5 Discussion and Conclusion

We introduced Sem86, an emulator for x86 architectures that treats the instruction semantics to be emulated as configurable input data. As such, it can be configured to emulate, e.g., CPU-specific semantics for accurate and precise emulation. It could also be used to emulate semantics written in the context of academic research efforts, e.g., ACL2 [11] or SAIL [12]. Sem86 runs typical x86 operating systems, such as Windows 98, Windows XP and Windows 7. Our evaluation shows that its performance lies between Bochs and QEMU.

One particular combination that we are looking into is using libLISA’s automatically inferred semantics [16]. This would allow “CPU cloning”, i.e., analyzing a CPU, extracting its semantics, and then starting an emulator that emulates that exact CPU accurately. Semantics generated by libLISA would not cover all available instructions. For example, libLISA is unable to analyze privileged instructions. These would still need to be manually specified. However, such instructions are a tiny subset of all x86 instructions, reducing the manual effort to a minimum. The main obstacle for using libLISA’s semantics is that libLISA currently does not support 16-bit and 32-bit x86 modes. Solving this is mostly an engineering effort. Most importantly, a CPU observer for 16-bit and 32-bit modes would need to be built.

For CPUs that support virtualization, building a CPU observer requires building a small VM kernel that can execute instructions and observe results. We are currently attempting to build such a CPU observer, and hope to use this to analyze a CPU and export its semantics for use in Sem86.