Vulnerability Detection in AArch64 Machine Code Using a Digital Twin
2026-08-03 • Cryptography and Security
Cryptography and SecurityProgramming LanguagesSoftware Engineering
AI summaryⓘ
The authors created a digital twin, which is like a detailed copy of how a program runs at the machine code level, to find security problems without needing the original source code. Their method tracks each instruction's effects on the computer's state and uses special rules to spot risky patterns that could cause bugs or crashes. These rules are turned into simple machines that scan the program's behavior quickly and explain exactly where and why a vulnerability was found. When tested, their system successfully identified different types of common software vulnerabilities and gave clear explanations for each detection.
digital twinAArch64machine codevulnerability detectionKleene algebrafinite automatainteger overflownull pointer dereferenceheap buffer overflowconcrete execution
Authors
Oleksandr Mostovyi, Denys Symonov
Abstract
This paper proposes an explainable digital twin for vulnerability detection in AArch64 machine code without access to source code. The digital twin reproduces the concrete execution of a program and preserves the state of registers, processor flags, memory, and live allocated blocks. Each instruction is transformed into a trace event containing the instruction name, operand values, and the post-instruction state. Vulnerabilities are represented as symbolic rules in Kleene algebra with tests: each rule specifies an event sequence and predicates over the machine state. This approach enables the detection of not only isolated unsafe instructions but also multi-step execution patterns. The rules are compiled into finite automata that scan the trace without using an SMT solver. The experimental evaluation covers three CWE classes: integer overflow (CWE-190), null pointer dereference (CWE-476), and heap buffer overflow (CWE-122). The system detected all three predefined vulnerabilities and produced no report on the safe trace. Each detection result includes the triggered rule, the trace position, and the concrete state values, thereby providing a reproducible explanation.