Dynamic taint analysis device and its application in file format reverse analysis

Abstract

The invention relates to a dynamic taint analysis device and application of the dynamic taint analysis device to document format reverse analysis, wherein the dynamic taint analysis device comprises a dynamic instrumentation executive logging module and a static snapshoot analysis taint tracking module, wherein the dynamic instrumentation executive logging module is used for calling and executing a tested program by using a binary program instrumentation platform, monitoring opening, analyzing and closing behaviors of a data document including original taint data in a process of executing the tested program, and acquiring snapshoot logs of all command processes, context information and memory access information in the process of executing the tested program according to the process of executing the tested program; the static snapshoot analysis taint tracking module is used for analyzing the snapshoot logs and simulating replay execution of a progress according to information obtained by analysis and recording processing and spread information of original taint data in the data document to obtain a taint data stream path. According to the dynamic taint analysis device, I / O (Input / Output), time and space overhead of dynamic taint analysis in a dynamic execution process can be reduced, an extended instruction set can be supported, and the continuity and incidence relation of original taint data can be obtained.

Description

technical field [0001] The invention relates to a dynamic stain analysis technology, in particular to an improved dynamic stain analysis device and the application of the improved dynamic stain analysis device in the gray box file format reverse analysis technology. Background technique [0002] The basic implementation idea of ​​taint analysis is: calibrate all input data as taint data, and track the flow path of these taint data during program execution, and then perform corresponding analysis on the basis of the flow path. [0003] At present, taint analysis is usually divided into dynamic taint analysis and static taint analysis for binary code, and dynamic taint analysis has been a research hotspot in the past ten years. [0004] The existing dynamic taint analysis mainly has two implementation methods: one is based on the system-wide virtual machine implementation, that is, the taint analysis is performed through internal or external plug-in codes, such as the taint an...

AI Technical Summary

Problems solved by technology

[0010] 1. Excessive overhead

In addition to the inherent overhead introduced by the dynamic binary program instrumentation platform, the taint analysis logic needs to memorize the propagation state of the taint path, and perform state-by-instruction instrumentation to analyze the context state and memory values, etc., which will introduce a lot of additional computing time and space overhead ; while virtual machine implementations suffer from inefficiencies due to system-wide emulation

[0011] 2. Lack of extended instruction set support

[0012] 3. There is an I / O bottleneck

If the type of information recorded in the log is reduced, the path information of dynamic taint tracking will not be restored, so that the dynamic taint analysis tool will lose its usability, and the dynamic taint analysis results will not be reusable

Images