Nowadays, DSP processors have been widely used in wireless network systems, since it can meet high-speed real-time information processing requirements. Meanwhile, the undocumented instructions in processors, with potentially catastrophic consequences, have become one of the main threats to system security. Therefore, the mining of undocumented instructions in processors is quite crucial for reinforcing the security of wireless network. To achieve this goal, we propose an undocumented instruction search method specifically for DSP processors, which can efficiently and accurately obtain undocumented instructions. First, to compress the instruction search space, we analyze the characteristics of DSP instruction format. Second, we build a precise instruction disassembly framework to identify all the undefined instructions. Finally, we build an automatic test tool for the executability of undefined instructions. We perform extensive experiments to evaluate the effectiveness of our method. The results reveal that our approach is valid for mining undocumented instructions in DSP processors. Specifically, we have successfully mined 335 instructions on 14 TI DSP processors from 6 different series.

As recently studied, the undocumented instructions in embedded processors that may cause catastrophic results for devices have become one of the main threats to system security. To tackle this issue, in this paper, we propose an undocumented instruction mining tool for digital signal processors named DSPUIM that can find out the undocumented instructions from the frequently used Digital Signal Processors (DSP) in network information systems. First, we analyzed the characteristics of the DSP instruction format to compress the instruction search space and improve the instruction search speed. Second, according to the public instruction set of DSPs, we built an instruction disassembly framework that helped us to identify all the undefined instructions. Finally, by testing the executability of undefined instructions automatically, we obtained the undocumented instructions for target DSPs. To demonstrate the effectiveness of our tool, we applied it on ten DSP processors of Texas Instruments (TI) and mined 335 undocumented instructions from them within 5 min. Some undocumented instructions have malicious functions, such as changing registers and denial of service, posing a security threat to the network devices using DSPs.