InstrSem: Automatically and Generically Inferring Semantics of (Undocumented) CPU Instructions | RootsecSkip to main content<br>Skip to navigation<br>InstrSem: Automatically and Generically Inferring Semantics of (Undocumented) CPU Instructions<br>Lorenz Hetterich, Fabian Thomas, Tristan Hornetz, Michael Schwarz<br>USENIX Security<br>Baltimore, Maryland, USA, August 12-14, 2026<br>PDF<br>CITE
Abstract<br>Modern CPUs implement complex Instruction Set Architectures (ISAs), yet machine-readable semantics are often incomplete.<br>Worse, many CPUs support undocumented instructions, i.e., bitstrings that execute on hardware but are absent from specifications, leading to potential security vulnerabilities.<br>In this paper, we present InstrSem, an ISA-agnostic, modular, fully automated approach to infer instruction semantics from execution behavior alone and provide semantics that are understandable by both, humans and machines.<br>Starting from a raw encoding, InstrSem executes it under systematically varied architectural states and synthesizes compact mathematical functions that explain every changed state component.<br>By mutating encoding bits and correlating induced behavioral changes with bit positions, InstrSem then generalizes from a single encoding to a full instruction, recovering register and immediate fields.<br>In contrast to prior work focusing on a single ISA, InstrSem is generic.<br>It requires only a lightweight ISA model and a per-architecture user-space runner and supports fixed- and variable-length encodings (RISC and CISC), memory accesses, and conditional behavior.<br>We evaluate InstrSem on RV64I, AArch64, and LA64, and additionally showcase CISC applicability on a Logitech macro language and partial x86-64.<br>InstrSem automatically recovers correct semantics for over 97.81% of the RV64I base instruction set, and 136 instructions covering 1009055744 instruction encodings within 77 hours for the LA64 instruction set.<br>InstrSem discovers undocumented vector instructions, inconsistencies between QEMU and Loongson hardware, and instructions that crash QEMU.<br>InstrSem enables scalable recovery of instruction semantics, substantially automating reverse engineering across commodity and niche targets and strengthening the foundations for emulation, verification, and security analysis.<br>With minimal requirements to support new architectures, its modular design, and human-readable output, InstrSem can aid future security analysis.
BibTeX Citation
@inproceedings{hetterich2026instrsem,<br>title={InstrSem: Automatically and Generically Inferring Semantics of (Undocumented) CPU Instructions},<br>booktitle={USENIX Security},<br>author={Lorenz Hetterich and Fabian Thomas and Tristan Hornetz and Michael Schwarz},<br>year={2026}<br>Copy