constructing assembly codes for assigning values to registers;

step 3.3: constructing an assembly code for initializing the memory;

step 3.4: patching;