Analysis of the correctness of Qualcomm Hexagon emulators and decompilers via differential testing

Abstract

Qualcomm Hexagon is an architecture for general-purpose digital signal processors and is used for mobile communication of various devices. Despite the importance of security as much as its popularity, studies on the correctness of emulators and decompilers are insufficient, which are essential for Hexagon's security analysis. In this study, we propose a differential testing tool to automatically discover bugs in emulators and decompilers for Hexagon. To this end, we devise an algorithm to generate random instructions while ensuring constraints in Hexagon

Hexagon employs several constraints in its instruction because of its VLIW (very long instruction word) structure. Then, we applied our tool to two emulators for Hexagon (hexagon-sim and quic/qemu) and one decompiler, binja-hexagon from Google. As a result, we found about 15,000 instructions that cause inconsistent results among them. By analyzing these instructions, we could discover four bugs which are fatal to the correctness.