A64 instruction set

Concept

A64 is the 64-bit instruction set used in the AArch64 execution mode of the ARMv8-A architecture. It is one of the instruction sets evaluated by the Examiner differential testing framework (for locating inconsistent instructions between real ARM devices and CPU emulators such as QEMU, Unicorn, and Angr), and one of the instruction sets exhaustively fuzzed by the armshaker hidden-instruction discovery tool.

First seen 6/7/2026

Last seen 6/21/2026

Evidence 4 chunks

Wiki v2

WIKI

Overview

The A64 instruction set is the instruction set used in the AArch64 execution mode of the Armv8-A architecture. It is distinct from the instruction sets used in the AArch32 execution mode, which comprises A32 (32-bit ARM), T32 (mixed 16-/32-bit Thumb-2), and T16 (16-bit Thumb-1). A64 instruction encodings are defined in the Arm Architecture Reference Manual (ARM ARM) — specifically the DDI0487E Armv8-A Architecture Reference Manual — and are specified using the ASL specification language, which served as the source for the Examiner test case generator.

Role in the Examiner Framework

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

3 connections

Examiner ← uses 100% 2e

Examiner generates test cases covering A64 instruction set encodings.

armshaker ← uses 100% 1e

armshaker can fuzz the A64 instruction set when compiled with a 64-bit toolchain.

Armv8-A ISA part of → 100% 1e

A64 is one of the three instruction sets that make up the Armv8-A ISA.

LINKED ENTITIES

2 links

armshaker USES Extracted graph relationship

Armv8-A ISA PART_OF Extracted graph relationship

CITATIONS

8 sources

8 citations — click to expand

[1] A64 is the 64-bit instruction set used in the AArch64 execution mode of the Armv8-A architecture, distinct from the AArch32 instruction sets A32, T32, and T16. Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM

[2] Examiner's test case generator targets A64 alongside A32, T32, and T16, producing streams executed on real ARMv5/6/7/8 devices and on the QEMU, Unicorn, and Angr emulators. Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM

[3] A64 testing in Examiner consumed 70.51 seconds and produced 1,094,700 Examiner streams covering 839 encodings, 581 instructions, and 3,436 constraints (versus 421,645 / 265 / 178 / 934 for random generation). Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM

[4] Examiner declares an instruction stream inconsistent when, after matching initial CPU states (PC, registers, memory, status), any element of the final CPU state — including signals/exceptions — differs between the emulator and the real device, with prologue/epilogue instructions setting up and dumping state. Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM

[5] armshaker targets the Armv8-A ISA and considers A64 (with A32 and T32) part of the set of Armv8-A instruction sets whose instruction space is small enough to allow exhaustive fuzzing for hidden instructions. frestr/armshaker

[6] armshaker can fuzz A64 when compiled with a 64-bit (AArch64) toolchain, and provides a concrete A64 example: `mov x0, #0x1337` assembles to encoding 0xd28266e0. frestr/armshaker

[7] The behavior of executing undefined instructions with unmatched condition codes as NOPs, documented in section G1.16.1 of the DDI0487E Armv8 Architecture Reference Manual, can produce apparent hidden instructions and is bypassed by armshaker's `-c` option. frestr/armshaker

[8] The armshaker findings were published at HASP 2020 as 'Uncovering Hidden Instructions in Armv8-A Implementations' (Strupe & Kumar, 2021), reporting no hardware-attributable hidden instructions but bugs in QEMU and the Linux kernel. frestr/armshaker