Binary Translation Section

Dynamic Binary Translation

Documents

A search for 'binary translation', 'dynamic binary translation' will provide you with a lot of literature on the topic. If you search for 'dynamic recompilation' and 'dynarec' you will find information about the dynamic binary translators used in the emulation scene (mostly old personal computer systems and video consoles). Those below are the papers I think are more interesting.

Of course most of the references and an introduction to the binary translation techniques can also be found at my document.

Starting with the basics you can read the Shade and Embra papers on dynamic binary translators used for CPU microarchitecture simulation.

IEEE's Computer run a special issue on binary translation. Here are some of the articles published.

UQBT started as a general static binary translator framework but later a dynamic version was implemented. The last developments I know is that SUN got involved with the project and was renamed as the Walkabout framework.

It seems like late 2004 one of the people from UQBT, Jens Tröger , actually presented his PhD. I just discovered it while writing this page so I don't know what there is but I guess it will be quite interesting ...

HP Dynamo project is not exactly binary translation, as the source and target architectures are the same, but the techniques used for dynamic code optimization are quite suitable for a dynamic binary translator.

Trasmeta succesfully created a new CPU VLIW architecture and used a pre BIOS level software layer to execute x86 code. These two papers present some of the techniques used by their CodeMorpher translator.

Intel and HP have their own software translator for the x86 and PA-RISC architectures to IA64 architecture.

IA-32 Execution Layer: a two-phase dynamic translator designed to support IA-32 applications on Itanium®-based systems

PA-RISC to IA-64: Transparent Execution, No Recompilation

Now defunct DEC tried something similar with an OS integrated static translator. FX!32 is a static binary translator and x86 instruction emulator for the Alpha WinNT. It seems it wasn't very succesful. However that is actually my prefered approach ever for binary translation and ISA independent execution of applications. In my opinion the future is on OS integrated transpareted binary translators. The current work on system virtualization (VMWare, MS and the new extensions to the x86 architecture) seems a first step.

Code

I don't have at hand code for any dynamic binary translator. However if you search for 'dynarec' you may get code for some of the open source emulators. Most will use the most simple kind of dynamic translation replacing each source instruction with a fixed match of target instructions and performing some patching.

DAISY was make public by IBM as a binary translator for their killed VLIW architecture. Unless you are interested into translating code for IA64 I don't think it will be that useful (many of the techniques propossed are VLIW specific) but you may try downloading it.

I used to work on the Dixie retargetable static binary translation framework here in the DAC but now the project is as much as dead. If you want additional information or documents (as most of the manuals are in spanish) you can ask me. I guess the code could be public but as there was never a complete enough documentation (that was the last and unfinished task we ever tried for the project) it would be hard to make it work again. I guess it would be hard even for me after 3 years without touching it. If someone asks for the code I will ask the ex managers for it to be released. The last and most interesting features implemented (never ever published or in any external document) were a semi automatic ISA verification mechanism and Speedy, a DVM to target ISA translator and optimizer (Dixie works translating a source ISA to a virtual machine). Dixie supported (mostly limited to some Spec 95 and Spec 2000 programs) source Alpha, Convex, x86, Power/PowerPC and MIPS programs and as target ISAs for Speedy basic Alpha instructions and most and most MIPS were supported. Dixie also translated differences between the OS calls from the source Unix systems and the Unix system where Dixie virtual machine was executing.

Links

There was a mail list and a page for console and computer dynamic recompilation but was closed a couple years ago. Most people in the mail list moved to the dynarec and staticrecompilers groups at Yahoo. I encourage subscribing and participating in both list if you are interested in binary translation and emulation. I my add or link the content from the old list some time later here.

For some years a Workshop on Binary Translation was celebrated with PACT. After 2002 it seems the interests on the topic dimished (as with many other matters interest on binary translation comes on waves and in the late 90s and early 2000s the talk about new architectures -mostly VLIW- made it interesting again). You may try to search for the papers that were presented iin the different years.

Micro-33 run a tutorial on binary. The slides from the tutorial can be found online.

Additional links and related information may be found here: