Assembly Instruction Sequence

An assembly instruction sequence is an ordered collection of assembly instructions, each composed of an opcode and one or more operands, supplied as a program input to a hardware design under verification (DUV). In the context of hardware verification and fuzzing, instruction sequences serve as test vectors that drive the hardware through specific execution paths.

Structure

An assembly instruction sequence is typically represented as a byte (8-bit) array, with internal segments separating individual instructions. Each instruction within the sequence comprises:

• An opcode specifying the operation
• One or more operands providing the data or addressing modes

This segmented structure allows a fuzzer to mutate individual components (opcodes or operands) independently, while also enabling tracking of individual instructions for symbolic execution.

Role in Hardware Fuzzing (FuSS Framework)

In the FuSS Framework (Coverage-Directed Hardware Fuzzing with Selective Symbolic Execution), assembly instruction sequences play a central role in the verification loop:

1. Fuzzer-generated sequences ($A_f$): The fuzzer generates assembly instruction sequences as test programs. These are simulated against the hardware design to explore coverage paths.
2. Plateau detection: When the fuzzer reaches a coverage plateau, the existing sequence $A_f$ is analyzed for its coverage contribution.
3. Selective symbolic execution: For each source–destination pair identified on the hardware CFG, concrete simulation of $A_f$ reaches the source point $s_i$. The internal hardware state is captured at that point, and selective symbolic execution generates a new instruction sequence $A_s = {a_{s1}, \ldots, a_{s_k}}$ to bridge from $s_i$ to the destination $d_i$.
4. Final program construction ($A_{f+s}$): The combined sequence is formed by concatenating the prefix of fuzzer-generated instructions up to the annotated execution point $a_{fj}$ with the symbolic execution-generated instructions:

$$A_{f+s} = {a_1^f, \ldots, a_{fj} ,||, a_{s1}, \ldots, a_{s_k}}$$

This combined program is then added to the fuzzing corpus for continued exploration.

Illustrative Example

In one FuSS example, the fuzzer-generated sequence explores the path 0x00→0x04→0x08→0x0C→0x10 on the hardware CFG. For the source-destination pair (0x0C, 0xC8), symbolic execution generates instructions activating the path 0x0C→0xC0→0xC8. The final assembly instruction sequence is constructed by combining:

• Upper segment: fuzzer-generated instructions for 0x00 to 0x0C
• Lower segment: symbolic-execution-generated instructions for 0x0C to 0xC8

Relationship to Instruction Embedding Models

Assembly instruction sequences also serve as input to neural instruction embedding models (e.g., BinBert), which transform such sequences into embedding vectors for downstream binary code understanding tasks. While the FuSS framework uses instruction sequences for hardware verification, instruction embedding models use them for semantic representation learning.

See Also

• FuSS Framework: Coverage-directed hardware fuzzing framework that uses assembly instruction sequences as test vectors and selectively applies symbolic execution to break coverage plateaus.