Sem86 is an x86 full-system emulator that loads instruction behavior from a file at runtime, so undefined or undocumented instructions can be changed by editing the file. That makes it possible to emulate undefined behavior and undocumented instructions the way a particular chip handles them. It uses LLVM rather than a custom JIT, and it’s 1.9x as fast as Bochs and about 42% of QEMU’s speed. It was presented at QRS’26.

One use is malware analysis. Malware can check for differences in undefined instruction behavior to work out that it’s running in a sandbox. Sem86 can switch semantics in the middle of execution, so a run can be bisected to find the exact instruction where two behaviors diverge. The team showed this with a toy malware sample.

It implements enough Pentium-era hardware to boot Windows 3.1, 98, XP, 7 and Debian 8, with optional ES1370 audio, VBE video and an NE2k network card.…