Search papers, labs, and topics across Lattice.
This paper introduces an explainable digital twin for detecting vulnerabilities in AArch64 machine code, enabling analysis without source code access. By transforming instructions into trace events and representing vulnerabilities as symbolic rules in Kleene algebra, the method captures both isolated unsafe instructions and complex execution patterns. The system successfully identified integer overflow, null pointer dereference, and heap buffer overflow vulnerabilities, providing detailed explanations for each detection while ensuring no false positives on safe traces.
A novel digital twin approach reveals vulnerabilities in AArch64 machine code without needing source code, achieving comprehensive detection with clear explanations.
This paper proposes an explainable digital twin for vulnerability detection in AArch64 machine code without access to source code. The digital twin reproduces the concrete execution of a program and preserves the state of registers, processor flags, memory, and live allocated blocks. Each instruction is transformed into a trace event containing the instruction name, operand values, and the post-instruction state. Vulnerabilities are represented as symbolic rules in Kleene algebra with tests: each rule specifies an event sequence and predicates over the machine state. This approach enables the detection of not only isolated unsafe instructions but also multi-step execution patterns. The rules are compiled into finite automata that scan the trace without using an SMT solver. The experimental evaluation covers three CWE classes: integer overflow (CWE-190), null pointer dereference (CWE-476), and heap buffer overflow (CWE-122). The system detected all three predefined vulnerabilities and produced no report on the safe trace. Each detection result includes the triggered rule, the trace position, and the concrete state values, thereby providing a reproducible explanation.
