Deterministic Fully-Static Whole-Binary Translation without Heuristics

Abstract: We present Elevator, the first binary translator that statically translates entire x86-64 executables to AArch64 without debug information, source code, or assumptions about code layout. Unlike existing systems, which rely on heuristics or runtime fallbacks to handle code-versus-data decoding errors, Elevator considers all possible interpretations of every byte and produces a separate translation for each feasible one ahead of time. Any byte may be interpreted as data, an opcode, or an opcode argument; we generate separate control flow paths for all interpretations, pruning only those leading to abnormal termination. Translations are built by composing code "tiles" automatically derived from a high-level description of the source ISA, yielding a nimble translation framework. The approach is deterministic and produces complete, self-contained binaries with no runtime component in the trusted code base. The principal cost is substantial code size expansion. The key benefit is that the output is the actual code that will run, enabling testing, validation, certification, and cryptographic signing prior to deployment, reducing risk compared to emulators or JIT compilers. We evaluate Elevator on a diverse corpus of real-world binaries, including the entire SPECint 2006 suite, demonstrating that static full-program binary translation can be both reliable and practical. Elevator achieves performance on par with or better than QEMU's user-mode JIT emulation.

• The paper demonstrates a scalable, deterministic translation pipeline that eliminates heuristics for binary-to-binary translation.
• It introduces a superset disassembly method with offline tile banks to ensure full state preservation and systematic control flow reconstruction.
• The approach guarantees static artifact validation through cryptographic attestation and robust performance on SPECint 2006 benchmarks.

Deterministic Fully-Static Whole-Binary Translation without Heuristics

Motivation and Background

ISA migration continues to be a major barrier for legacy systems longevity and security-critical deployments. Reliance on surviving source code and toolchains is increasingly untenable, particularly when authoritative binaries diverge due to patching or certification processes. Historically, binary translation pipelines have depended on either dynamic translation (JIT/emulation) or static frameworks augmented by heuristics to distinguish code, data, and control-flow. Both approaches introduce non-deterministic behavior and implicitly expand the trusted code base to include unvalidated runtime components.

Earlier static binary recompilers invariably relied on heuristics and partial runtime fallback, rendering them unreliable for analysis, certification, and deployment of large-scale stripped binaries. With architectures such as x64, which exhibit variable-length instructions and allow valid nested instruction sequences (“overlapping decode” and computed indirect jumps), code/data discrimination is fundamentally undecidable (Halting Problem). Prior static approaches were not robust against crafted or obfuscated binaries and struggled with program-scale benchmarks such as SPECint 2006.

Elevator: Superset-Based Static Translation

Elevator is introduced as a deterministic, fully-static, heuristics-free cross-ISA binary-to-binary translator from x86-64 to AArch64. The methodology is predicated on superset disassembly: every byte is interpreted under all feasible code/data hypotheses, and separate translations are generated for each interpretation, with only those paths pruned which terminate in exceptions. Thus, the code-versus-data ambiguity is avoided up front rather than addressed retroactively via heuristics or dynamic recovery. Crucially, output binaries are entirely self-contained, devoid of any runtime translation machinery, enabling comprehensive static validation and cryptographic attestation.

The translation pipeline leverages an offline tile bank generated via LLVM–each x86 instruction and operand combination is mapped to a corresponding AArch64 sequence. Instruction translation achieves full state preservation, including register mappings and ABI boundary reconciliation through targeted transition gadgets. Control flow reconstruction is systematic: direct/deferred targets, indirect branches, and computed jump chains are handled via embedded address-lookup tables that guarantee forward compatibility irrespective of binary complexity.

Figure 1: Indirect branch control flow transitioning and ABI boundary handling in Elevator.

Implementation Details

Translation comprises three stages:

1. Offline Tile Bank Generation: Each instruction semantic is encoded as a C function, specialized per operand, compiled to AArch64 via LLVM with custom register mapping, and stored as binary tiles. Separation of flag computation from arithmetic operations allows for targeted optimization.
2. Superset Disassembly and CFG Construction: Input binaries are exhaustively disassembled at every byte, candidate instruction sequences are identified, and per-node translation tiles concatenated via a greedy block-merging algorithm.
3. Executable Packaging: All translated code, original binary image, lookup table, and a minimal driver are packaged into a stand-alone ELF. Indirect jumps/calls are resolved at runtime using the offset-to-tile lookup table; signals are employed to catch external code pointers entering the translated binary.

ABI transitions are handled for all four cross-boundary cases (calls and returns into and out of external libraries), including argument layout and structure translation for architecture-dependent types. Stack alignment and register preservation are managed for compliance with AArch64 and x64 ABI semantics. Unsupported instructions (beyond SSE/AVX2) manifest as interrupts in unreachable code decodes, preserving semantics for all SPECint 2006 cases.

Evaluation and Numerical Results

Elevator’s correctness is validated by per-tile output equivalence against native x86 execution across over 100,000 test inputs per instruction and full end-to-end equivalence across all SPECint 2006 benchmarks.

Static translation speed scales linearly with input .text size, with a Pearson correlation $r = 0.9993$. Translation of the full suite at -O2/-O3 completes in $140$–$167$ seconds.

Figure 2: Elevator’s translation time scales linearly with input .text size across SPECint 2006.

Runtime cost is decomposed into instruction inflation and microarchitectural efficiency. Elevator exhibits a geometric-mean execution slowdown of $4.88\times$ ($-O2$) and $4.79\times$ ($-O3$) versus native AArch64, outperforming QEMU ($7.24\times$, $7.69\times$) on most benchmarks; Box64 stands as a production reference at $1.58\times$–$140$0. Instruction inflation dominates overhead: Elevator inflates the stream by $140$1 ($140$2) and $140$3 ($140$4), with only modest CPI and branch-miss increase compared to native.

Figure 3: Wall-clock runtime and executed instructions for native, Box64, Elevator, and QEMU on SPECint 2006.

Figure 4: Microarchitectural metrics for Elevator versus native AArch64—cycles per instruction (CPI) and branch-miss rates.

Code-size overhead is pronounced due to systematic superset emission: translated .text is $140$5–$140$6 larger than natively-compiled AArch64, with geometric means of $140$7 ($140$8) and $140$9 ($167$0). The expansion factors are traceable to tile density (every valid decode position), lowering ratio (AArch64 sequence per x86 instruction), and mid-instruction amplification (complex decodes at non-real offsets).

Figure 5: Code-size expansion via superset translation and average x86-64 instruction length.

Predictability and Trusted Deployment

Superset translation ensures that the instruction stream is fixed at translation time—unlike dynamic/JIT approaches, Elevator’s runtime performance is strictly a function of its artifact, immune to execution history or unseen code paths. The output binary can be statically inspected, exhaustively tested, and certified, addressing regulatory and deployment risk where runtime transparency is critical.

Limitations and Optimization Pathways

Current implementation limitations include:

• ABI translation for rare incompatible structures remains manual.
• Absence of multi-threaded binary support due to TLS and x64-to-AArch64 memory model discrepancy.
• Exception handling not yet implemented (stack unwinding).
• AVX2 and later instructions unsupported (would require memory-backed register context or SVE pairing).
• Self-modifying/JIT-compiled code not addressable in static translation paradigm.

Optimizations to reduce code size and runtime overhead are primarily centered on tile specialization (e.g., architecture-specific intrinsics for vector/SIMD), flag computation minimization via per-flag liveness, and targeted dead code elimination based on ground-truth or auxiliary symbol metadata.

Practical and Theoretical Implications

Elevator presents a deterministic, fully-static binary translation mechanism that is suitable for cross-ISA migration of large legacy executables, obfuscated code, or binaries for which source/toolchain provenance is lost. The approach is particularly germane for the rapid porting of certified, legacy, or mission-critical binaries to new hardware platforms where runtime non-determinism or trust expansion is unacceptable.

By shifting the translation burden entirely to offline, deterministic procedures, Elevator provides a framework for static binary artifact validation, cryptographic signing, and risk reduction in certified deployment pipelines. The method is extensible to other ISA pairs and is agnostic to binary layout and toolchain provenance.

Future Directions

Subsequent work should focus on expanding tile coverage, incorporating structure layout translation for more complex ABI mismatches, threading support including TLS emulation and memory model reconciliation, and aggressive tile engineering for hot code and vector paths. There is opportunity to further compress code size via post-translation pruning, probabilistic disassembly, and the use of source-level or symbol metadata where available.

The approach could serve as a foundation for resilient, auditable binary translation frameworks in sectors requiring rigorous validation, including embedded, medical, and government systems. Potential exists for integration into multi-variant execution and n-versioning architectures for fault tolerance and security hardening.

Conclusion

Elevator establishes a fundamentally different cost/benefit profile for cross-ISA binary translation. It eliminates heuristics and runtime dependencies, provides fully static, deterministic artifacts, and is demonstrably robust at program scale and code obfuscation complexity levels previously unattainable via static translation. The system provides strong guarantees for trusted deployment and post-translation validation. Future advancements should address tile granularity and architectural reach, threading, and exception handling to further expand applicability (2605.08419).