Examiner

Tool

First seen 6/7/2026

Last seen 6/7/2026

Evidence 13 chunks

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

33 connections

Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM ← introduces 100% 2e

The paper introduces the Examiner prototype system for locating inconsistent instructions.

differential testing uses → 100% 2e

Examiner uses differential testing to compare instruction execution between emulators and real devices.

Symbolic Execution uses → 100% 2e

Examiner uses symbolic execution on ARM ASL code to generate test cases.

ARM Architecture Specification Language (ASL) uses → 100% 2e

Examiner parses and symbolically executes ARM ASL code to derive test cases.

QEMU evaluates → 100% 2e

Examiner evaluates QEMU by comparing its instruction execution results against real devices.

A32 instruction set uses → 100% 2e

Examiner generates test cases covering A32 instruction set encodings.

T32 instruction set uses → 100% 2e

Examiner generates test cases covering T32 instruction set encodings.

T16 instruction set uses → 100% 2e

Examiner generates test cases covering T16 instruction set encodings.

ARMv5 architecture evaluates → 100% 2e

Examiner evaluates inconsistent instructions on ARMv5 architecture real devices.

ARMv6 architecture evaluates → 100% 2e

Examiner evaluates inconsistent instructions on ARMv6 architecture real devices.

ARMv7 architecture evaluates → 100% 2e

Examiner evaluates inconsistent instructions on ARMv7 architecture real devices.

ARMv8 architecture evaluates → 100% 2e

Examiner evaluates inconsistent instructions on ARMv8 architecture real devices.

test case generator ← part of 100% 2e

Examiner consists of a test case generator as one of its two main components.

differential testing engine ← part of 100% 2e

Examiner consists of a differential testing engine as one of its two main components.

UNPREDICTABLE instruction behavior mentions → 100% 2e

Examiner identifies UNPREDICTABLE instruction behavior as a root cause of inconsistencies.

UNDEFINED instruction behavior mentions → 100% 2e

Examiner detects UNDEFINED instruction behavior as part of its inconsistency analysis.

Constraint Solving uses → 100% 2e

Examiner uses constraint solving to find concrete values of encoding symbols that satisfy or negate ASL constraints.

prologue and epilogue instruction insertion uses → 100% 2e

Examiner inserts prologue and epilogue instructions to set up CPU state and capture execution results for comparison.

CPU state comparison uses → 100% 2e

Examiner compares the CPU state after instruction execution between emulators and real devices to identify inconsistencies.

mutation set uses → 100% 2e

Examiner builds mutation sets for each encoding symbol as the basis for test case generation.

ARM instruction encoding uses → 100% 2e

Examiner parses ARM instruction encodings to extract symbols and generate test cases.

A64 instruction set uses → 100% 2e

Examiner generates test cases covering A64 instruction set encodings.

Unicorn evaluates → 100% 1e

Examiner is applied to Unicorn to locate inconsistent instructions.

Angr evaluates → 100% 1e

Examiner is applied to Angr to locate inconsistent instructions.

syntax-aware test case generation uses → 100% 1e

Examiner uses a syntax-aware strategy to generate syntactically correct instructions by mutating encoding symbols.

semantics-aware test case generation uses → 100% 1e

Examiner uses a semantics-aware strategy to extract and solve ASL constraints to cover different execution paths.

Z3 SMT solver uses → 100% 1e

Examiner uses the Z3 SMT solver to solve encoding symbol constraints for test case generation.

encoding symbol mutation uses → 100% 1e

Examiner mutates encoding symbols based on pre-defined rules to generate instruction streams.

backward symbolic execution uses → 100% 1e

Examiner conducts backward symbolic execution to retrieve constraints from ASL code.

Instruction Stream Generation uses → 100% 1e

Examiner generates instruction streams to be fed into its differential testing engine.

Capstone uses → 100% 1e

Examiner uses Capstone to extract target memory addresses from instructions during differential testing.

EmuFuzzer ← compares with 90% 1e

Examiner is compared with EmuFuzzer, an existing differential testing framework.

iDEV compares with → 90% 1e

Examiner is compared with iDEV, a prior work studying semantic deviation of ARM instructions.