A coprocessor-based method and system for taint propagation

Abstract

The application discloses a kind of based on coprocessor's taint propagation method and system.The steps of the method include:1) pre-analysis instruction semantics, construct the taint propagation mask table of instruction;2) by coprocessor, intervene CPU instruction pipeline decoding, write-back process;3) in decoding stage, the opcode and operand of current instruction are acquired in real time quickly, and the taint propagation mask corresponding to instruction is found in taint propagation mask table by coprocessor;4) in write-back stage, the mask table corresponding to current instruction is searched in real time quickly, and taint propagation calculation is implemented.The application can analyze the semantics of instruction, calculate taint propagation process by using the characteristics of hardware fast and accurate when CPU instruction is executed by configuring the input function return value of monitoring.

Description

Technical Field

[0001] This invention belongs to the field of computer science and technology, specifically relating to a method for extracting information such as the opcode, registers, and access addresses of program analysis instructions during CPU instruction execution by adding coprocessor hardware on a hardware platform, and performing fast taint propagation calculations. Background Technology

[0002] Dynamic taint propagation analysis (DPMA) of binary programs is a crucial technique for dynamic code analysis of binary programs. Currently, DPMA primarily employs two methods: dynamic taint propagation analysis based on the virtual machine translation process and dynamic taint propagation analysis based on the instrumentation tool PinTools. Both methods are software-based, requiring third-party tools to disassemble all executed code, analyze instruction semantics and addressing modes, identify corresponding taint propagation rules, and then perform taint propagation calculations. Because taint propagation itself has complex logic, software-based methods severely impact the operational efficiency of the analyzed system. Existing dynamic taint propagation analysis methods are insufficient for analyzing large-scale applications. Specifically, the taint propagation process affects the logic of dynamic program execution; delays caused by taint propagation calculations lead to certain program behaviors no longer being observed. A common scenario is vulnerability analysis of large software applications such as Office.

[0003] Current dynamic taint propagation analysis techniques typically employ the following methods:

[0004] 1. Analysis of taint propagation in the virtual machine translation process

[0005] The dynamic taint propagation analysis method based on the virtual machine translation process aims to modify the code of the virtual machine's dynamic translation and execution process. Using address comparison, it detects the input APIs called by the target program, marks the data introduced by these APIs as taints, and creates shadow memory to record the taint data state. At the start of subsequent instruction dynamic translation, it obtains the instruction to be translated, analyzes its semantics using a disassembler engine, and inserts a callback function to calculate the taint propagation state of that instruction into the virtual machine's execution code. While the virtual machine executes the translated code, it calls the taint propagation calculation callback function, queries complex taint propagation rules, calculates the taint propagation state, and updates the records in the shadow memory. Due to system efficiency constraints, the current taint propagation engine is implemented for a single process.

[0006] 2. Analysis of taint propagation based on pin tools

[0007] The pin tool of the present application is a kind of dynamic taint analysis method based on coprocessor hardware, which can realize fast and cross-process taint propagation calculation.

[0008] In summary, the main defects of the current dynamic taint propagation analysis method are as follows: mainly supporting single-process dynamic taint propagation analysis, and the taint propagation process needs to go through multiple stages such as disassembly, semantic analysis, rule calculation, etc., which is low in efficiency, high in space and time complexity, and difficult to realize high-speed real-time taint propagation analysis. SUMMARY

[0009] The present application is aimed at the existing dynamic taint propagation technology, which is usually implemented for a single process, and needs to disassemble each instruction one by one, compare the instructions one by one according to the disassembly results, find the corresponding propagation rules according to the addressing mode and semantics of the instructions, and calculate the taint propagation, which is difficult to realize fast and cross-process taint propagation calculation. The purpose of the present application is to provide a fast and cross-process taint propagation calculation method based on coprocessor hardware, which can analyze the semantics of instructions and calculate the taint propagation process by configuring the return value of the input function of the monitoring.

[0010] The taint propagation method based on coprocessor of the present application comprises the following steps:

[0011] Pre-analyzing the semantics of instructions to construct a taint propagation mask table of instructions;

[0012] Intervene in the decoding and write-back process of the CPU instruction pipeline through the coprocessor;

[0013] In the decoding stage, the opcode and operand of the current instruction are obtained in real time and fast, and the coprocessor is used to find the taint propagation mask corresponding to the instruction from the taint propagation mask table;

[0014] In the write-back stage, the taint propagation mask table corresponding to the current instruction is retrieved in real time and fast, and the taint propagation calculation is implemented.

[0015] Further, the pre-analysis instruction semantics is based on static manual analysis, analyzing the operands of the instruction, the operation implemented on the operands, the result produced by the operation depending on the corresponding position of the operands, and based on this, constructing a corresponding pollution propagation mask table between the operands and the execution result of the instruction. The pollution propagation mask table no longer uses the traditional code implementation, but uses the pollution corresponding relationship mask between the source operands and the destination operands, and through the mask, the operands are directly calculated by AND operation, and the pollution propagation relationship after the instruction execution is obtained.

[0016] Further, the pollution propagation mask table uses a binary form to represent the association between the result data and the input data after the instruction execution. The mask is represented as follows: for example, the mask of the instruction mov ax, bx (write the content of the bx register to the ax register, both registers are 16 bits), since the operand of the instruction is 64 bits, the mask is 64 bits, and considering that the ax and bx of the result after the instruction execution are all related, the mask is represented as: ax = bx AND (00000000 00000000 00000000 00000000 00000000 11111111 11111111). When the pollution propagation calculation encounters mov ax, bx, the content of bx is directly ANDed with the mask (AND), and the pollution state of ax is obtained.

[0017] Further, the decoding and write-back process of the CPU pipeline through the intervention of the coprocessor is to connect the coprocessor to the pins of the CPU through electrical signals, and in the case of providing coprocessor functions by the CPU, to obtain the information of the CPU in real time during dynamic running. That is, through the coprocessor interface provided by the CPU, the electrical signals of the decoding and write-back process are led out and connected to the coprocessor dedicated for pollution propagation calculation.

[0018] Further, the real-time and fast acquisition of the operation code and the operand of the current instruction in the decoding stage is to directly extract the operation code and the operand of the instruction according to the result of the CPU decoding process in the decoding stage, and to find the pollution propagation mask corresponding to the instruction from the pollution propagation mask table through the coprocessor.

[0019] Further, the real-time and fast retrieval of the pollution propagation mask table corresponding to the current instruction in the write-back stage to implement pollution propagation calculation is to AND the instruction execution result with the pollution propagation mask corresponding to the instruction according to the instruction execution result in the write-back stage of the CPU instruction pipeline, and to obtain the pollution propagation calculation result.

[0020] Further, in the above process, the recording and calculation of pollution propagation are all based on physical memory addresses.

[0021] Further, in the above process, the record and calculation of the taint propagation are all based on the implementation of instructions, and the process and EIP (register) information where the instructions are located are recorded, so that the cross-process taint propagation calculation can be realized.

[0022] Further, the method for realizing the cross-process taint propagation calculation is that, for the taint content, the record is made based on the physical memory address, and since there is a case that different processes in the operating system may share data, the virtual addresses of the same data content may be different in different processes, but the physical memory is the same, so that under the condition of recording based on the physical address, the cross-process taint propagation calculation can be realized by monitoring multiple processes at the same time.

[0023] The application further provides a coprocessor-based taint propagation system adopting the above method, comprising a main processor, a coprocessor and a taint propagation mask table construction module; the taint propagation mask table construction module preanalyzes instruction semantics and constructs a taint propagation mask table of instructions; the coprocessor intervenes in the decoding and write-back process of the instruction pipeline of the main processor; the operation code and operand of the current instruction are acquired in real time and quickly in the decoding stage, and the taint propagation mask corresponding to the instruction is found from the taint propagation mask table through the coprocessor; the taint propagation mask table corresponding to the current instruction is searched in real time and quickly in the write-back stage, and the taint propagation calculation is implemented.

[0024] The application has the following advantages and positive effects:

[0025] The application can monitor the taint propagation process of the whole system completely, provides an efficient, accurate and cross-process taint propagation scheme, and provides a strong support for fast and real-time program taint propagation analysis. BRIEF DESCRIPTION OF DRAWINGS

[0026] Figure 1 It is a hardware structure diagram of the coprocessor-based taint propagation method of the application.

[0027] Figure 2 It is a flowchart of the coprocessor-based taint propagation method of the application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical scheme and advantages of the application more clear, the application is further described in detail below in combination with specific embodiments and with reference to the drawings.

[0029] Figure 1 It is a hardware structure diagram of the coprocessor-based taint propagation method of the application, and the specific description is as follows:

[0030] 1) Main processor. It refers to the commonly used CPU.

[0031] 2) Coprocessor refers to an external chip used for fast taint propagation analysis. This chip obtains information from the decoding and write-back phases executed by the CPU and performs taint propagation calculations.

[0032] Figure 2 This is a flowchart of a taint propagation method based on a coprocessor according to the present invention, and the specific steps are described as follows:

[0033] 1) Based on publicly available CPU instruction manuals, summarize the instructions that the CPU can execute, and analyze the semantics and operands (including registers, memory, etc.) of the instructions. Proceed to step 2).

[0034] 2) Based on the functions of interest to the analysts, analyze the functions that can introduce tainted data into the program (hereinafter referred to as "tainted source functions"), and analyze the meaning of their call addresses, input parameters, output parameters, and return values. Proceed to step 3).

[0035] 3) Based on the instruction semantics and operand information obtained from offline analysis, a taint propagation mask table is constructed through manual analysis, using the instruction's opcode as the index of the mask table. Proceed to step 4).

[0036] 4) Modify the implementation of tainted source functions in the operating system kernel and dynamic libraries to add shadow memory construction and tainted source marking functionality. Proceed to step 5).

[0037] The method for adding shadow memory construction and taint source marking functionality is as follows:

[0038] Modify the operating system's process creation mechanism so that when a program process starts, the operating system creates another extended page table (called shadow memory) corresponding to the process page table. The entries in the page table are used to record the state of tainted data.

[0039] Modify the system calls for reading files and receiving network data. Before the function returns, record the offset and length of the data read from the file or received from the network in memory, modify the flag of the corresponding address in the shadow memory, and set the taint status of the read data to 1.

[0040] 5) Run the modified operating system and the target program to be monitored on the hardware system. Proceed to step 6).

[0041] 6) When the target program calls the tainted source function, the modified operating system automatically constructs shadow memory and marks the memory address region of the input data returned by the tainted source function as tainted, thus officially starting the taint propagation calculation. Proceed to step 7).

[0042] 7) Coprocessor real-time fast get the semantics and operands of the current instruction according to the instruction opcode passed in the CPU decoding stage, and find the corresponding taint propagation mask table, record the taint propagation mask corresponding to the current instruction. Enter step 8).

[0043] 8) Coprocessor calculates the taint propagation state according to the information obtained in the instruction write-back stage, combined with the taint propagation mask table (that is, combined with the mask obtained in step 7), and modifies the taint state record in the shadow memory. Enter step 9). Wherein, combined with the taint propagation mask table to calculate the taint propagation state, refers to according to the taint propagation mask, and the operand of the instruction is operated (AND), the taint state after the instruction execution is obtained.

[0044] 9) End the analysis of this instruction, execute the next instruction, enter step 7).

[0045] 10) The above process runs until the system exits.

[0046] The taint propagation analysis method based on coprocessor proposed in the application can perform full-system, cross-process taint propagation analysis for those skilled in the art, so as to more conveniently and comprehensively meet the extraction of various information in the program analysis process.

[0047] Based on the same inventive concept, another embodiment of the application provides a coprocessor-based taint propagation system using the above method, comprising a host processor, a coprocessor and a taint propagation mask table construction module; the taint propagation mask table construction module pre-analyzes the instruction semantics and constructs the taint propagation mask table of the instruction; the coprocessor intervenes in the decoding and write-back process of the instruction pipeline of the host processor; in the decoding stage, the opcode and operand of the current instruction are obtained in real time, and the taint propagation mask corresponding to the instruction is found from the taint propagation mask table through the coprocessor; in the write-back stage, the taint propagation mask table corresponding to the current instruction is retrieved in real time, and the taint propagation calculation is implemented.

[0048] Based on the same inventive concept, another embodiment of the application provides an electronic device (computer, server, smart phone, etc.), which comprises a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing each step in the method of the application.

[0049] Based on the same inventive concept, another embodiment of the application provides a computer readable storage medium (such as ROM / RAM, magnetic disk, optical disk), which stores a computer program, and the computer program is executed by a computer to realize each step of the method of the application.

[0050] Portions of the disclosure that are not unambiguously described in detail are deemed to be within the knowledge of those skilled in the art.

[0051] While specific embodiments of the application have been disclosed in detail herein for purposes of illustration, it will be understood by those skilled in the art that various alternatives, modifications, and equivalents can be used, and that the application is intended to encompass all such alternatives, modifications and equivalents. Accordingly, the application should not be limited to a particular embodiment described herein, but should be accorded the full scope that the appended claims are entitled to.

Claims

1. A coprocessor-based taint propagation method, comprising the following steps: Pre-analyze instruction semantics and construct an instruction taint propagation mask table; The taint propagation mask table uses a taint correspondence mask between the source operand and the destination operand. By directly performing a bitwise AND operation on the operands through this mask, the taint propagation relationship after instruction execution can be obtained. The coprocessor intervenes in the decoding and write-back process of the CPU instruction pipeline. During the decoding phase, the opcode and operands of the current instruction are obtained in real time and quickly, and the taint propagation mask corresponding to the instruction is found from the taint propagation mask table through the coprocessor. During the write-back phase, the taint propagation mask table corresponding to the current instruction is retrieved in real time and the taint propagation calculation is performed.

2. The method as described in claim 1, characterized in that, The pre-analysis instruction semantics is based on static manual analysis, which analyzes the operands of the instruction, the operations performed on the operands, and the results of the operations, which depend on the corresponding positions of the operands. This leads to the construction of a corresponding taint propagation mask table between the operands and the instruction execution results.

3. The method as described in claim 1, characterized in that, The taint propagation mask table uses binary form to represent the association between the result data obtained after instruction execution and the input data.

4. The method as described in claim 1, characterized in that, The process of intervening in the decoding and write-back process of the CPU instruction pipeline through a coprocessor involves extracting the electrical signals of the decoding and write-back process through the coprocessor interface provided by the CPU and connecting them to a coprocessor dedicated to taint propagation calculations.

5. The method as described in claim 1, characterized in that, The step of rapidly retrieving the taint propagation mask table corresponding to the current instruction in real time during the write-back phase and performing taint propagation calculation includes: performing a bitwise AND operation between the instruction execution result and the taint propagation mask corresponding to the instruction based on the instruction execution result of the CPU instruction pipeline write-back phase to obtain the taint propagation calculation result.

6. The method as described in claim 1, characterized in that, The recording and calculation of taint propagation are all based on instructions, and the process and EIP information of the instructions are recorded to realize cross-process taint propagation calculation.

7. The method as described in claim 6, characterized in that, The method for implementing cross-process taint propagation calculation includes: recording tainted content based on physical memory addresses. The virtual addresses of the same data content may be different in different processes, but their physical memory addresses must be the same. Therefore, by monitoring multiple processes simultaneously under the condition of recording based on physical addresses, cross-process taint propagation calculation can be achieved.

8. A coprocessor-based taint propagation system employing the method described in any one of claims 1 to 7, characterized in that, It includes a main processor, a coprocessor, and a taint propagation mask table construction module; the taint propagation mask table construction module pre-analyzes instruction semantics and constructs an instruction taint propagation mask table; the coprocessor intervenes in the decoding and write-back process of the main processor's instruction pipeline; During the decoding phase, the opcode and operands of the current instruction are obtained in real time and the taint propagation mask corresponding to the instruction is found from the taint propagation mask table through the coprocessor; during the write-back phase, the taint propagation mask table corresponding to the current instruction is retrieved in real time and the taint propagation calculation is performed.

9. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method described in any one of claims 1 to 7.

Images