IA-64过程调用的逆向恢复技术

本文给出了对于IA-64体系结构可执行程序逆向恢复中过程识别和抽象的技术实现方法。采用自动机理论与模板匹配相结合的方法解决IA-64体系结构模板中不确定指令的识别问题。实现了基于数据流分析对过程调用的参数和返回值进行恢复的算法。有效地完成了过程调用的二进制代码向与硬件无关中间语言代码转换的恢复工作。     

Bitran二进制翻译实验系统的设计和实现

对处理器速度的追求促使体系结构不断发展 ,但是软件的支持却不能与其匹配 ,造成新体系结构推广的困难 ,研究、解决代码迁移问题的二进制翻译方法应运而生 .介绍作者参与开发的一个静态二进制翻译实验系统的框架设计 ,并详细介绍框架中各个部分的实现方法 ,最后给出该翻译系统的实验数据和分析 .     

二进制翻译中的库函数识别技术研究

体系结构的不断发展给软件开发者带来了巨大的风险，造成了新体系结构推广的困难，而二进制翻译技术使得可执行代码可自动迁移到新的体系结构。介绍了在开发一个静态二进制翻译系统（I2A翻译系统）中的库函数识别技术，并提出了解决库函数识别问题的新的方法。基于IA-64体系结构的调用约定及实例分析证明,该方法是一种简单实用的库函数识别方法，经I2A系统验证是有效的。     

二进制翻译中的X86浮点栈处理

二进制翻译系统是一种基于软件的跨平台代码迁移系统,它将一种体系结构的二进制代码翻译成另一种体系结构的二进制代码.二进制翻译可以用于解决遗产代码的迁移问题,也可以实现不同硬件平台之间软件的通用.浮点栈的处理已成为以X86为源的二进制翻译的研究中的关键性问题之一,如何处理X86浮点栈问题直接关系到以X86为源的二进制翻译系统的性能.针对X86浮点寄存器栈的特征,提出了一种扩展虚拟栈(extending virtual stack)处理方案.它采用归一的方法,保证了每个基本块中的运算所涉及到的浮点寄存器可以直接映射到目标机器中的浮点寄存器,确保了翻译的效率,并利用翻译时的分析避免了在入口处不必要的判断;同时还给出了在基本块入口处判别一个基本块是否会出现浮点栈上溢和下溢的充分必要条件,为生成更加高效的代码提供了条件.实验表明,它能够在保证正确实现其功能的前提下,获得更好的执行效率.     

静态二进制翻译中动态地址解析恢复技术研究

静态二进制翻译的入口点通常为main函数,所以main函数执行之前的动态地址解析部分就无法在目标机上恢复。通过分析基于ELF文件的动态地址解析机制,提出了在目标代码中插入代码模拟动态地址解析的方法来解决该问题。该方法已在静态二进制翻译项目中实现,测试结果表明该方法是有效的。     

IA-64二进制翻译中指令束特性的消除技术

目前对处理器速度的追求促使指令集体系结构不断发展，但是软件的支持却不能与其匹配，造成新体系结构推广的困难，研究、解决代码迁移问题的二进制翻译方法应运而生。文中介绍了二进制翻译中解码器的功能，并结合IA-64的指令特点，设计出基于指令束的解码算法。根据测试中发现该算法存在的问题，提出了改进方案，消除束的特性，给每条指令赋予唯一地址并按此地址进行解码。在IA-64至Alpha的二进制翻译课题中，对该算法进行了工程实现。     

动态二进制翻译中不对界问题的处理

复杂指令集计算机体系结构向精简指令集计算机体系结构的动态二进制翻译过程中经常出现地址不对界的问题。本文以I386到Alpha平台的动态二进制翻译为例,研究了内存映射时的不对界和数据存取时的不对界问题,提出了一种改进的内存映射方法以及在中间表示层处理不对界地址访存问题的方案,有效地解决了此类问题。经实验验证,该方法正确并有较高效率。     

静态二进制翻译中间接过程调用恢复技术研究

间接过程调用的恢复问题是静态二进制翻译中的难点之一。针对使用c后端的静态二进制翻译框架,提出并实现间接过程调用恢复方法,该方法结合代码间隙分析,在后端c代码生成过程中插入映射源过程地址到目标机过程地址的代码。相对于使用解释器的方法,该方法具有实现简洁、在目标机上运行速度更快的优点。     

静态二进制翻译中回调函数逆向恢复技术研究

回调函数的逆向恢复是静态二进制翻译的一个难点。针对使用C后端的静态二进制翻译框架,提出并实现回调函数逆向恢复方法,该方法结合代码间隙分析,在后端C代码生成过程中插入映射源回调函数地址到目标机函数地址的代码。相对于使用解释器的方法,该方法具有实现简洁,在目标机上运行速度更快的优点。     

二进制翻译应用级异常处理

二进制翻译可以用于解决遗产代码的迁移问题，也可以实现不同硬件平台之间软件的通用．异常处理是二进制翻译的一个重要方面，如何解决异常处理和二进制翻译效率的矛盾是问题的关键．提出了在库函数包装层面处理主动异常和被动异常的方法，一个算法可以高效处理信号异常，另一个算法使用栈展开技术，得到调用地址用于处理try catch异常．实验结果表明，上述方法能够正确处理异常函数，同时对于普通应用程序加入异常处理机制之后性能并不受影响．     

Fuzzy query translation for relational database systems

The paper presents a new method for fuzzy query translation based on the alpha-cuts operations of fuzzy numbers. This proposed method allows the retrieval conditions of SQL queries to be described by fuzzy terms represented by fuzzy numbers. It emphasizes friendliness and flexibility for inexperienced users. The authors have implemented a fuzzy query translator to translate user's fuzzy queries into precise queries for relational database systems. Because the proposed method allows the user to construct his fuzzy queries intuitively and to choose different retrieval threshold values for fuzzy query translation, the existing relational database systems will be more friendly and more flexible to the users.     

二进制翻译中的函数返回类型恢复技术

函数返回类型恢复分为库函数和用户函数返回类型恢复两类。分析IA-64体系结构在函数调用和返回方面的特性得知,用户函数返回类型恢复不是只能从调用者的角度进行分析，还可从被调用者的角度进行分析。综合两种分析方法的优缺点,提出了一种全新的函数返回类型恢复方法。介绍了静态二进制翻译系统ITA中基于控制流和数据流分析的函数返回类型恢复技术，并给出相应的实现算法。由IA-64体系结构的实例验证证明，该方法是一种实用的函数返回类型恢复方法。     

Validating More Loop Optimizations

Translation validation is a technique for ensuring that a translator, such as a compiler, produces correct results. Because complete verification of the translator itself is often infeasible, translation validation advocates coupling the verification task with the translation task, so that each run of the translator produces verification conditions which, if valid, prove the correctness of the translation. In previous work, the translation validation approach was used to give a framework for proving the correctness of a variety of compiler optimizations, with a recent focus on loop transformations. However, some of these ideas were preliminary and had not been implemented. Additionally, there were examples of common loop transformations which could not be handled by our previous approaches.This paper addresses these issues. We introduce a new rule Reduce for loop reduction transformations, and we generalize our previous rule Validate so that it can handle more transformations involving loops. We then describe how all of this (including some previous theoretical work) is implemented in our compiler validation tool TVOC.     

一种基于Re-Engineering的自动翻译方法研究

分析了结合Re Engineering技术的翻译器Bogart的工作原理，并与传统翻译器进行了比较，同时对源程序的存储方法提出了改进，采用了新的支持程序语言定义的语言处理系统。测试结果表明，该方法能够提高自动翻译的效率。     

Towards a multiple-ISA embedded system

In these days, every new added hardware feature must not change the underlying Instruction Set Architecture (ISA), in order to avoid adaptation or recompilation of existing code. Binary translation (BT) allows the execution of already compiled applications on different architectures. Therefore, it opens new possibilities for designers, previously tied to a specific ISA and all its legacy hardware issues. To overcome the BT inherent performance penalty, we propose a new mechanism based on a dynamic two-level binary translation system. While the first level is responsible for the BT de facto to an intermediate machine language, the second level optimizes the already translated instructions to be executed on the target architecture. The system is totally flexible: it supports the porting of radically different ISAs and the employment of different target architectures. This paper presents the first effort towards this direction: it translates code implemented in the x86 ISA to MIPS assembly (the intermediate language), which will be optimized by the target architecture: a dynamically reconfigurable array. We show that it is possible to maintain binary compatibility, with performance improvements and no energy losses, when compared to native execution.     

Automatic validation for binary translation

Binary translation is an important technique for porting programs as it allows binary code for one platform to execute on another. It is widely used in virtual machines and emulators. However, implementing a correct (and efficient) binary translator is still very challenging because many delicate details must be handled smartly. Manually identifying mistranslated instructions in an application program is difficult, especially when the application is large. Therefore, automatic validation tools are needed urgently to uncover hidden problems in a binary translator. We developed a new validation tool for binary translators. In our validation tool, the original binary code and the translated binary code run simultaneously. Both versions of the binary code continuously send their architecture states and the stored values, which are the values stored into memory cells, to a third process, the validator. Since most mistranslated instructions will result in wrong architecture states during execution, our validator can catch most mistranslated instructions emitted by a binary translator by comparing the corresponding architecture states. Corresponding architecture states may differ due to (1) translation errors, (2) different (but correct) memory layouts, and (3) return values of certain system calls. The need to differentiate the three sources of differences makes comparing architecture states very difficult, if not impossible. In our validator, we take special care to make memory layouts exactly the same and make the corresponding system calls always return exactly the same values in the original and in the translated binaries. Therefore, any differences in the corresponding architecture states indicate mistranslated instructions emitted by the binary translator. Besides solving the architecture-state-comparison problems, we also propose several methods to speed up the automatic validation. The first is the validation-block method, which reduces the number of validations while keeping the accuracy of instruction-level validation. The second is quick validation, which provides extremely fast validation at the expense of less accurate error information. Our validator can be applied to different binary translators. In our experiment, the validator has successfully validated programs translated by static, dynamic, and hybrid binary translators.