How sca-research/elmo works
ELMO is an ARM M0 leakage simulator and analysis tool. The principal workflow starts with user-compiled Thumb binaries: ELMO emulates execution and pipeline context, applies statistical power models, and produces traces that can be analyzed for fixed-vs-random leakage or energy. Separate M3 model-building code captures hardware traces and provides single- and sequential-instruction experiments. The README also documents mask-flow analysis, a memory-bus extension, alternate-core coefficients, and TVLA sample-size support. Some internal calls and unsampled subsystems are not shown, so links without direct evidence are omitted.
Main entry points: elmo.c ELMO emulator · BuildModel_M3_Full.py M3 trace capture · BuildModel_Single.c Single-instruction target · BuildModel_Seq.c Sequence target
Components 16
Emulation and leakage
- ELMO emulator
elmo.c - Core configuration
elmodefines.h - Execution dataflow
elmodefines.h - Power models
include/powermodel.h - Memory extension
elmodefines.h - Trace outputs
elmo.c
Trace analysis
- Fixed-random TVLA
include/fixedvsrandom.h - Mask-flow analysis
include/maskflow.h - Energy analysis
include/energy.h
Model building
- Single-instruction target
ModelBuilding_M3/ARMCode/SingleInstr/BuildModel_Single.c - Sequence target
ModelBuilding_M3/ARMCode/SeqInstr/BuildModel_Seq.c
Hardware acquisition
- M3 trace capture
ModelBuilding_M3/AcqCode/BuildModel_M3_Full.py - TRS trace writer
ModelBuilding_M3/AcqCode/TRS_TraceSet.py
Other components
- User
- Thumb binary
- PicoScope
Connections 14
- User → Thumb binary: compiles code
README.md - Thumb binary → ELMO emulator: provides binary
README.md - ELMO emulator → Execution dataflow: records execution
elmo.c - ELMO emulator → Power models: uses model
elmo.c - ELMO emulator → Core configuration: uses settings
elmo.c - ELMO emulator → Trace outputs: writes traces
README.md - ELMO emulator → Memory extension: tracks bus
README.md - ELMO emulator → Fixed-random TVLA: supports testing
README.md - ELMO emulator → Mask-flow analysis: tracks mask flow
README.md - ELMO emulator → Energy analysis: supports energy
README.md - Single-instruction target → M3 trace capture: measured by
- Sequence target → M3 trace capture: measured by
- M3 trace capture → PicoScope: captures samples
ModelBuilding_M3/AcqCode/BuildModel_M3_Full.py - M3 trace capture → TRS trace writer: writes traces
ModelBuilding_M3/AcqCode/BuildModel_M3_Full.py