Core Concepts

Before writing your first hardware simulation script, it is important to understand the mental model behind Certo.

Everything is a Resource

Most modern operating systems abstract hardware interactions into a generic “Resource” or “File” concept. Whether your application is opening a text document, connecting to a Bluetooth module, speaking to an I2C sensor, or opening a network socket, the operating system treats them all as a stream of bytes managed by a numeric identifier (a File Descriptor or Handle).

Because of this universal abstraction, all hardware interactions follow the same basic lifecycle:

1. Initialization: The application asks the OS to access a resource (open, connect).

2. Configuration: The application sends specific setup commands to the resource (ioctl, stat).

3. Data Transfer: The application sends or receives data from the resource (read, write, sendto, recvfrom).

4. Teardown: The application releases the resource (close).

EMU works by letting you target specific paths, network ports, or resources, and then overriding any or all of these lifecycle events.

The Intercept Lifecycle

When EMU is actively targeting an application, the normal flow of execution is gracefully rerouted. Here is exactly what happens in milliseconds when your application attempts to talk to a targeted device:

1. The Trap: The application executes a system call (e.g., asking to read 1024 bytes from a sensor).

2. The Pause: The EMU Engine catches the system call before it reaches the OS kernel. The application is temporarily frozen.

3. Data Translation: The Engine reads the arguments passed by the application. If you have linked a C-schema, it decodes the raw memory pointers into structured, accessible data.

4. The Policy Execution: EMU triggers your custom TCL script. Your script can read the application’s request, update its internal virtual state, print to the logger, and populate the memory buffers with fake sensor data.

5. The Return: Once the script finishes, EMU resumes the application.

Tip

You can configure EMU to either bypass the native OS entirely (returning your spoofed data instantly) or to allow the real OS call to proceed after your modifications.

To the application, the pause was imperceptible. It simply believes the physical hardware successfully responded.

Intercept Target Syntax

When configuring your .vhb or setting up a new intercept, EMU’s engine supports flexible pattern matching to make targeting dynamic resources effortless: