[{"data":1,"prerenderedAt":57},["ShallowReactive",2],{"publications-sem86-qrs26":3,"papers-sem86-qrs26-05-discussion":40},{"id":4,"title":5,"authors":6,"awards":7,"bibtex":11,"body":12,"date":27,"description":28,"extension":29,"link":30,"meta":31,"navigation":32,"path":33,"pdf":34,"seo":35,"slug":36,"stem":37,"venue":38,"__hash__":39},"publications\u002Fpublications\u002Fsem86-qrs26.md","Sem86: A Full-System Emulator Without Hard-Coded Semantics","Jos Craaijo, Freek Verbeek, Binoy Ravindran",[8],{"name":9,"url":10},"Best Presentation Award","https:\u002F\u002Fqrs26.techconf.org\u002Ftrack\u002Faward_presentation","",{"type":13,"value":14,"toc":24},"minimark",[15],[16,17,18,19,23],"p",{},"Emulation can be used to run legacy software, analyze malware in a sandboxed environment, or run software compiled for different architectures.\nAn emulator is based on instruction semantics.\nThere is, however, not a single instruction semantics to be followed, as x86 allows undefined behavior.\nIn order to make accurate CPU-specific emulators,\nwe argue the need for an emulator that can easily switch between different semantics.\nHowever, all existing emulators contain hard-coded semantics.\nWe present Sem86, an x86 emulator that loads semantics at runtime from data in an input file.\nWe implement all necessary hardware needed to emulate typical x86 operating systems such as Windows 98, Windows XP and Windows 7.\nAdditionally, we implement a sound card, network card and support for high-resolution display output.\nSem86 can automatically ",[20,21,22],"em",{},"bisect"," instruction execution to determine at which point different semantics would diverge.\nWe demonstrate this by constructing a toy malware example that exploits undefined instruction behavior to detect whether it is running in an emulator,\nand show that Sem86 can pinpoint the exact instruction that is used.",{"title":11,"searchDepth":25,"depth":25,"links":26},2,[],"2026-07-22","Emulation can be used to run legacy software, analyze malware in a sandboxed environment, or run software compiled for different architectures.\nAn emulator is based on instruction semantics.\nThere is, however, not a single instruction semantics to be followed, as x86 allows undefined behavior.\nIn order to make accurate CPU-specific emulators,\nwe argue the need for an emulator that can easily switch between different semantics.\nHowever, all existing emulators contain hard-coded semantics.\nWe present Sem86, an x86 emulator that loads semantics at runtime from data in an input file.\nWe implement all necessary hardware needed to emulate typical x86 operating systems such as Windows 98, Windows XP and Windows 7.\nAdditionally, we implement a sound card, network card and support for high-resolution display output.\nSem86 can automatically bisect instruction execution to determine at which point different semantics would diverge.\nWe demonstrate this by constructing a toy malware example that exploits undefined instruction behavior to detect whether it is running in an emulator,\nand show that Sem86 can pinpoint the exact instruction that is used.","md","https:\u002F\u002Fqrs26.techconf.org\u002F",{},true,"\u002Fpublications\u002Fsem86-qrs26","\u002Ffiles\u002Fsem86.pdf",{"title":5,"description":28},"sem86-qrs26","publications\u002Fsem86-qrs26","QRS'26","2isYelaLp7jOW_ygpxJBHzUdEprIalEWZTRkgsYVd-U",{"id":41,"title":42,"body":43,"date":43,"description":43,"extension":44,"html":45,"meta":46,"navigation":32,"next":47,"path":50,"previous":51,"seo":54,"slug":43,"stem":55,"__hash__":56},"papers\u002Fpublications\u002Fsem86-qrs26\u002F05-discussion.html","Discussion and Conclusion",null,"html","\u003Cstyle>\u002F* Alignment *\u002F\nmtable.right-align mtd,\nmtable mtd.right-align,\nmtable.left-align mtd.right-align,\nmtable.aligned mtd:nth-child(odd) {\n  justify-items: end;\n  text-align: right;\n}\nmtable.cases mtd,\nmtable.left-align mtd,\nmtable mtd.left-align,\nmtable.aligned mtd:nth-child(even),\nmath:is(:not([display])) > mtable.multiline-equation mtd {\n  justify-items: start;\n  text-align: left;\n}\nmtable.cases mtd,\nmtable.aligned mtd,\nmtable mtd.flushed,\nmtable mtd.left-flush {\n  padding-left: 0;\n}\nmtable.cases mtd,\nmtable.aligned mtd,\nmtable mtd.flushed,\nmtable mtd.right-flush {\n  padding-right: 0;\n}\n\n\u002F* Tables *\u002F\nmtable {\n  math-style: inherit;\n}\nmtd {\n  math-depth: auto-add;\n  math-style: compact;\n  math-shift: compact;\n}\n\n\u002F* Equations *\u002F\nmtable.multiline-equation mtd {\n  math-depth: inherit;\n  math-style: inherit;\n  math-shift: inherit;\n  padding: 0;\n}\nmath > mtable.multiline-equation mtr:not(:last-child) mtd {\n  padding-bottom: 0.5em;\n}\n\n\u002F* Fractions *\u002F\nmfrac {\n  padding-inline: 0;\n  margin-inline: 0.1em;\n}\n\n\u002F* Accents *\u002F\nmover[accent=\"true\" i] > :first-child {\n  font-feature-settings: \"dtls\";\n}\nmover.dotted[accent=\"true\" i] > :first-child {\n  font-feature-settings: \"dtls\" 0;\n}\n\n\u002F* Other rules for scriptlevel, displaystyle and math-shift *\u002F\nmunder > :nth-child(2),\nmunderover > :nth-child(2) {\n  math-shift: compact\n}\nmunder[accentunder=\"true\" i] > :not(:first-child),\nmover[accent=\"true\" i] > :not(:first-child) {\n  math-depth: inherit;\n  math-style: inherit;\n  math-shift: inherit;\n}\u003C\u002Fstyle>\u003Cdiv id=\"previous-page\" style=\"display: none\">\u003Ca href=\"\u002Fpublications\u002Fsem86-qrs26\u002F04-evaluation#loc-1\">Evaluation\u003C\u002Fa>\u003C\u002Fdiv>\u003Cdiv id=\"next-page\" style=\"display: none\">\u003Ca href=\"\u002Fpublications\u002Fsem86-qrs26\u002F06-bibliography#loc-1\">Acknowledgements, Data-availabilty and References\u003C\u002Fa>\u003C\u002Fdiv>\u003Ch2 id=\"loc-1\">5 Discussion and Conclusion\u003C\u002Fh2>\u003Cp>We introduced \u003Cspan style=\"font-variant-caps: small-caps\">Sem86\u003C\u002Fspan>, an emulator for x86 architectures that treats the instruction semantics to be emulated as configurable input data. As such, it can be configured to emulate, e.g., CPU-specific semantics for accurate and precise emulation. It could also be used to emulate semantics written in the context of academic research efforts, e.g., ACL2 [\u003Ca href=\"\u002Fpublications\u002Fsem86-qrs26\u002F06-bibliography#loc-9\" role=\"doc-biblioref\">11\u003C\u002Fa>] or SAIL [\u003Ca href=\"\u002Fpublications\u002Fsem86-qrs26\u002F06-bibliography#loc-10\" role=\"doc-biblioref\">12\u003C\u002Fa>]. \u003Cspan style=\"font-variant-caps: small-caps\">Sem86\u003C\u002Fspan> runs typical x86 operating systems, such as Windows 98, Windows XP and Windows 7. Our evaluation shows that its performance lies between Bochs and QEMU.\u003C\u002Fp>\u003Cp>One particular combination that we are looking into is using libLISA’s automatically inferred semantics [\u003Ca href=\"\u002Fpublications\u002Fsem86-qrs26\u002F06-bibliography#loc-14\" role=\"doc-biblioref\">16\u003C\u002Fa>]. This would allow “CPU cloning”, i.e., analyzing a CPU, extracting its semantics, and then starting an emulator that emulates that exact CPU accurately. Semantics generated by libLISA would not cover all available instructions. For example, libLISA is unable to analyze privileged instructions. These would still need to be manually specified. However, such instructions are a tiny subset of all x86 instructions, reducing the manual effort to a minimum. The main obstacle for using libLISA’s semantics is that libLISA currently does not support 16-bit and 32-bit x86 modes. Solving this is mostly an engineering effort. Most importantly, a CPU observer for 16-bit and 32-bit modes would need to be built.\u003C\u002Fp>\u003Cp>For CPUs that support virtualization, building a CPU observer requires building a small VM kernel that can execute instructions and observe results. We are currently attempting to build such a CPU observer, and hope to use this to analyze a CPU and export its semantics for use in \u003Cspan style=\"font-variant-caps: small-caps\">Sem86\u003C\u002Fspan>.\u003C\u002Fp>",{},{"url":48,"title":49},"\u002Fpublications\u002Fsem86-qrs26\u002F06-bibliography","Acknowledgements, Data-availabilty and References","\u002Fpublications\u002Fsem86-qrs26\u002F05-discussion",{"url":52,"title":53},"\u002Fpublications\u002Fsem86-qrs26\u002F04-evaluation","Evaluation",{"title":42},"publications\u002Fsem86-qrs26\u002F05-discussion","g7wUzEE1elpiNaGWfW8TFvo4m98XIr09bTuV8Oi7Pmo",1787086053581]