Method and device for accelerating legacy software emulation

Abstract

The present invention relates to a hardware-based device and method for accelerating legacy software emulation comprising the steps of: disassembling a legacy software code recognising one or more instructions; translating the recognised instructions into an intermediate form by means of substitution tables comprising instruction prefixes; determining execution efficiency by means of at least one performance counter that stores data of the instructions in intermediate form; applying IT security techniques in the instructions in intermediate form; applying execution optimisation techniques of the legacy software code by rearranging and substituting acceleration pattern-based instructions using pre-defined substitution blocks; and translating the instructions in intermediate form into a microcode specific to a machine.

Description

[0001] METHOD AND DEVICE FOR ACCELERATING LEGACY SOFTWARE EMULATION

[0002] OBJECT OF THE INVENTION

[0003] The invention focuses on the emulation of a computer system, more specifically, the automated transformation of legacy code.

[0004] The object of the invention is a hardware-based emulation acceleration method for legacy software that allows for optimizing performance and strengthening the security of legacy code using current techniques.

[0005] BACKGROUND OF THE INVENTION

[0006] In a processing system (CPU) one of the key components is the microprocessor, which executes instructions to carry out multiple tasks.

[0007] Each family of microprocessors executes instructions that are unique to that processor family. The collective set of instructions that a processor or a family of processors can execute is known as the processor's instruction set.

[0008] The exclusivity of the processor family to execute instructions often results in incompatibility between the other elements of the hardware architecture of computer systems.

[0009] To expand the number of operating systems and application programs that can run on a computer system, a field of technology has been developed in which a given computer having one type of CPU, called the host, will include an emulator program that allows the host computer to emulate the instructions of an unrelated type of CPU, called the guest.

[0010] Thus, the host computer runs an application that will call one or more host instructions in response to a given guest instruction. In this way, the host computer can run both software designed specifically for its own hardware architecture and software written for computers with a different architecture.

[0011] In this way, although each operating system is incompatible with the other, an emulator program can host one of the two operating systems, allowing the incompatible operating system to run concurrently on the same computer system.

[0012] When a guest computer system is emulated on a host computer system, the guest computer system is said to be a virtual machine, since the host computer system exists only as a software representation of the operation of the guest computer system's hardware architecture.

[0013] In this case, the emulator program acts as the exchange between the hardware architecture of the host machine and the instructions transmitted by the software running in the emulated environment.

[0014] If the goal is to emulate the complete hardware architecture of the guest system, it is often useful or desirable to make maximum use of the hardware in the host computer system, including, for example, the memory management unit, context-switching hardware, exception handling vectors, pointers to interrupt routines, and the host processor's floating-point units and memory. However, this hardware is typically under the control of the host operating system and is protected from user-level or application-level access.

[0015] Furthermore, software-based emulation causes the guest computer system to be separated from the host computer system's processor by several layers of software, which create a latency between the time the host processor performs an action and the time it is carried out in the emulation program.

[0016] Another option is for the emulation program to share the hardware with the host operating system, generating hardware-based emulation. However, no prior art solution has been found that allows hardware-based emulation of legacy software while optimizing performance and strengthening the security of its code.

[0017] DESCRIPTION OF THE INVENTION

[0018] The invention relates to a hardware-based emulation acceleration method for legacy software, enabling more precise control and enhanced security. The method of the invention comprises the following steps:

[0019] - disassemble legacy software code by recognizing one or more instructions;

[0020] - translate recognized instructions into an intermediate form using substitution tables comprising instruction prefixes;

[0021] - determine execution efficiency by at least one performance counter that stores instruction data in an intermediate form;

[0022] - Apply computer security techniques to the instructions in an intermediate way;

[0023] - apply execution optimization techniques to legacy software code by reordering and replacing instructions based on acceleration patterns using predefined replacement blocks; and

[0024] - translate the instructions in intermediate form into machine-specific microcode.

[0025] The intermediate form allows the application of optimization and security techniques while disregarding the specific architecture of the legacy code.

[0026] For its part, the use of substitution tables allows breaking possible attack mechanisms while keeping the code semantics intact, especially attacks using ROP (Return-Oriented Programming).

[0027] Preferably, computer security techniques can be of the Control-flow-integrity (CFI) or Pointer Authentication (PAC) type. The PAC technique, instead of having specific addresses where conditional instructions can end up, has a range. In this way, it can be determined whether the instructions jmp, call, mov, or ret are valid through a cryptographic signature calculation.

[0028] In addition, computer security techniques may also include ASLR (Address Space Layout Randomization), KASLR (Kernel Address Space Layout Randomization) or DEP (Data Execution Prevention), intended to protect against buffer overflow attacks.

[0029] When implementing ASLR or KASLR security techniques, memory segments are typically mapped to base addresses, and a randomization mechanism is used to change memory addresses. This is done using a memory management unit (MMU) for the host system, programmed to transparently add these functionalities.

[0030] In a set of preferred implementations, attacks are checked on instructions ending in ret-pop-jmp, as these are the most commonly used in attacks.

[0031] The method of the invention makes use of substitution tables and, preferably, includes multiple different tables for each type of operation. The type of operation is defined by its prefixes.

[0032] In some implementation examples, the instruction data stored by at least one performance counter may be the number of times those instructions have been used and the value of their operands.

[0033] Additionally, the stored instruction data can be used for anomaly detection.

[0034] The invention also relates to an emulation device for legacy software configured to connect a processing system with legacy software and a machine, and further comprising:

[0035] - a processing module configured to carry out the method of the invention described; and at least one performance counter comprising a memory buffer. Preferably, the device is a peripheral component interconnect (PCI) device using a PCI Express standard.

[0036] Alternatively, the device can be a surface-mount device (SMD) integrated into the system's printed circuit board with legacy software. Preferably, this device can use a Serial Peripheral Interface (SPI) bus communication protocol.

[0037] More preferably, this device implements an application-specific integrated circuit (ASIC).

[0038] BRIEF DESCRIPTION OF THE DRAWINGS

[0039] To complement the description being made and to help in a better understanding of the characteristics of the invention, according to a preferred embodiment thereof, a set of diagrams is attached, in which, for illustrative and non-limiting purposes, the following has been represented:

[0040] Figure 1 shows a schematic of a preferred embodiment of the method of the invention.

[0041] PREFERRED EMBODIMENTS OF THE INVENTION

[0042] The present invention relates to a device and emulation method for legacy software that offers high-tech protections and features.

[0043] The method and device of the invention allow emulation of legacy software while adding protections and other advantages of current software, as illustrated in Figure 1.

[0044] The method of the invention is based on hardware emulation, since in software the time required to emulate legacy software would be very long and would not be functional.

[0045] In a specific implementation of the invention, the device is a PCI Express board comprising a processing module configured to disassemble and transform code for different architectures, such as x86-64-MIPS-ARM-ARM64, into an intermediate form. Alternatively, this could be accomplished using a surface-mount device (SMD) embedded in the printed circuit board of a system running legacy software. The invention then transforms the legacy code and returns it to the legacy software emulator. This process also incorporates security and optimization techniques.

[0046] Thus, the device's processing module functions like a CPU but with advanced capabilities to instrument, implement security and optimize the execution of the emulated code, offering detailed manipulation of the emulation process.

[0047] Preferably, the device of the invention implements an Application-Specific Integrated Circuit (ASIC) designed to accelerate the emulation of legacy software. This ASIC enables efficient translation of x86 binary code into microcode specific to a Just-In-Time (JIT) compiler or a hardware-optimized dynamic translator.

[0048] In one application example, during the disassembly process, the hardware converts x86 code into microcode designed for the JIT hardware. This process is essential for enabling the device to function as a hardware JIT rather than a software one, significantly improving emulation performance. Thus, hardware-based disassembly is more efficient.

[0049] This disassembly process is typically performed using tables that translate binary code by recognizing instruction prefixes. The binary code is then transformed into an intermediate language. This intermediate language allows for abstraction from the original architecture, facilitating the implementation of security and optimization techniques not present in legacy software.

[0050] Preferably, the transformation is carried out using substitution tables, which are applied by means of operands and operators (memory addresses or values).

[0051] In this intermediate form, performance counters can be used to map code coverage. In one application example, the device will have 64 performance counters, each with a 128K memory buffer for memory addresses, allowing up to 64 instructions to be monitored simultaneously without sacrificing efficiency. These counters store detailed data about the mapped instructions, including operators, operands, and memory addresses. This makes it possible to see the efficiency of a program's execution or to detect any errors, such as a virus infection.

[0052] Instruction tracing largely depends on the type of instructions (jump, call, mov), which defines their behavior. For example, instructions can be profiled to determine whether they use more CPU (CPU bound) or memory (memory bound).

[0053] If the transformation were carried out in software, performing a plot like the one defined would be computationally very expensive.

[0054] Furthermore, before translating the code, security techniques can be implemented to protect legacy code. These security techniques are preferably applied during translation and execution. They are essential for protecting against attack techniques such as Return-Oriented Programming (ROP), limiting the tools available to attackers.

[0055] Hardware protections such as ASLR (Address Space Layout Randomization), KASLR (Kernel Address Space Layout Randomization) and DEP (Data Execution Prevention) are implemented, in addition to instruction reordering based on a substitution table, which are responsible for protecting memory by re-implementing non-executable stack and limiting ROP gadgets.

[0056] ROP attacks exploit stacks of non-executable code (for example, those ending with `return`) to reuse them with gadgets and execute added instructions. Instruction reordering techniques allow these stacks to be transformed without using the `return` command, replacing it with equivalent instructions using known patterns.

[0057] Thanks to its hardware-based implementation, the device can efficiently emulate entire legacy operating systems, adding protections that didn't exist in its time. For example, memory address reordering with a random scheme exists in software-based implementations but hasn't been implemented in hardware-based implementations, and even less so in legacy systems.

[0058] On the other hand, although the predominant approach in the industry is virtualization and software-based acceleration, the device of the invention uses a specific hardware approach, with a device that integrates emulation acceleration with advanced security techniques directly into the hardware, allowing for more precise control and greater security.

[0059] An example of the implementation of the device and method of the invention is shown below. In this case, the translation process is a disassembly of an original x86 - PE - Windows XP SP3 binary.

[0060] A call is made to the emulator, and when it begins booting the operating system and the machine via the BIOS memory, the device of the invention begins translating by recognizing the instructions, disassembling them, and transforming the original x86 code into an intermediate form using translation tables. Preferably, different tables are used for each type of operation, defined by their prefixes, to accelerate the process.

[0061] The following code sequence is included as an example:

[0062] 0: b8 0500 00 00 mov eax,0x5

[0063] 5: b9 0500 00 00 mov ecx,0x5 a: ba 0500 00 00 mov edx,0x5

[0064] In this use case, if we enable tracing, implemented through performance counters, for instructions of a specific type (e.g., mov), we could collect statistics on the number of times this type of instruction has been used and the value of its operands.

[0065] In more complex instructions (for example, cali or jmp type) the tracing allows accumulating all the addresses that the instruction attempts to call.

[0066] Furthermore, if a machine always executes the same code, the results would be predictable, and measures such as Control-flow-integrity could be implemented, since the arrival addresses are always the same (deterministic). In this case, performance counters allow for the detection of anomalies.

[0067] As an example, an implementation is shown with a simple anomaly detection measure to implement: a check that verifies that no sum ever returns more than 10.

[0068] The machine code is translated into disassembled code:

[0069] B8 06 00 00 00 ; mov eax, 6 (Load 6 into eax)

[0070] B9 0500 00 00 ; mov ecx, 5 (Load 5 in ecx)

[0071] 01 C8 ; add eax, ecx (Add ecx to eax) and the instruction register (IR):

[0072] IB

[0073] %eax = add 32 6, 5 ; Directly adds 6 and 5, and stores in eax

[0074] The instruction register, through the performance counters, could implement a check of the addition operands and find out that 6+5 > 10. Then, an anomaly is generated in the plot (or an exception of the emulated system).

[0075] Regarding the implementation of security measures, techniques such as the following can be implemented:

[0076] ASLR / KASLR: The original operating system maps memory segments to the same addresses (i.e., stack-heap-bss-etc will always have the same base address).

[0077] The device of the invention automatically implements a mapping randomness mechanism, making the system unaware of the randomness (offsets are always constant and relative even if the base address changes).

[0078] DEP: The device of the invention can also protect the stack through the Write XOR Execute technique, which configures the stack itself. This prevents a buffer overflow from allowing a third party to execute code.

[0079] Instruction reordering: to prevent return-oriented programming (ROP) attacks. For example, the following assembly gadget is shown: 0x080808aa -> pop eax;ret

[0080] An attacker who could reuse this code would only need to configure the stack (having write capability) as follows: j ... I <- More data or gadget addresses if the string is extended

[0081] When the function being executed does ret, it would call address 0x080808aa executing the gadget.

[0082] However, the device of the invention allows for stack replacement using a substitution table. In particular, instructions ending in ret-pop-jmp (typical attack primitives) can be replaced.

[0083] Thus, in this case, the gadget pop eax;ret can be rewritten as follows: xor eax, eax pop ebx nop ret nop

[0084] In this way, the semantics are left intact but the exploitation mechanism through ROP is limited, considerably reducing the number of gadgets and, therefore, the attack surface with ROP technique.

Claims

CLAIMS 1. A hardware-based emulation acceleration method for legacy software, comprising the following stages: - disassemble legacy software code by recognizing one or more instructions; - translate recognized instructions into an intermediate form using substitution tables comprising instruction prefixes; - determine execution efficiency by at least one performance counter that stores instruction data in an intermediate form; - Apply computer security techniques to the instructions in an intermediate way; - apply execution optimization techniques to legacy software code by reordering and replacing instructions based on acceleration patterns using predefined replacement blocks; and - translate the instructions in intermediate form into machine-specific microcode.

2. The emulation acceleration method for legacy software according to claim 1, wherein the computer security techniques are of the Control-flow-integrity type.

3. The emulation acceleration method for legacy software according to claim 1, wherein the computer security techniques are ASLR (Address Space Layout Randomization), KASLR (Kernel Address Space Layout Randomization) or DEP (Data Execution Prevention).

4. The emulation acceleration method for legacy software according to claim 1, wherein the computer security techniques are ASLR or KASLR, in which memory segments are always mapped to base addresses and a randomization mechanism is applied to change memory addresses.

5. The emulation acceleration method for legacy software according to claim 1, wherein attacks are checked on instructions ending in ret-pop-jmp.

6. The emulation acceleration method for legacy software according to claim 1, wherein the replacement tables include different tables for each type of operation defined by prefixes.

7. The emulation acceleration method for legacy software according to claim 1, wherein the instruction data stored by the at least one performance counter are the number of times it has been used and the value of its operands.

8. The emulation acceleration method for legacy software according to claim 1, the instruction data stored by the at least one performance counter is used for anomaly detection.

9. Emulation device for legacy software configured to connect a processing system with legacy software and a machine and comprising: - a processing module configured to carry out the method according to any of claims 1 to 8; and at least one performance counter comprising a memory buffer.

10. The device according to claim 9, wherein the device is a peripheral component interconnect (PCI) device using a PCI Express standard.

11. The device according to claim 10, which implements an application-specific integrated circuit (ASIC).

Images