Deterministic Fully-Static Whole-Binary Translation without Heuristics

We present Elevator , the first binary translator capable of statically translating entire x86-64 binary executables to AArch64 without using debug information, source code, or any assumptions about code patterns or layouts within the original binary. Unlike existing binary translation systems, which rely on heuristics or runtime fallback mechanisms to recover from erroneous code-versus-data decoding decisions, Elevator considers all possible interpretations of every byte in the original executable and creates a separate translation for each feasible one ahead of time. For example, any byte might be interpreted as data, as part of an opcode, or as part of an argument to an opcode. We generate separate control flow paths for all of these interpretations, pruning only those that lead to exceptional program termination. For each such control flow path, a translation is generated by composing code “tiles” that have been automatically derived from a high-level language description of the individual instructions in the source instruction set architecture. This leads to a nimble binary translation framework. Our approach is deterministic and produces complete, self-contained output binaries. Unlike previous solutions, it requires no run-time component in the trusted code base. Elevator offers a different cost/benefit profile than previous solutions, with the principal cost being a substantial code size expansion. The main benefit in return is that Elevator ’s output is the actual code that will run, so it can be tested, validated, certified, and/or cryptographically signed before deployment, reducing risk compared to emulators or just-in-time (JIT) compilers. Our solution is surprisingly general and scalable, even though two principal engineering restrictions remain in our current implementation: we support only single-threaded binaries, and we presently do not support C++-style exception handling. Notwithstanding these limitations, our approach is applicable to a wide range of real-world programs. We demonstrate Elevator on the entire SPECint 2006 benchmarking suite and on the 11 of the 14 programs in the newer SPECint 2026 that don’t raise exceptions. Our results show that fully static whole-binary cross-ISA translation can be applied successfully across a wide variety of executables, with a resulting performance on par or better than QEMU’s user-mode emulation with JIT acceleration.