Sem86: a full-system x86 emulator without hardcoded semantics

Sem86 is a full-system x86 emulator that operates without pre-determined instruction semantics. Instead, it retrieves instruction semantics from an input file during runtime, allowing for easy switching between different semantics to accurately emulate undefined behavior and undocumented instructions. Despite not having hardcoded semantics that compilers can optimize at compile-time and utilizing LLVM rather than a bespoke performance-optimized JIT, Sem86 maintains impressive speed, being 1.9 times faster than Bochs and achieving approximately 42% of QEMU's performance.

The ultimate objective for Sem86 is to employ automatically inferred semantics derived from libLISA, which would enable CPU cloning. This would involve analyzing a CPU, extracting its semantics, and initiating an emulator that emulates that precise CPU accurately. Currently, Sem86 utilizes manually coded instruction semantics due to libLISA's lack of CPU observers for 16-bit and 32-bit x86, thus lacking inferred semantics.

However, given that the semantics format utilized by Sem86 is very similar to libLISA's, transitioning to automatically inferred semantics would not necessitate significant modifications.

Emulation can prove beneficial in analyzing malware within a sandboxed environment, although there is no single instruction semantics universally applicable due to x86's allowance for undefined behavior. Malware can exploit differences in implementations of undefined behavior to discern whether it is operating within a sandboxed environment.

Sem86 simplifies the emulation of specific undefined behavior and facilitates switching between varying behaviors. Additionally, Sem86 can alter semantics in the middle of execution, enabling the dissection of instruction execution to ascertain the precise point where different semantics diverge. This capability was demonstrated using a toy malware example designed to exploit undefined instruction behavior for detecting its presence within an emulator. Sem86 can dissect the execution of this malware, pinpointing the exact instruction utilized.

Sem86 encompasses all hardware necessary to boot Windows and Linux operating systems compatible with Pentium 5 era hardware. It supports Windows 3.1, Windows 98, Windows XP, Windows 7, and Debian 8. Furthermore, several optional hardware components are implemented, including an ES1370 card for audio, high-resolution video output via VBE, and an NE2k network card for internet access.

Although Windows 7 runs on Sem86, the NE2k networking card lacks a Windows 7 driver; a more recent networking card would need to be developed to ensure compatibility. Furthermore, as no GPU is implemented, Aero effects and transparency are not supported. Sem86 is also functional on Android phones; a demonstration showcases Windows 7 on an Android device.

However, due to the LLVM JIT backend's potential memory usage during compilation, which can lead to emulator crashes on phones with limited RAM (8 GiB), older operating systems such as Windows 98 and XP tend to perform better on Sem86. Games compatible with Windows 98, such as Rollercoaster Tycoon, often run efficiently. Moreover, Internet Explorer can be utilized for browsing the internet.

Nonetheless, many contemporary websites often fail to function correctly due to their reliance on unsupported HTTPS encryption methods. On Windows XP, the latest supported version of Firefox operates and can access websites, including HTTPS sites; however, modern sites typically prove too resource-intensive for early-2000s CPUs.