Search papers, labs, and topics across Lattice.
This study introduces InSPECtor, a novel testing framework that systematically validates open-source SLEIGH language specifications used in tools like Ghidra. By employing an automated oracle validation strategy, the framework identifies discrepancies in processor specifications across multiple architectures, revealing over 38,920 inconsistencies and 125 unique bugs. The findings highlight critical decoding and semantic defects, providing actionable recommendations to enhance the accuracy of processor specifications and the reliability of associated security tools.
Over 38,920 discrepancies in processor specifications were uncovered, revealing critical bugs that compromise security analysis tools.
Processor specifications underpin critical security and program- analysis tools such as disassemblers, decompilers, and emulators, yet, their correctness is rarely examined. Errors in specifications distort program behaviour, obscure vulnerabilities, and enable analysis-evasion techniques. Validating processor specifications is a non-trivial task. Our study is a significant undertaking to enable, for the first time, the systematic validation of open-source SLEIGH language specifications, predominantly used by Ghidra. We design and implement a testing framework based on an automated oracle validation strategy by proxy. Our approach leverages the structure encoded in a specification itself to enumerate decodable instruction forms and generate targeted initial states. Then differentially test the successful decoding and emulation of those instructions by comparing emulators exercising the processor specification against hardware references. Applying InSPECtor across diverse, open-source specifications---x86-64, AArch64, ARM/Thumb, RISC-V, MSP430---embedding differences in specification styles, author preferences, and instruction set architecture designs, we uncovered over 38,920 discrepancies that led to 125 unique bugs with proposed fixes, identifying decoding and semantic defects as well as cross-vendor inconsistencies. We distill our findings into 8 concrete recommendations to drive future improvements. Our work underscores the importance of specification correctness and provides a practical tool to substantially improve the fidelity of SLEIGH processor specifications, strengthening the reliability of downstream security and analysis tools.
