Technical Guide

Cross-target & Custom Toolchains

Build and analyze binaries for targets different from the host architecture while keeping full control over the toolchain.

CROSS-TARGET

Host and target architectures are independent.

LABS351 allows the project target to be different from the architecture of the host system.

In cross-target mode, the developer retains full control over the toolchain: assembler, linker, executable paths, command-line arguments, ABI, binary format and linker scripts can be configured explicitly.

Native and cross-target builds
Custom assembler and linker executables
Custom command-line arguments
PE, COFF, ELF and Mach-O workflows
ARM, x86-64 and RISC-V targets

EXAMPLE

RISC-V RV32I target from macOS ARM64.

The following example is built on an Apple Silicon host while targeting a 32-bit RISC-V environment.

Host: macOS / ARM64 Target: RISC-V RV32I Output: ELF32

Source:

.section .text
.globl _start

_start:
    li  t0, 0x42
    li  t1, 0x100
    add t2, t0, t1

loop:
    j loop

Assembler:

/opt/homebrew/bin/riscv64-elf-as

-march=rv32i -mabi=ilp32

Linker:

/opt/homebrew/bin/riscv64-elf-ld

-T linker.ld -m elf32lriscv

LINKER SCRIPT

Explicit memory layout.

The linker script remains part of the project and is entirely controlled by the developer.

ENTRY(_start)

MEMORY
{
    RAM (xrw) : ORIGIN = 0x80000000, LENGTH = 128K
}

SECTIONS
{
    .text :
    {
        *(.text)
    } > RAM
}

In this configuration, LABS351 runs on ARM64 while the selected toolchain generates an ELF32 binary for the RISC-V RV32I target. The resulting binary can then be inspected and decoded in LABS351 using the available analysis engines.

EXECUTION

Native Runner or custom execution environment.

Cross-target build and binary analysis do not imply native execution of the target architecture.

The LABS351 Runner/Trampoline executes native code when the target architecture is compatible with the host. For other execution models, the Runner can be replaced by a custom environment configured by the developer.

External simulators or emulators such as QEMU can therefore be connected through the custom Runner configuration when required by the target.

WORKFLOW

Cross-target remains developer-controlled.

macOS ARM64 ↓ Custom assembler + arguments ↓ Custom linker + linker script ↓ RISC-V RV32I / ELF32 ↓ LABS351 binary analysis ↓ Native Runner or custom Runner when execution is required

LABS351 provides the project environment and configuration interfaces. In cross-target mode, the developer explicitly defines the tools and parameters required by the target.