Solver Aided Reverse Engineering of Architectural Features

To program a processor, you need to have some model of how it behaves. But providing accurate functional models of processors is challenging. Traditionally, the behavior of a processor is specified by documentation that describes its Instruction Set Architecture, or ISA. This documentation is usually long, making it laborious to produce, and it is often riddled with errors, typos, and inconsistencies. Additionally, it can be insufficiently formal for applications that need an accurate formal model of a processor, such as superoptimizers, program synthesis tools, or proof frameworks. We observe that formal methods can be used not just to consume these models, but to check them and to help us produce them. To demonstrate, we reverse engineer two interesting architectural features of a TI MSP430 microcontroller. First, we use the SMT solver Z3 [1] to synthesize the timings of many instructions. Second, we use Synapse [2], a program synthesis framework built on the Rosette solver-aided language [3], to synthesize the semantics of arithmetic instructions as bitvector programs. In both cases, we compare our results with the TI user’s guide and find that we can provide a more accurate formal model.