cpplinks Documentation

File: README.md

C++ links

A categorized list of C++ resources.

About

Being a part of a few C++ communities, I happen to run across some interesting links -- this is an attempt to categorize them. Thanks to Saurabh Malpani from "C++ Enthusiasts" for the suggestion.

An ongoing, work-in-progress effort -- comments, feedback, and suggestions welcome!

Hopefully some will find this of some use and interest, too :-)

File: analysis.dynamic.md

[C++ links](README.md): Program Analysis - Dynamic

Dynamic Binary Instrumentation (DBI)

Dynamic Binary Instrumentation (DBI): Readings

Cross-ISA Machine Instrumentation using Fast and Scalable Dynamic Binary Translation
- Virtual Execution Environments (VEE) 2019
- Emilio G. Cota, Luca P. Carloni
- http://www.cs.columbia.edu/~cota/pubs/cota_vee19.pdf
- https://www.sld.cs.columbia.edu/qemu-vee.html
Dynamic Binary Instrumentation Primer
- http://deniable.org/posts/binary-instrumentation/
- https://github.com/fdiskyou/DBI
Optimization of Naïve Dynamic Binary Instrumentation Tools
- 2011 Ph.D. Dissertation; Reid Kleckner
- https://dspace.mit.edu/handle/1721.1/76984
Security Evaluation of Dynamic Binary Instrumentation Engines
- DBI Engine Detection Tool and all PoC code
  - https://github.com/zhechkoz/PwIN
- 2018 Master Thesis; Zhechko Zhechev
  - https://web.archive.org/https://kirschju.re/static/ma_zhechev_2018.pdf
- REcon Montreal 2018
- Pwning Intel piN – Why DBI is unsuitable for security applications
  - ESORICS 2018
  - Julian Kirsch, Zhechko Zhechev, Bruno Bierbaumer, Thomas Kittel
  - https://link.springer.com/chapter/10.1007/978-3-319-99073-6_18
SoK: Using Dynamic Binary Instrumentation for Security (And How You May Get Caught Red Handed)
- Asia Conference on Computer and Communications Security (AsiaCCS) 2019
- Daniele Cono D’Elia, Emilio Coppa, Simone Nicchi, Federico Palmaro, Lorenzo Cavallaro
- https://doi.org/10.1145/3321705.3329819
- https://www.diag.uniroma1.it/~delia/papers/asiaccs2019.pdf
- https://github.com/season-lab/sok-dbi-security/
Unravelling Code Injection in Binaries
- 2016; Suchakra Sharma
- https://suchakra.wordpress.com/2016/07/03/unravelling-code-injection-in-binaries/
Using Binary Instrumentation for Vulnerability Discovery (or even mitigation!)
Valgrind Research Papers
- http://valgrind.org/docs/pubs.html

Dynamic Binary Instrumentation (DBI): Software

Avatar²: an open source framework for dynamic instrumentation and analysis of binary firmware
- https://github.com/avatartwo/avatar2
- Avatar²: Towards an open source binary firmware analysis framework
- Avatar²: A Multi-target Orchestration Platform
  - http://s3.eurecom.fr/docs/bar18_muench.pdf
- Dynamic Binary Firmware Analysis: Challenges & Solutions
  - 2019 PhD Dissertation; Marius Muench
  - https://www.eurecom.fr/publication/5969
DynamoRIO: Dynamic Instrumentation Tool Platform
- https://dynamorio.org/
- https://github.com/DynamoRIO/dynamorio
dynamorio_pin_escape
- Escaping DynamoRIO and Pin - or why it's a worse-than-you-think idea to run untrusted code or to input untrusted data
- Cosmin Gorgovan (2014)
- https://github.com/lgeek/dynamorio_pin_escape
Dyninst: Tools for binary instrumentation, analysis, and modification.
- http://www.dyninst.org/
- https://github.com/dyninst/dyninst
- dumpcfgs: Dump (extract) CFGs statically from binary programs using DynInst API
  -https://github.com/rimsa/dumpcfgs
- Parallelizing Binary Code Analysis
  - Xiaozhu Meng, Jonathon M. Anderson, John Mellor-Crummey, Mark W. Krentel, Barton P. Miller, Srđan Milaković
  - 2020 arXiv
  - https://arxiv.org/abs/2001.10621
Instrew: Leveraging LLVM for High Performance Dynamic Binary Instrumentation
- https://github.com/aengelke/instrew
- VEE 2020
  - Alexis Engelke, Martin Schulz
  - https://conf.researchr.org/details/vee-2020/vee-2020-papers/5/Instrew-Leveraging-LLVM-for-High-Performance-Dynamic-Binary-Instrumentation
QBDI (QuarkslaB Dynamic binary Instrumentation): A Dynamic Binary Instrumentation framework based on LLVM
- https://qbdi.quarkslab.com
- https://github.com/quarkslab/QBDI
- Implementing an LLVM based Dynamic Binary Instrumentation framework
  - 34C3 (2017)
  - https://events.ccc.de/congress/2017/Fahrplan/events/9006.html
- Example: plugging Triton on top of QBDI - http://shell-storm.org/repo/Notepad/qbdi_with_triton.txt
- A Preliminary Test of QBDI - https://web.archive.org/web/20181019164425/https://www.johnfxgalea.com/2018/01/13/a-preliminary-test-of-qbdi/
- Example: SRAC - a Simple Return Address Checker - https://github.com/johnfxgalea/SRAC
TinyInst: A lightweight dynamic instrumentation library
- https://github.com/googleprojectzero/TinyInst
Tracer: Set of Dynamic Binary Instrumentation and visualization tools for execution traces.
- https://github.com/SideChannelMarvels/Tracer
- https://insinuator.net/2016/03/how-to-crack-a-white-box-without-much-effort/
- TracerPIN: TracerPin is a Intel PIN tool for generating execution traces of a running process.
- TracerGrind: TracerGrind is a Valgrind tool for generating execution traces of a running process.
- TraceGraph: TraceGraph is a GUI for visualizing execution traces produced by TracerGrind and TracerPin.
Triton: a Dynamic Binary Analysis (DBA) framework
- Provides internal components like a Dynamic Symbolic Execution (DSE) engine, a dynamic taint engine, AST representations of the x86, x86-64, ARM32 and AArch64 Instructions Set Architecture (ISA), SMT simplification passes, an SMT solver interface and, the last but not least, Python bindings.
- https://github.com/JonathanSalwan/Triton
- Triton v0.8 and ARMv7: A Guideline for Adding New Architectures
  - https://blog.quarkslab.com/triton-v08-and-armv7-a-guideline-for-adding-new-architectures.html

Dynamic Binary Translation (DBT)

A Retargetable System-Level DBT Hypervisor
- Tom Spink, Harry Wagstaff, Björn Franke
- 2019 USENIX Annual Technical Conference
  - https://www.usenix.org/conference/atc19/presentation/spink
- ACM Transactions on Computer Systems 36(4) 2020
  - https://doi.org/10.1145/3386161
  - https://www.research.ed.ac.uk/portal/en/publications/a-retargetable-systemlevel-dbt-hypervisor(5807dfc5-6f47-4de6-af05-f0a575960b8d).html
Acceleration of memory accesses in dynamic binary translation
- 2018 PhD Dissertation; Antoine Faravelon
- https://tel.archives-ouvertes.fr/tel-02004524/
CrossDBT: An LLVM-based User-level Dynamic Binary Translation Emulator
- International European Conference on Parallel and Distributed Computing (Euro-Par) 2022
- Wei Li, Xiaohui Luo, Yiran Zhang, Qingkai Meng, Fengyuan Ren
- https://doi.org/10.1007/978-3-031-12597-3_1
Cross-ISA Machine Emulation for Multicores
- Code Generation and Optimization (CGO) 2017
- Emilio G. Cota, Paolo Bonzini, Alex Bennée, Luca P. Carloni
- https://sld.cs.columbia.edu/pubs/cota_cgo17.pdf
CrossMapping: Harmonizing Memory Consistency in Cross-ISA Binary Translation
- 2024 USENIX Annual Technical Conference
- Chen Gao, Xiangwei Meng, Wei Li, Jinhui Lai, Yiran Zhang, Fengyuan Ren
- https://www.usenix.org/conference/atc24/presentation/gao-chen
- CrossMapping implementation for x86, ARMv8, and RISC-V based on QEMU
  - https://github.com/ChenGao1999/CrossMapping-for-QEMU
Dynamic Binary Modification: Tools, Techniques, and Applications
- 2011 Book; Kim Hazelwood
- http://www.morganclaypool.com/doi/abs/10.2200/S00345ED1V01Y201104CAC015
Dynamically Translating x86 to LLVM using QEMU
- 2010 Technical Report; Vitaly Chipounov and George Candea
- https://infoscience.epfl.ch/record/149975/files/x86-llvm-translator-chipounov_
Efficient and Retargetable SIMD Translation in a Dynamic Binary Translator
- Software: Practice and Experience, 48(6) 2018
- Sheng-Yu Fu, Ding-Yong Hong, Yu-Ping Liu, Jan-Jan Wu, Wei-Chung Hsu
- https://onlinelibrary.wiley.com/doi/abs/10.1002/spe.2573?af=R
Efficient LLVM-Based Dynamic Binary Translation
- VEE 2021
- Alexis Engelke, Dominik Okwieka, Martin Schulz
- https://doi.org/10.1145/3453933.3454022
- https://conf.researchr.org/details/vee-2021/vee-2021-papers/6/Efficient-LLVM-Based-Dynamic-Binary-Translation
Enhancing Atomic Instruction Emulation for Cross-ISA Dynamic Binary Translation
- Code Generation and Optimization (CGO) 2021
- Ziyi Zhao, Zhang Jiang, Xiaoli Gong, Ying Chen, Wenwen Wang, Pen-Chung Yew
- https://github.com/NKU-EmbeddedSystem/ABA-LLSC
- https://tr0py.github.io/assets/materials/QEMU-ABA-CGO2021.pdf
- https://tr0py.github.io/assets/materials/QEMU-ABA-CGO2021-slides.pdf
Fast and Correct Load Link/Store Conditional Instruction Handling in DBT Systems
- 2020 International Conference on Compilers, Architecture, and Synthesis for Embedded Systems (CASES)
- Martin Kristien, Tom Spink, Brian Campbell, Susmit Sarkar, Ian Stark, Björn Franke, Igor Böhm, Nigel Topham
- http://hdl.handle.net/10023/20838
- How to emulate LL/SC instructions on hosts that only support Compare-And-Swap (e.g. x86)
Helper Function Inlining in Dynamic Binary Translation
- Compiler Construction (CC) 2021
- Wenwen Wang
- https://dl.acm.org/doi/10.1145/3446804.3446851
- https://homepage.iis.sinica.edu.tw/papers/dyhong/19657-F.pdf
Hermes: A fast cross-ISA binary translator with post-optimization
- Code Generation and Optimization (CGO) 2015
- Xiaochun Zhang, Qi Guo, Yunji Chen, Tianshi Chen, Weiwu Hu
- http://ieeexplore.ieee.org/document/7054204/
- https://dl.acm.org/citation.cfm?id=2738631
Improving Dynamically-Generated Code Performance on Dynamic Binary Translators
- Virtual Execution Environments VEE 2018
- Wenwen Wang, Jiacheng Wu, Xiaoli Gong, Tao Li, Pen-Chung Yew
- https://dl.acm.org/citation.cfm?id=3186413
Improving SIMD Parallelism via Dynamic Binary Translation
- Ding-Yong Hong, Yu-Ping Liu, Sheng-Yu Fu, Jan-Jan Wu, Wei-Chung Hsu
- ACM Transactions on Embedded Computing Systems (TECS) 17(3) 2018
- https://www.researchgate.net/publication/323149934_Improving_SIMD_Parallelism_via_Dynamic_Binary_Translation
- https://www.researchgate.net/publication/323865399_Improving_Dynamically-Generated_Code_Performance_on_Dynamic_Binary_Translators
libdetox: A Framework for Online Program Transformation
- Forming an Ecosystem Around Software Transformation FEAST 2016
- Mathias Payer
- https://nebelwelt.net/publications/files/16FEAST.pdf
- https://github.com/HexHive/libdetox
Low-Compilation-Cost Register Allocation in LLVM-Based Binary Translation
- EuroSys 2026
- Xiangwei Meng, Chen Gao, Wei Li, Fengyuan Ren
- https://doi.org/10.1145/3767295.3803591
Optimizing Binary Translation of Dynamically Generated Code
- Code Generation and Optimization (CGO) 2015
- Byron Hawkins, Brian Demsky, Derek Bruening, Qin Zhao
- https://research.google.com/pubs/archive/46470.pdf
- http://demsky.eecs.uci.edu/~bhawkins/papers/cgo-2015.slides.pdf
Optimizing indirect branches in a system-level dynamic binary translator
- SYSTOR 2012
- Toshihiko Koju, Xin Tong, Ali Ijaz Sheikh, Moriyoshi Ohara, Toshio Nakatani
- http://doi.acm.org/10.1145/2367589.2367599
Processor-Tracing Guided Region Formation in Dynamic Binary Translation
- ACM Transactions on Architecture and Code Optimization, Vol. 15, No. 4, Article 52, 2018
- Ding-Yong Hong, Jan-Jan Wu, Yu-Ping Liu, Sheng-Yu Fu, Wei-Chung Hsu
- http://dl.acm.org/citation.cfm?id=3281664
Requirements for Fast Binary Translation
- Mathias Payer, Thomas R. Gross
- AMAS-BT: Workshop on Architectural and Microarchitectural Support for Binary Translation 2009
- https://nebelwelt.net/publications/files/09AMAS-BT.pdf
- https://nebelwelt.net/publications/files/09AMAS-BT-presentation.pdf
rv8: a high performance RISC-V to x86 binary translator
- Workshop on Computer Architecture Research with RISC-V (CARRV) 2017
- Michael Clark and Bruce Hoult
- https://anarch128.org/~mclark/rv8-carrv.pdf
- https://carrv.github.io/2017/papers/clark-rv8-carrv2017.pdf
- https://rv8.io/
- https://github.com/rv8-io/rv8
Scalable Emulation of Heterogeneous Systems
- 2019 Ph.D. Dissertation; Luca Carloni
- https://academiccommons.columbia.edu/doi/10.7916/d8-a78j-z392
- "in this dissertation we first present a novel machine emulator design based on dynamic binary translation that makes the following improvements over the state of the art: it scales on multicore hosts while remaining memory efficient, correctly handles cross-ISA differences in atomic instruction semantics, leverages the host floating point (FP) unit to speed up FP emulation without sacrificing correctness, and can be efficiently instrumented to---among other possible uses---drive the execution of a full-system, cross-ISA simulator with support for accelerators."
Unleashing the Power of Learning: An Enhanced Learning-Based Approach for Dynamic Binary Translation
- 2019 USENIX Annual Technical Conference
- Changheng Song, Wenwen Wang, Pen-Chung Yew, Antonia Zhai, Weihua Zhang
- https://www.usenix.org/conference/atc19/presentation/song

Readings

Finding Unstable Code via Compiler-Driven Differential Testing
- Architectural Support for Programming Languages and Operating Systems (ASPLOS) 2023
- Shaohua Li, Zhendong Su
- https://dl.acm.org/doi/10.1145/3582016.3582053
- CompDiff: a tool that implements compiler-driven differential testing on top of AFL++
  - https://github.com/shao-hua-li/compdiff

Software

Dr. Memory: Memory Debugger for Windows, Linux, Mac, and Android
- http://drmemory.org/
- https://github.com/DynamoRIO/drmemory
- Practical memory checking with Dr. Memory
  - Code Generation and Optimization (CGO) 2011
  - Derek Bruening, Qin Zhao
  - https://www.researchgate.net/publication/224236404_Practical_memory_checking_with_Dr_Memory
  - http://www.burningcutlery.com/derek/docs/drmem-CGO11.pdf
PANDA: Platform for Architecture-Neutral Dynamic Analysis
- https://github.com/panda-re/panda

Software: Compilers

Software: Frida

Frida: Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.
- Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS, Android, and QNX.
- https://www.frida.re/
- https://github.com/frida/frida
Awesome Frida - A curated list of Frida resources
- https://github.com/dweinstein/awesome-frida
MemREPL: Memory inspection REPL interface
- https://github.com/agustingianni/memrepl

Software: Memory Forensics

AVML: Acquire Volatile Memory for Linux
- A portable volatile memory acquisition tool for Linux
- https://github.com/microsoft/avml
Volatility 3: The volatile memory extraction framework
- https://github.com/volatilityfoundation/volatility3
- https://volatilityfoundation.org/the-volatility-framework/

Software: Pin

Pin - A Dynamic Binary Instrumentation Tool
- https://www.intel.com/software/pintool
- https://en.wikipedia.org/wiki/Pin_(computer_program)

Software: Pin: Readings

Analyzing Parallel Programs With Pin
- IEEE Computer 43(3) 2010
- Moshe Bach, Mark Charney, Robert Cohn, Elena Demikhovsky, Tevi Devor, Kim Hazelwood, Aamer Jaleel, Chi-Keung Luk, Gail Lyons, Harish Patil, Ady Tal
- https://doi.org/10.1109/mc.2010.60
Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation
- PLDI 2005
- Chi-Keung Luk, Robert Cohn, Robert Muth, Harish Patil, Artur Klauser, Geoff Lowney, Steven Wallace, Vijay Janapa Reddi, Kim Hazelwood
- https://doi.org/10.1145/1065010.1065034
Controlling Program Execution through Binary Instrumentation
- SIGARCH Computer Architecture News 33(5) 2005
- Heidi Pan, Krste Asanović, Robert Cohn, Chi-Keung Luk
- https://doi.org/10.1145/1127577.1127587
- http://scale.eecs.berkeley.edu/papers/pin-wbia.pdf
Deterministic PinPoints: Representative and Repeatable Simulation Region Selection with PinPlay and Sniper
- HPCA 2013 Tutorial
- Harish Patil, Trevor E. Carlson
- https://snipersim.org/w/Tutorial:HPCA_2013_PinPoints
Dynamic Binary Analysis with Intel Pin
- https://blog.netspi.com/dynamic-binary-analysis-intel-pin/
- https://github.com/NetSPI/Pin
Pinballs: Portable and Shareable User-level Checkpoints for Reproducible Analysis and Simulation
- REPRODUCE 2014: Workshop on Reproducible Research Methodologies
- Harish Patil, Trevor E. Carlson
- https://www.researchgate.net/publication/280306016_Pinballs_Portable_and_Shareable_User-level_Checkpoints_for_Reproducible_Analysis_and_Simulation_Appeared_in_REPRODUCE_2014_Workshop_on_Reproducible_Research_Methodologies
PinPlay: a framework for deterministic replay and reproducible analysis of parallel programs
- Code Generation and Optimization (CGO) 2010
- Harish Patil, Cristiano Pereira, Mack Stallcup, Gregory Lueck, James Cownie
- https://doi.org/10.1145/1772954.1772958
PinPlay: Using PinPlay for Reproducible Analysis and Replay Debugging
- PLDI 2015 Tutorial
- Harish Patil, Milind Chabbi
- https://pldi15.sigplan.org/details/pldi2015-workshops/6/PINPLAY-Using-PinPlay-for-Reproducible-Analysis-and-Replay-Debugging
- https://sites.google.com/site/pinplaypldi2015tutotial/
PinPoints: Pinpointing Representative Portions of Large Intel® Itanium® Programs with Dynamic Instrumentation
- MICRO 2004
- H. Patil, R. Cohn, M. Charney, R. Kapoor, A. Sun, A. Karunanidhi
- https://doi.org/10.1109/MICRO.2004.28
- https://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-pinpoints
PinPoints: Simulation Region Selection with PinPlay and Sniper
- ISCA 2014 Tutorial
- Harish Patil, Mack Stallcup
- https://sites.google.com/site/pinpointstutorialisca14/
Some thoughts about code-coverage measurement with Pin
- https://doar-e.github.io/blog/2013/08/31/some-thoughts-about-code-coverage-measurement-with-pin/

Software: Pin: Projects

Ablation: Augmenting Static Analysis Using Pintool
- https://github.com/paulmehta/Ablation
- Black Hat 2016; Paul Mehta
- https://www.youtube.com/watch?v=wHIlNRK_HiQ
BasicBlocks: Pin tool for printing the address of each basic block executed in a program.
- https://github.com/chokepoint/BasicBlocks
MICA: Microarchitecture-Independent Characterization of Applications
- a Pin tool for collecting microarchitecture-independent workload characteristics
- https://github.com/boegel/MICA
Pin++: A C++ template meta-programmable framework for authoring Pintools
- https://github.com/SEDS/PinPP
- Pin++: A Object-oriented Framework for Writing Pintools
  - Generative Programming: Concepts and Experiences (GPCE) 2014
  - James H. Hill and Dennis C. Feiock
  - https://core.ac.uk/download/pdf/46962422.pdf
pinball2elf: a tool to create stand-alone Linux binaries from checkpoints for arbitrary portions of execution of other Linux programs
- https://github.com/intel/pinball2elf
- ELFies: Executable Region Checkpoints for Performance Analysis and Simulation
  - CGO 2021
  - Harish Patil, Alexander Isaev, Wim Heirman, Alen Sabu, Ali Hajiabadi, Trevor E. Carlson
  - https://conf.researchr.org/details/cgo-2021/cgo-2021-papers/11/ELFies-Executable-Region-Checkpoints-for-Performance-Analysis-and-Simulation
  - https://heirman.net/papers/patil2021elfies.pdf
PinCTF: use Intel's Pin Tool to instrument binaries and count instructions
- https://github.com/ChrisTheCoolHut/PinCTF

Software: Sanitizers

Compiler-Based Static Instrumentation

Sanitizers: AddressSanitizer, ThreadSanitizer, MemorySanitizer
- https://github.com/google/sanitizers
- https://github.com/google/sanitizers/wiki
Compilers
- Clang
  - AddressSanitizer - https://clang.llvm.org/docs/AddressSanitizer.html
  - DataFlowSanitizer - https://clang.llvm.org/docs/DataFlowSanitizer.html
  - Hardware-assisted AddressSanitizer Design Documentation - https://clang.llvm.org/docs/HardwareAssistedAddressSanitizerDesign.html
  - LeakSanitizer - https://clang.llvm.org/docs/LeakSanitizer.html
    - All about LeakSanitizer
      - 2023; MaskRay (Fangrui Song)
      - https://maskray.me/blog/2023-02-12-all-about-leak-sanitizer
  - MemorySanitizer - https://clang.llvm.org/docs/MemorySanitizer.html
  - RealtimeSanitizer (RTSan): a real-time safety testing tool for C and C++ projects
    - https://clang.llvm.org/docs/RealtimeSanitizer.html
  - SanitizerCoverage - https://clang.llvm.org/docs/SanitizerCoverage.html
    - SanCov: Above and Below the Sanitizer Interface
      - https://calabi-yau.space/blog/sanitizer-coverage-interface.html
  - SanitizerStats - https://clang.llvm.org/docs/SanitizerStats.html
  - Sanitizer special case list - https://clang.llvm.org/docs/SanitizerSpecialCaseList.html
  - ThreadSanitizer - https://clang.llvm.org/docs/ThreadSanitizer.html
  - TypeSanitizer - https://clang.llvm.org/docs/TypeSanitizer.html
  - UndefinedBehaviorSanitizer - https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html
    - All about UndefinedBehaviorSanitizer
      - 2023; MaskRay (Fangrui Song)
      - https://maskray.me/blog/2023-01-29-all-about-undefined-behavior-sanitizer
    - -fsanitize=pointer-overflow
      - Pointer Overflow Checking is in LLVM - https://blog.regehr.org/archives/1518
      - Catching pointer overflow bugs - https://wdtz.org/catching-pointer-overflow-bugs.html
- GCC
  - https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html
  - Address and Thread Sanitizers in GCC
    - https://developers.redhat.com/blog/2014/12/02/address-and-thread-sanitizers-gcc/
  - Useful GCC address sanitizer checks not enabled by default
    - https://kristerw.blogspot.com/2018/06/useful-gcc-address-sanitizer-checks-not.html
- MSVC
  - AddressSanitizer - https://docs.microsoft.com/en-us/cpp/sanitizers/asan
  - Introducing kernel sanitizers on Microsoft platforms
    - Kernel AddressSanitizer (KASAN), Secure Kernel AddressSanitizer (SKASAN), Hyper-V AddressSanitizer (HASAN)
    - https://www.microsoft.com/en-us/security/blog/2023/01/26/introducing-kernel-sanitizers-on-microsoft-platforms/
DRace: Data-race detector for Windows applications built on top of DynamoRIO
- shipped with the following detector backends: tsan (internal ThreadSanitizer), fasttrack, dummy (no detection at all), printer (print all calls to the detector)
- https://github.com/siemens/drace
- Dynamic Instrumentation of Code for Data-Race Detection
  - MUC++ 2020; Felix Mößbauer
  - https://www.youtube.com/watch?v=zWVipIkcypU
- High Performance Dynamic Threading Analysis for Hybrid Applications
  - 2019 Master Thesis; Felix Mößbauer
  - https://doi.org/10.5282/ubm/epub.60621
GWPSan: Sampling-Based Sanitizer Framework
- a framework for low-overhead sampling-based dynamic binary instrumentation, designed for implementing various bug detectors (also called "sanitizers") suitable for production uses
- https://github.com/google/gwpsan
Kernel Concurrency Sanitizer (KCSAN)
- https://github.com/google/ktsan/wiki/KCSAN
- Concurrency bugs should fear the big bad data-race detector
  - part 1: https://lwn.net/Articles/816850/
  - part 2: https://lwn.net/Articles/816854/
Kernel Thread Sanitizer (KTSAN)
- https://github.com/google/ktsan
- https://github.com/google/ktsan/wiki

Software: Sanitizers: Readings

Adding Clang Sanitizers to a CMake Build
- https://genbattle.bitbucket.io/blog/2018/01/05/Dev-Santa-Claus-Part-1/
  - https://old.reddit.com/r/cpp/comments/7qzqlg/dev_santa_claus_pt1_adding_clang_sanitizers_to_a/
AddressSanitizer Internals
- 2022
- Benjamin Peter
- https://blog.gistre.epita.fr/posts/benjamin.peter-2022-10-28-address_sanitizer_internals/
AddressSanitizer: global variable instrumentation
- 2023; MaskRay (Fangrui Song)
- https://maskray.me/blog/2023-10-15-address-sanitizer-global-variable-instrumentation
All about sanitizer interceptors
- 2023; MaskRay (Fangrui Song)
- https://maskray.me/blog/2023-01-08-all-about-sanitizer-interceptors
Creating an LLVM Sanitizer from Hopes and Dreams
- https://blog.trailofbits.com/2019/06/25/creating-an-llvm-sanitizer-from-hopes-and-dreams/
- llvm-sanitizer-tutorial and documentation
  - https://github.com/trailofbits/llvm-sanitizer-tutorial
Data races and the limits of ThreadSanitizer in C and Go
- 2026; Phil Eaton
- https://theconsensus.dev/p/2026/09/06/data-races-and-the-limits-of-threadsanitizer-in-c-and-go.html
GWP-ASan
- https://llvm.org/docs/GwpAsan.html
- GWP-ASan: Sampling-Based Detection of Memory-Safety Bugs in Production
  - 2023
  - Kostya Serebryany, Chris Kennelly, Mitch Phillips, Matt Denton, Marco Elver, Alexander Potapenko, Matt Morehouse, Vlad Tsyrklevich, Christian Holler, Julian Lettner, David Kilzer, Lander Brandt
    https://arxiv.org/abs/2311.09394
- GWP-ASan: Sampling heap memory error detection in-the-wild
  - 2019; Vlad Tsyrklevich
  - https://sites.google.com/a/chromium.org/dev/Home/chromium-security/articles/gwp-asan
- Use GWP-ASan to detect exploits in production environments
  - https://blog.trailofbits.com/2025/12/16/use-gwp-asan-to-detect-exploits-in-production-environments/
Memory error checking in C and C++: Comparing Sanitizers and Valgrind
- https://developers.redhat.com/blog/2021/05/05/memory-error-checking-in-c-and-c-comparing-sanitizers-and-valgrind/
Sanitize your C++ containers: ASan annotations step-by-step
- 2024; Dominik Klemba, Dominik Czarnota
- https://blog.trailofbits.com/2024/09/10/sanitize-your-c-containers-asan-annotations-step-by-step/
SoK: Sanitizing for Security
- IEEE Symposium on Security and Privacy (S&P) 2019
- Dokyung Song, Julian Lettner, Prabhu Rajasekaran, Yeoul Na, Stijn Volckaert, Per Larsen, Michael Franz
- https://ieeexplore.ieee.org/document/8835294
- https://github.com/securesystemslab/sanitizing-for-security-benchmarks
Understanding AddressSanitizer: Better memory safety for your code
- 2024; Dominik Klemba, Dominik Czarnota
- https://blog.trailofbits.com/2024/05/16/understanding-addresssanitizer-better-memory-safety-for-your-code/

Software: Sanitizers: Readings: Research

AddressSanitizer: A Fast Address Sanity Checker
- 2012 USENIX Annual Technical Conference (ATC)
- Konstantin Serebryany, Derek Bruening, Alexander Potapenko, Dmitry Vyukov
- https://www.usenix.org/conference/atc12/technical-sessions/presentation/serebryany
- https://research.google/pubs/pub37752/
MemorySanitizer: fast detector of uninitialized memory use in C++
- Code Generation and Optimization (CGO) 2015
- Evgeniy Stepanov and Konstantin Serebryany
- https://research.google.com/pubs/archive/43308.pdf
ThreadSanitizer
- ThreadSanitizer: data race detection in practice
  - WBIA 2009: Workshop on Binary Instrumentation and Applications
  - Konstantin Serebryany, Timur Iskhodzhanov
  - https://dl.acm.org/doi/abs/10.1145/1791194.1791203
  - https://research.google/pubs/pub35604/
- Dynamic Race Detection with LLVM Compiler
  - RV 2011: Runtime Verification
  - Konstantin Serebryany, Alexander Potapenko, Timur Iskhodzhanov, Dmitry Vyukov
  - https://research.google/pubs/pub37278/

Software: Sanitizers: Readings: Research: 2026

Triton-Sanitizer: A Fast and Device-Agnostic Memory Sanitizer for Triton with Rich Diagnostic Context
- ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) 2026
- Hao Wu, Qidong Zhao, Songqing Chen, Yang Chen, Yueming Hao, Tony CW Liu, Sijia Chen, Adnan Aziz, Keren Zhou
- https://doi.org/10.1145/3779212.3790241
- https://deep-learning-profiling-tools.github.io/CAT-Lab/publication/triton-sanitizer_asplos2026/
- Artifacts:
  - https://github.com/Deep-Learning-Profiling-Tools/TritonSanitizer-Experiments
  - ASPLOS-26-AE: https://doi.org/10.5281/zenodo.17925530
  - TritonSanitizer-Experiments: https://doi.org/10.5281/zenodo.18363705

Software: Sanitizers: Readings: Research: 2025

CMASan: Custom Memory Allocator-aware Address Sanitizer
- IEEE Symposium on Security and Privacy (S&P) 2025
- Junwha Hong, Wonil Jang, Mijung Kim, Lei Yu, Yonghwi Kwon, Yuseok Jeon
- https://doi.ieeecomputersociety.org/10.1109/SP61157.2025.00074
- https://s2-lab.github.io/assets/CMASan_S&P25.pdf
- https://github.com/S2-Lab/CMASan
Détection à faible surcoût des conditions de course et des violations de la sûreté de la mémoire de tas (Low-overhead detection of race conditions and heap memory safety violations)
- 2025 PhD dissertation
- Farzam Dorostkar
- Chapter 6, "Identifying and mitigating implementation-induced data race detection blind spots in ThreadSanitizer v3"
- https://publications.polymtl.ca/70029/
- https://publications.polymtl.ca/70029/15/2025_FarzamDorostkar.pdf
Evaluating the Effectiveness of Memory Safety Sanitizers
- 2025 IEEE Symposium on Security and Privacy (S&P)
- Emanuel Vintila, Philipp Zieris, Julian Horsch
- https://doi.org/10.24406/publica-3847
- https://doi.org/10.1109/SP61157.2025.00088
- MSET: Memory Sanitizer Evaluation Tool
  - https://github.com/Fraunhofer-AISEC/MSET
Janitizer: Rethinking Binary Tools for Practical and Comprehensive Security
- International Symposium on Code Generation and Optimization (CGO) 2025
- Mahwish Arif, Sam Ainsworth, Timothy M. Jones
- https://doi.org/10.1145/3696443.3708930
- https://2025.cgo.org/details/cgo-2025-papers/15/Janitizer-Rethinking-Binary-Tools-for-Practical-and-Comprehensive-Security
- Janitizer: Hybrid binary framework, based on Janus, with implementations of address sanitizer scheme JASAN and control-flow integrity scheme JCFI. Janus: Statically Guided Dynamic Binary Modification.
  - https://github.com/CompArchCam/Janus/tree/security
Memory Safety Instrumentations in Practice: Usability, Performance, and Security Guarantees
- International Symposium on Code Generation and Optimization (CGO) 2025
- Tina Jung, Fabian Ritter, Sebastian Hack
- https://doi.org/10.1145/3696443.3708926
- MemInstrument: A framework to make C memory safe
  - https://github.com/cdl-saarland/MemInstrument/
  - https://compilers.cs.uni-saarland.de/projects/meminstrument/
Practical Object-Level Sanitizer with Aggregated Memory Access and Custom Allocator
- ICSE 2025
- Xiaolei wang, Ruilin Li, Bin Zhang, Chao Feng, Chaojing Tang
- https://doi.org/10.1109/ICSE55347.2025.00213
- OLASan: Object-Level Address Sanitizer
  - https://github.com/040840308-liu/ICSE2025-OLASan-Artifact
QMSan: Efficiently Detecting Uninitialized Memory Errors During Fuzzing
- Network and Distributed System Security (NDSS) Symposium 2025
- Matteo Marini, Daniele Cono D'Elia, Mathias Payer, Leonardo Querzoni
- https://dx.doi.org/10.14722/ndss.2025.241133
- https://hexhive.epfl.ch/publications/files/25NDSS3.pdf
- QMSan: QEMU-based Memory Sanitizer for binary software
  - https://github.com/heinzeen/qmsan
RangeSanitizer: Detecting Memory Errors with Efficient Range Checks
- USENIX Security Symposium 2025
- Floris Gorter, Cristiano Giuffrida
- https://www.usenix.org/conference/usenixsecurity25/presentation/gorter
- RangeSanitizer (RSan): detects spatial and temporal memory errors in C/C++ programs using efficient range checks
  - https://github.com/vusec/rangesanitizer
SAND: Decoupling Sanitization from Fuzzing for Low Overhead
- IEEE/ACM International Conference on Software Engineering (ICSE) 2025
- Ziqiao Kong, Shaohua Li, Heqing Huang, Zhendong Su
- https://doi.org/10.1109/ICSE55347.2025.00187
- https://arxiv.org/abs/2402.16497
- https://shao-hua-li.github.io/assets/pdf/2024_sand_preprint.pdf
- https://github.com/AFLplusplus/AFLplusplus/blob/stable/docs/SAND.md
SpecASan: Mitigating Transient Execution Attacks Using Speculative Address Sanitization
- International Symposium on Computer Architecture (ISCA) 2025
- Saber Ganjisaffar, Esmaeil Mohmmadian Koruyeh, Jason Zellmer, Hodjat Asghari Esfeden, Chengyu Song, Nael B. Abu-Ghazaleh
- https://doi.org/10.1145/3695053.3731119
- https://www.cs.ucr.edu/~csong/isca25-specasan.pdf
Tech-ASan: Two-stage check for Address Sanitizer
- Internetware 2025
- Yixuan Cao, Yuhong Feng, Huafeng Li, Chongyi Huang, Fangcao Jian, Haoran Li, Xu Wang
- https://arxiv.org/abs/2506.05022
- https://conf.researchr.org/details/internetware-2025/internetware-2025-research-track/38/Tech-ASan-Two-stage-check-for-Address-Sanitizer
- https://www.slideshare.net/slideshow/tech-asan-two-stage-check-for-address-sanitizer-yixuan-cao-pdf/280618754
- https://www.youtube.com/watch?v=bkVE5PIIc3g
Triton-San: Toward Precise Debugging of Triton Kernels via LLVM Sanitizers
- 2025 US LLVM Developers' Meeting
- Lechen Yu, Tim Lu, Brandon Myers, Ofer Dekel
- https://www.youtube.com/watch?v=Ncvjewv6hZ0
- https://llvm.org/devmtg/2025-10/slides/technical_talks/lu.pdf
- Triton-San: a dynamic analysis tool that is capable of accurately detecting bugs (e.g., buffer overflow, data race) in Triton programs
  - https://github.com/microsoft/triton-shared/tree/main/triton-san
type++: Prohibiting Type Confusion with Inline Type Information
- Network and Distributed System Security (NDSS) Symposium 2025
- Nicolas Badoux, Flavio Toffalini, Yuseok Jeon, Mathias Payer
- https://www.ndss-symposium.org/ndss-paper/type-prohibiting-type-confusion-with-inline-type-information/
- https://nebelwelt.net/files/25NDSS.pdf
- https://github.com/HexHive/typepp

Software: Sanitizers: Readings: Research: 2024

A Binary-level Thread Sanitizer or Why Sanitizing on the Binary Level is Hard
- USENIX Security 2024
- Joschua Schilling, Andreas Wendler, Philipp Görz, Nils Bars, Moritz Schloegel, Thorsten Holz
- https://www.usenix.org/conference/usenixsecurity24/presentation/schilling
- https://github.com/CISPA-SysSec/binary-tsan
Don't Waste My Efforts: Pruning Redundant Sanitizer Checks by Developer-Implemented Type Checks
- USENIX Security 2024
- Yizhuo Zhai, Zhiyun Qian, Chengyu Song, Manu Sridharan, Trent Jaeger, Paul Yu, Srikanth V. Krishnamurthy
- https://www.usenix.org/conference/usenixsecurity24/presentation/zhai
- https://github.com/seclab-ucr/TPrunify
ERASAN: Efficient Rust Address Sanitizer
- 2024 IEEE Symposium on Security and Privacy (S&P)
- Jiun Min, Dongyeon Yu, Seongyun Jeong, Dokyung Song, Yuseok Jeon
- https://doi.ieeecomputersociety.org/10.1109/SP54263.2024.00258
- https://s2-lab.github.io/assets/erasan_S&P_2024.pdf
- https://s2-lab.github.io/assets/ERASan_S&P24.pdf
- https://www.youtube.com/watch?v=r_a5zJg5jeE
- https://github.com/S2-Lab/ERASan
GiantSan: Efficient Memory Sanitization with Segment Fold
- ACM Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) 2024
- Hao Ling, Heqing Huang, Chengpeng Wang, Yuandao Cai, Charles Zhang
- https://dl.acm.org/doi/10.1145/3620665.3640391
- https://5hadowblad3.github.io/files/asplos24-GiantSan.pdf
- https://github.com/5hadowblad3/GiantSan-Artifact
- https://github.com/AceSrc/GiantSan-Artifact
(Offload) ASan via Software Managed Virtual Memory
- 2024 LLVM Developers' Meeting
- Johannes Doerfert
- https://www.youtube.com/watch?v=B60jp4khrvc
- https://llvm.org/devmtg/2024-10/slides/techtalk/Doerfert-Offload-ASAN.pdf
RMASanitizer: Generalized Runtime Detection of Data Races in Remote Memory Access Applications
- ICPP 2024
- Simon Schwitanski, Yussur Mustafa Oraji, Cornelius Pätzold, Joachim Jenke, Felix Tomski, Matthias S. Müller
- https://doi.org/10.1145/3673038.3673109
RustSan: Retrofitting AddressSanitizer for Efficient Sanitization of Rust
- USENIX Security 2024
- Kyuwon Cho, Jongyoon Kim, Kha Dinh Duy, Hajeong Lim, Hojoon Lee
- https://www.usenix.org/conference/usenixsecurity24/presentation/cho-kyuwon

Software: Sanitizers: Readings: Research: 2023

ASanity: On Bug Shadowing by Early ASan Exits
- IEEE Workshop on Offensive Technologies (WOOT) 2023
- Vincent Ulitzsch, Deniz Scholz, Dominik Maier
- http://wootconference.org/papers/woot23-paper34.pdf
- http://wootconference.org/slides/34-ASanity_On_Bug_Shadowing_by_Early_ASan_Exits.pdf
Don’t Look UB: Exposing Sanitizer-Eliding Compiler Optimizations
- PLDI 2023
- Raphael Isemann, Cristiano Giuffrida, Herbert Bos, Erik van der Kouwe, Klaus von Gleissenthall
- https://goto.ucsd.edu/~gleissen/papers/dontlookub.pdf
- https://github.com/vusec/LookUB
- https://pldi23.sigplan.org/details/pldi-2023-pldi/38/Don-t-Look-UB-Exposing-Sanitizer-Eliding-Compiler-Optimizations
Finding Bugs in Sanitizer Implementations
- ASPLOS 2024
- Shaohua Li, Zhendong Su
- https://shao-hua-li.github.io/files/2024_ASPLOS_UBFUZZ.pdf
- UBGen: an automated UB program generator for C
  - Given a valid C program, UBGen can mutate it to generate programs containing undefined behaviors. For each of the generated UB program, it only contains one kind of undefined behavior at one program location.
  - https://github.com/shao-hua-li/UBGen
FloatZone: Accelerating Memory Error Detection using the Floating Point Unit
- USENIX Security 2023
- Floris Gorter, Enrico Barberis, Raphael Isemann, Erik van der Kouwe, Cristiano Giuffrida, Herbert Bos
- https://www.vusec.net/projects/floatzone/
- https://www.usenix.org/conference/usenixsecurity23/presentation/gorter
- https://github.com/vusec/floatzone
Mapping High-Level Concurrency from OpenMP and MPI to ThreadSanitizer Fibers
- SC Workshops 2023
- Joachim Jenke, Simon Schwitanski, Isabel Thärigen, Matthias S. Müller
- https://dl.acm.org/doi/10.1145/3624062.3624085

Software: Sanitizers: Readings: Research: 2022

Debloating Address Sanitizer
- USENIX Security Symposium 2022
- Yuchen Zhang, Chengbin Pang, Georgios Portokalidis, Nikos Triandopoulos, Jun Xu
- https://www.usenix.org/system/files/sec22summer_zhang-yuchen.pdf
- https://github.com/junxzm1990/ASAN--
Efficient Greybox Fuzzing to Detect Memory Errors
- Automated Software Engineering (ASE) 2022
- Jinsheng Ba, Gregory J. Duck, Abhik Roychoudhury
- https://arxiv.org/abs/2204.02773
- ReZZan: RET+Fuzzing+Sanitizer
  - a fast memory error sanitizer for fuzzing C/C++ code
  - https://github.com/bajinsheng/ReZZan
SafePM: A Sanitizer for Persistent Memory
- EuroSys 2022
- Kartal Kaan Bozdoğan, Dimitrios Stavrakakis, Shady Issa, Pramod Bhatotia
- https://dse.in.tum.de/wp-content/uploads/2022/04/final_digital_version.pdf
- https://dse.in.tum.de/wp-content/uploads/2022/04/SafePM_eurosys22_presentation.pdf
- SafePM: Memory Safety for Persistent Memory
- https://github.com/TUM-DSE/safepm
SymSan: Time and Space Efficient Concolic Execution via Dynamic Data-Flow Analysis
- USENIX Security 2022
- Ju Chen, Wookhyun Han, Mingjun Yin, Haochen Zeng, Chengyu Song, Byoungyong Lee, Heng Yin, and Insik Shin
- https://www.usenix.org/conference/usenixsecurity22/presentation/chen-ju
- An LLVM Sanitizer for Symbolic Tracing
  - https://github.com/R-Fuzz/symsan

Software: Sanitizers: Readings: Research: 2021

NSan: A Floating-Point Numerical Sanitizer
- Compiler Construction (CC) 2021
- Clement Courbet
- https://dl.acm.org/doi/abs/10.1145/3446804.3446848
- https://arxiv.org/abs/2102.12782
- https://reviews.llvm.org/D97854
Parallel Shadow Execution to Accelerate the Debugging of Numerical Errors
- ESEC/FSE 2021
- Sangeeta Chowdhary, Santosh Nagarakatte
- https://doi.org/10.1145/3468264.3468585
- https://www.cs.rutgers.edu/~santosh.nagarakatte/papers/fse-2021-final-preprint.pdf
- https://people.cs.rutgers.edu/~sn349/papers/fse-2021-final-preprint.pdf
- https://2021.esec-fse.org/details/fse-2021-papers/54/Parallel-Shadow-Execution-to-Accelerate-the-Debugging-of-Numerical-Errors
- PFPSanitizer: A Parallel Shadow Execution Tool for Debugging Numerical Errors
  -https://github.com/rutgers-apl/PFPSanitizer
SanRazor: Reducing Redundant Sanitizer Checks in C/C++ Programs
- USENIX Symposium on Operating Systems Design and Implementation (OSDI) 2021
- Jiang Zhang, Shuai Wang, Manuel Rigger, Pinjia He, Zhendong Su
- https://www.usenix.org/conference/osdi21/presentation/zhang
- https://github.com/SanRazor-repo/SanRazor
UAFSan: An Object-Identifier-Based Dynamic Approach for Detecting Use-After-Free Vulnerabilities
- ISSTA 2021
- Binfa Gui, Wei Song, Jeff Huang
- https://doi.org/10.1145/3460319.3464835
- UAFSan: a sanitizer that can detect UAFs (including double frees) in C/C++ software at runtime
  - https://github.com/wsong-nj/UAFSan

Software: Sanitizers: Readings: Research: 2020

A Preliminary Study on Open-Source Memory Vulnerability Detectors
- International Conference on Software Analysis, Evolution, and Reengineering (SANER), ERA track, 2020
- Yu Nong and Haipeng Cai
- http://chapering.github.io/pubs/saner20-a.pdf
- AddressSanitizer, CBMC, DrMemory, MemorySanitizer, Valgrind
- Research questions:
  - RQ1: How effective are these detectors in terms of precision, recall, and accuracy?
  - RQ2: How efficient are the detectors in terms of their cost for detecting vulnerabilities?
  - RQ3: How do these detectors compare in terms of their detection accuracy?
Debugging and Detecting Numerical Errors in Computation with Posits
- PLDI 2020
- Sangeeta Chowdhary, Jay P. Lim, Santosh Nagarakatte
- https://doi.org/10.1145/3385412.3386004
- https://www.cs.rutgers.edu/~santosh.nagarakatte/papers/PositDebug-PLDI-2020-preprint.pdf
- FPSanitizer: A debugger to detect and diagnose numerical errors in floating point programs
  - https://github.com/rutgers-apl/fpsanitizer
- PositDebug: A debugger to detect numerical errors in applications using posits
  - https://github.com/rutgers-apl/PositDebug
FuZZan: Efficient Sanitizer Metadata Design for Fuzzing
- USENIX Annual Technical Conference (USENIX ATC) 2020
- Yuseok Jeon, WookHyun Han, Nathan Burow, Mathias Payer
- https://nebelwelt.net/files/20ATC.pdf
- https://github.com/HexHive/FuZZan
ParmeSan: Sanitizer-guided Greybox Fuzzing
- USENIX Security 2020
- Sebastian Österlund, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida
- https://github.com/vusec/parmesan
- https://www.usenix.org/conference/usenixsecurity20/presentation/osterlund

Software: Sanitizers: Readings: Research: 2018

Automatic fuzzy-scheduling of threads in Google Thread Sanitizer to detect errors in multithreaded code
- MICSECS 2018
- Oleg Doronin, Karina Dergun, Andrey Dergachev
- https://ceur-ws.org/Vol-2344/paper9.pdf
- [RFC] [tsan] Implementing a Fuzz Scheduler for TSAN
  - 2024-2026; Chris Cotter
  - https://discourse.llvm.org/t/rfc-tsan-implementing-a-fuzz-scheduler-for-tsan/80969
  - Introduce Adaptive Delay Scheduling to TSAN
    - https://github.com/llvm/llvm-project/pull/178836
CastSan: Efficient Detection of Polymorphic C++ Object Type Confusions with LLVM
- European Symposium on Research in Computer Security (ESORICS) 2018
- Muntean P., Wuerl S., Grossklags J., Eckert C.
- https://link.springer.com/chapter/10.1007/978-3-319-99073-6_1
- https://www.docdroid.net/INWYBF7/castsan-esorics18.pdf
CUP: Comprehensive User-Space Protection for C/C++
- AsiaCCS 2018
- Nathan Burow, Derrick McKee, Scott A. Carr, Mathias Payer
- https://hexhive.github.io/publications/files/18AsiaCCS.pdf
- https://github.com/HexHive/CUP
EffectiveSan: Type and Memory Error Detection using Dynamically Typed C/C++
- PLDI 2018
- Gregory J. Duck, Roland H. C. Yap
- https://arxiv.org/abs/1710.06125
- https://github.com/GJDuck/EffectiveSan
- https://pldi18.sigplan.org/event/pldi-2018-papers-effectivesan-type-and-memory-error-detection-using-dynamically-typed-c-c-
PartiSan: Fast and Flexible Sanitization via Run-time Partitioning
- Research in Attacks, Intrusions and Defenses (RAID) 2018
- Julian Lettner, Dokyung Song, Taemin Park, Stijn Volckaert, Per Larsen, Michael Franz
- https://arxiv.org/abs/1711.08108

Software: Sanitizers: Readings: Research: 2017

DangSan: Scalable Use-after-free Detection
- European Conference on Computer Systems (EuroSys) 2017
- Erik van der Kouwe, Vinod Nigade, Cristiano Giuffrida
- http://www.cs.vu.nl/~giuffrida/papers/dangsan_eurosys17.pdf
- https://github.com/vusec/dangsan
HexType: Efficient Detection of Type Confusion Errors for C++
- ACM Conference on Computer and Communication Security (CCS) 2017
- Yuseok Jeon, Priyam Biswas, Scott A. Carr, Byoungyoung Lee, and Mathias Payer.
- Paper (PDF): https://nebelwelt.net/publications/files/17CCS.pdf
- Slides (PDF): http://nebelwelt.net/publications/files/17CCC-presentation.pdf
- 34C3 (2017)
  - https://media.ccc.de/v/34c3-8848-type_confusion_discovery_abuse_and_protection
  - https://www.youtube.com/watch?v=jbglFfkRYQs
- HexType: Efficient Detection of Type Confusion Errors for C++
  - https://github.com/HexHive/HexType
HexVASAN: Venerable Variadic Vulnerabilities Vanquished
- USENIX Security Symposium 2017
- Priyam Biswas, Alessandro Di Federico, Scott A. Carr, Prabhu Rajasekaran, Stijn Volckaert, Yeoul Na, Michael Franz, and Mathias Payer.
- https://nebelwelt.net/publications/files/17SEC.pdf
- https://nebelwelt.net/publications/files/17SEC-presentation.pdf
- https://github.com/HexHive/HexVASAN

Software: Sanitizers: Readings: Research: 2016

TypeSanitizer: Practical Type Confusion Detection
- Computer and Communications Security (CCS) 2016
- Istvan Haller, Yuseok Jeon, Hui Peng, Mathias Payer, Herbert Bos, Cristiano Giuffrida, Erik van der Kouwe
- https://nebelwelt.net/publications/files/16CCS2.pdf
- TypeSan checks casts in C++ code - code released for CCS 2016
  - https://github.com/vusec/typesan

Software: Sanitizers: Projects

ALSan： Attachable Leak Sanitizer
- https://github.com/Bojun-Seo/bcc/tree/lsan
- Detect C++ Memory Leaks with ALSan： Attachable Leak Sanitizer
  - C++Now 2024
  - Bojun Seo
  - https://www.youtube.com/watch?v=9f5hd-8suVE
  - https://github.com/boostcon/cppnow_presentations_2024/blob/main/Presentations/ALSAN.pdf
QASan: QEMU-AddressSanitizer
- a custom QEMU that detects memory errors in the guest using AddressSanitizer
- https://github.com/andreafioraldi/qasan
- Sanitized Emulation with QASan
  - https://andreafioraldi.github.io/articles/2019/12/20/sanitized-emulation-with-qasan.html
- Fuzzing binaries for memory safety errors with QASan
  - IEEE Secure Development Conference (SecDev) 2020
  - Andrea Fioraldi, Daniele Cono D’Elia, Leonardo Querzoni
  - https://andreafioraldi.github.io/assets/qasan-secdev20.pdf
  - https://andreafioraldi.github.io/assets/qasan-secdev20-slides.pdf
  - https://youtube.com/watch?v=UtFXU7Nkd8g
sanitizers-cmake: CMake modules to help use sanitizers
- https://github.com/arsenm/sanitizers-cmake
TypeART: LLVM-based type and memory allocation tracking sanitizer
- https://github.com/tudasc/TypeART
- Compiler-aided Type Tracking for Correctness Checking of MPI Applications
  - International Workshop on Software Correctness for HPC Applications (Correctness) 2018
  - Alexander Hück, Jan-Patrick Lehr, Sebastian Kreutzer, Joachim Protze, Christian Terboven, Christian Bischof, Matthias S. Müller
  - https://doi.org/10.1109/Correctness.2018.00011
  - https://correctness-workshop.github.io/2018/papers/lehr.pdf

Software: Sanitizers: Talks

AddressSanitizer, ThreadSanitizer and MemorySanitizer -- Dynamic Testing Tools for C++
- GTAC 2013; Kostya Serebryany
- https://www.youtube.com/watch?v=Q2C2lP8_tNE
Address and Thread Sanitizer in GCC: State of the Onion
- GNU Tools Cauldron 2013; Dodji Seketeli
- https://gcc.gnu.org/wiki/cauldron2013?action=AttachFile&do=view&target=asan.pdf
- https://www.youtube.com/watch?v=41_WZk6AePY
C++ Sanitizers
- C++ Weekly; Ep. 84 (2017)
- https://www.youtube.com/watch?v=MB6NPkB4YVs
Debugging with LLVM: A quick introduction to LLDB and LLVM sanitizers
- FOSDEM 2020
- Andrzej Warzynski; Graham Hunter
- https://fosdem.org/2020/schedule/event/debugging_with_llvm/
Finding races and memory errors with LLVM instrumentation
- 2011 LLVM Developers’ Meeting; Konstantin Serebryany
- https://www.youtube.com/watch?v=sJqQTUtV6GY
Finding races and memory errors with compiler instrumentation: AddressSanitizer, ThreadSanitizer
- GNU Tools Cauldron 2012; Konstantin Serebryany, Dmitry Vyukov
- https://gcc.gnu.org/wiki/cauldron2012?action=AttachFile&do=get&target=kcc.pdf
- https://gcc.gnu.org/wiki/cauldron2012#Finding_races_and_memory_errors_with_GCC_instrumentation_.28AddressSanitizer.29
MemorySanitizer, ThreadSanitizer: Scalable run-time detection of uninitialized memory reads and data races with LLVM instrumentation
- 2012 LLVM Developers’ Meeting; Kostya Serebryany
- https://www.youtube.com/watch?v=HDgttiIvMxA
New Address Sanitizer Features
- 2013 LLVM Developers’ Meeting
- Kostya Serebryany, Alexey Samsonov
- https://www.youtube.com/watch?v=ldZvZE8fWwA
- https://llvm.org/devmtg/2013-11/slides/Serebryany-ASAN.pdf
News from Sanitizers
- GNU Tools Cauldron 2014; Evgeniy Stepanov, Kostya Serebryany
- https://docs.google.com/presentation/d/1QG2qlzpxlsdDsX4uHhTLWAoUmbzbhedFMoMvviud0Us
- https://www.youtube.com/watch?v=Ek7z_oC0dak
Run-time tracking of uninitialized data with MemorySanitizer
- 2013 EuroLLVM Developers’ Meeting; Evgeniy Stepanov
- https://www.youtube.com/watch?v=2Y0T-1AB-gY
Teaching C++ Containers and Allocators How to Sanitize Addresses
- CppNorth 2023
- Miro Knejp
- https://www.youtube.com/watch?v=RCYhxIKh8rs
The Type Sanitizer: Free Yourself from -fno-strict-aliasing
- 2017 LLVM Developers’ Meeting; Hal Finkel
- https://www.youtube.com/watch?v=vAXJeN7k32Y
ThreadSanitizer APIs for external libraries
- 2017 LLVM Developers’ Meeting; Kuba Mracek
- https://www.youtube.com/watch?v=-J9bMpqfc7A
Utilizing ThreadSanitizer for HPC Correctness Checking
- LLVM Meetup Darmstadt 2024-07-31
- Simon Schwitanski
- https://www.youtube.com/watch?v=IB04tyatpww
- MUST: a runtime error detection tool for MPI applications
  - https://www.itc.rwth-aachen.de/MUST
  - https://www.vi-hps.org/tools/must.html

Software: Valgrind

Valgrind
- http://valgrind.org/
- Valgrind is an instrumentation framework for building dynamic analysis tools. There are Valgrind tools that can automatically detect many memory management and threading bugs, and profile your programs in detail. You can also use Valgrind to build new tools.
Valgrind
- Overload Journal; Paul Floyd
- Part 1 – Introduction - https://accu.org/index.php/journals/1930
- Part 2 – Basic memcheck - https://accu.org/index.php/journals/1913
- Part 3 – Advanced memcheck - https://accu.org/index.php/journals/1905
- Part 4 – Cachegrind and Callgrind - https://accu.org/index.php/journals/1886
- Part 5 – Massif - https://accu.org/index.php/journals/1884
- Part 6 – Helgrind and DRD - https://accu.org/index.php/journals/1867
Valgrind
- C++ Weekly - Episode 86
- https://www.youtube.com/watch?v=3l0BQs2ThTo
Valgrind Memcheck: Different ways to lose your memory
- https://developers.redhat.com/blog/2021/04/23/valgrind-memcheck-different-ways-to-lose-your-memory/
gdb + valgrind - https://fau.re/blog/20140330_vgdb.html
Valgrind and GDB: Tame the Wild C - https://heeris.id.au/2016/valgrind-gdb/
Watching for software inefficiencies with Valgrind
- https://kristerw.blogspot.com/2020/02/watching-for-software-inefficiencies.html
- deadstores: A Valgrind tool for finding redundant loads/stores.
  - https://github.com/kristerw/deadstores
CFGGrind: Dynamic Control Flow Graph Reconstruction
- https://github.com/rimsa/CFGgrind
- https://compilers.iecc.com/comparch/article/19-11-004
- Practical Dynamic Reconstruction of Control Flow Graphs
  - Software: Practice and Experience, 2020
  - Andrei Rimsa, José Nelson Amaral, Fernando Magno Quintão Pereira
  - https://homepages.dcc.ufmg.br/~fernando/publications/papers/RimsaSPE20.pdf
InstrGrind: A dynamic instruction counter plugin for Valgrind
- https://github.com/rimsa/instrgrind
- Instruction Visibility in SPEC CPU2017
  - Journal of Computer Languages, Volume 66, 2021
  - Andrei Rimsa Álvares, José Nelson Amaral, Fernando Magno Quintão Pereira
  - https://doi.org/10.1016/j.cola.2021.101062
  - https://homepages.dcc.ufmg.br/~fernando/publications/papers/AlvaresJCL21.pdf
Taintgrind: A taint-tracking plugin for the Valgrind memory checking tool
- https://github.com/wmkhoo/taintgrind
Use Valgrind Memcheck with a custom memory manager
- https://developers.redhat.com/articles/2022/03/23/use-valgrind-memcheck-custom-memory-manager

File: analysis.static.md

[C++ links](README.md): Program Analysis - Static

Readings

Static Analysis Roadmap
- https://tpiazza.me/posts/2017-11-01-static-analysis-roadmap.html
Best Practices for the use of Static Code Analysis within a Real-World Secure Development Lifecycle
- 2015; Jeremy Boone
- https://www.nccgroup.trust/us/our-research/best-practices-for-the-use-of-static-code-analysis-within-a-real-world-secure-development-lifecycle/
Bill Torpey - static analysis posts
- Static Analysis with Clang - http://btorpey.github.io/blog/2015/04/27/static-analysis-with-clang/
- Mo' Static - http://btorpey.github.io/blog/2016/04/07/mo-static/
- Even Mo' Static - http://btorpey.github.io/blog/2016/11/12/even-mo-static/
- Lots o' static - http://btorpey.github.io/blog/2017/09/17/lotso-static/
OASIS Static Analysis Results Interchange Format (SARIF) TC
- Defining a standard output format for static analysis tools
- https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif
- https://github.com/oasis-tcs/sarif-spec
- Static Analysis Results: A Format and a Protocol: SARIF & SASP
  - https://blogs.grammatech.com/static-analysis-results-a-format-and-a-protocol-sarif-sasp
- Integration of the Static Analysis Results Interchange Format in CogniCrypt
  - 2019 arXiv
  - Sriteja Kummita, Goran Piskachev
  - https://arxiv.org/abs/1907.02558
On the Relationship Between Static Analysis and Type Theory
- https://semantic-domain.blogspot.com/2019/08/on-relationship-between-static-analysis.html
Pascal Cuoq
- Static analysis and low-level C programs that access the representation of addresses
  - https://trust-in-soft.com/blog/2022/04/26/static-analysis-and-low-level-c-programs-that-access-the-representation-of-addresses/
- C programs that access the representation of addresses: TrustInSoft’s solution
  - https://trust-in-soft.com/blog/2022/06/03/c-programs-that-access-the-representation-of-addresses-trustinsofts-solution/

Readings: Books

Static Program Analysis
- Anders Møller, Michael I. Schwartzbach
- https://cs.au.dk/~amoeller/spa/

Readings: Implementation

Implementing and Executing Static Analysis Using LLVM and CodeChecker
- 2024
- Gabor Horvath, Reka Kovacs, Richard Szalay, Zoltan Porkolab
- https://arxiv.org/abs/2408.05657

Readings: Research

Static Analysis Symposia Central Site
- http://staticanalysis.org/
A Few Billion Lines of Code Later: Using Static Analysis to Find Bugs in the Real World
- Communications of the ACM, Vol. 53 No. 2, 2010
- Al Bessey, Ken Block, Ben Chelf, Andy Chou, Bryan Fulton, Seth Hallem, Charles Henri-Gros, Asya Kamsky, Scott McPeak, Dawson Engler
- https://cacm.acm.org/magazines/2010/2/69354-a-few-billion-lines-of-code-later/fulltext
Automated Program Transformation for Improving Software Quality
- 2019 PhD Dissertation; Rijnard van Tonder
- https://rijnard.com/pdfs/dissertation-rijnard.pdf
Clog: A Declarative Language for C Static Code Checkers
- CC 2024: ACM SIGPLAN International Conference on Compiler Construction
- Alexandru Dura, Christoph Reichenbach
- https://dl.acm.org/doi/10.1145/3640537.3641579
- https://github.com/lu-cs-sde/clog
Detecting Element Accessing Bugs in C++ Sequence Containers
- 2024 International Conference on Automated Software Engineering (ASE)
- Zhilin Li, Xutong Ma, Mengze Hu, Jun Yan
- https://doi.org/10.1145/3691620.3695471
- Scasa: a tool based on Clang Static Analyzer (CSA) detecting Element Accessing bugs in C++ Sequence Containers
  - https://github.com/SQUARE-RG/Scasa
How to Build Static Checking Systems Using Orders of Magnitude Less Code
- ASPLOS 2016
- Fraser Brown, Andres Nötzli, Dawson Engler
- https://web.stanford.edu/~mlfbrown/paper.pdf
- http://lambda-the-ultimate.org/node/5348
- https://blog.acolyer.org/2016/05/31/how-to-build-static-checking-systems-using-orders-of-magnitude-less-code/
IceBear: A Fine-Grained Incremental Scheduler for C/C++ Static Analyzers
- ACM International Conference on the Foundations of Software Engineering (FSE Companion) 2025
- Yu Xiao, Xutong Ma, Zhilin Li, Jun Yan
- https://doi.org/10.1145/3696630.3728590
- https://www.youtube.com/watch?v=iI39c1Tw1F8
- https://conf.researchr.org/details/fse-2025/fse-2025-demonstrations/17/IceBear-A-Fine-Grained-Incremental-Scheduler-for-C-C-Static-Analyzers
- IceBear: a scheduler for C/C++ static analysis tools built on Bear and Panda
  - Supported static analyzers: CSA (Clang Static Analyzer), Clang-Tidy, CppCheck, GSA (GCC Static Analyzer)
  - https://github.com/hribz/IceBear
Object Model Construction for Inheritance in C++ and Its Applications to Program Analysis
- Compiler Construction (CC) 2012
- Yang, Jing, Gogul Balakrishnan, Naoto Maeda, Franjo Ivancic, Aarti Gupta, Nishant Sinha, Sriram Sankaranarayanan, Naveen Sharma
- https://dl.acm.org/citation.cfm?id=2259241
- http://pages.cs.wisc.edu/~bgogul/Research/Papers/cc12.html
- https://www.semanticscholar.org/paper/Object-Model-Construction-for-Inheritance-in-C%2B%2B-a-Yang-Balakrishnan/510501c7051c03d5e2a70089deeda8dfc3a7304f
- https://www.cs.colorado.edu/~srirams/papers/cc12-final.pdf
- http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.225.2429
Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report
- ECOOP 2024
- Fabian Schiebel, Florian Sattler, Philipp Dominik Schubert, Sven Apel, Eric Bodden
- https://doi.org/10.4230/LIPIcs.ECOOP.2024.37
- https://2024.ecoop.org/details/ecoop-2024-papers/22/Scaling-Interprocedural-Static-Data-Flow-Analysis-to-Large-C-C-Applications
- https://bodden.de/pubs/ssd+24scaling.pdf
- https://www.se.cs.uni-saarland.de/publications/docs/SSS+24.pdf
Scaling Static Analyses at Facebook
- Communications of the ACM, Vol. 62 No. 8, 2019
- Dino Distefano, Manuel Fähndrich, Francesco Logozzo, Peter W. O'Hearn
- https://cacm.acm.org/magazines/2019/8/238344-scaling-static-analyses-at-facebook/fulltext
Source Language Representation of Function Summaries in Static Analysis
- ICOOOLPS / ECOOP 2016
- Gábor Horváth, Norbert Pataki
- https://2016.ecoop.org/event/icooolps-2016-source-language-representation-of-function-summaries-in-static-analysis
Sys: a Static/Symbolic Tool for Finding Good Bugs in Good (Browser) Code
- USENIX Security Symposium 2020
- Fraser Brown, Deian Stefan, Dawson Engler
- https://cseweb.ucsd.edu/~dstefan/pubs/brown:2020:sys.pdf
- https://sys.programming.systems/
- Sys: a Static/Symbolic Tool for Finding Good Bugs in Good (Browser) Code
  - https://github.com/PLSysSec/sys
Tailoring Programs for Static Analysis via Program Transformation
- International Conference on Software Engineering (ICSE) 2020
- Rijnard van Tonder and Claire Le Goues
- https://rijnard.com/pdfs/tailoring-analysis-icse-2020.pdf
Toward Full Elasticity in Distributed Static Analysis
- 2016 Microsoft Research Technical Report: MSR-TR-2015-88
- Diego Garbervetsky, Edgardo Zoppi, Thomas Ball, Ben Livshits
- https://www.microsoft.com/en-us/research/publication/toward-full-elasticity-distributed-static-analysis/
Undecidability of static analysis
- ACM Letters on Programming Languages and Systems (LOPLAS) Volume 1 Issue 4, Dec. 1992
- William Landi
- https://dl.acm.org/citation.cfm?id=161501
- "Two fundamental static-analysis problems are may alias and must alias. The former is not recursive (is undecidable), and the latter is not recursively enumerable (is uncomputable), even when all paths are executable in the program being analyzed for languages with if statements, loops, dynamic storage, and recursive data structures."

Readings: Research: Correctness

Testing, Validation, Verification

Readings: Research: Usability

A Large-Scale Study of Usability Criteria Addressed by Static Analysis Tools
- International Symposium on Software Testing and Analysis (ISSTA) 2022
- Marcus Nachtigall, Michael Schlichtig, Eric Bodden
- https://doi.org/10.1145/3533767.3534374
- https://www.bodden.de/pubs/nsb22large.pdf
- https://sites.google.com/view/datatoolsurvey/
Lessons from Building Static Analysis Tools at Google
- Communications of the ACM, Vol. 61 No. 4, 2018
- Caitlin Sadowski, Edward Aftandilian, Alex Eagle, Liam Miller-Cushon, Ciera Jaspan
- https://cacm.acm.org/magazines/2018/4/226371-lessons-from-building-static-analysis-tools-at-google/abstract
- https://research.google.com/pubs/pub46576.html

Benchmarking

Benchmarks & comparisons

A Comparison of Static Analysis Tools for Vulnerability Detection in C/C++ Code
- SYNASC 2017
- Andrei Arusoaie, Ștefan Ciobâcă, Vlad Crăciun, Dragoș Gavriluț, Dorel Lucanu
- https://profs.info.uaic.ro/~stefan.ciobaca/synasc2017.pdf
An Empirical Study of Static Analysis Tools for Secure Code Review
- International Symposium on Software Testing and Analysis (ISSTA) 2024
- Wachiraphan (Ping) Charoenwet, Patanamon Thongtanunam, Thuan Pham, Christoph Treude
- https://arxiv.org/abs/2407.12241
- https://2024.issta.org/details/issta-2024-papers/56/An-Empirical-Study-of-Static-Analysis-Tools-for-Secure-Code-Review
An Empirical Study on the Effectiveness of Static C Code Analyzers for Vulnerability Detection
- International Symposium on Software Testing and Analysis (ISSTA) 2022
- Stephan Lipp, Sebastian Banescu, Alexander Pretschner
- https://mediatum.ub.tum.de/doc/1659728/1659728.pdf
- https://zenodo.org/record/6584404
Analyzing the State of Static Analysis: A Large-Scale Evaluation in Open Source Software
- Software Analysis, Evolution, and Reengineering (SANER) 2016
- http://ieeexplore.ieee.org/document/7476667/
- https://www.slideshare.net/inventitech/analyzing-the-state-of-static-analysis-a-largescale-evaluation-in-open-source-software-60473247
- 2015 Master’s Thesis: https://repository.tudelft.nl/islandora/object/uuid:3d834130-8dd7-420a-9af9-6e77761cdad6/
Automated Customized Bug-Benchmark Generation
- IEEE SCAM 2019
- Vineeth Kashyap, Jason Ruchti, Lucja Kot, Emma Turetsky, Rebecca Swords, David Melski, Eric Schulte
- https://arxiv.org/abs/1901.02819
- https://www.dropbox.com/sh/f3p1wbomv93fz78/AABzXcLzqp5zkx75nQym6gJPa
Benchmark Software for Evaluation of Software Analysis Tools
- http://web.archive.org/web/20180611162911/https://github.com/Toyota-ITC-SSD/Software-Analysis-Benchmark
- Static analysis benchmarks from Toyota ITC - https://github.com/regehr/itc-benchmarks
How Toyota Picks Software Tools
- EETimes, August 11, 2015; Bernard Cole
- http://web.archive.org/web/20150815120014/http://www.eetimes.com/author.asp?section_id=36&doc_id=1327387
Quantitative Evaluation of Static Analysis Tools
- Software Reliability Engineering Workshops (ISSREW) 2014
- Shinichi Shiraishi, Veena Mohan, Hemalatha Marimuthu
- https://dl.acm.org/citation.cfm?id=2706360
Software Assurance Reference Dataset (SARD)
- https://samate.nist.gov/SARD/
- Test Suites - https://samate.nist.gov/SRD/testsuite.php
Static Analysis Benchmarks
- https://blog.regehr.org/archives/1217
Test Suites for Benchmarks of Static Analysis Tools
- IEEE International Symposium on Software Reliability Engineering (ISSRE) 2015
- Shinichi Shiraishi, Veena Mohan, and Hemalatha Marimuthu
- https://www.researchgate.net/publication/283548090_Test_Suites_for_Benchmarks_of_Static_Analysis_Tools
Towards Automatically Generating a Sound and Complete Dataset for Evaluating Static Analysis Tools
- NDSS Workshop on Binary Analysis Research (BAR) 2019
- Aravind Machiry, Nilo Redini, Eric Gustafson, Hojjat Aghakhani, Christopher Kruegel, Giovanni Vigna
- https://ruoyuwang.me/bar2019/pdfs/bar2019-final90.pdf
- https://github.com/ucsb-seclab/autofacts
Toyota ITC Benchmark
- https://runtimeverification.com/match/1.0-SNAPSHOT/docs/benchmark/
Using Benchmarks to Assess Static Analysis Tools
- http://blogs.grammatech.com/using-benchmarks-to-assess-static-analysis-tools

Software

BDE Verify: A Static Checker for C++
- https://github.com/bloomberg/bde_verify
- https://bloomberg.github.io/bde_verify/
CodeChecker: an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
- https://github.com/Ericsson/codechecker
CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
- https://github.com/github/codeql
- https://codeql.github.com/
Cppcheck: A tool for static C/C++ code analysis
- http://cppcheck.sourceforge.net/
- https://github.com/danmar/cppcheck
- Building Cppcheck: What We Learned from 17 Years of Development
  - CppCon 2024
  - Daniel Marjamäki
  - https://www.youtube.com/watch?v=ztyhiMhvrqA
  - https://github.com/CppCon/CppCon2024/blob/main/Presentations/Building_Cppcheck.pdf
- Seamless Static Analysis with Cppcheck: From IDE to CI and Code Review
  - CppCon 2025
  - Daniel Marjamäki
  - https://www.youtube.com/watch?v=7u97LZYxu3g
  - https://github.com/CppCon/CppCon2025/blob/main/Presentations/Seamless_Static_Analysis_with_CppCheck.pdf
cpplint: static code checker for C++
- https://github.com/cpplint/cpplint
Crab: A Language-Agnostic Library for Static Analysis
- https://github.com/seahorn/crab
- Crab-llvm: Abstract Interpretation of LLVM bitcode
  - https://github.com/seahorn/crab-llvm
IKOS: Inference Kernel for Open Static Analyzers
- Static analyzer for C/C++ based on the theory of Abstract Interpretation.
- https://github.com/NASA-SW-VnV/ikos
Infer Static Analyzer: A static analyzer for Java, C, C++, and Objective-C
- http://fbinfer.com/
- https://github.com/facebook/infer
ORC: a tool for finding violations of C++'s One Definition Rule (ODR)
- ORC was originally conceived on macOS. While its current implementation is focused there, it does not have to be constrained to that toolchain.
- https://github.com/adobe/orc
Phasar: A LLVM-based static code analysis framework
- http://phasar.org/
- https://github.com/secure-software-engineering/phasar
- Static Analysis for C++ with Phasar
  - https://pldi18.sigplan.org/event/pldi-2018-pldi-tutorials-static-analysis-for-c-with-phasar
- PhASAR: An Inter-Procedural Static Analysis Framework for C/C++
  - TACAS 2019
  - Philipp D. Schubert, Ben Hermann, Eric Bodden
  - http://www.thewhitespace.de/publications/shb19-phasar.pdf
Semmle QL
- https://github.com/Semmle/ql
- Vulnerability hunting with Semmle QL, part 1
  - https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/
SPARTA: a library that provides the basic blocks for building high-performance static code analyzers based on Abstract Interpretation
- https://github.com/facebookincubator/SPARTA
- SPARTA: a C++ library of software components for building high-performance static analyzers
  - https://code.fb.com/open-source/sparta/
- Easy Abstract Interpretation with SPARTA
  - Strange Loop 2019; Arnaud Venet and Jez Ng
  - https://www.youtube.com/watch?v=_fA7vkVJhF8
  - https://thestrangeloop.com/2019/easy-abstract-interpretation-with-sparta.html
Verasco: a formally verified C static analyzer
- static analyzer for the CompCert subset of ISO C 1999 that establishes the absence of run-time errors in analyzed programs
- entirely specified and proved sound using the Coq proof assistant
- http://compcert.inria.fr/verasco/

Software: Compilers

Clang
- Clang Static Analyzer
  - http://clang-analyzer.llvm.org/
  - Checker Developer Manual
    - http://clang-analyzer.llvm.org/checker_dev_manual.html
  - A survey of dataflow analyses in Clang
    - 2020; Kristóf Umann
    - https://lists.llvm.org/pipermail/cfe-dev/2020-October/066937.html
  - An in-depth look at Liveness Analysis in the Clang Static Analyzer
    - 2020; Kristóf Umann
    - http://lists.llvm.org/pipermail/cfe-dev/2020-July/066330.html
  - Clang Static Analysis
    - Meeting C++ 2016; Gabor Horvath
    - https://www.youtube.com/watch?v=UcxF6CVueDM
  - Clang Static Analyzer - A Checker Developer's Guide.
    - https://github.com/haoNoQ/clang-analyzer-guide
  - Detecting Uninitialized Variables in C++ with the Clang Static Analyzer
    - Acta Cybernetica 2020
    - Kristóf Umann, Zoltán Porkoláb
    - https://doi.org/10.14232/actacyb.282900
    - https://clang.llvm.org/docs/analyzer/checkers.html#optin-cplusplus-uninitializedobject-c
  - Faster, Stronger C++ Analysis with the Clang Static Analyzer
    - 2018 LLVM Developers’ Meeting; George Karpenkov, Artem Dergachev
    - https://www.youtube.com/watch?v=4n3l-ZcDJNY
  - Using the Clang Static Analyzer to Find Bugs
    - 2020 LLVM Developers’ Meeting; Vince Bridgers
    - https://www.youtube.com/watch?v=nTslG8HtKeA
    - https://llvm.org/devmtg/2020-09/slides/Using_the_clang_static_ananalyzer_to_find_bugs.pdf
- Clang-Tidy: Clang-based C++ “linter” tool
  - http://clang.llvm.org/extra/clang-tidy/
  - Clang-Tidy - KDAB
    - part 1: Modernize your source code using C++11/C++14 - https://www.kdab.com/clang-tidy-part-1-modernize-source-code-using-c11c14/
    - part 2: Integrate qmake and other build systems using Bear - https://www.kdab.com/clang-tidy-part-2-integrate-qmake-and-other-build-systems-using-bear/
  - How to use Clang Tidy to automatically correct code
    - https://github.com/KratosMultiphysics/Kratos/wiki/How-to-use-Clang-Tidy-to-automatically-correct-code
  - Intro to clang-tidy - C++ Weekly - Ep 3
    - https://www.youtube.com/watch?v=OchPaGEH4TE
    - Using Clang-Tidy for Customized Checkers and Large Scale Source Tree Refactoring
      - 2020 LLVM Developers’ Meeting; Vince Bridgers
      - https://www.youtube.com/watch?v=UfLH7dORav8
      - https://llvm.org/devmtg/2020-09/slides/LLVM-Virtual-Presentation-Clang-Tidy.pdf
- Clang Thread Safety Analysis
  - https://clang.llvm.org/docs/ThreadSafetyAnalysis.html
  - C/C++ Thread Safety Analysis
    - DeLesley Hutchins, Aaron Ballman, Dean Sutherland
    - 2014 IEEE 14th International Working Conference on Source Code Analysis and Manipulation
    - https://research.google/pubs/pub42958/
  - Thread Safety Analysis in C and C++
    - https://insights.sei.cmu.edu/sei_blog/2014/10/thread-safety-analysis-in-c-and-c.html
  - Thread Safety Annotations in Clang
    - DeLesley Hutchins
    - 2011 LLVM Developers' Meeting; https://llvm.org/devmtg/2011-11/Hutchins_ThreadSafety.pdf
    - https://www.youtube.com/watch?v=5Xx0zktqSs4
GCC
- https://gcc.gnu.org/onlinedocs/gcc/Static-Analyzer-Options.html
- https://gcc.gnu.org/wiki/DavidMalcolm/StaticAnalyzer
- Static analysis in GCC 10
  - https://developers.redhat.com/blog/2020/03/26/static-analysis-in-gcc-10/
- Static analysis updates in GCC 11
  - https://developers.redhat.com/blog/2021/01/28/static-analysis-updates-in-gcc-11/
- Detecting memory management bugs with GCC 11
  - Part 1: Understanding dynamic allocation
    - https://developers.redhat.com/blog/2021/04/30/detecting-memory-management-bugs-with-gcc-11-part-1-understanding-dynamic-allocation/
  - Part 2: Deallocation functions
    - https://developers.redhat.com/blog/2021/05/05/detecting-memory-management-bugs-with-gcc-11-part-2-deallocation-functions/
- Use source-level annotations to help GCC detect buffer overflows
  - https://developers.redhat.com/articles/2021/06/25/use-source-level-annotations-help-gcc-detect-buffer-overflows
Visual C++
- /analyze (Code analysis)
  - https://docs.microsoft.com/en-us/cpp/build/reference/analyze-code-analysis
- Source Code Annotation Language (SAL)
  - https://docs.microsoft.com/en-us/visualstudio/code-quality/using-sal-annotations-to-reduce-c-cpp-code-defects
  - Salieri: Source-code annotation language (SAL) compatibility header
    - https://github.com/nemequ/salieri

Software: Indexing

clangd language server: provides C++ IDE features to editors
Ctags
- https://en.wikipedia.org/wiki/Ctags
- https://github.com/freebsd/freebsd-src/tree/main/usr.bin/ctags
- Universal Ctags: A maintained ctags implementation
  - https://ctags.io/
  - https://github.com/universal-ctags/ctags
Glean: System for collecting, deriving, and working with facts about source code
- https://github.com/facebookincubator/glean
- https://glean.software/
- Glean: C++ Code Indexing at Meta
  - C++Now 2024
  - Michael Park
  - https://www.youtube.com/watch?v=BAxoeCEfb1I
  - https://github.com/boostcon/cppnow_presentations_2024/blob/main/Presentations/glean.pdf
Multiplier: Code auditing productivity multiplier
- Multiplier provides precise and comprehensive code understanding capabilities. It does so by saving build artifacts into a database, and then making them persistently accessible using a C++ or Python API.
- https://github.com/trailofbits/multiplier
scip-clang: SCIP indexer for C and C++
- https://github.com/sourcegraph/scip-clang
- https://sourcegraph.com/blog/announcing-scip-clang

Verification

Verification & Model Checking

Formal Verification to Ensuring the Memory Safety of C++ Programs
- 2020 M.Sc. Thesis; Felipe R. Monteiro
- https://feliperodri.github.io/papers/msc-manuscript.pdf
- https://feliperodri.github.io/talks/msc-presentation.pdf
- Apply model checking techniques to ensuring memory safety of C++ programs:
  - (i) Provide a logical formalization of essential features that the C++ programming language offers, such as templates, sequential and associative containers, inheritance, polymorphism, and exception handling.
  - (ii) Provide a set of abstractions to the Standard C++ Libraries that reflects their semantics, in order to enable the verification of functional properties related to the use of these libraries.
  - (iii) Extend an existing verifier to handle the verification of C++ programs based on (i) and (ii) and evaluate its efficiency and effectiveness in comparison to similar state-of-the-art approaches.
Model Checking a C++ Software Framework, a Case Study
- European Software Engineering Conference / Foundations of Software Engineering (ESEC/FSE) 2019
- John Lång, I.S.W.B. Prasetya
- https://arxiv.org/abs/1907.00172
Model Checking C++ Programs
- 2021
- Felipe R. Monteiro, Mikhail R. Gadelha, Lucas C. Cordeiro
- https://arxiv.org/abs/2107.01093

Verification: Software

See also: Program Analysis - LLVM - Verification

CMBC: C Bounded Model Checker
- Bounded Model Checker for C and C++ programs
- http://www.cprover.org/cbmc/
- https://github.com/diffblue/cbmc
DIVINE
- DIVINE is a modern, explicit-state model checker. Based on the LLVM toolchain, it can verify programs written in multiple real-world programming languages, including C and C++.
- https://divine.fi.muni.cz/
ESBMC
- ESBMC is an open source, permissively licensed, context-bounded model checker based on satisfiability modulo theories for the verification of single- and multi-threaded C/C++ programs.
- https://github.com/esbmc/esbmc
- https://ssvlab.github.io/esbmc/
Symbiotic
- Tool for verifying computer programs based on instrumentation, program slicing and symbolic executor KLEE.
- http://staticafi.github.io/symbiotic/

Talks

Talks: 2021

Finding Bugs Using Path-Sensitive Static Analysis
- CppCon 2021; Gabor Horvath
- https://www.youtube.com/watch?v=aUIk97fJ_hY

File: assembly.arm.md

[C++ links](README.md): ARM and AArch64 Assembly

See also: Computer Architecture -- recommended background (which makes the following significantly more approachable) includes an undergraduate-level course.

Readings:
References:
Software:
Talks: 2019, 2018, 2017, 2016, 2015, 2014, 2012, 2011, 2010, History
Tutorials, Courses: AArch64, Thumb-2

Readings

Readings: Binary Analysis

Readings: Binary Analysis: 2023

A Comprehensive Study on ARM Disassembly Tools
- IEEE Transactions on Software Engineering 49(4) 2023
- Muhui Jiang, Qinming Dai, Wenlong Zhang, Rui Chang, Yajin Zhou, Xiapu Luo, Ruoyu Wang, Yang Liu, Kui Ren
- https://ieeexplore.ieee.org/abstract/document/9814882
- https://dl.acm.org/doi/abs/10.1109/TSE.2022.3187811
ARMore: Pushing Love Back Into Binaries
- USENIX Security Symposium 2023
- Luca Di Bartolomeo, Hossein Moghaddas, Mathias Payer
- https://nebelwelt.net/files/23SEC3.pdf
- https://github.com/HexHive/RetroWrite
- "efficient, robust, and heuristic-free static binary rewriter for arbitrary aarch64 binaries that produces reassembleable assembly"
- "can rewrite binaries from different languages and compilers (even arbitrary hand-written assembly), both on PIC and non-PIC code, with or without symbols, including exception handling for C++ and Go binaries, and also including binaries with mixed data and text"
D-ARM: Disassembling ARM Binaries by Lightweight Superset Instruction Interpretation and Graph Modeling
- IEEE Symposium on Security and Privacy S&P 2023
- Yapeng Ye, Zhuo Zhang, Qingkai Shi, Yousra Aafer, Xiangyu Zhang
- https://ieeexplore.ieee.org/abstract/document/10179307
- https://qingkaishi.github.io/public_pdfs/SP23DARM.pdf
- https://www.youtube.com/watch?v=HFIrYXS3A8o
Revisiting Lightweight Compiler Provenance Recovery on ARM Binaries
- International Conference on Program Comprehension (ICPC) 2023 Replications and Negative Results (RENE) 2023
- Jason Kim, Daniel Genkin, Kevin Leach
- https://arxiv.org/abs/2305.03934

Readings: Binary Analysis: 2014-2022

A Retargetable Static Binary Translator for the ARM Architecture
- ACM Transactions on Architecture and Code Optimization, 11(2) 2014
- Shen, B.-Y., Hsu, W.-C., & Yang, W.
- https://doi.org/10.1145/2629335
An Empirical Study on ARM Disassembly Tools
- International Symposium on Software Testing and Analysis (ISSTA) 2020
- Muhui Jiang, Yajin Zhou, Xiapu Luo, Ruoyu Wang, Yang Liu, Kui Ren
- https://yajin.org/papers/issta20.pdf
- https://github.com/valour01/arm_disasssembler_study
ArmWrestling: efficient binary rewriting for ARM
- 2021 Master's Thesis
- Luca Di Bartolomeo
- https://doi.org/10.3929/ethz-b-000474088
- https://hexhive.epfl.ch/theses/20-dibartolomeo-thesis.pdf
Balancing Performance and Productivity for the Development of Dynamic Binary Instrumentation Tools: A Case Study on Arm Systems
- Compiler Construction (CC) 2020
- Cosmin Gorgovan, Guillermo Callaghan, Mikel Luján
- https://doi.org/10.1145/3377555.3377895
- https://www.research.manchester.ac.uk/portal/files/158729354/mambo_api_cc2020_cr_authors.pdf
Exploiting SIMD Asymmetry in ARM-to-x86 Dynamic Binary Translation
- ACM Transactions on Architecture and Code Optimization (TACO) 2019
- Yu-Ping Liu, Ding-Yong Hong, Jan-Jan Wu, Sheng-Yu Fu, Wei-Chung Hsu
- http://dl.acm.org/citation.cfm?id=3301488
Exploiting Vector Processing in Dynamic Binary Translation
- 2019 International Conference on Parallel Processing (ICPP)
- Chih-Min Lin, Sheng-Yu Fu, Ding-Yong Hong, Yu-Ping Liu, Jan-Jan Wu, Wei-Chung Hsu
- https://doi.org/10.1145/3337821.3337844
Ground Truth for Binary Disassembly is Not Easy
- USENIX Security Symposium 2022
- Chengbin Pang, Tiantai Zhang, Ruotong Yu, Bing Mao, Jun Xu
- https://www.usenix.org/conference/usenixsecurity22/presentation/pang-chengbin
Optimising Dynamic Binary Modification across 64-bit Arm Microarchitectures
- VEE 2020
- Guillermo Callaghan, Cosmin Gorgovan, Mikel Lujan
- https://doi.org/10.1145/3381052.3381322
- https://conf.researchr.org/details/vee-2020/vee-2020-papers/8/Optimising-Dynamic-Binary-Modification-across-64-bit-Arm-Microarchitectures
- https://www.youtube.com/watch?v=3jxLu1zGpV0
RevARM: A Platform-Agnostic ARM Binary Rewriter for Security Applications
- Annual Computer Security Applications Conference (ACSAC) 2017
- T. Kim, C. Kim, H. Choi, Y. Kwon, B. Saltaformaggio, X. Zhang, D. Xu
- https://saltaformaggio.ece.gatech.edu/publications/ACSAC_17.pdf
- https://www.acsac.org/2017/openconf/modules/request.php?module=oc_program&action=summary.php&id=201
- https://www.researchgate.net/publication/321506390_RevARM_A_Platform-Agnostic_ARM_Binary_Rewriter_for_Security_Applications
Translating AArch64 Floating-Point Instruction Set to the x86-64 Platform
- 2019 International Conference on Parallel Processing: Workshops (ICPP)
- Yi-Ping You, Tsung-Chun Lin, and Wuu Yang
- https://doi.org/10.1145/3339186.3339192

Readings: Concurrency

A Study on the Performance Implications of AArch64 Atomics
- ISC High Performance 2023
- Ricardo Jesus, Michèle Weiland
- https://link.springer.com/chapter/10.1007/978-3-031-32041-5_15
- https://www.researchgate.net/publication/370682772_A_Study_on_the_Performance_Implications_of_AArch64_Atomics
An Axiomatic Basis for Computer Programming on the Relaxed Arm-A Architecture: The AxSL Logic
- POPL 2024
- Angus Hammond, Zongyuan Liu, Thibaut Pérami, Peter Sewell, Lars Birkedal, Jean Pichon-Pharabod
- https://doi.org/10.1145/3632863
- https://popl24.sigplan.org/details/POPL-2024-popl-research-papers/23/An-Axiomatic-Basis-for-Computer-Programming-on-the-Relaxed-Arm-A-Architecture-The-Ax
- https://github.com/logsem/AxSL
Arm and Lock-Free Programming
- 2020; Bruce Dawson
- https://randomascii.wordpress.com/2020/11/29/arm-and-lock-free-programming/
Armed Cats: Formal Concurrency Modelling at Arm
- POPL 2022
- Jade Alglave, Will Deacon, Richard Grisenthwaite, Antoine Hacquard, Luc Maranget
- https://doi.org/10.1145/3458926
Atomics in AArch64
- 2021; Jim Cownie
- https://cpufun.substack.com/p/atomics-in-aarch64
Formal Verification of a Multiprocessor Hypervisor on Arm Relaxed Memory Hardware
- Symposium on Operating Systems Principles (SOSP) 2021
- Runzhou Tao, Jianan Yao, Xupeng Li, Shih-Wei Li, Jason Nieh, Ronghui Gu
- https://dl.acm.org/doi/10.1145/3477132.3483560
- https://www.cs.columbia.edu/~nieh/pubs/sosp2021_vrm.pdf
Formalising the ARMv8 Memory Consistency Model
- Will Deacon, ARM, Keynote, OpenSHMEM 2018
- https://www.csm.ornl.gov/workshops/openshmem2018/presentations/mm-openshmem2018.pdf
Isla-axiomatic: combines Sail ISA specifications with axiomatic memory models with an SMT solver
- Isla: a symbolic execution engine for Sail
  - Executes instruction set architecture (ISA) specifications written in Sail, such as Sail ARMv8 model translated from ARM’s machine readable specification, or Sail RISC-V. It can be used to evaluate the relaxed-memory behavior of instruction set architectures specified in Sail, using an axiomatic memory model specified in a subset of the cat language used by the herd7 tools.
  - https://github.com/rems-project/isla
- Isla-axiomatic: combines Sail ISA specifications with axiomatic memory models written in a subset of the cat language used by the diy tool suite (and in particular the memory model simulation tool herd7), with an SMT solver like z3 or CVC4.
  - https://isla-axiomatic.cl.cam.ac.uk/
  - https://isla-axiomatic.cl.cam.ac.uk/help_standalone.html
- Isla: Integrating Full-Scale ISA Semantics and Axiomatic Concurrency Models
  - Computer Aided Verification (CAV) 2021
  - Alasdair Armstrong, Brian Campbell, Ben Simner, Christopher Pulte, Peter Sewell
  - https://link.springer.com/chapter/10.1007/978-3-030-81685-8_14
Just-In-Time Compilation on ARM—A Closer Look at Call-Site Code Consistency
- ACM Transactions on Architecture and Code Optimization (TACO) 19(4) 2022
- Tim Hartley, Foivos S. Zakkak, Andy Nisbet, Christos Kotselidis, Mikel Luján
- https://dl.acm.org/doi/10.1145/3546568
- https://figshare.com/articles/dataset/Datasets_for_TACO_-_JIT_Compilation_on_ARM/20372304
Lasagne: A Static Binary Translator for Weak Memory Model Architectures
- Programming Language Design and Implementation (PLDI) 2022
- Rodrigo C. O. Rocha, Dennis Sprokholt, Martin Fink, Redha Gouicem, Tom Spink, Soham Chakraborty, Pramod Bhatotia
- https://dl.acm.org/doi/10.1145/3519939.3523719
- https://pldi22.sigplan.org/details/pldi-2022-pldi/52/Lasagne-A-Static-Binary-Translator-for-Weak-Memory-Model-Architectures
- https://www.youtube.com/watch?v=CbllhRN1Huk
Mixed-size Concurrency: ARM, POWER, C/C++11, and SC
- POPL 2017
- Shaked Flur, Susmit Sarkar, Christopher Pulte, Kyndylan Nienhuis, Luc Maranget, Kathryn E. Gray, Ali Sezgin, Mark Batty, Peter Sewell
- http://www.cl.cam.ac.uk/~pes20/popl17/
- http://www.cl.cam.ac.uk/~pes20/AArch64
Modelling the ARM v8 Architecture, Operationally: Concurrency and ISA
- POPL 2016
- Shaked Flur, Kathryn E. Gray, Christopher Pulte, Susmit Sarkar, Ali Sezgin, Luc Maranget, Will Deacon, Peter Sewell
- http://www.cl.cam.ac.uk/~pes20/popl16-armv8/top.pdf
- https://blog.acolyer.org/2016/02/02/arm-v8/
No Barrier in the Road: A Comprehensive Study and Optimization of ARM Barriers
- Principles and Practice of Parallel Programming (PPoPP) 2020
- Nian Liu, Binyu Zang, Haibo Chen
- https://doi.org/10.1145/3332466.3374535
- https://ipads.se.sjtu.edu.cn/_media/publications/liuppopp20.pdf
Precise Exceptions in Relaxed Architectures
- International Symposium on Computer Architecture (ISCA) 2025
- Ben Simner, Alasdair Armstrong, Thomas Bauereiss, Brian Campbell, Ohad Kammar, Jean Pichon-Pharabod, Peter Sewell
- https://doi.org/10.1145/3695053.3731102
- https://2plus2a.com/files/publications/2025-ISCA-precise-exceptions.pdf
- https://2plus2a.com/files/slides/2025-06-23-ISCA.pdf
- https://www.youtube.com/watch?v=JkNgZz4bu1E
Relaxed virtual memory in Armv8-A
- ESOP 2022
- Ben Simner, Alasdair Armstrong, Jean Pichon-Pharabod, Christopher Pulte, Richard Grisenthwaite, Peter Sewell
- https://www.cl.cam.ac.uk/~pes20/RelaxedVM-Arm/
- extended version: https://arxiv.org/abs/2203.00642
Relaxed-Memory Concurrency - Power and ARM
- http://www.cl.cam.ac.uk/~pes20/weakmemory/#PA
- http://www.cl.cam.ac.uk/~pes20/papers/topics.html#Power_and_ARM
RMEM
- a tool for exploring the relaxed-memory concurrency behaviour allowed by the ARM and IBM POWER architectures; it also has experimental support for x86-TSO and a candidate RISC-V model
- help page: http://www.cl.cam.ac.uk/~sf502/regressions/rmem/help.html
- web interface: http://www.cl.cam.ac.uk/users/pes20/rmem/
Simplifying ARM Concurrency: Multicopy-atomic Axiomatic and Operational Models for ARMv8
- POPL 2018 - https://www.youtube.com/watch?v=v9uygT1d0xY
- Christopher Pulte, Shaked Flur, Will Deacon, Jon French, Susmit Sarkar, Peter Sewell
- http://www.cl.cam.ac.uk/%7Epes20/armv8-mca/
- http://www.cl.cam.ac.uk/%7Epes20/armv8-mca/armv8-mca-draft.pdf
Synchronization Overview and Case Study on Arm Architecture
- 2022
- Ker Liu, Zaiping Bie
- https://community.arm.com/arm-community-blogs/b/infrastructure-solutions-blog/posts/synchronization-overview-and-case-study-on-arm-architecture-563085493
- https://developer.arm.com/documentation/107630/latest/
The ARMv8 Application Level Memory Model
- https://developer.arm.com/architectures/cpu-architecture/a-profile/memory-model-tool
- Herd - http://diy.inria.fr/www/?record=aarch64
- ARMv8 ARM, section B2.3
- How to use the Memory Model Tool
  - https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/how-to-use-the-memory-model-tool
The Semantics of Power and ARM Multiprocessor Machine Code
- DAMP 09
- J. Alglave, A. Fox, S. Isthiaq, M. Myreen, S. Sarkar, P. Sewell, F. Zappa Nardelli
- http://www.di.ens.fr/~zappa/readings/damp09.pdf
The Semantics of Power and ARM Multiprocessor Programs
- http://www.cl.cam.ac.uk/~pes20/weakmemory/index4.html
TOSTING: Investigating Total Store Ordering on Arm
- International Conference on Architecture of Computing Systems (ARCS) 2023
- Lars Wrenger, Dominik Töllner, Daniel Lohmann
- https://link.springer.com/chapter/10.1007/978-3-031-42785-5_10
- https://sra.uni-hannover.de/Publications/2023/tosting-arcs23/wrenger_23_arcs.pdf
- https://www.sra.uni-hannover.de/Publications/2023/tosting-arcs23/wrenger_23_arcs_talk.pdf

Readings: Emulation

Examiner: Automatically Locating Inconsistent Instructions Between Real Devices and CPU Emulators for ARM
- ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS 2022)
- Muhui Jiang, Tianyi Xu, Yajin Zhou, Yufeng Hu, Ming Zhong, Lei Wu, Xiapu Luo, Kui Ren
- https://dl.acm.org/doi/10.1145/3503222.3507736
- https://yajin.org/papers/examiner_asplos22.pdf
- https://www.youtube.com/watch?v=n2I6VP5Wr2I
- https://github.com/valour01/examiner
- https://alastairreid.github.io/RelatedWork/papers/jiang:arxiv:2021/
Project Champollion: Reverse engineering Rosetta 2 in M1 Mac
- 2021
- Koh M. Nakagawa
- https://github.com/FFRI/ProjectChampollion/
Why is Rosetta 2 fast?
- 2022; Dougall Johnson
- https://dougallj.wordpress.com/2022/11/09/why-is-rosetta-2-fast/

Formalization, Specification, Verification

A Trustworthy Monadic Formalization of the ARMv7 Instruction Set Architecture
- Interactive Theorem Proving (ITP), 2010
- Anthony Fox and Magnus O. Myreen
- https://www.cl.cam.ac.uk/~mom22/itp10-armv7.pdf
Alastair Reid's
- Blog Posts - https://alastairreid.github.io/
- Papers: https://alastairreid.github.io/alastairreid.github.io/papers/
- 2020-01-01 - Using ASLi with Arm's v8.6-A ISA specification - https://alastairreid.github.io/using-asli/
- 2019-02-17 - Generating multiple solutions with SMT - https://alastairreid.github.io/tracing-smt3/
- 2019-02-09 - Using SMT to check specifications for errors - https://alastairreid.github.io/tracing-smt2/
- 2019-02-02 - Generating SMT from traces - https://alastairreid.github.io/tracing-smt/
- 2017-12-24 - Bidirectional Assembly Syntax Specifications - https://alastairreid.github.io/bidirectional-assemblers/
- 2017-09-24 - Formal validation of the Arm v8-M specification - https://alastairreid.github.io/validating-specs/
- 2017-08-19 - Are natural language specifications useful? - https://alastairreid.github.io/natural-specs/
- 2017-07-31 - Arm v8.3 Machine Readable Specification Released - https://alastairreid.github.io/arm-v8_3/
- 2017-05-07 - ASL Lexical Syntax - https://alastairreid.github.io/asl-lexical-syntax/
- 2017-04-29 - Dissecting ARM's Machine Readable Specification - https://alastairreid.github.io/dissecting-ARM-MRA/
- 2017-04-20 - ARM Releases Machine Readable Architecture Specification - https://alastairreid.github.io/ARM-v8a-xml-release/
- 2016-08-17 - ARM's Architecture Specification Language - https://alastairreid.github.io/specification_languages/
- 2016-07-30 - Limitations of ISA-Formal - https://alastairreid.github.io/isa-formal-limitations/
- 2016-07-26 - Verifying against the official ARM specification - https://alastairreid.github.io/using-armarm/
- 2016-07-18 - Finding Bugs versus Proving Absence of Bugs - https://alastairreid.github.io/finding-bugs/
- 2016-07-03 - Specification Terminology - https://alastairreid.github.io/spec-terminology/
ARMv8-A System Semantics: Instruction Fetch in Relaxed Architectures
- ESOP 2020: European Symposium on Programming
- Ben Simner, Shaked Flur, Christopher Pulte, Alasdair Armstrong, Jean Pichon-Pharabod, Luc Maranget, Peter Sewell
- https://www.cl.cam.ac.uk/~pes20/iflat/
ASL Interpreter
- Example implementation of Arm's Architecture Specification Language (ASL).
- https://github.com/ARM-software/asl-interpreter
End-to-End Verification of ARM Processors with ISA-Formal
- CAV 2016
- Alastair Reid, Rick Chen, Anastasios Deligiannis, David Gilday, David Hoyes, Will Keen, Ashan Pathirane, Owen Shepherd, Peter Vrabel, Ali Zaidi
- https://alastairreid.github.io/papers/CAV_16/
Formal Semantics Extraction from Natural Language Specifications for ARM
- FM 2019: International Symposium on Formal Methods
- Anh V. Vu and Mizuhito Ogawa
- https://doi.org/10.1007/978-3-030-30942-8_28
- https://anhvvcs.github.io/static/media/vu2019formal.pdf
- Corana: Dynamic Symbolic Execution Engine for ARM Cortex-M
  - https://github.com/anhvvcs/corana
- Formal Semantics Extraction from Natural Language Specifications for ARM
  - 2018 Master’s Thesis; Viet Anh Vu
  - https://www.jaist.ac.jp/~mizuhito/masterthesis/VuVietAnh.pdf
  - https://www.jaist.ac.jp/~mizuhito/masterthesis/VuVietAnh_corrected17Jul2019.pdf
hs-arm: (Dis)assembler and analyzer generated from the machine-readable ARMv8.3-A specification
- https://github.com/nspin/hs-arm
- library for (dis)assembling and analyzing ARMv8.3-A code, part of which is generated from the MRAS.
- implementation of ARM ASL (architecture specification language)
ISA Semantics for ARMv8-A, RISC-V, and CHERI-MIPS
- POPL 2019
- Alasdair Armstrong, Thomas Bauereiss, Brian Campbell, Alastair Reid, Kathryn E. Gray, Robert M. Norton, Prashanth Mundkur, Mark Wassell, Jon French, Christopher Pulte, Shaked Flur, Ian Stark, Neel Krishnaswami, Peter Sewell
- https://alastairreid.github.io/papers/POPL_19/
L3: A Specification Language for Instruction Set Architectures
- https://github.com/8l/L3
- https://web.archive.org/https://www.cl.cam.ac.uk/~acjf3/l3/
Low-level program verification under cached address translation
- 2019 PhD Dissertation; Hira Taqdees Syeda
- "In this thesis, we present a formal model of the memory management unit (MMU) in the interactive proof assistant Isabelle/HOL for the ARMv7-A architecture which includes the TLB, its maintenance operations, and its derived properties. We integrate this specification into the Cambridge ARM model. We derive sufficient conditions for TLB consistency, and we abstract away the functional details of the MMU using data refinement for simpler reasoning about executions in the presence of cached address translation, including complete and partial walks."
- https://www.unsworks.unsw.edu.au/permalink/f/a5fmj0/unsworks_60079
- http://unsworks.unsw.edu.au/fapi/datastream/unsworks:60079/SOURCE02?view=true
Puss in Boots: Formalizing Arm's Virtual Memory System Architecture
- IEEE Micro 44(6) 2024
- Jade Alglave, Richard Grisenthwaite, Artem Khyzha, Luc Maranget, Nikos Nikoleris
- https://doi.org/10.1109/MM.2024.3422668
- http://www0.cs.ucl.ac.uk/staff/j.alglave/papers/IEEEMicro24.pdf
- Puss In Boots: on formalising Arm’s Virtual Memory System Architecture (extended version)
  - https://inria.hal.science/hal-04567296
- AArch64 VMSA experiment report
  - https://diy.inria.fr/vmsa/
- Enhanced Translation Synchronisation (ETS), ETS2
- Translation Table Hardware Management (TTHM)
Renee: ARMv8 binary verification project
- The Renee project is investigating the formalization of ARMv8 instruction semantics and reasoning and verification of ARMv8 binaries including their security properties.
- https://ssrg-vt.github.io/Renee/
sail-arm: Sail version of the ARMv8.5-A ISA definition
- https://github.com/rems-project/sail-arm
Scapula: Compare ARM CPUs Against ARM's Machine Parsable Architecture Reference Manual
- tools for performing testing and verification of ARM CPUs against a machine parsable version of the ARMv8-A Architecture Reference Manual
- https://github.com/ainfosec/scapula
  - Scapula: An Open-Source Toolkit For Model-Based Fuzzing and Verification of ARM CPUs
    - HITB+ CyberWeek 2019; Jared Wright
    - https://www.youtube.com/watch?v=v8SYv3GP3cs
Specifications and theorem-proving at Arm
- Big Specification: Specification, Proof, and Testing at Scale 2024
- Anthony Fox, Hrutvik Kanabar
- https://www.youtube.com/watch?v=bkO9ZYA04UY
Trustworthy Specifications of ARM v8-A and v8-M System Level Architecture
Weak Persistency Semantics from the Ground Up: Formalising the Persistency Semantics of ARMv8 and Transactional Models
- OOPSLA 2019
- Azalea Raad, John Wickerson, Viktor Vafeadis
- "PARMv8 persistency model, formalising the persistency semantics of the ARMv8 architecture for the first time"
- http://www.soundandcomplete.org/papers/OOPSLA2019/PARM/PARM-OOPSLA-2019.pdf
- http://www.soundandcomplete.org/papers/OOPSLA2019/PARM/PARM-OOPSLA-2019-Talk.pdf
- https://plv.mpi-sws.org/pmem/
Who Guards the Guards? Formal Validation of the Arm v8-M Architecture Specification
- SPLASH 2017 OOPSLA
- Alastair Reid
- Paper: https://alastairreid.github.io/papers/oopsla2017-whoguardstheguards.pdf
- Post: https://alastairreid.github.io/validating-specs/
- Slides: https://alastairreid.github.io/papers/oopsla2017-whoguardstheguards-slides.pdf

Instruction Set Architecture

ARM Assembly Language Programming - Pete Cockerell (historical)
- http://www.peter-cockerell.net/aalp/
ARMv8 A64 Quick Reference
- Instruction Set Quick Reference Sheets: https://github.com/flynd/asmsheets
Exploring the Arm dot product instructions - https://community.arm.com/tools/b/blog/posts/exploring-the-arm-dot-product-instructions
Introduction to Computer Organization: ARM Assembly Language Using the Raspberry Pi
- http://bob.cs.sonoma.edu/IntroCompOrg-RPi/intro-co-rpi.html
Learn the Architecture
- https://developer.arm.com/architectures/learn-the-architecture
REPICA: Rewriting Position Independent Code of ARM
- IEEE Access 6 (2018)
- Dongsoo Ha, Wenhui Jin, Heekuck Oh
- https://doi.org/10.1109/access.2018.2868411

Encoding, Shellcode

AArch64 Bitmask Immediates
- https://kddnewton.com/2022/08/11/aarch64-bitmask-immediates.html
Alphanumeric ARM Shellcode
- March 15, 2018
- https://vishnudevtj.github.io/notes/arm-alphanumeric-shellcode
Alphanumeric RISC ARM Shellcode
- Phrack Magazine #66 (2009-11-06)
- Yves Younan, Pieter Philippaerts
- http://www.phrack.org/archives/issues/66/12.txt
- http://www.phrack.org/issues/66/12.html#article
Alphanumeric Shellcode Generator for ARM Architecture
- SPACE 2013: Security, Privacy, and Applied Cryptography Engineering
- Pratik Kumar, Nagendra Chowdary, Anish Mathuria
- https://link.springer.com/chapter/10.1007/978-3-642-41224-0_3
ARM Assembly and Shellcode Basics
- 44CON 2017; Saumil Shah
- https://www.youtube.com/watch?v=BhjJBuX0YCU
ARM immediate value encoding - 2014 - Alisdair McDiarmid
- https://alisdair.mcdiarmid.org/arm-immediate-value-encoding/
ARM Shellcode - Azeria Labs
- Code: https://github.com/azeria-labs/ARM-assembly-examples
- Introduction to Writing ARM Shellcode - https://azeria-labs.com/writing-arm-shellcode/
- TCP Bind Shell (ARM 32-bit) - https://azeria-labs.com/tcp-bind-shell-in-assembly-arm-32-bit/
- TCP Reverse Shell (ARM 32-bit) - https://azeria-labs.com/tcp-reverse-shell-in-assembly-arm-32-bit/
- Process Memory and Memory Corruptions - https://azeria-labs.com/process-memory-and-memory-corruption/
- Stack Overflow Challenges - https://azeria-labs.com/part-3-stack-overflow-challenges/
- Process Continuation Shellcode - https://azeria-labs.com/process-continuation-shellcode/
- Heap Exploitation Part 1: Understanding the Glibc Heap Implementation - https://azeria-labs.com/heap-exploitation-part-1-understanding-the-glibc-heap-implementation/
ARM shellcode and exploit development
- BSidesMunich 2018 Workshop; Andrea Sindoni
- https://github.com/invictus1306/Workshop-BSidesMunich2018
- https://github.com/invictus1306/Workshop-BSidesMunich2018/blob/master/workshop_slides.pdf
ARMv8 Shellcodes from 'A' to 'Z'
- ISPEC 2016
- Hadrien Barral, Houda Ferradi, Rémi Géraud, Georges-Axel Jaloyan, David Naccache
- https://arxiv.org/abs/1608.03415
Bit-Twiddling: Optimising AArch64 Logical Immediate Encoding (and Decoding)
- https://dougallj.wordpress.com/2021/10/30/bit-twiddling-optimising-aarch64-logical-immediate-encoding-and-decoding/
Encoding of immediate values on AArch64 - 2017 - Dominik Inführ
- https://dinfuehr.github.io/blog/encoding-of-immediate-values-on-aarch64/
Exploring New Depths of Threat Hunting ...or How to Write ARM Shellcode in Six Minutes
- Security Analysts Summit (SAS) 2018
- https://www.youtube.com/watch?v=DGJZBDlhIGU
- https://azeria-labs.com/downloads/SAS-v1.0-Azeria.pdf
Filter-resistant Code Injection on ARM
- CCS 2009
- Yves Younan, Pieter Philippaerts, Frank Piessens, Wouter Joosen, Sven Lachmund, Thomas Walter
- http://amnesia.gtisc.gatech.edu/~moyix/CCS_09/docs/p11.pdf
Make ARM Shellcode Great Again
- Saumil Shah
- Hack.lu 2018 - https://www.youtube.com/watch?v=9tx293lbGuc
- 44CON 2018 - https://www.youtube.com/watch?v=pkhla6_2Kl0
Shellcode: Encryption Algorithms in ARM Assembly
- https://modexp.wordpress.com/2018/02/04/arm-crypto/
- https://github.com/odzhan/shellcode

A-profile

BFloat16 extensions for Armv8-A
- https://community.arm.com/developer/ip-products/processors/b/ml-ip-blog/posts/bfloat16-processing-for-neural-networks-on-armv8_2d00_a

M-profile

A Tourist's Guide to the ARM Cortex M3
- BSides Knoxville 2020
- Travis Goodspeed and Ryan Speers
- https://www.youtube.com/watch?v=ilNhCW8ShlY
A Tourist’s Phrasebook for Reversing Embedded ARM in the Dialect of the Cortex M Series
- PoC||GTFO Issue 0x11 March 2016
- Travis Goodspeed and Ryan Speers
- https://www.riverloopsecurity.com/projects/pocgtfo_tourist_armcortexm/
Arm M-profile Assembly Tricks
- 2025; Thomas Pornin
- https://github.com/pornin/arm-asm-notes
Code-Generation for the Arm M-profile Vector Extension
- 2019 LLVM Developers’ Meeting; Sjoerd Meijer, Sam Parker
- https://www.youtube.com/watch?v=TUDWpAhLjBU
- http://llvm.org/devmtg/2019-10/talk-abstracts.html#tech2
Helium – Arm Developer
- https://developer.arm.com/architectures/instruction-sets/simd-isas/helium
- Helium Intrinsics
  - https://developer.arm.com/architectures/instruction-sets/intrinsics/#f:@navigationhierarchiessimdisa=[Helium]
- Helium Programmer's Guide
  - https://developer.arm.com/architectures/instruction-sets/simd-isas/helium/helium-programmers-guide
- Making Helium
  - Why not just add Neon? (1/4) - https://community.arm.com/arm-research/b/articles/posts/making-helium-why-not-just-add-neon
  - Sudoku, registers and rabbits (2/4) - https://community.arm.com/developer/research/b/articles/posts/making-helium-sudoku-registers-and-rabbits
  - Going around in circles (3/4) - https://community.arm.com/developer/research/b/articles/posts/making-helium-going-around-in-circles
  - Bringing Amdahl's law to heel (4/4) - https://community.arm.com/developer/research/b/articles/posts/making-helium-bringing-amdahl-s-law-to-heel
Instruction set reference card for Arm M-profile CPUs
Profiling Firmware on Cortex-M
- https://interrupt.memfault.com/blog/profiling-firmware-on-cortex-m
SoK: Where's the "up"?! A Comprehensive (bottom-up) Study on the Security of Arm Cortex-M Systems
- USENIX WOOT Conference on Offensive Technologies 2024
- Xi Tan, Zheyuan Ma, Sandro Pinto, Le Guan, Ning Zhang, Jun Xu, Zhiqiang Lin, Hongxin Hu, Ziming Zhao
- https://www.usenix.org/conference/woot24/presentation/tan
- https://github.com/CactiLab/SoK-Cortex-M
- https://cactilab.github.io/assets/pdf/tan2024sok.pdf
- https://arxiv.org/abs/2401.15289

Performance

An Instruction Level Energy Characterization of ARM Processors
- 2015 Technical Report (FORTH-ICS/TR-450); Evangelos Vasilakis
- https://www.ics.forth.gr/carv/greenvm/files/tr450.pdf
CoreSight, Perf and the OpenCSD Library
- https://www.linaro.org/blog/coresight-perf-and-the-opencsd-library/
Linaro Wiki - perf
- https://web.archive.org/https://wiki.linaro.org/KenWerner/Sandbox/perf
- https://web.archive.org/https://wiki.linaro.org/Platform/DevPlatform/Tools/Perf
On-Target Trace Using the CoreSight Access Library
- https://developer.arm.com/products/software-development-tools/ds-5-development-studio/resources/tutorials/on-target-trace-using-the-coresight-access-library
OpenCSD HOWTO - using the library with perf
- https://github.com/Linaro/OpenCSD/blob/master/HOWTO.md
Statistical Profiling Extension for ARMv8-A
- https://community.arm.com/processors/b/blog/posts/statistical-profiling-extension-for-armv8-a
Using Perf and its friend eBPF on Arm platform
- Linaro Connect San Diego 2019; Leo Yan
- https://connect.linaro.org/resources/san19/san19-223/

Performance: Numerics

ARM Floating Point 2019: Latency, Area, Power
- 2019 IEEE 26th Symposium on Computer Arithmetic (ARITH)
- David Lutz
- https://doi.org/10.1109/ARITH.2019.00025
LLVM and the Automatic Vectorization of Loops Invoking Math Routines: -fsimdmath
- 2018 IEEE/ACM 5th Workshop on the LLVM Compiler Infrastructure in HPC (LLVM-HPC)
- Francesco Petrogalli, Paul Walker
- https://sc18.supercomputing.org/proceedings/workshops/workshop_files/ws_llvmf106s2-file1.pdf

Performance: Statistical Profiling Extension (SPE)

perf-arm-spe - Support for Arm Statistical Profiling Extension within Perf tools
- https://perf.wiki.kernel.org/index.php/Latest_Manual_Page_of_perf-arm-spe.1
- https://man7.org/linux/man-pages/man1/perf-arm-spe.1.html
Using the Arm Statistical Profiling Extension to detect false cache-line sharing
- https://www.linaro.org/blog/using-the-arm-statistical-profiling-extension-to-detect-false-cache-line-sharing/

Security

ARM Lab Environment - https://www.vulnhub.com/series/arm-lab,145/
ARM Return Oriented Programming (ROP) - Billy Ellis
Cache Speculation Side-channels
- Richard Grisenthwaite
- https://developer.arm.com/support/security-update
- Compiler support for mitigations - https://developer.arm.com/support/security-update/compiler-support-for-mitigations
- Speculation Barrier - https://github.com/ARM-software/speculation-barrier
Damn Vulnerable ARM Router (DVAR)
- http://blog.exploitlab.net/2018/01/dvar-damn-vulnerable-arm-router.html
Exploitation on ARM-based Systems
- Troopers18; Sascha Schirra, Ralf Schaefer
- https://github.com/sashs/arm_exploitation
Micro-Architectural Power Simulator for Leakage Assessment of Cryptographic Software on ARM Cortex-M3 Processors
- Cryptology ePrint Archive: Report 2017/1253
- Yann Le Corre, Johann Großschädl, Daniel Dinu
- https://eprint.iacr.org/2017/1253
NORAX: Enabling Execute-Only Memory for COTS Binaries on AArch64
- Security and Privacy (S&P) 2017
- Yaohui Chen, Dongli Zhang, Ruowen Wang, Rui Qiao, Ahmed Azab, Long Lu, Hayawardh Vijayakumar, Wenbo Shen
- http://seclab.cs.sunysb.edu/seclab/pubs/norax.pdf
RevARM: A Platform-Agnostic ARM Binary Rewriter for Security Applications
- Annual Computer Security Applications Conference (ACSAC) 2017
- T. Kim, C. Kim, H. Choi, Y. Kwon, B. Saltaformaggio, X. Zhang, D. Xu
- https://saltaformaggio.ece.gatech.edu/publications/ACSAC_17.pdf
- https://www.acsac.org/2017/openconf/modules/request.php?module=oc_program&action=summary.php&id=201
- https://www.researchgate.net/publication/321506390_RevARM_A_Platform-Agnostic_ARM_Binary_Rewriter_for_Security_Applications
Safe and Efficient Implementation of a Security System on ARM using Intra-level Privilege Separation
- ACM Transactions on Privacy and Security (TOPS) 22(2) 2019
- Donghyun Kwon, Hayoon Yi, Yeongpil Cho, Yunheung Paek
- https://doi.org/10.1145/3309698
Smashing the ARM Stack: ARM Exploitation Part 1
- https://web.archive.org/https://www.merckedsecurity.com/blog/smashing-the-arm-stack-part-1
TCP Bind Shell in Assembly (ARM 32-bit)
- https://azeria-labs.com/tcp-bind-shell-in-assembly-arm-32-bit/

Security: 2023

Capacity: Cryptographically-Enforced In-Process Capabilities for Modern Arm Architectures
- ACM Conference on Computer and Communications Security (CCS) 2023
- Kha Dinh Duy, Kyuwon Cho, Taehyun Noh, Hojoon Lee
- https://dl.acm.org/doi/10.1145/3576915.3623079
- https://arxiv.org/abs/2309.11151
- https://github.com/sslab-skku/capacity

Security: Arm Confidential Compute Architecture (CCA)

A verification methodology for the Arm Confidential Computing Architecture
- OOPSLA 2023
- Anthony C. J. Fox, Gareth Stockwell, Shale Xiong, Hanno Becker, Dominic P. Mulligan, Gustavo Petri, Nathan Chong
- https://dominicpm.github.io/publications/fox-verification-2023.pdf
- https://2023.splashcon.org/details/splash-2023-oopsla/14/A-verification-methodology-for-the-Arm-Confidential-Computing-Architecture
Design and Verification of the Arm Confidential Compute Architecture
- USENIX Symposium on Operating Systems Design and Implementation (OSDI) 2022
- Xupeng Li, Xuheng Li, Christoffer Dall, Ronghui Gu, Jason Nieh, Yousuf Sait, Gareth Stockwell
- https://www.usenix.org/conference/osdi22/presentation/li
- https://github.com/columbia/VIA

Security: Debugging

Revisiting ARM Debugging Features: Nailgun and Its Defense
- IEEE Transactions on Dependable and Secure Computing (TDSC) 2022
- Zhenyu Ning, Chenxu Wang, Yinhua Chen, Fengwei Zhang, Jiannong Cao
- https://fengweiz.github.io/paper/nailgun-tdsc22.pdf
Understanding the Security of ARM Debugging Features
- Security & Privacy (S&P) 2019
- Zhenyu Ning, Fengwei Zhang
- https://compass.cs.wayne.edu/nailgun/
- http://webpages.eng.wayne.edu/~fy8421/paper/nailgun-sp19.pdf

Memory Tagging Extension (MTE)

Memory Tagging Extension (MTE): 2026

Arm MTE Performance in Practice (Extended Version)
- USENIX Security 2026
- Taehyun Noh, Yingchen Wang, Tal Garfinkel, Mahesh Madhav, Mattan Erez, Daniel Moghimi, Shravan Narayan
- https://arxiv.org/abs/2601.11786
- https://shravanrn.com/pubs/mte-extended.pdf
- https://github.com/UT-Security/mte-root
- https://doi.org/10.5281/zenodo.17953064
NanoTag: Systems Support for Efficient Byte-Granular Overflow Detection on Arm MTE
- IEEE Symposium on Security and Privacy (S&P) 2026
- Mingkai Li, Hang Ye, Joseph Devietti, Suman Jana, Tanvir Ahmed Khan
- https://arxiv.org/abs/2509.22027
- https://takhandipu.github.io/papers/li-nanotag-oakland-2026.pdf
- https://github.com/ice-rlab/NanoTag

Memory Tagging Extension (MTE): 2025

Optimized Memory Tagging on AmpereOne Processors
- 2025
- Shiv Kaushik, Mahesh Madhav, Nagi Aboulenein, Jason Bessette, Sandeep Brahmadathan, Ben Chaffin, Matthew Erler, Stephan Jourdan, Thomas Maciukenas, Ramya Masti, Jon Perry, Massimo Sutera, Scott Tetrick, Bret Toll, David Turley, Carl Worth, Atiq Bajwa
- https://arxiv.org/abs/2511.17773

Memory Tagging Extension (MTE): 2018-2024

ARM Memory Tagging Extension and How It Improves C/C++ Memory Safety
- USENIX ;login: Vol. 44, No. 2 Summer 2019
- Kostya Serebryany
- https://www.usenix.org/publications/login/summer2019/serebryany
- https://github.com/google/sanitizers/blob/master/hwaddress-sanitizer/login_summer19_03_serebryany.pdf
Hardware-assisted AddressSanitizer (HWASAN)
- Design Documentation - https://clang.llvm.org/docs/HardwareAssistedAddressSanitizerDesign.html
- Talks - https://github.com/google/sanitizers/tree/master/hwaddress-sanitizer
  - Hardware Memory Tagging to make C/C++ memory safe(r)
    - iSecCon 2018; Kostya Serebryany
    - https://github.com/google/sanitizers/blob/master/hwaddress-sanitizer/MTE-iSecCon-2018.pdf
  - Towards a fully sanitizable C++, with the help from hardware
    - PLEMM 2019; Kostya Serebryany
    - https://github.com/google/sanitizers/blob/master/hwaddress-sanitizer/plemm-2019.pdf
Memory Tagging and how it improves C/C++ memory safety
- 2018
- Kostya Serebryany, Evgenii Stepanov, Aleksey Shlyapnikov, Vlad Tsyrklevich, Dmitry Vyukov
- https://arxiv.org/abs/1802.09517
- https://research.google/pubs/pub46800/
Memory Tagging, how it improves C++ memory safety, and what does it mean for compiler optimizations
- 2018 LLVM Developers’ Meeting
- Kostya Serebryany, Evgenii Stepanov, Vlad Tsyrklevich
- https://llvm.org/devmtg/2018-10/talk-abstracts.html#talk16
MTE As Implemented
- 2023
- Mark Brand
- Part 1: Implementation Testing
  - https://googleprojectzero.blogspot.com/2023/08/mte-as-implemented-part-1.html
- Part 2: Mitigation Case Studies
  - https://googleprojectzero.blogspot.com/2023/08/mte-as-implemented-part-2-mitigation.html
- Part 3: The Kernel
  - https://googleprojectzero.blogspot.com/2023/08/mte-as-implemented-part-3-kernel.html
scudo: Add initial memory tagging support
- 2019
- https://reviews.llvm.org/D70762
Security analysis of memory tagging
- 2020; Joe Bialek, Ken Johnson, Matt Miller, Tony Chen
- https://github.com/microsoft/MSRC-Security-Research/blob/master/papers/2020/Security%20analysis%20of%20memory%20tagging.pdf
Sticky Tags: Efficient and Deterministic Spatial Memory Error Mitigation using Persistent Memory Tags
- IEEE Symposium on Security and Privacy (S&P) 2024
- Floris Gorter, Taddeus Kroes, Herbert Bos, Cristiano Giuffrida
- https://doi.ieeecomputersociety.org/10.1109/SP54263.2024.00182
- https://www.vusec.net/projects/stickytags/
- Arm Memory Tagging Extension: Security Update
  - https://developer.arm.com/Arm%20Security%20Center/Arm%20Memory%20Tagging%20Extension
Strengthening the Shield: MTE in Heap Allocators
- 2024
- https://www.darknavy.org/blog/strengthening_the_shield_mte_in_memory_allocators/
The Memory Tagging Extension MTE for Arm AArch64
- Lund Linux Conference (LLC) 2024
- Linus Walleij
- https://www.youtube.com/watch?v=M8BVlx-ILOM
TikTag: Breaking Arm's Memory Tagging Extension with Speculative Execution
- 2024
- IEEE Symposium on Security and Privacy (S&P) 2025
- Juhee Kim, Jinbum Park, Sihyeon Roh, Jaeyoung Chung, Youngjoo Lee, Taesoo Kim, Byoungyoung Lee
- https://arxiv.org/abs/2406.08719
- https://github.com/compsec-snu/tiktag

Pointer Authentication (PAC): 2022

PACMAN: attacking ARM pointer authentication with speculative execution
- International Symposium on Computer Architecture (ISCA) 2022
- Joseph Ravichandran, Weon Taek Na, Jay Lang, Mengjia Yan
- https://pacmanattack.com/
- https://dl.acm.org/doi/10.1145/3470496.3527429
PACMem: Enforcing Spatial and Temporal Memory Safety via Arm Pointer Authentication
- CCS 2022
- Yuan Li, Wende Tan, Zhizheng Lv, Songtao Yang, Mathias Payer, Ying Liu, Chao Zhang
- https://doi.org/10.1145/3548606.3560598
- https://hexhive.epfl.ch/publications/files/22CCS2.pdf

Pointer Authentication (PAC): 2019-2017

arm64e: An ABI for Pointer Authentication
- 2019 LLVM Developers’ Meeting; Ahmed Bougacha, John McCall
- https://www.youtube.com/watch?v=C1nZvpEBfYA
- http://llvm.org/devmtg/2019-10/talk-abstracts.html#tech15
- https://github.com/apple/llvm-project/blob/apple/main/clang/docs/PointerAuthentication.rst
Examining Pointer Authentication on the iPhone XS
- 2019; Brandon Azad
- https://googleprojectzero.blogspot.com/2019/02/examining-pointer-authentication-on.html
LLVM-based Implementations
- [llvm-dev] [RFC] Pointer authentication for arm64e
  - http://lists.llvm.org/pipermail/llvm-dev/2019-October/136091.html
- [LLVM and Clang] Upstream arm64e and Pointer Authentication support #14
  - https://github.com/apple/llvm-project/pull/14
- Add arm64e and pointer authentication support for Swift #30112
  - https://github.com/apple/swift/pull/30112
PAC it up: Towards Pointer Integrity using ARM Pointer Authentication
- USENIX Security 2019
- Hans Liljestrand, Thomas Nyman, Kui Wang, Carlos Chinea Perez, Jan-Erik Ekberg, N. Asokan
- https://www.usenix.org/conference/usenixsecurity19/presentation/liljestrand
- https://github.com/pointer-authentication
Pointer Authentication on ARMv8.3: Design and Analysis of the New Software Security Instructions
Raising the Bar: New Hardware Primitives for Exploit Mitigations
- BlueHat v17 (2017); Rob Turner
- ARMv8.3 pointer authentication
- https://www.youtube.com/watch?v=PYe8W33lbAQ
- https://www.slideshare.net/MSbluehat/raising-the-bar-new-hardware-primitives-for-exploit-mitigations-83686492

TrustZone

A Deep Dive Into Samsung's TrustZone
- Part 1: Detailed overview of Samsung's TrustZone components
  - https://blog.quarkslab.com/a-deep-dive-into-samsungs-trustzone-part-1.html
- Part 2: Tools development for reverse-engineering and vulnerability research
  - https://blog.quarkslab.com/a-deep-dive-into-samsungs-trustzone-part-2.html
- Part 3: Vulnerability exploitation to reach code execution in EL3 on a Samsung device
  - https://blog.quarkslab.com/a-deep-dive-into-samsungs-trustzone-part-3.html
Attacking the ARM's TrustZone
- https://blog.quarkslab.com/attacking-the-arms-trustzone.html
Azeria Labs
- TrustZone Research
  - Trusted Execution Environments and Arm TrustZone
    - https://azeria-labs.com/trusted-execution-environments-tee-and-trustzone/
  - Trustonic’s Kinibi TEE Implementation
    - https://azeria-labs.com/trustonics-kinibi-tee-implementation/
Breaking Samsung's ARM TrustZone
- Black Hat USA 2019
- Maxime Peterlin, Alexandre Adamski, Joffrey Guilbon
- https://www.blackhat.com/us-19/briefings/schedule/#breaking-samsungs-arm-trustzone-14932
- https://www.youtube.com/watch?v=uXH5LJGRwXI
Cachegrab: a tool designed to help perform and visualize trace-driven cache attacks against software in the secure world of TrustZone-enabled ARMv8 cores
- https://github.com/nccgroup/cachegrab
- https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/december/34C3-Tool-Release-Cachegrab/
Demystifying Arm TrustZone: A Comprehensive Survey
- ACM Computing Surveys 51(6) 2019
- Sandro Pinto and Nuno Santos
- https://www.gsd.inesc-id.pt/~nsantos/papers/pinto_acsur19.pdf
Hardware-assisted Transparent Tracing and Debugging on ARM
- IEEE Transactions on Information Forensics & Security (TIFS) 2018
- Zhenyu Ning, Fengwei Zhang
- https://doi.org/10.1109/TIFS.2018.2883027
- http://webpages.eng.wayne.edu/~fy8421/paper/ninja-tifs19.pdf
Introduction to Trusted Execution Environment: ARM's TrustZone
- https://blog.quarkslab.com/introduction-to-trusted-execution-environment-arms-trustzone.html
Introduction to Trusted Execution Environment and ARM's TrustZone
- https://embeddedbits.org/introduction-to-trusted-execution-environment-tee-arm-trustzone/
Ninja: Towards Transparent Tracing and Debugging on ARM
- USENIX Security 2017
- Zhenyu Ning, Fengwei Zhang
- https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/ning
PARTEMU: Enabling Dynamic Analysis of Real-World TrustZone Software Using Emulation
- USENIX Security 2020
- Lee Harrison, Hayawardh Vjayakumar, Rohan Padhye, Koushik Sen, Michael Grace
- https://people.eecs.berkeley.edu/~rohanpadhye/files/partemu-usenixsec20.pdf
Running Trusted Firmware-A on gem5
- https://community.arm.com/developer/research/b/articles/posts/running-trusted-firmware-a-on-gem5
SoK: Understanding the Prevailing Security Vulnerabilities in TrustZone-assisted TEE Systems
- IEEE Symposium on Security and Privacy (S&P) 2020
- David Cerdeira, Nuno Santos, Pedro Fonseca, Sandro Pinto
- https://www.cs.purdue.edu/homes/pfonseca/papers/sp2020-tees.pdf
TEE-reversing: A curated list of public TEE resources for learning how to reverse-engineer and achieve trusted code execution on ARM devices
- https://github.com/enovella/TEE-reversing
Verification of a Practical Hardware Security Architecture Through Static Information Flow Analysis (ARM TrustZone)
- ASPLOS 2017
- Andrew Ferraiuolo, Rui Xu, Danfeng Zhang, Andrew C. Myers, G. Edward Suh
- http://www.cs.cornell.edu/andru/papers/trustzone/
vTZ: Virtualizing ARM TrustZone
- USENIX Security 2017
- Zhichao Hua, Jinyu Gu, Yubin Xia, Haibo Chen, Binyu Zang, and Haibing Guan
- https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/hua

Simulation

Simulation of ARM and x86 microprocessors using in-order and out-of-order CPU models with Gem5 simulator
- International Conference on Electrical and Electronic Engineering (ICEEE) 2018
- Anas Ahmad Abudaqa, Talal M. Al-Kharoubi, Muhamed F. Mudawar, Armin Kobilica
- https://ieeexplore.ieee.org/document/8391354/
Simulation of 64-bit ARM Systems: Implementation, Validation and Design Space Exploration
- 2018 MSc dissertation
- Juan Miguel de Haro Ruiz
- https://upcommons.upc.edu/handle/2117/127677

Virtualization

ARM Virtualization: Performance and Architectural Implications
- ACM SIGOPS Operating Systems Review 52(1) 2018
- Christoffer Dall, Shih-Wei Li, Jin Tack Lim, and Jason Nieh
- https://dl.acm.org/citation.cfm?id=3273987
Cross-ISA Testing of the Pharo VM: Lessons Learned While Porting to ARMv8
- ACM SIGPLAN International Conference on Managed Programming Languages and Runtimes (MPLR) 2021
- Guillermo Polito, Pablo Tesone, Stéphane Ducasse, Luc Fabresse, Théo Rogliano, Pierre Misse-Chanabier, Carolina Hernandez Phillips
- https://doi.org/10.1145/3475738.3480715
- https://hal.archives-ouvertes.fr/hal-03332033/
Hiding in the Shadows: Empowering ARM for Stealthy Virtual Machine Introspection
- Annual Computer Security Applications Conference (ACSAC) 2018
- Sergej Proskurin, Tamas Lengyel, Marius Momeu, Claudia Eckert, Apostolis Zarras
- https://dl.acm.org/citation.cfm?id=3274698
- https://www.sec.in.tum.de/i20/publications/hiding-in-the-shadows-empowering-arm-for-stealthy-virtual-machine-introspection
- DRAKVUF on ARM
  - https://github.com/drakvuf-on-arm
Hypervisor Necromancy; Reanimating Kernel Protectors, or On emulating hypervisors; a Samsung RKP case study
- Phrack 2020-02-14; Aris Thallas
- http://phrack.org/papers/emulating_hypervisors_samsung_rkp.html
Optimizing the Design and Implementation of the Linux ARM Hypervisor
- 2017 USENIX Annual Technical Conference
- Christoffer Dall, Shih-Wei Li, Jason Nieh
- https://www.usenix.org/conference/atc17/technical-sessions/presentation/dall
The Design, Implementation, and Evaluation of Software and Architectural Support for ARM Virtualization
- 2018 PhD Thesis; Christoffer Dall
- https://academiccommons.columbia.edu/catalog/ac:t1g1jwstss

References

ARM Architecture Documentation
- A-Profile: The Applications profile - https://developer.arm.com/products/architecture/a-profile/docs
  - A-Profile Architectures - Exploration Tools - https://developer.arm.com/products/architecture/a-profile/exploration-tools
  - ARM Architecture Reference Manual ARMv8, for ARMv8-A architecture profile
    - https://developer.arm.com/docs/ddi0487/latest/arm-architecture-reference-manual-armv8-for-armv8-a-architecture-profile
  - Programmer’s Guide for ARMv8-A: ARM® Cortex-A Series, Version: 1.0
    - http://infocenter.arm.com/help/topic/com.arm.doc.den0024a/DEN0024A_v8_architecture_PG.pdf
- R-Profile: The Real-Time profile - https://developer.arm.com/products/architecture/r-profile/docs
- M-Profile: The Microcontroller profile - https://developer.arm.com/products/architecture/m-profile/docs
ARM and Thumb-2 Instruction Set Quick Reference Card
- http://infocenter.arm.com/help/topic/com.arm.doc.qrc0001m/QRC0001_UAL.pdf
ARM Assembly Basics Cheatsheet - https://azeria-labs.com/assembly-basics-cheatsheet/
ARM architecture documentation set - http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.set.architecture/
Arm A64 Instruction Set Architecture: Armv8-A - Base Instructions (alphabetic order)
- https://developer.arm.com/docs/ddi0596/h/base-instructions-alphabetic-order
asm.thi.ng - baremetal ARM coding resources - http://asm.thi.ng/
Instruction Sets - https://developer.arm.com/products/architecture/instruction-sets
Jon's Arm Reference
- This site offers reference documentation for the AArch64 instruction set and system registers defined by the Armv8-A and Armv9-A architectures.
- https://arm.jonpalmisc.com/
The ARM Machinists Atlas
- https://www.youtube.com/watch?v=PRaJQepIf44
- https://xlogicx.net/ARM_Atlas.html
Works on ARM newsletter - https://github.com/vielmetti/worksonarm-news

References: Application Binary Interface (ABI)

Application Binary Interface for the Arm® Architecture
- https://github.com/ARM-software/abi-aa
C/C++ Atomics ABI for the Arm® 64-bit Architecture (AArch64)
- https://github.com/ARM-software/abi-aa/tree/main/atomicsabi64
Windows Arm64EC ABI Notes
- https://www.corsix.org/content/windows-arm64ec-notes

References: Microarchitecture

References: Microarchitecture: Apple

References: Microarchitecture: Apple: M1

AArch64-Explore: Exploration of Apple CPUs
- https://github.com/name99-org/AArch64-Explore
Apple M1 CPU Microarchitectures Research by Dougall Johnson
- Research on the Apple M1 CPU microarchitectures (Firestorm and Icestorm), with instruction tables describing throughput, latency, and uops for most instructions, and detailed experiments and measurements.
  - https://dougallj.github.io/applecpu/firestorm.html
  - https://github.com/dougallj/applecpu
- Counting cycles and instructions on the Apple M1 processor
  - https://lemire.me/blog/2021/03/24/counting-cycles-and-instructions-on-the-apple-m1-processor/
- Apple M1: Load and Store Queue Measurements
  - https://dougallj.wordpress.com/2021/04/08/apple-m1-load-and-store-queue-measurements/
Analyzing the memory ordering models of the Apple M1
- Journal of Systems Architecture Volume 149, April 2024
- Lars Wrenger, Dominik Töllner, Daniel Lohmann
- https://doi.org/10.1016/j.sysarc.2024.103102
Apple Silicon Hardware Secrets: SPRR and Guarded Exception Levels (GXF)
- 2021-05-06
- Sven Peter
- https://blog.svenpeter.dev/posts/m1_sprr_gxf/

References: Microarchitecture: Arm

References: Microarchitecture: Arm: Cortex

Arm Cortex-A
- Cortex-A57 Software Optimization Guide
- Cortex-A72: AArch64 for the Masses
  - https://chipsandcheese.com/2022/03/06/arms-cortex-a72-aarch64-for-the-masses/
- Cortex-A510: https://www.arm.com/products/silicon-ip-cpu/cortex-a/cortex-a510
  - Cortex-A510: Two Kids in a Trench Coat
    - https://chipsandcheese.com/2023/10/01/arms-cortex-a510-two-kids-in-a-trench-coat/
  - WikiChip
    - https://en.wikichip.org/wiki/arm_holdings/microarchitectures/cortex-a510
Arm Cortex-X
- Cortex-X2: Arm Aims High
  - https://chipsandcheese.com/2023/10/27/cortex-x2-arm-aims-high/

References: Microarchitecture: Arm: Neoverse

References: Microarchitecture: Arm: Neoverse: N-Series

Arm Neoverse N2
- https://chipsandcheese.com/2023/08/18/arms-neoverse-n2-cortex-a710-for-servers/

References: Microarchitecture: Arm: Neoverse: V-Series

Arm Neoverse V2
- Hot Chips 2023: Arm Neoverse V2
  - https://chipsandcheese.com/2023/09/11/hot-chips-2023-arms-neoverse-v2/
- Arm Neoverse V2 in AWS Graviton4
  - https://chipsandcheese.com/2024/07/22/arms-neoverse-v2-in-awss-graviton-4/

References: Microarchitecture: Fujitsu

Fujitsu A64FX - https://github.com/fujitsu/A64FX

References: Microarchitecture: NVIDIA

NVIDIA Grace: https://www.nvidia.com/en-us/data-center/grace-cpu/
- NVIDIA Grace 72 Core Processor Cache Micro-Benchmarks
  - https://cpufun.substack.com/p/nvidia-grace-72-core-processor-cache

References: OS

Linux
- Linux Kernel Documentation
  - ARM: https://www.kernel.org/doc/Documentation/arm/
  - ARM64: https://www.kernel.org/doc/Documentation/arm64/
  - silent syscall hooking on arm64 linux via patching svc handler
    - tmp.0ut #003 - 2023-11
    - wintermute
    - https://tmpout.sh/3/23.html
- Asahi Linux documentation Wiki
  - https://github.com/asahilinux/docs/wiki
  - Introduction to Apple Silicon
    - https://github.com/AsahiLinux/docs/wiki/Introduction-to-Apple-Silicon
  - Open OS Ecosystem on Apple Silicon Macs
    - https://github.com/AsahiLinux/docs/wiki/Open-OS-Ecosystem-on-Apple-Silicon-Macs
  - m1n1:User Guide
    - https://github.com/AsahiLinux/docs/wiki/m1n1%3AUser-Guide
  - Apple Platform Security Crash Course
    - https://github.com/AsahiLinux/docs/wiki/Apple-Platform-Security-Crash-Course
macOS
- Apple Silicon - Apple Developer Documentation
  - https://developer.apple.com/documentation/apple_silicon
Windows
- Windows on Arm
  - https://learn.microsoft.com/en-us/windows/arm/overview
- System call dispatching on Windows ARM64
  - https://gracefulbits.wordpress.com/2018/07/26/system-call-dispatching-for-windows-on-arm64/
- Arm64 Boot Camp: The Windows on Arm Tutorials
  - 2024 by Darek Mihocka
  - http://www.emulators.com/docs/nx44_intro_to_woa.htm#abc
  - A Brief History of Windows on Arm
    - http://www.emulators.com/docs/abc_history_of_woa.htm
  - The Genius of Arm64
    - http://www.emulators.com/docs/abc_genius_of_arm64.htm
  - Installing Windows on Arm developer tools
    - http://www.emulators.com/docs/abc_devtools.htm
  - Arm64EC (and Arm64X) Explained
    - http://www.emulators.com/docs/abc_arm64ec_explained.htm
  - Understanding x86/x64 Emulation on Windows on Arm
    - http://www.emulators.com/docs/abc_exit_xta.htm

Intrinsics & SIMD

Arm Intrinsics reference search engine
- https://developer.arm.com/architectures/instruction-sets/intrinsics/
Arm C Language Extensions (ACLE)
- the source material for the ACLE specifications
- https://github.com/ARM-software/acle
- https://arm-software.github.io/acle/main/acle.html
ARC SIMD Built-in Functions - https://gcc.gnu.org/onlinedocs/gcc/ARC-SIMD-Built-in-Functions.html
ARM Intrinsics - MSDN - Microsoft - https://docs.microsoft.com/en-us/cpp/intrinsics/arm-intrinsics
SIMD ISAs – Arm Developer
- https://developer.arm.com/architectures/instruction-sets/simd-isas
SIMD Loops
- a collection of self-contained, real-world loop kernels — written in a mix of C, ACLE intrinsics, and inline assembly — that target everything from simple arithmetic to matrix multiplication, sorting, and string processing
- Neon, SVE (Scalable Vector Extension), SME (Scalable Matrix Extension)
- https://gitlab.arm.com/architecture/simd-loops
Vectorization cost modeling for NEON, AVX, and SVE
- Performance Evaluation 140–141 (2020)
- Angela Pohl, Biagio Cosenza, Ben Juurlink
- https://doi.org/10.1016/j.peva.2020.102106
- http://www.cosenza.eu/papers/PohlPEJ20.pdf

Neon

Arm Neon Intrinsics Reference
- https://arm-software.github.io/acle/neon_intrinsics/advsimd.html
Neon – Arm Developer
- https://developer.arm.com/architectures/instruction-sets/simd-isas/neon
- Neon Programmer's Guide for Armv8-A
  - https://developer.arm.com/architectures/instruction-sets/simd-isas/neon/neon-programmers-guide-for-armv8-a
Neon Intrinsics - https://developer.arm.com/architectures/instruction-sets/intrinsics/#f:@navigationhierarchiessimdisa=[Neon]
Neon intrinsics guide - https://github.com/thenifty/neon-guide
Neon Programmer’s Guide - http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.den0018a/
Porting and Optimizing HPC Applications for Arm Documentation
- https://developer.arm.com/docs/101725/0200
- Coding for Neon
  - https://developer.arm.com/docs/101725/0200/coding-for-neontm
A whirlwind tour of AArch64 vector instructions
- https://www.corsix.org/content/whirlwind-tour-aarch64-vector-instructions
ARM Neon Intrinsics - https://gcc.gnu.org/onlinedocs/gcc-4.9.4/gcc/ARM-NEON-Intrinsics.html#ARM-NEON-Intrinsics
Bit twiddling with Arm Neon: beating SSE movemasks, counting bits and more
- https://community.arm.com/arm-community-blogs/b/infrastructure-solutions-blog/posts/porting-x86-vector-bitmask-optimizations-to-arm-neon
Branch Free - Geoff Langdale
- An Intel Programmer Jumps Over the Wall: First Impressions of ARM SIMD Programming
  - https://branchfree.org/2019/03/26/an-intel-programmer-jumps-over-the-wall-first-impressions-of-arm-simd-programming/
- Fitting My Head Through The ARM Holes or: Two Sequences to Substitute for the Missing PMOVMSKB Instruction on ARM NEON
  - https://branchfree.org/2019/04/01/fitting-my-head-through-the-arm-holes-or-two-sequences-to-substitute-for-the-missing-pmovmskb-instruction-on-arm-neon/
Control Flow Vectorization for ARM NEON
- International Workshop on Software and Compilers for Embedded Systems (SCOPES) 2018
- Angela Pohl, Biagio Cosenza, Ben Juurlink
- http://www.cosenza.eu/papers/PohlSCOPES18.pdf
Porting Intel Intrinsics to Arm Neon Intrinsics
- https://www.codeproject.com/Articles/5301747/Porting-Intel-Intrinsics-to-Arm-Neon-Intrinsics
VPEXPANDB on NEON with Z3
- https://zeux.io/2022/09/02/vpexpandb-neon-z3/

Scalable Matrix Extension (SME)

Arm Scalable Matrix Extension (SME) Introduction
- Part 1: https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/arm-scalable-matrix-extension-introduction
- Part 2:
  https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/arm-scalable-matrix-extension-introduction-p2

Scalable Vector Extension (SVE)

A64 SIMD Instruction List: SVE Instructions
- https://dougallj.github.io/asil/
- https://github.com/dougallj/asil
Arm Intrinsics reference search engine
Arm HPC tools for SVE
- https://developer.arm.com/tools-and-software/server-and-hpc/compile/arm-instruction-emulator/resources/tutorials/sve
Arm’s Scalable Vector Extensions: A Critical Look at SVE2 For Integer Workloads
- https://gist.github.com/zingaburga/805669eb891c820bd220418ee3f0d6bd
Asvie: A Timing-Agnostic SVE Optimization Methodology
- Methodology for ArmIE SVE
  - https://github.com/ARM-software/Methodology_for_ArmIE_SVE
- Asvie: A Timing-Agnostic SVE Optimization Methodology
  - Programming and Performance Visualization Tools (ProTools) 2019
  - Miguel Tairum Cruz, Daniel Ruiz, Roxana Rusitoru
  - https://doi.org/10.1109/ProTools49597.2019.00007
Porting and Optimizing HPC Applications for Arm SVE Documentation
- https://developer.arm.com/documentation/101726
Scalable Vector Extension (SVE)
- https://community.arm.com/processors/b/blog/posts/technology-update-the-scalable-vector-extension-sve-for-the-armv8-a-architecture
- https://developer.arm.com/hpc/a-sneak-peek-into-sve-and-vla-programming
- ARMv8-A Next Generation Vector Architecture for HPC
  - Hot Chips 28 (2016)
  - Nigel Stephens
  - https://youtu.be/egE-VKoF4ZI?t=1h9m8s
  - https://community.arm.com/cfs-file/__key/telligent-evolution-components-attachments/01-2142-00-00-00-01-20-49/ARMv8_2D00_A-SVE-technology-Hot-Chips-v12.pdf
Scalable Vector Extension support for AArch64 Linux
- https://www.kernel.org/doc/html/latest/arm64/sve.html
The ARM Scalable Vector Extension
- IEEE Micro, March 2017
- Nigel Stephens, Stuart Biles, Matthias Boettcher, Jacob Eapen, Mbou Eyole, Giacomo Gabrielli, Matt Horsnell, Grigorios Magklis, Alejandro Martinez, Nathanael Premillieu, Alastair Reid, Alejandro Rico, Paul Walker
- Preprint: https://alastairreid.github.io/papers/sve-ieee-micro-2017.pdf
- http://dx.doi.org/10.1109/MM.2017.35

Scalable Vector Extension (SVE): Applications

A fast vectorized sorting implementation based on the ARM scalable vector extension (SVE)
- PeerJ Comput. Sci. 7: e769 (2021)
- Bérenger Bramas
- https://arxiv.org/abs/2105.07782
- https://gitlab.inria.fr/bramas/arm-sve-sort
Evaluating the Effectiveness of a Vector-Length-Agnostic Instruction Set
- Euro-Par 2020: Parallel Processing
- Andrei Poenaru, Simon McIntosh-Smith
- https://doi.org/10.1007/978-3-030-57675-2_7
- https://www.youtube.com/watch?v=oX_SD43qrWA
- Emulated SVE Analysis Tools
  - Scripts used to characterise performance of applications using the Arm Instruction Emulator (ArmIE)
  - https://github.com/UoB-HPC/sve-analysis-tools/tree/euro-par-2020
FFTE on SVE: SPIRAL-Generated Kernels
- International Conference on High Performance Computing in Asia-Pacific Region (HPC Asia) 2020
- Daisuke Takahashi and Franz Franchetti
- https://dl.acm.org/doi/abs/10.1145/3368474.3368488
- https://www.spiral.net/doc/papers/ffte-spiral.pdf
Using Arm Scalable Vector Extension to Optimize OPEN MPI
- Cluster, Cloud and Internet Computing (CCGRID) 2020
- Zhong, Dong, Pavel Shamis, Qinglei Cao, George Bosilca, Shinji Sumimoto, Kenichi Miura, Jack Dongarra
- https://ieeexplore.ieee.org/document/9139622
- https://www.icl.utk.edu/publications/using-arm-scalable-vector-extension-optimize-open-mpi
Using Arm’s scalable vector extension on stencil codes
- The Journal of Supercomputing (2019)
- Armejach, Adrià, Helena Caminal, Juan M. Cebrian, Rubén Langarita, Rekai González-Alberquilla, Chris Adeniyi-Jones, Mateo Valero, Marc Casas, Miquel Moretó
- https://doi.org/10.1007/s11227-019-02842-5

Scalable Vector Extension (SVE): LLVM Implementation

Road to SVE enablement in LLDB
- Linaro Connect San Diego 2019; Omair Javaid
- https://connect.linaro.org/resources/san19/san19-204/
Scalable Vectorization for LLVM
- 2016 LLVM Developers’ Meeting; Amara Emerson & Graham Hunter, ARM
- https://www.youtube.com/watch?v=0up2hJk7k94
- http://llvm.org/devmtg/2016-11/Slides/Emerson-ScalableVectorizationinLLVMIR.pdf
SVE/SVE2 Patches on Phabricator
- https://docs.google.com/document/d/1ph1l1KhrrHgBlrKeEnuoIPrVO9jTjHvcwUlz61QWNMA

Scalable Vector Extension (SVE): Tutorials

Arm SVE Tools Training
- https://gitlab.com/arm-hpc/training/arm-sve-tools
- Hands-on training materials for Arm compilers, libraries, and tools related to SVE
Hands on: Try Arm SVE on Docker
- Tutorials for Arm SVE on Docker
- https://github.com/kaityo256/xbyak_aarch64_handson
How to use LLDB to debug SVE enabled applications
- https://www.linaro.org/blog/how-to-use-lldb-to-debug-sve-enabled-applications/
Introduction to Arm SVE
- HiPEAC 2021; John Linford
- https://www.youtube.com/watch?v=mVdeE2Qbm2I
- https://montblanc-project.eu/wp-content/uploads/2021/01/MB2020-HiPEAC_2021-JLinford-SVE.pdf
Mastering the Arm HPC ecosystem
- CEA-RIKEN HPC school (June 2019)
- https://indico.math.cnrs.fr/event/4705/
SVE Programming Examples
- Learn the architecture - SVE and SVE2 programming examples
- https://developer.arm.com/documentation/dai0548/latest/

References: Toolchains

ARM Product Manuals - Keil - http://www.keil.com/support/man_arm.htm
- armasm Assembler User Guide - http://www.keil.com/support/man/docs/armasm/
- armcc Compiler User Guide - http://www.keil.com/support/man/docs/armcc/
- armlink Linker User Guide - http://www.keil.com/support/man/docs/armlink/
- armclang Compiler Getting Started Guide - http://www.keil.com/support/man/docs/armclang_intro/
- armclang Compiler Reference Guide - http://www.keil.com/support/man/docs/armclang_ref/
Demystifying ARM Floating Point Compiler Options - https://embeddedartistry.com/blog/2017/10/9/r1q7pksku2q3gww9rpqef0dnskphtc
GNU Compiler Collection (GCC)
- AArch64 Options - https://gcc.gnu.org/onlinedocs/gcc/AArch64-Options.html
- ARM Options - https://gcc.gnu.org/onlinedocs/gcc/ARM-Options.html
- ARM C Language Extensions (ACLE) - https://gcc.gnu.org/onlinedocs/gcc/ARM-C-Language-Extensions-_0028ACLE_0029.html
- Target-Specific Builtins - https://gcc.gnu.org/onlinedocs/gcc/Target-Builtins.html#Target-Builtins
Microsoft ARM Assembler Reference - https://docs.microsoft.com/en-us/cpp/assembler/arm/arm-assembler-reference

Software

Arm HPC Users Group - resources for end-users and developers deploying on Arm hardware.
- https://gitlab.com/arm-hpc
AMaCC (Another Mini ARM C Compiler) - Small C Compiler generating ELF executable for Arm architecture
- https://github.com/jserv/amacc
libopencm3: Open source ARM Cortex-M microcontroller library
- http://libopencm3.org/
- https://github.com/libopencm3/libopencm3
mra_tools: Tools to process ARM's Machine Readable Architecture Specification
- https://github.com/alastairreid/mra_tools

Software: Assembly

AsmJit: Machine code generation for C++
- a lightweight library for machine code generation written in C++ language
- https://github.com/asmjit/asmjit
AZM - Live ARM Assembler and Syntax Checker
- https://azeria-labs.com/azm/
DynASM
- https://luajit.org/dynasm.html
- https://luajit.org/dynasm_examples.html
- The Unofficial DynASM Documentation
  - Peter Cawley
  - https://corsix.github.io/dynasm-doc/
  - https://github.com/corsix/dynasm-doc
- Hello, JIT World: The Joy of Simple JITs
  - Josh Haberman
  - https://blog.reverberate.org/2012/12/hello-jit-world-joy-of-simple-jits.html
Lightening: Just-in-time code generation library derived from GNU Lightning
- Lightening can generate code for the x86-64, i686, ARMv7, and AArch64 architectures. It supports the calling conventions of MS Windows, GNU/Linux, and Mac OS.
- https://gitlab.com/wingo/lightening
- https://wingolog.org/archives/2019/05/24/lightening-run-time-code-generation
Xbyak_aarch64: JIT assembler for AArch64 CPUs in C++
- https://github.com/fujitsu/xbyak_aarch64
Xbyak_translator_aarch64: A translator which generates JIT functions for ARMv8 with SVE from JIT functions for x86
- https://github.com/fujitsu/xbyak_translator_aarch64
VIXL: ARMv8 Runtime Code Generation Library
- https://git.linaro.org/arm/vixl.git/about/
- Programmatic assemblers to generate A64, A32 or T32 code at runtime. The assemblers abstract some of the constraints of each ISA; for example, most instructions support any immediate.
- Disassemblers that can print any instruction emitted by the assemblers.
- A simulator that can simulate any instruction emitted by the A64 assembler. The simulator allows generated code to be run on another architecture without the need for a full ISA model.

Software: Binary Analysis

Software: Concurrency

PROGRESS64: a C library of scalable functions for concurrent programs, primarily focused on networking applications
- https://github.com/ARM-software/progress64
Synchronization Benchmarks: Collection of synchronization micro-benchmarks and traces from infrastructure applications
- https://github.com/ARM-software/synchronization-benchmarks

Software: Debugging, Tracing

Coresight Access Library
- https://github.com/ARM-software/CSAL
- https://developer.arm.com/products/software-development-tools/ds-5-development-studio/resources/tutorials/on-target-trace-using-the-coresight-access-library
OpenCSD - Open CoreSight Decoder library
- https://github.com/Linaro/OpenCSD
ptm2human: ARM PTM (and ETMv4) trace to human-readable format
- ARM PTM decoder, and ARM ETM v4 decoder. ptm2human is a decoder for trace data outputted by Program Trace Macrocell (PTM) and Embedded Trace Macrocell (ETMv4).
- https://github.com/hwangcc23/ptm2human
Statically compiled ARM binaries for debugging and runtime analysis
- https://github.com/therealsaumil/static-arm-bins/
Troll
- A source level debugger for C programs running on ARM Cortex-M parts. Utilizes the blackmagic probe and the Qt framework
- https://github.com/stoyan-shopov/troll

Software: Emulation, Simulation

Arm Instruction Emulator (ArmIE)
- https://developer.arm.com/tools-and-software/server-and-hpc/compile/arm-instruction-emulator
ARM instruction evaluator - http://svr-acjf3-armie.cl.cam.ac.uk/
ARM Lab (VM) - https://azeria-labs.com/arm-lab-vm/
ARMulator: A emulator for ARM programs (aims to run ARM programs in x86 platform)
- https://github.com/x-y-z/armulator
- http://x-y-z.github.io/armulator/
ARM-X Firmware Emulation Framework
- The ARM-X Firmware Emulation Framework is a collection of scripts, kernels and filesystems to be used with QEMU to emulate ARM/Linux IoT devices. ARM-X is aimed to facilitate IoT research by virtualising as much of the physical device as possible. It is the closest we can get to an actual IoT VM.
- https://armx.exploitlab.net/
- https://github.com/therealsaumil/armx/
- Introducing ARM-X: The ARM IoT Firmware Emulation Framework
  - HITB+ CyberWeek 2019; Saumil Shah
  - https://www.youtube.com/watch?v=NVl6uJiEaoI
arm_now: arm vm working out of the box for everyone (Linux / Windows) - https://github.com/nongiach/arm_now
ASMBits: A problem set and online judge for practicing Nios II or ARMv7 assembly language - https://asmbits.01xz.net/
CPUlator: An in-browser full-system MIPS, Nios II, and ARMv7 simulator and debugger - https://cpulator.01xz.net/
Debian on an emulated ARM machine
ELMO (Emulator for power Leakages for the M0): Leakage simulator for the ARM Cortex M0
- https://github.com/bristol-sca/ELMO
- Towards Practical Tools for Side Channel Aware Software Engineering: 'Grey Box' Modelling for Instruction Leakages
- USENIX Security '17
- David McCann, Elisabeth Oswald, and Carolyn Whitnall
- https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/mccann
Emulate Raspberry Pi with QEMU - http://graznik.de/posts/emulate-raspberry-pi-with-qemu/
gem5
- ARM Implementation
  - http://www.gem5.org/documentation/general_docs/architecture_support/arm_implementation/
  - http://old.gem5.org/ARM_Implementation.html
- Building ARM Kernel - http://www.gem5.org/documentation/general_docs/fullsystem/building_arm_kernel
- Extending gem5 for ARM - http://www.gem5.org/documentation/learning_gem5/part1/extending_configs
LNSym: Armv8 Native Code Symbolic Simulator in Lean
- https://github.com/leanprover/LNSym
OakSim: Online ARM assembler and emulator
- https://wunkolo.github.io/OakSim/
- https://github.com/Wunkolo/OakSim
Qemu images (ARM, MIPS, PowerPC, SPARC, AArch64) - https://blahcat.github.io/2017/06/25/qemu-images-to-play-with/
SimEng (the Simulation Engine): a framework for building modern cycle-accurate processor simulators
- A fast, easy to use and modify cycle-level simulator for CPUs. Its initial focus is on simulating single Arm cores in server CPUs, and so the instruction set architecture (ISA) target is initially Armv8.4-A+SVE. Later versions of the Arm ISA, and other ISAs such as RISC-V, will be supported in future releases.
- CPU models in SimEng include: Marvell ThunderX2, Fujitsu A64FX
- https://github.com/UoB-HPC/SimEng
- https://uob-hpc.github.io/SimEng/
thumbulator: Thumb (16 bit ARM) instruction set simulator - https://github.com/dwelch67/thumbulator
VisUAL - A highly visual ARM emulator - http://salmanarif.bitbucket.org/visual/

Software: Emulation, Simulation: x86, x86-64

Box64: Linux Userspace x86_64 Emulator with a twist, targeted at ARM64 Linux devices
- https://box86.org/
- https://github.com/ptitSeb/box64
FEX-Emu: A fast linux usermode x86 and x86-64 emulator for AArch64 devices
- https://fex-emu.org
- https://github.com/FEX-Emu/FEX

Software: Lifting

Disassemblers, Decompilers, Recompilers

bad64: Binja Arm64 Disassembler
- bindings to the Binary Ninja arm64 architecture/disassembler plugin: https://github.com/Vector35/arch-arm64
- https://github.com/yrp604/bad64
Dynarmic: A dynamic recompiler for the ARMv6K architecture
- https://github.com/merrymage/dynarmic
IDA script for highlighting and decoding ARM system instructions
- https://github.com/gdelugre/ida-arm-system-highlight
REIL: A C++ translation/emulation library for the AArch64 instruction set to REIL
- https://github.com/googleprojectzero/reil
retools: a reverse engineering toolkit for normies
- Collection of tools (disassembler, emulator, binary parser) aimed at reverse enginering tasks, more specifically, bug finding related. Currently we target ARMv7 and Mach-O though in the future more architectures and formats are planned.
- retools is somewhat unique in that most of the semantics for relevant instructions are parsed out of the specification PDFs as opposed to being generated by hand. Currently the disassembler, emulator, and binary parsers are partially done, with a symbolic execution engine and instrumentation/hooking framework to come as I get more time.
- https://github.com/agustingianni/retools
Spedi: a speculative disassembler for the variable-size Thumb ISA
- Speculative disassembly, CFG recovery, and call-graph recovery from stripped binaries
- "Speculative disassembly of binary code" - CASES'16 - https://dl.acm.org/citation.cfm?doid=2968455.2968505
- https://github.com/abenkhadra/spedi

Software: Performance

Software: Performance: Apple Silicon

lauka: Apple Silicon PMU recorder
- A minimal, predictable CLI to record Apple Silicon PMU counters and compare multiple commands.
- https://github.com/verte-zerg/lauka
- PMU Counters on Apple Silicon
  - 2026-01-07; Mikhail Zhuk
  - https://blog.bugsiki.dev/posts/apple-pmu/

Software: Performance: Benchmarking

LIKWID: Performance monitoring and benchmarking suite
- https://github.com/RRZE-HPC/likwid
- https://hpc.fau.de/research/tools/likwid/
Microbenchmarks for Cortex A53
- https://github.com/thomwiggers/microbenchmark-aarch64/
- Energy-Efficient ARM64 Cluster with Cryptanalytic Applications
- LATINCRYPT 2017; Thom Wiggers
- https://thomwiggers.nl/publication/armcluster/

Software: Performance: Cache

CacheFlow: a Linux kernel module that exposes the contents of the last-level cache on most Arm machines
- https://github.com/weirdindiankid/cacheflow
- Observing the Invisible: Live Cache Inspection for High-Performance Embedded Systems
  - IEEE Transactions on Computers 2021
  - Dharmesh Tarapore, Shahin Roozkhosh, Steven Brzozowski, Renato Mancuso
  - https://arxiv.org/abs/2007.12271
  - https://dx.doi.org/10.1109/TC.2021.3060650

Software: Performance: Events

HWCPipe: a simple and extensible interface for reading CPU and GPU hardware counters
- https://github.com/ARM-software/HWCPipe
Linux: ARMv8 PMU Performance Events
Machine-readable data: JSON descriptions of hardware performance events for Arm cores
- https://github.com/ARM-software/data
User-mode access to ARMv7 PMU cycle counters
- https://github.com/thoughtpolice/enable_arm_pmu
- User-mode performance counters for ARM/Linux
  - http://neocontra.blogspot.com/2013/05/user-mode-performance-counters-for.html
User-mode access to ARMv8 PMU cycle counters
- https://github.com/rdolbeau/enable_arm_pmu

Software: Performance: Libraries

Arm Optimized Routines
- Optimized implementations of various library functions for ARM architecture processors
- https://github.com/ARM-software/optimized-routines
Compute Library
- The ARM Computer Vision and Machine Learning library is a set of functions optimised for both ARM CPUs and GPUs using SIMD technologies.
- https://developer.arm.com/technologies/compute-library
- https://github.com/ARM-software/ComputeLibrary

Software: Performance: SIMD

SIMDe (SIMD Everywhere): Implementations of SIMD instruction sets for systems which don't natively support them
- The SIMDe header-only library provides fast, portable implementations of SIMD intrinsics on hardware which doesn't natively support them, such as calling SSE functions on ARM. There is no performance penalty if the hardware supports the native implementation (e.g., SSE/AVX runs at full speed on x86, NEON on ARM, etc.).
- https://github.com/simd-everywhere/simde
- https://github.com/simd-everywhere/simde#related-projects

Software: Performance: SIMD: Neon

Arm Neon reference tests
- Tests for Arm Neon instructions, useful for compilers and simulators.
- https://github.com/christophe-lyon/arm-neon-tests
AvxToNeon
- AVX intrinsics implemented with NEON SIMD intrinsics
- https://github.com/kunpengcompute/AvxToNeon
Ne10 Open Source Library
- Ne10 is a library of common, useful functions that have been heavily optimised for ARM-based CPUs equipped with NEON SIMD capabilities. It provides consistent, well-tested behaviour, allowing for painless integration into a wide variety of applications. The library currently focuses primarily around math, signal processing, image processing, and physics functions.
- http://projectne10.github.io/Ne10/
- https://github.com/projectNe10/Ne10
sse2neon: A C/C++ header file that converts Intel SSE intrinsics to Arm/Aarch64 Neon intrinsics
- https://github.com/DLTcollab/sse2neon
- https://github.com/DLTcollab/sse2neon#related-projects

Software: Performance: SIMD: SVE

Farm-SVE: A scalar C++ implementation of the ARM® Scalable Vector Extension (SVE)
- Naive/scalar implementation of the ARM C language extensions (ACLE) for the ARM Scalable Vector Extension (SVE) in standard C++.
- https://gitlab.inria.fr/bramas/farm-sve

Software: Virtualization

NOVA Microhypervisor
- http://hypervisor.org/
- https://github.com/udosteinberg/NOVA
- NOVA Microhypervisor on ARMv8-A
  - FOSDEM 2020; Udo Steinberg
  - https://fosdem.org/2020/schedule/event/uk_nova/

Talks

2019

Arm/AArch64 BoF
The Definitive Guide to Make Software Fail on ARM64
- SREcon19 Asia/Pacific
- Ignat Korchagin
- https://www.youtube.com/watch?v=B5pmy1OI7uo
- https://www.usenix.org/conference/srecon19asia/presentation/korchagin

2018

Arm/AArch64 BoF
- GNU Tools Cauldron 2018; Ramana Radhakrishnan & Richard Earnshaw
- https://www.youtube.com/watch?v=WEUPBc9QORE
Arm Architecture Enhancements in 2018
- Linaro Connect Vancouver 2018 (YVR18)
- https://connect.linaro.org/resources/yvr18/sessions/yvr18-104/
ARMaHYDAN - Misadventures of ARM instruction encodings
- CactusCon 2018
- https://www.youtube.com/watch?v=qEfWt2naCx4
- https://github.com/XlogicX/ARMaHYDAN
Introduction To Return Oriented Exploitation On ARM64
- BSidesMCR 2018; Billy Ellis
- https://www.youtube.com/watch?v=-_LGrrKv61c
The Path to Fast Data on Arm - Brian Brooks
- FD.io Mini-Summit: KubeCon + CloudNativeCon EU 2018
  - https://www.youtube.com/watch?v=n8Yl3Tw7XLg
- FD.io Mini Summit: Open Networking Summit North America 2018
Using perf On Arm platforms
- Linaro Connect Vancouver 2018 (YVR18)
- https://www.youtube.com/watch?v=xV4UHWLH_7Y
- https://connect.linaro.org/resources/yvr18/yvr18-416/

2017

A tour of the ARM architecture and its Linux support
- linux.conf.au 2017; Thomas Petazzoni
- https://www.youtube.com/watch?v=NNol7fRGo2E
ARM Assembly and Shellcode Basics
- 44CON 2017 Workshop; Saumil Shah
- https://www.youtube.com/watch?v=BhjJBuX0YCU
ARM Developer Systems/Tools – BUD17-508 - http://connect.linaro.org/resource/bud17/bud17-508/
DynInst on arm64 – Status – BUD17-323 - http://connect.linaro.org/resource/bud17/bud17-323/
Formal verification by the book: ISA Formal at ARM
- Formal Verification 2017; Will Keen (Senior Engineer, CPU Group), ARM
- https://www.youtube.com/watch?v=Z7-qkYOpu7I
- http://www.testandverification.com/wp-content/uploads/2017/Formal_Verification/Will_Keen%20_ARM.pdf
- http://www.testandverification.com/conferences/formal-verification-conference/fv2017/fv2017-formal-verification-book/
Hardware based tracing on ARM
- ZeroNights 2017; Ralf Philipp Weinmann
- https://www.youtube.com/watch?v=xX-B7tW7E_8
How can you trust formally verified software?
- 34th Chaos Communication Congress (34C3) 2017; Alastair Reid
- https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8915.html
- https://media.ccc.de/v/34c3-8915-how_can_you_trust_formally_verified_software
- Slides: https://fahrplan.events.ccc.de/congress/2017/Fahrplan/system/event_attachments/attachments/000/003/393/original/How_can_you_trust_formally_verified_software_-_34C3_27_December_2017.pdf
Introducing LLDB for linux on Arm and AArch64 – BUD17-310 - http://connect.linaro.org/resource/bud17/bud17-310/
MAMBO: A Low-Overhead Dynamic Binary Modification Tool for ARM
- PLDI 2017
- Amanieu d'Antras, Cosmin Gorgovan, Jim Garside, Mikel Lujan
- https://www.youtube.com/watch?v=FCf-DJ2m0FM
- https://pldi17.sigplan.org/event/pldi-2017-papers-low-overhead-dynamic-binary-translation-on-arm
- https://www.research.manchester.ac.uk/portal/files/56078084/pldi_16.pdf
- https://github.com/beehive-lab/mambo
Microarchitectural Attacks on Trusted Execution Environments
- 34th Chaos Communication Congress (34C3) 2017 - Keegan Ryan
- https://media.ccc.de/v/34c3-8950-microarchitectural_attacks_on_trusted_execution_environments
- https://www.youtube.com/watch?v=G8-3G_cep4M
Navigating the ABI for the ARM Architecture – BUD17-318 - http://connect.linaro.org/resource/bud17/bud17-318/
Towards Practical Tools for Side Channel Aware Software Engineering: 'Grey Box' Modelling for Instruction Leakages
- USENIX Security '17
- David McCann, Elisabeth Oswald, and Carolyn Whitnall
- https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/mccann
TrustZone is not enough: Hijacking debug components for embedded security
- 34th Chaos Communication Congress (34C3) 2017 - Pascal Cotret
- https://media.ccc.de/v/34c3-8831-trustzone_is_not_enough

2016

ARM Research
- SAMOS’16
- Eric Hennenhoefer
- http://samos-conference.com/Resources_Samos_Websites/Files_Repository_SAMOS/SAMOS_XVI_Keynote_Hennenhoefer.pdf
ARMv8-A Next Generation Vector Architecture for HPC
- Hot Chips 28 (2016)
- Nigel Stephens
- https://youtu.be/egE-VKoF4ZI?t=1h9m8s
- https://community.arm.com/cfs-file/__key/telligent-evolution-components-attachments/01-2142-00-00-00-01-20-49/ARMv8_2D00_A-SVE-technology-Hot-Chips-v12.pdf
Hardware Assisted Rootkits and Instrumentation ARM Edition
Hardware Assisted Tracing on ARM with CoreSight and OpenCSD
- Embedded Linux Conference 2016
  - https://www.youtube.com/watch?v=Gm2ZXIB18PQ
  - https://elinux.org/images/b/b3/Hardware_Assisted_Tracing_on_ARM.pdf
- Linaro Connect Las Vegas 2016 (LAS16)
  - http://connect.linaro.org/resource/las16/las16-210/
  - http://www.slideshare.net/linaroorg/las16210-hardware-assisted-tracing-on-arm-with-coresight-and-opencsd
Modelling the ARMv8 Architecture, Operationally: Concurrency and ISA
- POPL 2016
- https://www.youtube.com/watch?v=6QU37TwRO4w

2015

perf status on ARM and ARM64

2014

Cycle Accurate Profiling With Perf
- Embedded Linux Conference Europe 2014
- Pawel Moll, ARM
- https://www.elinux.org/File:Moll--cycle_accurate_profiling_with_perf.pdf
- http://elinux.org/images/d/d0/Moll--cycle_accurate_profiling_with_perf.pdf
Square Pegs in Round holes, or System Level Performance Data and perf
- Embedded Linux Conference Europe 2014
- Pawel Moll, ARM
- https://events.static.linuxfound.org/sites/events/files/slides/2014-10_square_pegs.pdf

2012

Advanced Software Exploitation on ARM Microprocessors
The AArch64 backend: status and plans
- 2012 LLVM Developers’ Meeting; Tim Northover
- https://llvm.org/devmtg/2012-11/Northover-AArch64.pdf
- https://www.youtube.com/watch?v=rvrHmrtZz-g

2011

ARMv8 Technology Preview
- ARM TechCon 2011
- Richard Grisenthwaite, ARM Lead Architect and Fellow
- https://www.youtube.com/playlist?list=PLB9C800D20A692D7C
- Part 1 of 4: https://www.youtube.com/watch?v=GBeEEfmJ3NI
- Part 2 of 4: https://www.youtube.com/watch?v=Vm02ZMSfdOc
- Part 3 of 4: https://www.youtube.com/watch?v=9ppbRPgzO_s
- Part 4 of 4: https://www.youtube.com/watch?v=YPGMwuDaN2k
- Slides:
  - http://aarch64.me/public/documents/cpu/arm/ARMv8_Techonology_Preview_Richard.pdf
  - http://web.archive.org/web/20180918053004/https://www.arm.com/files/downloads/ARMv8_Architecture.pdf

2010

Exploitation on ARM - Technique and Bypassing Defense Mechanisms

History

ARM inventor: Sophie Wilson
- 2015 Charbax
- ARM inventor (Part 1) - https://www.youtube.com/watch?v=jhwwrSaHdh8
- The first ARM processor in the world with Sophie Wilson (Part 2) - https://www.youtube.com/watch?v=re5xAqgKqc0
- ARM Instruction Set design history with Sophie Wilson (Part 3) - https://www.youtube.com/watch?v=QqxThgLTLyk
ARM microarchitect: Steve Furber
- 2016 Charbax
- https://www.youtube.com/watch?v=_VYxIaw1kBU
ARM Microprocessor Rise and Fall
- 2019 Talks at Google; Dave Jaggar
- https://www.youtube.com/watch?v=_6sh097Dk5k
ARM Processor Evolution
- Keynote I, Hot Chips 23 (2011); Simon Segars, ARM
- https://www.youtube.com/watch?v=ht2cDH2kcW8
ARM Processor - Sowing the Seeds of Success
- 2015 Computerphile; Steve Furber
- https://www.youtube.com/watch?v=1jOJl8gRPyQ
Clever solutions find inconvenient truths: A history of the ARM Architecture, and the lessons learned while building it
- Cambridge Science Festival 2016
- Richard Grisenthwaite, Lead Architect and Fellow, ARM
- https://soundcloud.com/university-of-cambridge/a-history-of-the-arm-architecture-and-the-lessons-learned-while-building-it
- https://sms.cam.ac.uk/media/2202336
- https://player.fm/series/cambridge-science-festival-2016/a-history-of-the-arm-architecture-and-the-lessons-learned-while-building-it
- Lessons from the ARM Architecture - Slides (2010): http://www.eit.lth.se/fileadmin/eit/courses/eitf20/ARM_RG.pdf
Historic ARM Presentation to Apple Computer (ARM 610 processor)
- 1992
- https://www.youtube.com/watch?v=ZV1NdS_w4As
The Future of Microprocessors, Sophie Wilson
- 2016 - Code Mesh - https://www.youtube.com/watch?v=_9mzmvhwMqw
- 2014 - Wuthering Bytes - https://www.youtube.com/watch?v=b5j_Y-ML3dg
The Ultimate Acorn Archimedes talk: Everything about the Archimedes computer (with zero 'Eureka!' jokes)
- 36th Chaos Communication Congress (2019); Matt Evans
- https://media.ccc.de/v/36c3-10703-the_ultimate_acorn_archimedes_talk
- https://www.youtube.com/watch?v=Hf67JYkUCHQ

Tutorials, Courses

ARM assembler in Raspberry Pi - http://thinkingeek.com/arm-assembler-raspberry-pi/
- 1. Introduction - http://thinkingeek.com/2013/01/09/arm-assembler-raspberry-pi-chapter-1/
- 2. Registers and basic arithmetic - http://thinkingeek.com/2013/01/10/arm-assembler-raspberry-pi-chapter-2/
- 3. Memory, addresses; load and store - http://thinkingeek.com/2013/01/11/arm-assembler-raspberry-pi-chapter-3/
- 4. GDB - http://thinkingeek.com/2013/01/12/arm-assembler-raspberry-pi-chapter-4/
- 5. Branches - http://thinkingeek.com/2013/01/19/arm-assembler-raspberry-pi-chapter-5/
- 6. Control structures - http://thinkingeek.com/2013/01/20/arm-assembler-raspberry-pi-chapter-6/
- 7. Indexing modes - http://thinkingeek.com/2013/01/26/arm-assembler-raspberry-pi-chapter-7/
- 8. Arrays and structures and more indexing modes - http://thinkingeek.com/2013/01/27/arm-assembler-raspberry-pi-chapter-8/
- 9. Functions (I) - http://thinkingeek.com/2013/02/02/arm-assembler-raspberry-pi-chapter-9/
- 10. Functions (II); the stack - http://thinkingeek.com/2013/02/07/arm-assembler-raspberry-pi-chapter-10/
- 11. Predication - http://thinkingeek.com/2013/03/16/arm-assembler-raspberry-pi-chapter-11/
- 12. Loops and the status register - http://thinkingeek.com/2013/03/28/arm-assembler-raspberry-pi-chapter-12/
- 13. Floating point numbers - http://thinkingeek.com/2013/05/12/arm-assembler-raspberry-pi-chapter-13/
- 14. Matrix multiply - http://thinkingeek.com/2013/05/12/arm-assembler-raspberry-pi-chapter-14/
- 15. Integer division - http://thinkingeek.com/2013/08/11/arm-assembler-raspberry-pi-chapter-15/
- 16. Switch control structure - http://thinkingeek.com/2013/08/23/arm-assembler-raspberry-pi-chapter-16/
- 17. Passing data to functions - http://thinkingeek.com/2013/11/20/arm-assembler-raspberry-pi-chapter-17/
- 18. Local data and the frame pointer - http://thinkingeek.com/2014/05/11/arm-assembler-raspberry-pi-chapter-18/
- 19. The operating system - http://thinkingeek.com/2014/05/24/arm-assembler-raspberry-pi-chapter-19/
- 20. Indirect calls - http://thinkingeek.com/2014/08/20/arm-assembler-raspberry-pi-chapter-20/
- 21. Subword data - http://thinkingeek.com/2014/08/23/arm-assembler-raspberry-pi-chapter-21/
- 22. The Thumb instruction set - http://thinkingeek.com/2014/12/20/arm-assembler-raspberry-pi-chapter-22/
- 23. Nested functions - http://thinkingeek.com/2015/01/02/arm-assembler-raspberry-pi-chapter-23/
- 24. Trampolines - http://thinkingeek.com/2015/01/09/arm-assembler-raspberry-pi-chapter-24/
- 25. Integer SIMD - http://thinkingeek.com/2015/07/04/arm-assembler-raspberry-pi-chapter-25/
- 26. A primer about linking - http://thinkingeek.com/2016/10/30/arm-assembler-raspberry-pi-chapter-26/
- 27. Dynamic linking - http://thinkingeek.com/2017/04/17/arm-assembler-raspberry-pi-chapter-27/
ARM Assembly Basics - Azeria Labs
- Part 1: Introduction to ARM Assembly Basics - https://azeria-labs.com/writing-arm-assembly-part-1/
- Part 2: Data Types - https://azeria-labs.com/arm-data-types-and-registers-part-2/
- Part 3: ARM & Thumb - https://azeria-labs.com/arm-instruction-set-part-3/
- Part 4: Memory Instructions: Load and Store - https://azeria-labs.com/memory-instructions-load-and-store-part-4/
- Part 5: Load/Store Multiple - https://azeria-labs.com/load-and-store-multiple-part-5/
- Part 6: Conditional Execution - https://azeria-labs.com/arm-conditional-execution-and-branching-part-6/
- Part 7: Stack and Functions - https://azeria-labs.com/functions-and-the-stack-part-7/
- Assembly Basics Cheatsheet: https://azeria-labs.com/assembly-basics-cheatsheet/
ARM Assembly Language - Isfahan University of Technology (Slides)
- http://www.googoolia.com/micro/lecture/arm_assembly.pdf
ARM Assembly Language Programming (AALP) - http://www.peter-cockerell.net/aalp/
ARM by David Thomas - http://www.davespace.co.uk/arm/
- Introduction to ARM - http://www.davespace.co.uk/arm/introduction-to-arm/
- Efficient C for ARM - http://www.davespace.co.uk/arm/efficient-c-for-arm/
ARM Challenges - "Root Me" Learning Platform - https://www.root-me.org/?page=recherche&lang=en&recherche=ARM
ARM exploitation for IoT
- Episode 1: Reversing ARM applications - https://web.archive.org/https://quequero.org/2017/07/arm-exploitation-iot-episode-1/
- Episode 2: ARM shellcoding - https://web.archive.org/https://quequero.org/2017/09/arm-exploitation-iot-episode-2/
- Episode 3: ARM exploitations - https://web.archive.org/https://quequero.org/2017/11/arm-exploitation-iot-episode-3/
ARM lectures by Dr. Santanu Chaudhury, EE Department, IIT Delhi - https://www.youtube.com/playlist?list=PL95AFA4ABA8B28627
EECS 370 - http://www.eecs.umich.edu/courses/eecs370/ - http://www.eecs.umich.edu/courses/eecs370/eecs370/resources/
- ARM Examples - https://www.eecs.umich.edu/courses/eecs370/eecs370.f20/resources/materials/370ARMExamples.pdf
- ARM Instruction Set Quick Reference Card - https://www.eecs.umich.edu/courses/eecs370/eecs370.f20/resources/materials/ARM_Instruction_Set.pdf
- ARM v8 Quick Reference Guide - http://www.eecs.umich.edu/courses/eecs370/eecs370.f20/resources/materials/ARM-v8-Quick-Reference-Guide.pdf
ELEC 5260/ELEC 6260-6266: Embedded Computing Systems
- http://www.eng.auburn.edu/~nelson/courses/elec5260_6260/
- ARM Assembly Language (Knaggs & Welsh - Bournemouth Univ.)
  - http://www.eng.auburn.edu/~nelson/courses/elec5260_6260/arm/ARM_AssyLang.pdf
- ARM processor architecture - http://www.eng.auburn.edu/~nelson/courses/elec5260_6260/slides/Chapter2%20ARM.pdf
Introducing ARM assembly language - http://www.toves.org/books/arm/
Introduction to ARM
- Gananand Kini's class on the ARM CPU assembly and architecture
- http://www.opensecuritytraining.info/IntroARM.html
- https://www.youtube.com/playlist?list=PLUFkSN0XLZ-n91t_AX5zO007Giz1INwPd
Understanding ARM Assembly - Marion Cole
- Part 1: Processor features - https://blogs.msdn.microsoft.com/ntdebugging/2013/11/22/understanding-arm-assembly-part-1/
- Part 2: How Windows uses the processor - https://blogs.msdn.microsoft.com/ntdebugging/2014/05/15/understanding-arm-assembly-part-2/
- Part 3: Calling conventions - https://blogs.msdn.microsoft.com/ntdebugging/2014/05/29/understanding-arm-assembly-part-3/
Whirlwind Tour of ARM Assembly - https://www.coranac.com/tonc/text/asm.htm
Windows on ARM - An assembly language primer - http://www.codemachine.com/article_armasm.html

AArch64

A Gentle Introduction to Assembly Language Programming
- A book teaching assembly language programming in the Arm 64-bit ISA
- "What makes this introduction "gentle" is that it assumes the reader is already comfortable with C or C++ coding. We use this assumed knowledge to bridge backward towards the low level ISA (Instruction Set Architecture)."
- https://github.com/pkivolowitz/asm_book
A Guide to ARM64 / AArch64 Assembly on Linux with Shellcodes and Cryptography
- https://modexp.wordpress.com/2018/10/30/arm64-assembly/
ARM AArch64 Assembly Language Lectures
- Princeton COS 217 (Spring 2020)
- https://www.cs.princeton.edu/courses/archive/spr20/cos217/schedule.html
- Assembly Language 1
  - https://www.youtube.com/watch?v=w--9Zm55C0o
  - https://www.cs.princeton.edu/courses/archive/spr20/cos217/lectures/13_Assembly1.pdf
- Assembly Language 2
  - https://www.youtube.com/watch?v=JDCPs-m-3Dw
  - https://www.cs.princeton.edu/courses/archive/spr20/cos217/lectures/14_Assembly2.pdf
- Assembly Language Functions
  - https://www.youtube.com/watch?v=HkGldSflDwM
  - https://www.cs.princeton.edu/courses/archive/spr20/cos217/lectures/15_AssemblyFunctions.pdf
- Machine Language Instructions
  - https://www.youtube.com/watch?v=guXTCGlL50A
  - https://www.cs.princeton.edu/courses/archive/spr20/cos217/lectures/17_MachineLang.pdf
- Assembler and Linker
  - https://www.youtube.com/watch?v=ZYV6pAhvX_M
  - https://www.cs.princeton.edu/courses/archive/spr20/cos217/lectures/17_MachineLang.pdf#page=37
arm64 assembly crash course - https://github.com/Siguza/ios-resources/blob/master/bits/arm64.md
Armv8-A Instruction Set Architecture (ISA)
- https://developer.arm.com/architectures/learn-the-architecture/armv8-a-instruction-set-architecture
Code in ARM Assembly - https://eclecticlight.co/tag/assembler/
- 1: Building an app to develop assembly routines, including an explanation of calling assembly language from Swift, with a complete Xcode project
  - https://eclecticlight.co/2021/06/07/code-in-assembly-for-apple-silicon-with-the-asmattic-app/
- 2: Registers explained
  - https://eclecticlight.co/2021/06/16/code-in-arm-assembly-registers-explained/
- 3: Working with pointers
  - https://eclecticlight.co/2021/06/21/code-in-arm-assembly-working-with-pointers/
- 4: Controlling flow
  - https://eclecticlight.co/2021/06/23/code-in-arm-assembly-controlling-flow/
- 5: Conditional loops
  - https://eclecticlight.co/2021/06/29/code-in-arm-assembly-conditional-loops/
- 6: Flow, pipelines and performance
  - https://eclecticlight.co/2021/07/06/code-in-arm-assembly-flow-pipelines-and-performance/
- 7: Moving data around
  - https://eclecticlight.co/2021/07/08/code-in-arm-assembly-moving-data-around/
- 8: Integer arithmetic
  - https://eclecticlight.co/2021/07/13/code-in-arm-assembly-integer-arithmetic/
- 9: Bit operations
  - https://eclecticlight.co/2021/07/16/code-in-arm-assembly-bit-operations/
- 10: Conditions without branches
  - https://eclecticlight.co/2021/07/20/code-in-arm-assembly-conditions-without-branches/
- 11: Floating point registers and conversions
  - https://eclecticlight.co/2021/07/23/code-in-arm-assembly-floating-point-registers-and-conversions/
- 12: Rounding and arithmetic
  - https://eclecticlight.co/2021/07/27/code-in-arm-assembly-rounding-and-arithmetic/
- 13: Accelerating the M1 Mac: an introduction to SIMD
  - https://eclecticlight.co/2021/08/06/accelerating-the-m1-mac-an-introduction-to-simd/
- 14: Lanes and loads in NEON
  - https://eclecticlight.co/2021/08/23/code-in-arm-assembly-lanes-and-loads-in-neon/
“csinc”, the AArch64 instruction you didn’t know you wanted
- https://danlark.org/2023/06/06/csinc-the-arm-instruction-you-didnt-know-you-wanted/
Exploring AArch64 assembler - https://thinkingeek.com/categories/aarch64/
- Chapter 1: first program - http://thinkingeek.com/2016/10/08/exploring-aarch64-assembler-chapter1/
- Chapter 2: register operands and immediate operands - http://thinkingeek.com/2016/10/08/exploring-aarch64-assembler-chapter-2/
- Chapter 3: more about register operands - http://thinkingeek.com/2016/10/23/exploring-aarch64-assembler-chapter-3/
- Chapter 4: arithmetic and bitwise instructions - http://thinkingeek.com/2016/10/23/exploring-aarch64-assembler-chapter-4/
- Chapter 5: memory - http://thinkingeek.com/2016/11/13/exploring-aarch64-assembler-chapter-5/
- Chapter 6: control flow - http://thinkingeek.com/2016/11/27/exploring-aarch64-assembler-chapter-6/
- Chapter 7: functions - http://thinkingeek.com/2017/03/19/exploring-aarch64-assembler-chapter-7/
- Chapter 8: the stack - http://thinkingeek.com/2017/05/29/exploring-aarch64-assembler-chapter-8/
- Chapter 9: control constructs - http://thinkingeek.com/2017/11/05/exploring-aarch64-assembler-chapter-9/
Introduction to ARMv8 64-bit Architecture - https://web.archive.org/https://quequero.org/2014/04/introduction-to-arm-architecture/
Passive Arm Assembly Skills for Debugging, Optimization (and Hacking)
- 2024-11-21 StockholmCpp 0x32
- Sebastian Theophil
- https://www.youtube.com/watch?v=uyIEg0HkWrQ
- https://www.think-cell.com/assets/think-cell_talk_arm.pdf
Programming with 64-Bit Arm Assembly Language
- 2020; Stephen Smith
- https://www.apress.com/us/book/9781484258804
- https://github.com/Apress/programming-with-64-bit-ARM-assembly-language
- HelloSilicon: third-party Apple Silicon version
  - Alexander von Below
  - https://github.com/below/HelloSilicon
  - Apple M1 Assembly Language Hello World
    - https://smist08.wordpress.com/2021/01/08/apple-m1-assembly-language-hello-world/
The AArch64 processor (aka arm64) - Raymond Chen
- 1: Introduction
  - https://devblogs.microsoft.com/oldnewthing/20220726-00/?p=106898
- 2: Extended register operations
  - https://devblogs.microsoft.com/oldnewthing/20220727-00/?p=106907
- 3: Addressing modes
  - https://devblogs.microsoft.com/oldnewthing/20220728-00/?p=106912
- 4: Addition and subtraction
  - https://devblogs.microsoft.com/oldnewthing/20220729-00/?p=106915
- 5: Multiplication and division
  - https://devblogs.microsoft.com/oldnewthing/20220801-00/?p=106922
- 6: Bitwise operations
  - https://devblogs.microsoft.com/oldnewthing/20220802-00/?p=106927
- 7: Bitfield manipulation
  - https://devblogs.microsoft.com/oldnewthing/20220803-00/?p=106941
- 8: Bit shifting and rotation
  - https://devblogs.microsoft.com/oldnewthing/20220804-00/?p=106945
- 9: Sign and zero extension
  - https://devblogs.microsoft.com/oldnewthing/20220805-00/?p=106948
- 10: Loading constants
  - https://devblogs.microsoft.com/oldnewthing/20220808-00/?p=106953
- 11: Loading addresses
  - https://devblogs.microsoft.com/oldnewthing/20220809-00/?p=106955
- 12: Memory access and alignment
  - https://devblogs.microsoft.com/oldnewthing/20220810-00/?p=106958
- 13: Atomic access
  - https://devblogs.microsoft.com/oldnewthing/20220811-00/?p=106963
- 14: Barriers
  - https://devblogs.microsoft.com/oldnewthing/20220812-00/?p=106968
- 15: Control transfer
  - https://devblogs.microsoft.com/oldnewthing/20220815-00/?p=106975
- 16: Conditional execution
  - https://devblogs.microsoft.com/oldnewthing/20220817-00/?p=106998
- 17: Manipulating flags
  - https://devblogs.microsoft.com/oldnewthing/20220818-00/?p=107005
- 18: Return address protection
  - https://devblogs.microsoft.com/oldnewthing/20220819-00/?p=107020
- 19: Miscellaneous instructions
  - https://devblogs.microsoft.com/oldnewthing/20220822-00/?p=107032
- 20: The classic calling convention
  - https://devblogs.microsoft.com/oldnewthing/20220823-00/?p=107041
- 21: Classic function prologues and epilogues
  - https://devblogs.microsoft.com/oldnewthing/20220824-00/?p=107043
- 22: Other kinds of classic prologues and epilogues
  - https://devblogs.microsoft.com/oldnewthing/20220825-00/?p=107050
- 23: Common patterns
  - https://devblogs.microsoft.com/oldnewthing/20220826-00/?p=107059
- 24: Code walkthrough
  - https://devblogs.microsoft.com/oldnewthing/20220829-00/?p=107066

Thumb-2

ARM-ASM-Tutorial - Thumb-2 (T32) - Niklas Gürtler
- https://www.mikrocontroller.net/articles/ARM-ASM-Tutorial
The ARM processor (Thumb-2) - Raymond Chen
- part 1: Introduction: https://devblogs.microsoft.com/oldnewthing/20210531-00/?p=105265
- part 2: Differences between classic ARM and Thumb-2: https://devblogs.microsoft.com/oldnewthing/20210601-00/?p=105267
- part 3: Addressing modes: https://devblogs.microsoft.com/oldnewthing/20210602-00/?p=105271
- part 4: Single-instruction constants: https://devblogs.microsoft.com/oldnewthing/20210603-00/?p=105276
- part 5: Arithmetic: https://devblogs.microsoft.com/oldnewthing/20210604-00/?p=105280
- part 6: The lie hiding inside the CMN instruction: https://devblogs.microsoft.com/oldnewthing/20210607-00/?p=105288
- part 7: Bitwise operations: https://devblogs.microsoft.com/oldnewthing/20210608-00/?p=105290
- part 8: Bit shifting and bitfield access: https://devblogs.microsoft.com/oldnewthing/20210609-00/?p=105293
- part 9: Sign and zero extension: https://devblogs.microsoft.com/oldnewthing/20210610-00/?p=105295
- part 10: Memory access and alignment: https://devblogs.microsoft.com/oldnewthing/20210611-00/?p=105299
- part 11: Atomic access and barriers: https://devblogs.microsoft.com/oldnewthing/20210614-00/?p=105307
- part 12: Control transfer: https://devblogs.microsoft.com/oldnewthing/20210615-00/?p=105311
- part 13: Trampolines: https://devblogs.microsoft.com/oldnewthing/20210616-00/?p=105314
- part 14: Manipulating flags: https://devblogs.microsoft.com/oldnewthing/20210617-00/?p=105317
- part 15: Miscellaneous instructions: https://devblogs.microsoft.com/oldnewthing/20210618-00/?p=105324
- part 16: The calling convention: https://devblogs.microsoft.com/oldnewthing/20210621-00/?p=105327
- part 17: Prologues and epilogues: https://devblogs.microsoft.com/oldnewthing/20210622-00/?p=105332
- part 18: Other kinds of prologues and epilogues: https://devblogs.microsoft.com/oldnewthing/20210623-00/?p=105351
- part 19: Common patterns: https://devblogs.microsoft.com/oldnewthing/20210624-46/?p=105355
- part 20: Code walkthrough: https://devblogs.microsoft.com/oldnewthing/20210625-00/?p=105369

File: assembly.riscv.md

[C++ links](README.md): RISC-V Assembly

Note: see Computer Architecture -- recommended background (which makes the following significantly more approachable) includes an undergraduate-level course.

RISC-V Foundation

Readings: Books, Security
Formalization, Specification, Verification
Open-Source Hardware Projects
References
Software: Binary Analysis, Emulation & Simulation, Performance, Security
Talks
Tutorials

Readings

https://riscv.org/publications/

A Bug-Free RISC-V Core without Simulation - https://tomverbeure.github.io/risc-v/2018/11/19/A-Bug-Free-RISC-V-Core-without-Simulation.html
A Highly Productive Implementation of an Out-of-Order Processor Generator
- 2018 PhD Thesis; Christopher Celio
- https://www2.eecs.berkeley.edu/Pubs/TechRpts/2018/EECS-2018-151.html
A Survey of the RISC-V Architecture Software Support
- IEEE Access 10 (2022)
- Benjamin W. Mezger, Douglas A. dos Santos, Luigi Dilillo, Cesar A. Zeferino, Douglas R. Melo
- https://dx.doi.org/10.1109/ACCESS.2022.3174125
An Agile Approach to Building RISC-V Microprocessors - https://people.eecs.berkeley.edu/~bora/Journals/2016/IEEEMicro16.pdf
CARRV: Workshop on Computer Architecture Research with RISC-V - https://carrv.github.io/
Design of the RISC-V Instruction Set Architecture - http://www.eecs.berkeley.edu/Pubs/TechRpts/2016/EECS-2016-1.html
GRVI Phalanx: A Massively Parallel RISC-V FPGA Accelerator Accelerator - https://arxiv.org/abs/1606.01037
How Genode came to RISC-V - https://genode.org/documentation/articles/riscv
Instruction Sets Should Be Free: The Case For RISC-V - https://www.eecs.berkeley.edu/Pubs/TechRpts/2014/EECS-2014-146.html
ISA Semantics for ARMv8-A, RISC-V, and CHERI-MIPS - https://alastairreid.github.io/papers/POPL_19/
Proprietary versus Open Instruction Sets - http://research.cs.wisc.edu/multifacet/papers/ieeemicro16_card_isa.pdf
RISC-V development plans - https://groups.google.com/a/groups.riscv.org/d/msg/isa-dev/sUQk6pFG0eA/AGNF44e4AAAJ
RISC-V Geneology - https://www.eecs.berkeley.edu/Pubs/TechRpts/2016/EECS-2016-6.html
RISC-V International Conference Proceedings - http://rise.cse.iitm.ac.in/ric2017/index.html#Proceedings
RISC-V Offers Simple, Modular ISA - https://riscv.org/2016/04/risc-v-offers-simple-modular-isa/
Surveying the Free and Open Source RISC-V Ecosystem – Embecosm
- https://www.embecosm.com/2018/05/07/surveying-the-free-and-open-source-risc-v-ecosystem/
The Adventures of OS: Making a RISC-V Operating System using Rust
- https://osblog.stephenmarz.com/
The Berkeley Out-of-Order Machine (BOOM): An Industry-Competitive, Synthesizable, Parameterized RISC-V Processor
- https://www.eecs.berkeley.edu/Pubs/TechRpts/2015/EECS-2015-167.html
- BOOM v2: an open-source out-of-order RISC-V core - https://www2.eecs.berkeley.edu/Pubs/TechRpts/2017/EECS-2017-157.html
The Case for Open Instruction Sets - http://www.linleygroup.com/mpr/article.php?id=11267
The Renewed Case for the Reduced Instruction Set Computer: Avoiding ISA Bloat with Macro-Op Fusion for RISC-V
- https://arxiv.org/abs/1607.02318
- https://www.eecs.berkeley.edu/Pubs/TechRpts/2016/EECS-2016-130.html
The VexRiscV CPU - A New Way to Design - https://tomverbeure.github.io/rtl/2018/12/06/The-VexRiscV-CPU-A-New-Way-To-Design.html

Readings: Performance

RISC-V Optimization Guide
- https://gitlab.com/riseproject/riscv-optimization-guide
Supporting RISC-V Performance Counters through Performance analysis tools for Linux (Perf)
- CARRV 2021
- Joao Mario Domingos, Pedro Tomas, Leonel Sousa
- https://arxiv.org/abs/2112.11767

Readings: Performance: Research

Icicle: Open-Source Hardware Support for Top-Down Microarchitectural Analysis on RISC-V
- IEEE International Symposium on Workload Characterization (IISWC) 2025
- Matthew Edwin Weingarten, Michael Grieco, Stephen A. Edwards, Tanvir Ahmed Khan
- https://doi.org/10.1109/IISWC66894.2025.00045
- https://www.cs.columbia.edu/~sedwards/papers/weingarten2025icicle.pdf
- https://github.com/ice-rlab/Icicle

Readings: Security

Return-Oriented Programming on RISC-V
- 2020 ACM Asia Conference on Computer and Communications Security (AsiaCCS)
- Georges-Axel Jaloyan, Konstantinos Markantonakis, Raja Naeem Akram, David Robin, Keith Mayes, David Naccache
- https://doi.org/10.1145/3320269.3384738

Books

https://riscv.org/risc-v-books/

"Computer Organization and Design: The Hardware Software Interface: RISC-V Edition" by David A. Patterson, John L. Hennessy (2017)
- http://store.elsevier.com/product.jsp?isbn=9780128122754
"The RISC-V Reader: An Open Architecture Atlas" by David Patterson, Andrew Waterman (2017)
- http://www.riscvbook.com/

Concurrency

The Semantics of Multicopy Atomic ARMv8 and RISC-V
- 2019 PhD dissertation; Christopher Pulte
- https://doi.org/10.17863/CAM.39379

Emulation & Simulation

Accelerate RISC-V Instruction Set Simulation by Tiered JIT Compilation
- VMIL 2024: ACM SIGPLAN International Workshop on Virtual Machines and Intermediate Languages
- Yen-Fu Chen, Meng-Hung Chen, Ching-Chun Huang, Chia-Heng Tu
- https://dl.acm.org/doi/10.1145/3689490.3690399
Practical and Efficient x86-64 Emulation on RISC-V
- European Conference on Computer Systems (EuroSys) 2026
- Xiongchuan Tan, Yang Liu, Sebastien Chevalier, Yangyu Chen, Xiaoyi Liu, Haohuan Fu
- https://doi.org/10.1145/3767295.3803574
- Box64: Linux Userspace x86_64 Emulator with a twist, targeted at ARM64, RV64 and LoongArch Linux devices
  - https://github.com/ptitSeb/box64
rv8: a high performance RISC-V to x86 binary translator
- First Workshop on Computer Architecture Research with RISC-V (CARRV) 2017
- Michael Clark, Bruce Hoult
- https://anarch128.org/~mclark/rv8-carrv.pdf
- https://carrv.github.io/2017/papers/clark-rv8-carrv2017.pdf
- https://carrv.github.io/2017/slides/clark-rv8-carrv2017-slides.pdf
Towards a High-Performance RISC-V Emulator
- WSCAD 2018
- Leandro Lupori, Vanderson Martins do Rosario, Edson Borin
- https://www.researchgate.net/publication/328314631_Towards_a_High-Performance_RISC-V_Emulator
- https://www.researchgate.net/profile/Vanderson_Rosario2/publication/328314631_Towards_a_High-Performance_RISC-V_Emulator/links/5bc5e1ec458515f7d9bf6342/Towards-a-High-Performance-RISC-V-Emulator.pdf

Instruction Set Architecture

RISC-V and Floating-Point
- https://fprox.substack.com/p/risc-v-and-floating-point
RISC-V Register Files
- https://fprox.blogspot.com/2022/10/risc-v-register-files.html
Adding custom instructions in the RISC-V ISA
- https://pcotret.gitlab.io/riscv-custom/
RISC-V Assembler Cheat Sheet
- https://projectf.io/posts/riscv-cheat-sheet/
RISC-V ISA online string decoder
- https://rv.drom.io/
- https://github.com/drom/rv
rvcodec.js: a RISC-V instruction encoder/decoder
- shows how each token of the assembly instruction is encoded as part of the binary representation
- https://gitlab.com/luplab/rvcodecjs/
- https://luplab.gitlab.io/rvcodecjs/

Instruction Set Architecture: Encoding

Basic Shellcode in RISC-V Linux
- Thomas Karpiniec
- https://thomask.sdf.org/blog/2018/08/25/basic-shellcode-in-riscv-linux.html
Emoji shellcoding in RISC-V
- IEEE Workshop on Offensive Technologies (WOOT) 2023
- Hadrien Barral, Georges-Axel Jaloyan, David Naccache
- https://wootconference.org/papers/woot23-paper5.pdf
- https://github.com/RischardV/emoji-shellcoding
RISC-V: #AlphanumericShellcoding
- USENIX Workshop on Offensive Technologies (WOOT) 2019; DEF CON 27 (2019)
- Hadrien Barral, Rémi Géraud-Stewart, Georges-Axel Jaloyan, David Naccache
- https://www.usenix.org/conference/woot19/presentation/barral
- https://xn--fda.fr/riscv-alphanumeric-shellcoding/defcon27_riscv-alphanumeric-shellcoding.pdf
- https://github.com/RischardV/riscv-alphanumeric-shellcoding
RISC-V Shellcoding Cheatsheet

Instruction Set Architecture: Extensions

RISC-V Compressed Instructions (part 2): Zc extensions
- https://fprox.blogspot.com/2022/12/riscv-compressed-zc-extensions.html

Instruction Set Architecture: Extensions: Bit Manipulation

RISC-V Scalar Bit Manipulation Extensions
- 2024-04-08
- Zba (address generation), Zbb (basic bit manipulation), Zbc (carry-less multiplication), Zbs (single-bit manipulation), Zbkb (bit manipulation for cryptography), Zbkc (carry-less for cryptography), Zbkx (crossbar permutations), B Standard Extension for Bit Manipulation Instructions (Zba, Zbb, Zbs)
- https://fprox.substack.com/p/risc-v-scalar-bit-manipulation-extensions

Instruction Set Architecture: Extensions: C Standard Extension for Compressed Instructions

RISC-V Compressed Instructions (part 1): C extension
- https://fprox.blogspot.com/2022/12/riscv-c-extension.html

Instruction Set Architecture: Extensions: Cryptography

RISC-V Cryptography Extensions Volume II: Vector Instructions:
Zvbb, Zvbc, Zvkb, Zvkg, Zvkn, Zvknc, Zvkned, Zvkng, Zvknha, Zvknhb, Zvks, Zvksc, Zvksed, Zvksg, Zvksh, Zvkt

RISC-V Vector Cryptography Extensions (1/2)
- 2023-02-11
- accelerating cryptography with RISC-V Vector: Introduction and ciphers
- https://fprox.substack.com/p/risc-v-vector-cryptography-extensions
RISC-V Vector Cryptography Extensions (2/2)
- 2023-02-19
- Hash, bitmanip and conclusion
- https://fprox.substack.com/p/risc-v-vector-cryptography-extension
RISC-V vector crypto spec freeze update
- 2023-06-24
- Revisiting vector crypto specification on its way to ratification
- https://fprox.substack.com/p/risc-v-vector-crypto-spec-freeze

Instruction Set Architecture: Extensions: Smcntrpmf: Cycle & Instret Privilege Mode Filtering Architecture Extension

RISC-V Smcntrpmf: mode filtering for Zicntr
- Accurate user-mode base event counting over privilege mode flow diversion
- 2023-08-10
- https://fprox.substack.com/p/risc-v-smcntrpmf-mode-filtering-for

Instruction Set Architecture: Extensions: V Vector Extension

riscv-v-spec: Working draft of the proposed RISC-V V vector extension
- https://github.com/riscv/riscv-v-spec
Programming with RISC-V Vector Instructions
- https://gms.tf/riscv-vector.html
RISC-V Vector benchmarks
- https://github.com/camel-cdr/rvv-bench
RISC-V Vector Extension in a Nutshell
- https://fprox.substack.com/p/risc-v-vector-in-a-nutshell
- Part 1: Introduction
  - https://fprox.blogspot.com/2022/07/risc-v-vector-extension-in-nutshell.html
- Part 2: Arithmetic and Logic Instructions
  - https://fprox.blogspot.com/2022/08/risc-v-vector-extension-in-nutshell.html
- Part 3: Masks
  - https://fprox.blogspot.com/2022/08/risc-v-vector-extension-in-a-nutshell-part-3.html
- Part 4: permute operations
  - https://fprox.blogspot.com/2022/08/isc-v-vector-extension-in-nutshell-part4.html
- Part 5.1: vector loads and stores: Simple, strided, and segmented memory operations
  - https://fprox.blogspot.com/2022/09/riscv-vector-extension-part5-1-load-store-memory.html
- Part 5.2: vector loads and stores: Indexed memory operations, whole register instructions, managing faults during vector memory operations
  - https://fprox.blogspot.com/2022/09/riscv-vector-extension-part5-2-load-store-memory.html
- How to read a RISC-V Vector assembly instruction
  - https://fprox.substack.com/p/how-to-read-risc-v-vector-assembly
- RISC-V Vector Register Groups
  - https://fprox.substack.com/p/risc-v-vector-register-groups
- RISC-V Vector Element Groups
  - https://fprox.substack.com/p/risc-v-vector-element-groups
RISC-V Vector Extension overview
- Wojciech Muła
- http://0x80.pl/notesen/2024-11-09-riscv-vector-extension.html
RISC-V Vector Programming in C with Intrinsics
- 2023-11-23
- https://fprox.substack.com/p/risc-v-vector-programming-in-c-with
RISC-V Vector Reduction Operations
- 2025-04-08
- https://fprox.substack.com/p/risc-v-vector-reduction-operations
RVV implementation of Keccak / SHA-3 (part 1)
- Leveraging RISC-V Vector to slow down SHA-3 software implementation
- 2023-12-31
- https://fprox.substack.com/p/rvv-implementation-of-keccak-sha
Tutorial: RISC-V Vector Extension Demystified
- 2020 RISC-V Summit
- Thang Tran
- https://www.youtube.com/watch?v=oTaOd8qr53U
Accelerating CRC with RISC-V Vector
- Zvbc(32e) for the win
- 2024-10-12
- https://fprox.substack.com/p/accelerating-crc-with-risc-v-vector
Accidental Dataflow Analysis: Extending the RISC-V VL Optimizer
- 2025 EuroLLVM Developers' Meeting
- Luke Lau, Michael Maitland
- https://www.youtube.com/watch?v=Mfb5fRSdJAc
- https://llvm.org/devmtg/2025-04/slides/technical_talk/lau_accidental_dataflow.pdf
Implementing Softmax using RISC-V Vector
- Quick and dirty method to implement a vectorized non-linear function using RVV
- 2024-02-12
- https://fprox.substack.com/p/implementing-softmax-using-risc-v
Quick Note: swapping pairs with RVV
- 2024-12-25
- https://fprox.substack.com/p/quick-note-swapping-pairs-with-rvv
Taxonomy of RISC-V Vector Extensions
- 2025-03-05
- https://fprox.substack.com/p/taxonomy-of-risc-v-vector-extensions
Transposing a Matrix using RISC-V Vector
- Survey of basic techniques to transform matrix layouts using RVV
- 2024-01-09
- https://fprox.substack.com/p/transposing-a-matrix-using-risc-v
Visualize RISC-V Vector Memory Instructions
- 2025-01-05
- Min-Yih Hsu
- https://myhsu.xyz/riscv-rvv-mem-visualize/
When LLVM scalable vector meets RISC-V: RVVBitsPerBlock
- 2024-10-05
- Min-Yih Hsu
- https://myhsu.xyz/llvm-riscv-bits-per-block/

Instruction Set Architecture: Extensions: "Zfa" Standard Extension for Additional Floating-Point Instructions

Zfa: even more floating-point operations
- 2023-05-24
- https://fprox.substack.com/p/zfa-even-more-floating-point-operations

Instruction Set Architecture: Extensions: "Zfbfmin, Zvfbfmin, Zvfbfwma" BF16 Extensions

RISC-V support for BFloat16
- Fast track extensions Zfbfmin, Zvfbfmin, Zvfbfwma
- 2023-09-04
- https://fprox.substack.com/p/bfloat16-support-in-risc-v

Instruction Set Architecture: Extensions: "Zfh" and "Zfhmin" Standard Extensions for Half-Precision Floating-Point

Support of half precision floating-point numbers in RISC-V ISA: Zfh and Zfhmin
- 2022-11-03
- https://fprox.substack.com/p/riscv-zfh-half-support

Instruction Set Architecture: Extensions: Zimop, Zcmop May-Be-Operations

Extension for placeholder instructions
- 2023-10-15
- https://fprox.substack.com/p/zimopzcmop-may-be-operations

Instruction Set Architecture: Profiles

RISC-V Profiles: Defining sets of extensions for coherent ecosystems
- 2023-03-22
- https://fprox.substack.com/p/risc-v-profiles
RVB profile: application class profile with options
- 2023-07-15
- https://fprox.substack.com/p/rvb-profile-application-class-profile
Sneak peek at RISC-V RVA23(U64) profile
- 2023-02-26
- https://fprox.substack.com/p/risc-v-profile-rva23u64

Simulation

Flexible Timing Simulation of RISC-V Processors with Sniper
- Computer Architecture Research with RISC-V (CARRV) 2018
- Neethu Bal Mallya, Cecilia Gonzalez-Alvarez, Trevor E. Carlson
- https://carrv.github.io/2018/papers/CARRV_2018_paper_7.pdf
High-performance RISC-V emulation
- 2019 Master's Thesis; Leandro Lupori
- http://repositorio.unicamp.br/handle/REPOSIP/334082?locale=en
- RISC-V Static Binary Translator (SBT)
  - https://github.com/OpenISA/riscv-sbt
Simulation of RISC-V based Systems in gem5
- 2018 Diploma Thesis (Dipl.-Ing.); Robert Schefel
- https://cfaed.tu-dresden.de/files/Images/people/chair-cc/theses/1808_Scheffel.pdf
Verifying Instruction Set Simulators using Coverage-guided Fuzzing
- Design, Automation & Test in Europe Conference & Exhibition (DATE) 2019
- Vladimir Herdt, Daniel Große, Hoang M. Le, Rolf Drechsler
- http://www.informatik.uni-bremen.de/agra/doc/konf/2019DATE_Verifying_Instruction_Set_Simulators_using_Coverage-guided_Fuzzing.pdf
- http://www.informatik.uni-bremen.de/agra/systemc-verification/riscv-vp.html

Formalization, Specification, Verification

End-to-End Formal Verification of a RISC-V Processor Extended with Capability Pointers
- FMCAD 2021
- Dapeng Gao, Tom Melham
- http://hdl.handle.net/20.500.12708/18622
- https://youtube.com/watch?v=u6XT3OCOIcc
- https://fmcad.org/FMCAD21/slides/end-to-end-verif.pdf
- Capability Hardware Enhanced RISC Instructions (CHERI)
  - https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
- CHERI-modified versions of the Flute processor
  - https://github.com/CTSRD-CHERI/Flute
Experimental_RISCV_Feature_Model
- An experimental DSL to describe the full feature list of a RISC-V implementation, along with constraints on features and between features
- https://github.com/rsnikhil/Experimental_RISCV_Feature_Model
FORCE-RISCV
- FORCE-RISCV is an instruction sequence generator (ISG) for the RISC-V instruction set architecture. It can be used to generate tests for design verification of RISC-V processors.
- https://github.com/openhwgroup/force-riscv
GRIFT: Galois RISC-V ISA Formal Tools
- https://github.com/GaloisInc/grift
ISA Semantics for ARMv8-A, RISC-V, and CHERI-MIPS
- POPL 2019
- Alasdair Armstrong, Thomas Bauereiss, Brian Campbell, Alastair Reid, Kathryn E. Gray, Robert M. Norton, Prashanth Mundkur, Mark Wassell, Jon French, Christopher Pulte, Shaked Flur, Ian Stark, Neel Krishnaswami, Peter Sewell
- https://www.cl.cam.ac.uk/~pes20/sail/
- http://www.cl.cam.ac.uk/users/pes20/sail/sail-popl2019.pdf
- talk; https://dl.acm.org/citation.cfm?doid=3302515.3290384&preflayout=flat#formats
KRISC-V: Semantics of RISC-V in K
- an executable formal semantics of the RISC-V ISA using the K framework
- unprivileged RV32E base ISA
- https://github.com/runtimeverification/riscv-semantics
L3 Specification of the RISC-V ISA - https://github.com/SRI-CSL/l3riscv
RISC-V Architectural Self Checking Tests
- https://github.com/tenstorrent/riscv_arch_tests
RISC-V Formal Verification Framework - https://github.com/cliffordwolf/riscv-formal
RISC-V ISA Formal Spec in BSV (Bluespec SystemVerilog) - https://github.com/rsnikhil/RISCV_ISA_Formal_Spec_in_BSV
RISC-V Litmus Tests
- RISC-V architecture concurrency model litmus tests
- https://github.com/litmus-tests/litmus-tests-riscv
RISC-V Sail ISA model
- https://github.com/rems-project/sail-riscv
- A Tour of the RISC-V ISA Formal Specification
  - https://github.com/rsnikhil/RISCV_ISA_Spec_Tour
riscv-avs: RISC-V Architecture Verification Suite (AVS)
- https://github.com/ispras/riscv-avs
- an open test suite for RISC-V microprocessors
- Each test is a program (in assembly or C) equipped with additional information: a test purpose description, an instruction describing how to generate a program (if applicable), a test coverage report, etc.
RISCV-DV: a SV/UVM based open-source instruction generator for RISC-V processor verification
- https://github.com/google/riscv-dv
riscv-fs: F# RISC-V Instruction Set formal specification
- https://github.com/mrLSD/riscv-fs
RISCV-ISA-Spec: Formal specification of RISC-V Instruction Set - https://github.com/rsnikhil/RISCV-ISA-Spec
riscv-coq: RISC-V Specification in Coq - https://github.com/mit-plv/riscv-coq
riscv-semantics: formal specification of the RISC-V ISA written in Haskell - https://github.com/mit-plv/riscv-semantics
RiscvSpecFormal: Formal Specification of RISC-V ISA in Kami
- https://github.com/sifive/RiscvSpecFormal
RMEM - relaxed-memory concurrency
- a tool for exploring the relaxed-memory concurrency for ARM, POWER, RISC-V, and x86
- help page: http://www.cl.cam.ac.uk/~sf502/regressions/rmem/help.html
- web interface: http://www.cl.cam.ac.uk/users/pes20/rmem/

Open-Source Hardware Projects

RISC-V Cores and SoC Overview - https://github.com/riscv/riscv-cores-list
Taxonomy of Open Source Processors - http://parallel.princeton.edu/openpiton/open_source_processors.php
A Comparative Survey of Open-Source Application-Class RISC-V Processor Implementations
- ACM International Conference on Computing Frontiers (CF) 2021
- Alexander Dörflinger, Mark Albers, Yejun Guan, Benedikt Kleinbeck, Harald Michalik, Raphael Klink, Chistopher Blochwitz, Anouar Nechi, Mladen Berekovic
- https://dl.acm.org/doi/10.1145/3457388.3458657

BlackParrot (SystemVerilog)
- Linux-capable cache-coherent, RV64GC multicore
- https://github.com/black-parrot
- BlackParrot: An Agile Open Source RISC-V Multicore for Accelerator SoCs
  - FOSDEM 2020; Dan Petrisko
  - https://fosdem.org/2020/schedule/event/riscv_blackparrot/
BOOM: The Berkeley Out-of-Order RISC-V Processor (Chisel)
- https://ccelio.github.io/riscv-boom-doc/
- https://github.com/ucb-bar/riscv-boom
- https://twitter.com/boom_cpu
core-v-wally: Configurable RISC-V Processor (SystemVerilog)
- https://github.com/openhwgroup/cvw
- Wally is a 5-stage pipelined processor configurable to support all the standard RISC-V options, incluidng RV32/64, A, C, F, D, and M extensions, FENCE.I, and the various privileged modes and CSRs. It is written in SystemVerilog. It passes the RISC-V Arch Tests and boots Linux on an FPGA.
CVA6 RISC-V CPU (SystemVerilog)
- application class, 6-stage, single issue, in-order CPU, implements the 64-bit RISC-V instruction set, capable of booting Linux
- https://github.com/openhwgroup/cva6
- https://docs.openhwgroup.org/projects/cva6-user-manual/
- https://pulp-platform.org/docs/Ariane_detailed.pdf
- Ara: A 64-bit Vector Unit, compatible with the RISC-V Vector Extension Version 1.0, working as a coprocessor to CORE-V's CVA6 core
  - https://github.com/pulp-platform/ara
  - Fast and Efficient Floating-Point Computation for RISC-V Architectures: A Hardware-Software Codesign Approach
    - 2025 PhD dissertation
    - Matteo Perotti
    - https://doi.org/10.3929/ethz-b-000731530
    - https://research-collection.ethz.ch/handle/20.500.11850/731530
  - Marian: Modified version of PULP Ara to support Vector Cryptography (Zvk) Instructions
    - https://github.com/soc-hub-fi/Marian
    - Development of the First Open-Source Implementation of the RISC-V Vector Cryptography Extension
      - RISC-V Summit North America 2024
      - Markku-Juhani O. Saarinen
      - https://www.youtube.com/watch?v=0H0aQO_Wxy8
- CVA6S+: A Superscalar RISC-V Core with High-Throughput Memory Architecture
  - RISC-V Summit Europe 2025
  - Riccardo Tedeschi, Gianmarco Ottavi, Côme Allart, Nils Wistoff, Zexin Fu, Filippo Grillotti, Fabio De Ambroggi, Elio Guidetti, Jean-Baptiste Rigaud, Olivier Potin, Jean Roch Coulon, César Fuguet, Luca Benini, Davide Rossi
  - https://arxiv.org/abs/2505.03762
  - https://www.youtube.com/watch?v=eU16AtP6Fng
DarkRISCV: open-source RISC-V CPU core implemented in Verilog from scratch in one night! (Verilog)
- https://github.com/darklife/darkriscv
Davis In-Order (DINO) CPU models (Chisel)
- A teaching-focused RISC-V CPU design used at UC Davis
- https://github.com/jlpteaching/dinocpu
- The Davis In-Order (DINO) CPU: A Teaching-focused RISC-V CPU Design
  - Workshop on Computer Architecture Education (WCAE) 2019
  - Jason Lowe-Power and Christopher Nitta
  - Paper: https://arch.cs.ucdavis.edu/assets/papers/wcae19-dinocpu.pdf
  - Slides: https://arch.cs.ucdavis.edu/assets/papers/wcae19-dinocpu-presentation.pdf
engine-V: SoftCPU/SoC engine-V (Verilog)
- https://github.com/micro-FPGA/engine-V
f32c - A 32-bit RISC-V / MIPS retargetable CPU core (VHDL)
- https://github.com/f32c/f32c
FemtoRV: a minimalistic RISC-V CPU (Verilog)
- Learning FPGA, yosys, nextpnr, and RISC-V
- FemtoRV is a minimalistic RISC-V design, with easy-to-read Verilog sources (less than 1000 lines), directly written from the RISC-V specification. It includes a companion SOC, with drivers for an UART, a led matrix, a small OLED display, SPI RAM and SDCard. Its most basic configuration fits on the Lattice IceStick (< 1280 LUTs). It can be used for teaching processor design and RISC-V programming.
- https://github.com/BrunoLevy/learn-fpga
FWRISC: a Featherweight RISC-V implementation of the RV32I instruction set
- https://github.com/mballance/fwrisc
- FWRISC: Sizing up the RISC-V Architecture
  - https://bitsbytesgates.blogspot.com/2018/12/fwrisc-sizing-up-risc-v-architecture.html
HammerBlade RISC-V Manycore (SystemVerilog)
- A programmable, scalable RISC-V fabric
- https://github.com/bespoke-silicon-group/bsg_bladerunner
- https://github.com/bespoke-silicon-group/bsg_manycore
- http://bjump.org/manycore/
- HammerBlade IR: https://capra.cs.cornell.edu/hbir/
- FOSDEM 2020; Michael Taylor
  - https://fosdem.org/2020/schedule/event/riscv_hammerblade/
Hazard3: 3-stage RV32IMACZb* processor with debug (Verilog)
- https://github.com/Wren6991/Hazard3
HL5: A 32-bit RISC-V Processor Designed with High-Level Synthesis (SystemC)
- https://github.com/sld-columbia/hl5
- Custom Integrated Circuits Conference (CICC) 2020
  - Paolo Mantovani, Robert Margelli, Davide Giri, Luca P. Carloni
  - https://sld.cs.columbia.edu/pubs/mantovani_cicc20.pdf
Ibex: a small 32 bit RISC-V CPU core (RV32IMC/EMC) with a 2-stage pipeline (SystemVerilog)
- https://github.com/lowRISC/ibex/
- https://www.lowrisc.org/blog/2019/06/an-update-on-ibex-our-microcontroller-class-cpu-core/
- How lowRISC made its Ibex RISC-V CPU core faster: Using open source tools to improve an open source core
  - FOSDEM 2020; Greg Chadwick
  - https://fosdem.org/2020/schedule/event/riscv_lowrisc/
Icicle: 32-bit RISC-V system on chip for iCE40 and ECP5 FPGAs (SystemVerilog)
- https://github.com/grahamedgecombe/icicle
lowRISC - creating a fully open-sourced, Linux-capable, RISC-V-based SoC (SystemVerilog)
- http://www.lowrisc.org/
- https://github.com/lowRISC/lowrisc-chip/
- https://twitter.com/lowRISC
mriscv: A 32-bit Microcontroller featuring a RISC-V core (Verilog)
- http://www.onchipuis.io/risc-v
- https://github.com/onchipuis/mriscv
- https://github.com/onchipuis/mriscvcore
- https://twitter.com/onchipUIS
NekoIchi: A simple RISC-V CPU & GPU running on an Arty A7-100T FPGA board (SystemVerilog)
- https://github.com/ecilasun/NekoIchi
- NekoIchi Tutorials: the articles for each part of the RISC-V CPU & GPU series
  - https://github.com/ecilasun/nekoichiarticle
NEORV32 Processor: A size-optimized, customizable full-scale 32-bit RISC-V soft-core CPU and SoC written in platform-independent VHDL
- https://github.com/stnolting/neorv32
ORCA - an implementation of RISC-V intended to target FPGAs (VHDL)
- https://github.com/VectorBlox/orca
PicoRV32 - A Size-Optimized RISC-V CPU (Verilog)
- https://github.com/cliffordwolf/picorv32
PULPino - 32-bit RISC-V microcontroller core (SystemVerilog)
- http://www.pulp-platform.org/
- https://github.com/pulp-platform/pulpino
- https://twitter.com/pulp_platform
PulseRain Reindeer: RISCV RV32I[M] Soft CPU (Verilog)
- https://github.com/PulseRain/Reindeer
RIDECORE (RIsc-v Dynamic Execution CORE) - Out-of-Order RISC-V processor (Verilog)
- https://github.com/ridecore/ridecore
RI5CY: RISC-V Core - PULP RI5CY core modified for Verilator modeling and as a GDB server (SystemVerilog)
- https://github.com/embecosm/ri5cy
- A dive into RI5CY core internals - https://www.embecosm.com/2019/08/13/a-dive-into-ri5cy-core-internals/
RISC-V VHDL: System-on-Chip (VHDL)
- VHDL implementation of the RISC-V System-on-Chip based on bare "Rocket Chip"
- http://sergeykhbr.github.io/riscv_vhdl/
- https://github.com/sergeykhbr/riscv_vhdl
riscv-simple-sv: A simple RISC V core for teaching (SystemVerilog)
- https://github.com/tilk/riscv-simple-sv
Riscy Processors - Open-Sourced RISC-V Processors (Bluespec System Verilog)
- https://github.com/csail-csg/riscy
Rocket Chip Generator (Chisel)
- https://github.com/ucb-bar/rocket-chip/
RPU: Basic RISC-V CPU implementation in VHDL
- https://github.com/Domipheus/RPU
- Designing a RISC-V CPU (TPU/RPU) in VHDL Series
  - http://labs.domipheus.com/blog/tpu-series-quick-links/
RSD: RISC-V Out-of-Order Superscalar Processor (SystemVerilog)
- https://github.com/rsd-devel/rsd
- An Open Source FPGA-Optimized Out-of-Order RISC-V Soft Processor
  - IEEE International Conference on Field-Programmable Technology (FPT) 2019
  - Susumu Mashimo, Akifumi Fujita, Reoma Matsuo, Seiya Akaki, Akifumi Fukuda, Toru Koizumi, Junichiro Kadomoto, Hidetsugu Irie, Masahiro Goshima, Koji Inoue, Ryota Shioya
  - http://sv.rsg.ci.i.u-tokyo.ac.jp/pdfs/Mashimo-FPT'19.pdf
RXV RISC-V soft core (SystemVerilog)
- https://github.com/jamieiles/rxv
- An RV32IMAZicsrZifencei core written in SystemVerilog offering good performance and synthesizable for a variety of FPGAs
- Additional standard extensions include: SSTC (supervisor timer compare), Sscofpmf (supervisor PMU + filter)
SCR1: an open-source RISC-V compatible MCU core (SystemVerilog)
- https://github.com/syntacore/scr1
SERV: The SErial RISC-V CPU (Verilog)
- https://github.com/olofk/serv
SHAKTI Processor Project (Bluespec System Verilog; generated Verilog)
- http://rise.cse.iitm.ac.in/shakti.html
- SHAKTI Tutorial at the VLSI Design Conference - http://www.slideshare.net/GSMadhusudan/shaktivlsidtutorial
- https://bitbucket.org/casl/shakti_public
SiFive's Freedom platforms RTL source files (Chisel)
- https://github.com/sifive/freedom
Sodor Processor Collection - educational microarchitectures (Chisel)
- https://github.com/ucb-bar/riscv-sodor
SweRV RISC-V core from Western Digital (SystemVerilog)
- https://github.com/westerndigitalcorporation/swerv_eh1
Taiga (SystemVerilog)
- 32-bit RISC-V processor designed for FPGAs supporting the Multiply/Divide and Atomic extensions (RV32IMA)
- https://gitlab.com/sfu-rcl/Taiga
- TAIGA: A new RISC-V soft-processor framework enabling high performance CPU architectural features
  - Field Programmable Logic and Applications (FPL) 2017
  - E. Matthews and L. Shannon
  - https://doi.org/10.23919/FPL.2017.8056766
  - https://carrv.github.io/2017/papers/matthews-taiga-carrv2017.pdf
VexRiscv: FPGA-friendly 32-bit RISC-V CPU implementation (SpinalHDL)
- https://github.com/SpinalHDL/VexRiscv
Vortex RISC-V GPGPU (SystemVerilog)
- A full-system RISC-V-based GPGPU processor
- RV32IMF
- https://github.com/vortexgpgpu/vortex
YARVI - Yet Another RISC-V Implementation (Verilog)
- https://github.com/tommythorn/yarvi
- https://www.cl.cam.ac.uk/teaching/1516/ECAD+Arch/exercise-yarvi.html

References

https://riscv.org/specifications/

A RISC-V ELF psABI Document - RISC-V calling convention - https://github.com/riscv/riscv-elf-psabi-doc
Calling Convention - http://riscv.org/wp-content/uploads/2015/01/riscv-calling.pdf
Documentation for RISC-V Spike - https://github.com/poweihuang17/Documentation_Spike
Intrinsics viewer
- https://dzaima.github.io/intrinsics-viewer/
- https://github.com/dzaima/intrinsics-viewer
Notes on RISC-V assembly - https://www.imperialviolet.org/2016/12/31/riscv.html
Reference Card - https://www.cl.cam.ac.uk/teaching/1617/ECAD+Arch/files/docs/RISCVGreenCardv8-20151013.pdf
RISC-V Assembly Programmer's Manual - https://github.com/riscv/riscv-asm-manual/blob/master/riscv-asm.md
riscv-calling-conv-model: work towards a "golden model" of the RISC-V calling convention(s) - https://github.com/lowRISC/riscv-calling-conv-model
RISC-V Instruction Set Manual - https://github.com/riscv/riscv-isa-manual
RISC-V Instruction Set Listing - https://github.com/michaeljclark/riscv-meta/blob/master/doc/pdf/riscv-instructions.pdf
RISC-V Instruction Types - https://github.com/michaeljclark/riscv-meta/blob/master/doc/pdf/riscv-types.pdf
RISC-V Instructions
- riscv-instr-encoding spreadsheet: a compact overview of the available instructions, their grouping, the encoding, etc.
- https://www.akkadia.org/drepper/risc-v-instructions.html
RISC-V ISA Manual — Docusaurus Site
- (Unofficial) RISC-V ISA Manual
- A searchable, navigable web rendition of the RISC-V ISA Manual
- https://riscv.houmus.org/
- https://github.com/damageboy/docusaurus-riscv-isa
RISC-V Reference Card: An unofficial reference sheet for RISC-V
- https://github.com/jameslzhu/riscv-card
- https://github.com/jameslzhu/riscv-card/blob/master/riscv-card.pdf
RISC-V Toolchain Conventions - https://github.com/lowRISC/riscv-toolchain-conventions
RISC-V Unified Database
- https://github.com/riscv-software-src/riscv-unified-db
- RISC-V ISA Manual
  - https://riscv-software-src.github.io/riscv-unified-db/manual/html/landing/
- RISC-V Specification for generic_rv64
  - https://riscv-software-src.github.io/riscv-unified-db/example_cfg/html/generic_rv64/landing.html
The Embedded RISC-V Project
- A complementary RISC-V specification intended for bare metal embedded applications
- https://emb-riscv.github.io/
- https://github.com/emb-riscv
- https://github.com/emb-riscv/specs-markdown
The RISC-V Compressed Instruction Set Manual - https://riscv.org/specifications/compressed-isa/
The RISC-V Instruction Set Manual, Volume I: User-Level ISA - https://riscv.org/specifications/
The RISC-V Instruction Set Manual Volume II: Privileged Architecture - https://riscv.org/specifications/privileged-isa/
Wikipedia: RISC-V - https://en.wikipedia.org/wiki/RISC-V

Software

https://riscv.org/software-tools/

Compiler Explorer with RISC-V support - https://cx.rv8.io/
Debian port - https://wiki.debian.org/RISC-V
RISC-V Disassembler: Single file RISC-V Disassembler with support for RV32/RV64/RV128 IMAFDC
- https://github.com/michaeljclark/riscv-disassembler
RISC-V Meta – a suite of tools that operate on RISC-V ISA - https://github.com/michaeljclark/riscv-meta/
RISC-V support for LLVM projects - http://www.lowrisc.org/llvm/status/ - https://github.com/lowRISC/riscv-llvm
RISC-V Torture Test Generator - https://github.com/ucb-bar/riscv-torture
Xv6 for RISC-V
- https://github.com/mit-pdos/xv6-riscv
- a re-implementation of Dennis Ritchie's and Ken Thompson's Unix Version 6 (v6)
- loosely follows the structure and style of v6, but is implemented for a modern RISC-V multiprocessor using ANSI C
- xv6-riscv-book: Text describing xv6 on RISC-V
  - https://github.com/mit-pdos/xv6-riscv-book
  - 6.S081: Operating System Engineering - https://pdos.csail.mit.edu/6.828/

Software: Binary Analysis

MAMBO: A Low-Overhead Dynamic Binary Modification Tool for RISC architectures
- supports Arm (both AArch32 and AArch64) and RISC-V (RV64GC)
- https://github.com/beehive-lab/mambo
- Evaluating the Impact of Optimizations for Dynamic Binary Modification on 64-bit RISC-V
  - 2023 IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS)
  - John Alistair Kressel, Guillermo Callaghan, Cosmin Gorgovan, Mikel Luján
  - https://research.manchester.ac.uk/en/publications/evaluating-the-impact-of-optimizations-for-dynamic-binary-modific

Software: Emulation & Simulation

Banshee: A Fast LLVM-Based RISC-V Binary Translator
- https://github.com/pulp-platform/snitch/tree/master/sw/banshee
- International Conference on Computer-Aided Design (ICCAD) 2021
  - Samuel Riedel, Fabian Schuiki, Paul Scheffler, Florian Zaruba, Luca Benini
  - https://pulp-platform.org/docs/Banshee_ICCAD_2021.pdf
  - https://www.research-collection.ethz.ch/handle/20.500.11850/517913
Berberis: Dynamic binary translator to run Android apps with riscv64 native code on x86_64 devices or emulators
- https://android.googlesource.com/platform/frameworks/libs/binary_translation
- Berberis: Dynamic Binary Translation from RISC-V to X86_64 on Android
  - RISC-V Summit North America 2024
  - Lev Rumyantsev & Jeremiah Griffin
  - https://www.youtube.com/watch?v=HjhzXZqjFrU
BRISC-V: an open-source, RISC-V based, full multicore, design space exploration platform
- https://ascslab.org/research/briscv/index.html
- BRISC-V Explorer (RTL) - http://ascslab.org/research/briscv/explorer/explorer.html
- BRISC-V Simulator (Assembly) - http://ascslab.org/research/briscv/simulator/simulator.html
- The BRISC-V Platform: A Practical Teaching Approach for Computer Architecture
  - Workshop on Computer Architecture Education (WCAE) 2019
  - Rashmi Agarwal, Sahan Bandara, Alan Ehret, Mihailo Isakov, Miguel Mark, Michel A. Kinsy
  - Paper: https://ascslab.org/research/briscv/wcae/a1-agrawal.pdf
  - Slides: https://drive.google.com/file/d/1j969LvF8yN8OBsq58schBLjSh6Lfjbba/view
Dromajo: Esperanto Technology's RISC-V Reference Model
- RISC-V RV64GC emulator designed for RTL co-simulation
- https://github.com/chipsalliance/dromajo
emulsiV: A visual simulator for teaching computer architecture using the RISC-V instruction set
- https://github.com/ESEO-Tech/emulsiV
- https://eseo-tech.github.io/emulsiV/
libriscv: RISC-V userspace emulator library
- https://github.com/fwsGonzo/libriscv
- C++17 RISC-V RV32GC userspace emulator library
MARSS-RISCV: Micro-Architectural System Simulator for RISC-V
- https://github.com/bucaps/marss-riscv
mini-rv32ima: A tiny C header-only RISC-V emulator
- https://github.com/cnlohr/mini-rv32ima
Pydrofoil: A fast RISC-V emulator based on the RISC-V Sail model
- https://github.com/pydrofoil/pydrofoil
- https://docs.pydrofoil.org/en/latest/
- Pydrofoil: A fast RISC-V emulator generated from the Sail model, using PyPy's JIT
  - 2022-12
  - https://www.youtube.com/watch?v=dUHWhUdXFJg
- Pydrofoil: Fast CPU emulators using PyPy's JIT and Sail
QtRVSim: RISC-V CPU Simulator for Education Purposes
- https://github.com/cvut/qtrvsim
- https://comparch.edu.cvut.cz/qtrvsim/app/
- QtRVSim – RISC-V Simulator for Computer Architectures Classes
  - DevConf.cz Mini 2022; Jakub Dupak
  - https://www.youtube.com/watch?v=l0jfvINWgK4
RARS: RISC-V Assembler and Runtime Simulator
- https://github.com/TheThirdOne/rars
Ripes: A graphical 5-stage RISC-V pipeline simulator & assembly editor
- https://github.com/mortbopet/Ripes
RISCVEmu Toy RISC-V emulator
- https://github.com/jdryg/RISCVEmu
riscvOVPsim: A Complete, Fully Functional, Configurable RISC-V Simulator
- https://github.com/riscv/riscv-ovpsim
rv32-sail - high-level emulator for RV32IM
- https://github.com/thoughtpolice/rv32-sail
- https://riscv.ls0f.pw/
rv32emu: RISC-V RV32I[MACF] emulator with ELF support
- https://github.com/sysprog21/rv32emu
rv8: RISC-V simulator for x86-64 - https://rv8.io/
- https://github.com/rv8-io/rv8
RVirt: RISC-V hypervisor written in Rust
- https://github.com/mit-pdos/RVirt
- an S-mode trap-and-emulate hypervisor for RISC-V
semu: A minimalist RISC-V emulator capable of running xv6
- https://github.com/jserv/semu
Spike, a RISC-V ISA Simulator
- https://github.com/riscv/riscv-isa-sim
- Adding a new RISC-V extension (to Spike)
  - 2023-04-14
  - https://fprox.substack.com/p/adding-a-new-risc-v-extension-to
TinyEMU
- https://bellard.org/tinyemu/
- TinyEMU is a system emulator for the RISC-V architecture. Its purpose is to be small and simple while being complete.
Venus: RISC-V instruction set simulator built for education
- https://venus.cs61c.org/
- https://github.com/hm-riscv/venus
- https://github.com/ThaumicMekanism/venus
- RISC-V Venus Simulator embedded in VS Code
  - https://github.com/hm-riscv/vscode-riscv-venus
  - https://marketplace.visualstudio.com/items?itemName=hm.riscv-venus
WebRISC-V: a Web-Based Education-Oriented RISC-V Pipeline Simulation Environment
- http://www.dii.unisi.it/~giorgi/WebRISC-V
- source code: http://www.dii.unisi.it/~giorgi/WebRISC-V/download
- Workshop on Computer Architecture Education (WCAE) 2019
- Roberto Giorgi and Gianfranco Mariotti
- Paper: http://www.dii.unisi.it/~giorgi/papers/Giorgi19-wcae.pdf
- Slides: http://www.dii.unisi.it/~giorgi/giorgi19-wcae_slides.pdf

Software: Performance

hpm_counters: A simple utility for doing RISC-V Hardware Performance Monitor (HPM) perf monitoring
- https://github.com/ccelio/riscv-hpmcounters
Olympia: a Performance Model written in C++ for the RISC-V community as an example of an Out-of-Order RISC-V CPU Performance Model
- https://github.com/riscv-software-src/riscv-perf-model
- RISC-V CPU Development Using Olympia Performance Model
  - RISC-V Summit North America 2024
  - Knute Lingaard
  - https://www.youtube.com/watch?v=Seu0FoXqkmw

Software: Security

Keystone: An Open Framework for Architecting Trusted Execution Environments
- https://keystone-enclave.org
- EuroSys 2020
  - Dayeol Lee, David Kohlbrenner, Shweta Shinde, Krste Asanovic, Dawn Song
  - https://dl.acm.org/doi/abs/10.1145/3342195.3387532
  - https://www.youtube.com/watch?v=S8MmKBCoPSg

Software: Translation

arm2riscv: Arm AArch64 to RISC-V Transpiler
- https://github.com/schorrm/arm2riscv
- https://github.com/schorrm/arm2riscv/tree/master/docs
rv32i_jit: A super simple RV32i JIT, designed for ease of understanding and modification
- x86 backend
- https://github.com/gamozolabs/rv32i_jit

Talks

Talks: 2024

How to Add a Calling Convention: RISC-V Vector as an Example
- 2024 LLVM Developers' Meeting
- Brandon Wu
- https://www.youtube.com/watch?v=6ZaiFA8eyHk
- https://llvm.org/devmtg/2024-10/slides/tutorial/Wu-Support-a-NewCallingConvention.pdf

Talks: 2020

Working with RISC-V: from open ISA to open Architecture to open Hardware
- HiPEAC ACACES Summer School 2020
- Luca Benini, Frank K. Gürkaynak
- session 1: https://www.youtube.com/watch?v=RklEOl3xAdQ
- session 2: https://www.youtube.com/watch?v=Ipy71G8eSWY
- slides:

Talks: 2019

The Hype Around the RISC-V Hypervisor
- KVM Forum 2019; Alistair Francis, Anup Patel
- https://www.youtube.com/watch?v=2MUka4lKGFU

Talks: 2018

LLVM backend development by example (RISC-V)
- 2018 LLVM Developers’ Meeting; Alex Bradbury
- https://www.youtube.com/watch?v=AFaIP-dF-RA
- https://speakerdeck.com/asb/llvm-backend-development-by-example-risc-v
- RISC-V LLVM Coding Lab at the LLVM Developers' Meeting 2018
  - https://www.lowrisc.org/llvm/devmtg18/
  - https://github.com/lowRISC/lowrisc-site/blob/master/content/llvm/devmtg18.md
- RISC-V LLVM: a series of patches implementing a RISC-V backend for LLVM as well as initial tutorial material.
  - https://github.com/lowRISC/riscv-llvm

Talks: 2017

End-to-end formal ISA verification of RISC-V processors with riscv-formal
- 34C3 (2017), Clifford Wolf
- https://www.youtube.com/watch?v=VU97ffHF_IQ
- https://media.ccc.de/v/34c3-8768-end-to-end_formal_isa_verification_of_risc-v_processors_with_riscv-formal

Tutorials

Adding a new RISC-V instruction (to LLVM)
- Extending the LLVM compiler to assemble new RISC-V instructions
- 2023-05-05
- https://fprox.substack.com/p/adding-a-new-risc-v-instruction-to
"All Aboard" Blog Series
- Part 0: Introduction: Part 0: Introduction - https://www.sifive.com/blog/2017/08/07/all-aboard-part-0-introduction/
- Part 1: The -march, -mabi, and -mtune arguments to RISC-V Compilers - https://www.sifive.com/blog/2017/08/14/all-aboard-part-1-compiler-args/
- Part 2: Relocations in ELF Toolchains - https://www.sifive.com/blog/2017/08/21/all-aboard-part-2-relocations/
- Part 3: Linker Relaxation in the RISC-V Toolchain - https://www.sifive.com/blog/2017/08/28/all-aboard-part-3-linker-relaxation-in-riscv-toolchain/
- Part 4: The RISC-V Code Models - https://www.sifive.com/blog/2017/09/11/all-aboard-part-4-risc-v-code-models/
- Part 5: Per-march and per-mabi Library Paths on RISC-V Systems - https://www.sifive.com/blog/2017/09/18/all-aboard-part-5-risc-v-multilib/
- Part 6: Booting a RISC-V Linux Kernel - https://www.sifive.com/blog/2017/10/09/all-aboard-part-6-booting-a-risc-v-linux-kernel/
- Part 7: Entering and Exiting the Linux Kernel on RISC-V - https://www.sifive.com/blog/2017/10/23/all-aboard-part-7-entering-and-exiting-the-linux-kernel-on-risc-v/
- Part 8: The RISC-V Linux Port is Upstream! - https://www.sifive.com/blog/2017/12/05/all-aboard-part-8-the-risc-v-linux-port-is-upstream/
- Part 9: Paging and the MMU in the RISC-V Linux Kernel - https://www.sifive.com/blog/2017/12/11/all-aboard-part-9-paging-and-mmu-in-risc-v-linux-kernel/
- Part 10: How to Contribute to the RISC-V Software Ecosystem - https://www.sifive.com/blog/2018/02/20/all-aboard-part-10-how-to-contribute-to-the-risc-v-software-ecosystem/
Building upstream RISC-V GCC+binutils+newlib: the quick and dirty way - http://www.lowrisc.org/blog/2017/09/building-upstream-risc-v-gccbinutilsnewlib-the-quick-and-dirty-way/
Easy RISC-V: An interactive introduction to RISC-V assembly programming
- https://dramforever.github.io/easyriscv/
- https://github.com/dramforever/easyriscv
LMARV-1 (Learn Me A RISC-V, level 1)
RISC-V 101 Webinar - https://info.sifive.com/risc-v-webinar
RISC-V ASM Tutorial Collection - Western Digital
- https://www.youtube.com/playlist?list=PL6noQ0vZDAdh_aGvqKvxd0brXImHXMuLY
RISC-V Assembler - Will Green
- https://projectf.io/tags/asm/
- Arithmetic
  - https://projectf.io/posts/riscv-arithmetic/
- Logical
  - https://projectf.io/posts/riscv-logical/
- Shift
  - https://projectf.io/posts/riscv-shift/
- Load Store
  - https://projectf.io/posts/riscv-load-store/
- Branch Set
  - https://projectf.io/posts/riscv-branch-set/
- Jump and Function
  - https://projectf.io/posts/riscv-jump-function/
- Multiply Divide
  - https://projectf.io/posts/riscv-multiply-divide/
RISC-V Assembly Language Programming
- John Winans
- https://github.com/johnwinans/rvalp
- CSCI 463: Computer Architecture and Systems Organization
  - Spring 2020; John Winans
  - https://www.youtube.com/playlist?list=PL3by7evD3F50uclXhrmlwoWQicSDTy8yT
  - http://faculty.cs.niu.edu/~winans/CS463/
RISC-V Assembly Language Programming: Unlock the Power of the RISC-V Instruction Set
- 2024; Stephen Smith
- https://smist08.wordpress.com/2024/02/16/risc-v-assembly-language-programming/
- Source code
  - https://github.com/Apress/RISC-V-Assembly-Language-Programming
  - https://github.com/smist09/riscv-assembly-language
RISC-V Bytes - https://danielmangum.com/categories/risc-v-bytes/
- Cross-Platform Debugging with QEMU and GDB - https://danielmangum.com/posts/risc-v-bytes-qemu-gdb/
- Caller and Callee Saved Registers - https://danielmangum.com/posts/risc-v-bytes-caller-callee-registers/
- Passing on the Stack - https://danielmangum.com/posts/risc-v-bytes-passing-on-the-stack/
- Introduction to Instruction Formats - https://danielmangum.com/posts/risc-v-bytes-intro-instruction-formats/
- Privilege Levels - https://danielmangum.com/posts/risc-v-bytes-privilege-levels/
RISC-V Educational Materials
- https://riscv.org/educational-materials/
- https://github.com/riscv/educational-materials
RISC-V from scratch
- 1: Introduction, toolchain setup, and hello world! - https://twilco.github.io/riscv-from-scratch/2019/03/10/riscv-from-scratch-1.html
- 2: Hardware layouts, linker scripts, and C runtimes - https://twilco.github.io/riscv-from-scratch/2019/04/27/riscv-from-scratch-2.html
- 3: Writing a UART driver in assembly (1 / 3) - https://twilco.github.io/riscv-from-scratch/2019/07/08/riscv-from-scratch-3.html
- 4: Creating a function prologue for our UART driver (2 / 3) - https://twilco.github.io/riscv-from-scratch/2019/07/28/riscv-from-scratch-4.html
RISC-V Presentation at ESC Boston 2016 - https://riscv.org/2016/04/risc-v-presentation-esc-boston/
RISC-V QEMU
- Part 1: Privileged ISA v1.10, HiFive1 and VirtIO - https://www.sifive.com/blog/2017/12/20/risc-v-qemu-part-1-privileged-isa-hifive1-virtio/
- Adding RISC-V Vector Cryptography Extension support to QEMU
  - https://www.codethink.co.uk/articles/2023/vcrypto_qemu/
RISC-V Tutorial at HPCA 2015 - https://riscv.org/2015/02/risc-v-tutorial-hpca-2015/
Understanding Assembly Part I: RISC-V
- https://mcyoung.xyz/2021/11/29/assembly-1/

File: README.md Copy Chapter

C++ links

Categories Copy Chapter

About Copy Chapter

File: analysis.dynamic.md Copy Chapter

[C++ links](README.md): Program Analysis - Dynamic

Contents

Dynamic Binary Instrumentation (DBI)

Dynamic Binary Instrumentation (DBI): Readings Copy Chapter

Dynamic Binary Instrumentation (DBI): Software Copy Chapter

Dynamic Binary Translation (DBT)

Readings

Software

Software: Compilers Copy Chapter

Software: Frida Copy Chapter

Software: Memory Forensics Copy Chapter

Software: Pin Copy Chapter

Software: Pin: Readings Copy Section

Software: Pin: Projects Copy Section

Software: Sanitizers Copy Chapter

Software: Sanitizers: Readings Copy Section

Software: Sanitizers: Readings: Research

Software: Sanitizers: Readings: Research: 2026

Software: Sanitizers: Readings: Research: 2025

Software: Sanitizers: Readings: Research: 2024

Software: Sanitizers: Readings: Research: 2023

Software: Sanitizers: Readings: Research: 2022

Software: Sanitizers: Readings: Research: 2021

Software: Sanitizers: Readings: Research: 2020

Software: Sanitizers: Readings: Research: 2018

Software: Sanitizers: Readings: Research: 2017

Software: Sanitizers: Readings: Research: 2016

Software: Sanitizers: Projects Copy Section

Software: Sanitizers: Talks Copy Section

Software: Valgrind Copy Chapter

File: analysis.static.md Copy Chapter

[C++ links](README.md): Program Analysis - Static

Contents

Readings

Readings: Books Copy Chapter

Readings: Implementation Copy Chapter

Readings: Research Copy Chapter

Readings: Research: Correctness Copy Chapter

Readings: Research: Usability Copy Chapter

Benchmarking

Software

Software: Compilers Copy Chapter

Software: Indexing Copy Chapter

Verification

Verification: Software Copy Chapter

Talks

Talks: 2021 Copy Chapter

File: assembly.arm.md Copy Chapter

[C++ links](README.md): ARM and AArch64 Assembly

Contents

Readings

Readings: Binary Analysis Copy Chapter

Readings: Binary Analysis: 2023 Copy Section

Readings: Binary Analysis: 2014-2022 Copy Section

Readings: Concurrency Copy Chapter

Readings: Emulation Copy Chapter

Formalization, Specification, Verification Copy Chapter

Instruction Set Architecture Copy Chapter

Encoding, Shellcode Copy Section

A-profile Copy Section

M-profile Copy Section

Performance Copy Chapter

Performance: Numerics Copy Section

Performance: Statistical Profiling Extension (SPE) Copy Section

Security Copy Chapter

Security: 2023 Copy Section

Security: Arm Confidential Compute Architecture (CCA) Copy Section

Security: Debugging Copy Section

Memory Tagging Extension (MTE) Copy Section

Memory Tagging Extension (MTE): 2026

Memory Tagging Extension (MTE): 2025

Memory Tagging Extension (MTE): 2018-2024

Pointer Authentication (PAC) Copy Section

Pointer Authentication (PAC): 2024

Pointer Authentication (PAC): 2023

File: README.md

Categories

About

File: analysis.dynamic.md

Dynamic Binary Instrumentation (DBI): Readings

Dynamic Binary Instrumentation (DBI): Software

Software: Compilers

Software: Frida

Software: Memory Forensics

Software: Pin

Software: Pin: Readings

Software: Pin: Projects

Software: Sanitizers

Software: Sanitizers: Readings

Software: Sanitizers: Projects

Software: Sanitizers: Talks

Software: Valgrind

File: analysis.static.md

Readings: Books

Readings: Implementation

Readings: Research

Readings: Research: Correctness

Readings: Research: Usability

Software: Compilers

Software: Indexing

Verification: Software

Talks: 2021

File: assembly.arm.md

Readings: Binary Analysis

Readings: Binary Analysis: 2023

Readings: Binary Analysis: 2014-2022

Readings: Concurrency

Readings: Emulation

Formalization, Specification, Verification

Instruction Set Architecture

Encoding, Shellcode

A-profile

M-profile

Performance

Performance: Numerics

Performance: Statistical Profiling Extension (SPE)

Security

Security: 2023

Security: Arm Confidential Compute Architecture (CCA)

Security: Debugging

Memory Tagging Extension (MTE)

Pointer Authentication (PAC)

TrustZone

Simulation

Virtualization

References: Application Binary Interface (ABI)

References: Microarchitecture

References: Microarchitecture: Apple

References: Microarchitecture: Arm

References: Microarchitecture: Fujitsu

References: Microarchitecture: NVIDIA

References: OS

Intrinsics & SIMD

Neon

Scalable Matrix Extension (SME)

Scalable Vector Extension (SVE)

References: Toolchains

Software: Assembly

Software: Binary Analysis

Software: Concurrency

Software: Debugging, Tracing

Software: Emulation, Simulation

Software: Emulation, Simulation: x86, x86-64

Software: Lifting

Software: Performance

Software: Performance: Apple Silicon

Software: Performance: Benchmarking

Software: Performance: Cache

Software: Performance: Events

Software: Performance: Libraries

Software: Performance: SIMD

Software: Virtualization

2019

2018

2017