Deterministic Fully-Static Whole-Binary Translation without Heuristics
Authors: Hongyu Chen, James McGowan, Michael Franz
Summary
The authors built Elevator, a system that translates entire x86-64 binaries to AArch64 (ARM) architecture purely statically — no runtime fallback, no debug info, no assumptions about where code vs. data live. The core trick: instead of guessing whether each byte is data or code, Elevator generates separate translation paths for every possible interpretation and only prunes paths that lead to crashes. This produces huge binaries (lots of redundant translations) but guarantees the output is deterministic and can be tested, validated, or cryptographically signed before deployment — unlike JIT compilers or emulators that generate code at runtime.
Main takeaways:
- First fully-static whole-binary translator that handles x86-64 to AArch64 without heuristics or runtime components
- Considers all possible interpretations of each byte (data, opcode, or opcode argument) and generates translations for all feasible ones
- Output is complete, self-contained, and deterministic — no JIT compiler in the trusted code base
- Major cost is code size explosion due to multiple translation paths
- Achieves performance competitive with QEMU's JIT emulation on SPECint 2006 benchmarks
Relevance
No connection to my LLM work — this is low-level binary translation and computer architecture. Included because it's systems research, but not relevant to behavioral conditioning or language models.
Abstract
arXiv:2605.08419v1 Announce Type: new Abstract: We present Elevator, the first binary translator that statically translates entire x86-64 executables to AArch64 without debug information, source code, or assumptions about code layout. Unlike existing systems, which rely on heuristics or runtime fallbacks to handle code-versus-data decoding errors, Elevator considers all possible interpretations of every byte and produces a separate translation for each feasible one ahead of time. Any byte may be interpreted as data, an opcode, or an opcode argument; we generate separate control flow paths for all interpretations, pruning only those leading to abnormal termination. Translations are built by composing code "tiles" automatically derived from a high-level description of the source ISA, yielding a nimble translation framework. The approach is deterministic and produces complete, self-contained binaries with no runtime component in the trusted code base. The principal cost is substantial code size expansion. The key benefit is that the output is the actual code that will run, enabling testing, validation, certification, and cryptographic signing prior to deployment, reducing risk compared to emulators or JIT compilers. We evaluate Elevator on a diverse corpus of real-world binaries, including the entire SPECint 2006 suite, demonstrating that static full-program binary translation can be both reliable and practical. Elevator achieves performance on par with or better than QEMU's user-mode JIT emulation.