Turing completeness | EPFL Graph Search

In computability theory, a system of data-manipulation rules (such as a model of computation, a computer's instruction set, a programming language, or a cellular automaton) is said to be Turing-complete or computationally universal if it can be used to simulate any Turing machine (devised by English mathematician and computer scientist Alan Turing). This means that this system is able to recognize or decide other data-manipulation rule sets. Turing completeness is used as a way to express the power of such a data-manipulation rule set. Virtually all programming languages today are Turing-complete. A related concept is that of Turing equivalence – two computers P and Q are called equivalent if P can simulate Q and Q can simulate P. The Church–Turing thesis conjectures that any function whose values can be computed by an algorithm can be computed by a Turing machine, and therefore that if any real-world computer can simulate a Turing machine, it is Turing equivalent to a

Efficiency enhancement and frequency-tunable capability in linear CMOS RF power amplifiers for wireless applications

Paulo Augusto Dal Fabbro

This research work deals with the design of linear CMOS RF power amplifiers. Two important aspects are treated: efficiency enhancement and frequency-tunable capability. For this purpose, two different integrated circuits were realized in a 0.11 µm technology, each one addressing a different aspect. With respect to efficiency enhancement, a dynamic supply RF power amplifier was realized. The circuit was designed for an operating frequency of 5.2 GHz, but measurements were also performed at 2.4 GHz. The integrated circuit includes a class A amplifier and a high-efficiency, switched-mode modulator. It occupies an area of 1.35 mm2. Two-tone measurement results at 2.4 and 5.2 GHz showed that the system can deliver over 16 dBm (40 mW) linear output power with efficiencies of 22.7% and 12.6%, respectively. Compared to a constant 2.5 V supply operation, the power amplifier operating with the dynamic supply delivers higher linear output power. Moreover, a relative efficiency improvement of a factor of 2.3 at 2.4 GHz and of a factor of 1.6 at 5.2 GHz at low output power levels is achieved. OFDM measurements at 2.4 GHz demonstrated that for an EVM lower than 3% and for an equal output power of 11 dBm (12.6 mW), the absolute improvement in efficiency is over 3.2%. In this work we also propose a tunable impedance matching network for use in multiband RF power amplifiers. This novel network is based on coupled inductors. A frequency-tunable RF power amplifier using this network was designed for operation at 3.7 and 5.2 GHz. Simulation results for the complete system integrated in a CMOS technology showed good results. However, the frequency-tunable behavior could not be observed in the characterization of the integrated circuit because of the low coupling factor of the integrated coupled inductors. A hybrid implementation using the integrated CMOS power amplifier, a discrete commercial RF transformer and a discrete bipolar transistor to control the current in the secondary winding of the transformer was carried out. The circuit was designed for operation at 200 and 300 MHz. The measurements have shown that at 200 MHz a relative improvement in efficiency of a factor of 1.4 was achieved. Moreover, less distortion was generated with the proposed tunable output matching network. The hybrid implementation allowed us to demonstrate the feasibility of the frequency-tunable RF power amplifier based on coupled inductors.

EPFL2009

Block Oriented Programming: Automating Data-Only Attacks

Mathias Josef Payer

With the widespread deployment of Control-Flow Integrity (CFI), control-flow hijacking attacks, and consequently code reuse attacks, are significantly more difficult. CFI limits control flow to well-known locations, severely restricting arbitrary code execution. Assessing the remaining attack surface of an application under advanced control-flow hijack defenses such as CFI and shadow stacks remains an open problem. We introduce BOPC, a mechanism to automatically assess whether an attacker can execute arbitrary code on a binary hardened with CFI/shadow stack defenses. BOPC computes exploits for a target program from payload specifications written in a Turing-complete, high-level language called SPL that abstracts away architecture and program-specific details. SPL payloads are compiled into a program trace that executes the desired behavior on top of the target binary. The input for BOPC is an SPL payload, a starting point (e.g., from a fuzzer crash) and an arbitrary memory write primitive that allows application state corruption. To map SPL payloads to a program trace, BOPC introduces Block Oriented Programming (BOP), a new code reuse technique that utilizes entire basic blocks as gadgets along valid execution paths in the program, i.e., without violating CFI or shadow stack policies. We find that the problem of mapping payloads to program traces is NP-hard, so BOPC first reduces the search space by pruning infeasible paths and then uses heuristics to guide the search to probable paths. BOPC encodes the BOP payload as a set of memory writes. We execute 13 SPL payloads applied to 10 popular applications. BOPC successfully finds payloads and complex execution traces which would likely not have been found through manual analysis - while following the target's Control-Flow Graph under an ideal CFI policy in 81% of the cases.

ASSOC COMPUTING MACHINERY2018

Efficiency enhancement and frequency-tunable capability in linear CMOS RF power amplifiers for wireless applications

Paulo Augusto Dal Fabbro

EPFL2009