Testbed Assisted Control Flow Tracing for Wireless Embedded Systems.

Observing wireless embedded systems is difficult because of resource constraints and tight interaction with the environment. In this paper, we develop a method that can reconstruct the entire control flow of a program based on recorded state changes (time and state) of I/O pins. We instrument program binaries by statically inserting instructions that alter the states of a set of I/O pins. During program execution, the overhead of added instructions must be kept as low as possible to preserve the original program behavior. We first adapt an existing software-only placement method to generate an unambiguous pattern on the I/O pins for every possible execution path. Then, we make use of recorded timestamps to further reduce the runtime overhead substantially. This timing information is extracted from the executable by means of an elaborate static analysis. An algorithm is presented that safely reduces the number of recorded events while still being able to uniquely determine the executed program path. Experiments on a testbed show that using time information reduces the runtime overhead by up to 38.3 % for typical applications. The average runtime overhead is 19%.