Staint analysis method and device, computer equipment and storage medium

Abstract

The embodiment of the invention discloses a taint analysis method and device, computer equipment and a storage medium, and belongs to the technical field of information security. In the application, the coprocessor of the computer equipment comprises a plurality of registers, and the plurality of registers not only can be used for storing stain information corresponding to a plurality of general registers in a main processor of the computer equipment, but also can be used for storing stain information corresponding to a program memory space of a target program currently executed by the main processor. Therefore, when the coprocessor performs taint propagation on the first instruction, the taint information of the operand of the first instruction can be accessed by accessing the plurality of registers, and compared with the mode of accessing the taint information by accessing a memory, the operation is simpler, the speed is faster, and the performance overhead is smaller.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a taint analysis method, device, computer equipment and storage medium. Background Art

[0002] With the rapid development of technologies such as the Internet, cloud computing, and mobile terminals, information security issues in computer systems are becoming increasingly important. Dynamic taint analysis is an information flow analysis technology that is currently widely used in information security detection fields such as vulnerability detection and privacy data leakage detection. This method can detect information security issues in computer systems by marking sensitive data as tainted data and tracking the spread of tainted data during program execution.

[0003] In the related art, a main processor and a coprocessor may be configured in a computer device. The main processor is used to execute the target program to be tested. In the process of the main processor executing the target program, for any instruction in the target program, the coprocessor can read the taint tag corresponding to the source operand of the instruction, and determine whether the destination operand of the instruction is contaminated according to the taint propagation rule and the taint tag corresponding to the source operand, and then update the taint tag corresponding to the destination operand according to the determination result. In the process, any operand of the instruction can be used to indicate a memory unit or a general register in the main processor, and the taint tag corresponding to the operand is used to indicate whether the information stored in the memory unit or general register indicated by the operand is contaminated, and when the operand indicates a memory unit, the taint tag corresponding to the operand will be stored in the memory. Based on this, when the source operand and / or the destination operand of the instruction indicates a memory unit, the coprocessor needs to read and / or update the taint tag by accessing the memory during the taint propagation process, which has a large performance overhead. Summary of the invention

[0004] The present application provides a taint analysis method, apparatus, computer equipment and storage medium, which can reduce the performance overhead of a coprocessor when performing taint analysis.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, a taint analysis method is provided, which is applied to a coprocessor in a computer device, wherein the coprocessor includes a plurality of registers, and the plurality of registers are used to store taint information corresponding to a plurality of general registers in a main processor of the computer device, and taint information corresponding to a program memory space of a target program currently executed by the main processor. The method includes: obtaining a first instruction, wherein the first instruction is an instruction in the target program; and updating taint information corresponding to a first general register or a first memory unit indicated by a destination operand of the first instruction according to a taint propagation rule corresponding to the first instruction, wherein the plurality of general registers include the first general register, and the program memory space includes the first memory unit.

[0007] The first instruction is the instruction to be currently analyzed, and the first instruction is neither a stain marking instruction nor a stain detection instruction.

[0008] In the present application, the coprocessor of the computer device includes a plurality of registers, which can be used not only to store the taint information corresponding to the plurality of general registers in the main processor of the computer device, but also to store the taint information corresponding to the program memory space of the target program currently executed by the main processor. In this way, when the coprocessor performs taint propagation on the first instruction, it can access the taint information of the operand of the first instruction by accessing the plurality of registers, which is simpler to operate, faster and with less performance overhead than accessing the taint information by accessing the memory.

[0009] Optionally, the program memory space includes a stack area, and the taint information corresponding to the program memory space includes taint information corresponding to the memory unit in the stack area, and the taint information corresponding to the memory unit in the stack area includes a taint tag and an information type tag, the taint tag corresponding to the memory unit is used to indicate whether the information stored in the memory unit is contaminated, and the information type tag corresponding to the memory unit is used to indicate that the information stored in the memory unit is data or a stack address.

[0010] In the present application, the taint information corresponding to each memory unit in the stack area includes not only a taint tag for indicating whether the information stored in the corresponding memory unit is contaminated, but also an information type tag for indicating that the information stored in the corresponding memory unit is data or a heap address. Since the heap address in the stack area can be the starting address of the variable of the object type in the heap area, the taint information corresponding to each memory unit in the stack area can not only mark the pollution status of the data stored in the stack area, but also mark the pollution status of the variable of the object type in the heap area at the same time. That is, the embodiment of the present application can realize the taint marking of the memory unit granularity of the stack area through the taint information corresponding to each memory unit in the stack area, and at the same time, it can also realize the taint marking of the variable granularity of the heap area.

[0011] Optionally, the program memory space further includes a global area, and the taint information corresponding to the program memory space further includes a taint tag corresponding to a memory unit in the global area.

[0012] In the present application, the taint information corresponding to each memory unit in the global zone can be used to implement the taint marking based on the granularity of the memory unit for the global zone. For example, when one byte is one memory unit, the taint marking based on the byte granularity for the global zone can be implemented through the taint information corresponding to each memory unit in the global zone.

[0013] Optionally, the taint information corresponding to the general register includes a taint tag and an information type tag, the taint tag corresponding to the general register is used to indicate whether the information stored in the general register is contaminated, and the information type tag corresponding to the general register is used to indicate that the information stored in the general register is data or a heap address. When the information type tag corresponding to the general register indicates that the information stored in the general register is a heap address, the taint information corresponding to the general register also includes the storage address of the heap address stored in the general register in the program memory space.

[0014] In the present application, the taint information corresponding to the general register includes not only a taint tag for indicating whether the information stored in the corresponding general register is tainted, but also an information type tag for indicating whether the information stored in the corresponding general register is data or a heap address. In this way, the taint information corresponding to the general register can not only implement taint marking for the data in the general register, but also implement taint marking for the variables in the heap area.

[0015] Optionally, the implementation process of obtaining the first instruction may include: reading the first instruction from an instruction cache queue, the instruction cache queue being used to store a plurality of decoded instructions, the plurality of instructions being instructions executed by the main processor in the target program.

[0016] In the present application, multiple decoded instructions can be stored through the instruction cache queue, so that the operation of the coprocessor obtaining instruction information and decoding instructions is decoupled from the operation of reading the decoded instructions for taint analysis, and is executed in parallel in a pipeline manner, thereby improving the efficiency of the coprocessor in taint analysis.

[0017] Optionally, before reading the first instruction from the instruction cache queue, the method also includes: reading first instruction information from an instruction information queue, the instruction information queue being used to store multiple instruction information sent by the main processor, the first instruction information including undecoded instructions; decoding the undecoded instructions included in the first instruction information to obtain the first instruction, and storing the first instruction in the instruction cache queue.

[0018] In the present application, multiple instruction information submitted by the main processor can be cached through the instruction information queue, so that the coprocessor can perform the operations of receiving instruction information and reading and processing instruction information in parallel, thereby improving processing efficiency. Moreover, compared with the method in which the main processor submits one instruction information each time and waits for the coprocessor to complete the analysis before executing the next instruction to submit the next instruction information, the performance overhead caused by the coprocessor blocking the main processor can be effectively reduced.

[0019] Optionally, the method further includes: if the instruction information queue is full, sending an interrupt instruction to the main processor, wherein the interrupt instruction is used to instruct the main processor to interrupt sending instruction information.

[0020] Optionally, the method further includes: performing stain detection according to the stain information stored in the plurality of registers.

[0021] Optionally, the implementation process of performing taint detection based on the taint information stored in the multiple registers may include: obtaining a second instruction, where the second instruction is an instruction in the target program; if the second instruction is a sensitive instruction and the taint information corresponding to the general register or memory unit indicated by the operand of the second instruction indicates that the stored information is contaminated, sending an interrupt instruction to the main processor and writing the program count value of the second instruction in a designated memory area.

[0022] In the present application, after detecting a sensitive instruction, the coprocessor can implement taint detection by reading the taint information stored in multiple registers without accessing the memory to read the taint information, thereby improving the speed of taint detection and reducing performance overhead.

[0023] Optionally, the main processor and the coprocessor are processors based on a reduced instruction set computer (RISC-V) architecture. Since the RSIC-V architecture has a higher open source program than other open source architectures, the cost of taint analysis can be reduced by applying the above taint analysis method on the main processor and coprocessor using the RSIC-V architecture.

[0024] In a second aspect, a stain analysis device is provided, the stain analysis device comprising at least one module, and the at least one module is used to execute the stain analysis method described in the first aspect.

[0025] In a third aspect, a computer device is provided, comprising a main processor and a coprocessor, wherein the main processor is used to execute a target program, and the coprocessor comprises a plurality of registers, wherein the plurality of registers are used to store taint information corresponding to a plurality of general registers in the main processor of the computer device, and taint information corresponding to a program memory space of the target program currently executed by the main processor, and the coprocessor is used to execute at least one program instruction or code stored in the memory, so as to implement the taint analysis method described in the first aspect above.

[0026] In a fourth aspect, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium. When the instructions are executed on a coprocessor of a computer device, the coprocessor of the computer device executes the stain analysis method described in the first aspect.

[0027] In a fifth aspect, a computer program product comprising instructions is provided. When the computer program product is run on a computer device, a coprocessor of the computer device is enabled to execute the stain analysis method described in the first aspect.

[0028] The technical effects obtained by the above-mentioned second, third, fourth and fifth aspects are similar to the technical effects obtained by the corresponding technical means in the first aspect, and will not be repeated here.

[0029] In an embodiment of the present application, the coprocessor of the computer device includes a plurality of registers, which can be used not only to store the taint information corresponding to the plurality of general registers in the main processor of the computer device, but also to store the taint information corresponding to the program memory space of the target program currently executed by the main processor. In this way, when the coprocessor performs taint propagation on the first instruction, it can access the taint information of the operand of the first instruction by accessing the plurality of registers, which is simpler to operate, faster, and has a lower performance overhead than accessing the taint information by accessing the memory. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of the structure of a computer device provided in an embodiment of the present application;

[0031] Figure 2 A schematic diagram of a program memory space and corresponding stain information provided in an embodiment of the present application;

[0032] Figure 3A schematic diagram of another program memory space of a main processor and corresponding taint information provided in an embodiment of the present application;

[0033] Figure 4 A schematic diagram of a general register and corresponding taint information in a main processor provided in an embodiment of the present application;

[0034] Figure 5 A flow chart of a stain analysis method provided in an embodiment of the present application;

[0035] Figure 6 A flowchart of another stain analysis method provided in an embodiment of the present application;

[0036] Figure 7 A schematic diagram of the structure of a stain analysis device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0038] Before explaining the embodiments of the present application in detail, the application scenarios involved in the embodiments of the present application are first introduced.

[0039] With the rapid development of technologies such as the Internet, cloud computing, and mobile smart terminals, computer systems have an increasing demand for information security. The two important characteristics of computer system information security are information confidentiality and integrity. Among them, information confidentiality means that the data in the system will not be leaked during use, and integrity means that the data in the system will not be maliciously tampered with or deleted during use.

[0040] At present, with the development of Internet technology, a large amount of user data is involved in Internet activities such as online payment and social networking. The use of third-party applications makes it difficult to effectively protect user data. For example, social software installed in computer devices may be attacked due to security vulnerabilities, resulting in the leakage of user personal information. For another example, online payment websites used by computer devices may also be attacked due to security vulnerabilities, resulting in the theft of user account information and transaction information. It can be seen that the information security issues of computer systems are becoming more and more serious. Based on this, dynamic taint analysis technology used in security business fields such as vulnerability mining, malicious code detection, and sensitive data leakage detection has become one of the current research hotspots.

[0041] Dynamic taint analysis technology can detect information security issues in the target program by marking sensitive data in the target program and tracking the propagation of the marked data during the operation of the target program. At present, commonly used dynamic taint analysis technologies include software-based dynamic taint analysis methods and hardware-assisted dynamic taint analysis methods. Among them, the software-based dynamic taint analysis method often has a large performance overhead because it needs to insert a large amount of analysis code into the binary file of the target program through the dynamic binary plugging method, or it needs to execute the target program through a virtual machine to obtain the execution information of the program. On this basis, hardware-assisted dynamic taint analysis methods are increasingly receiving attention. The embodiment of the present application provides a hardware-assisted dynamic taint analysis method based on a coprocessor, which can be applied to security business fields such as vulnerability mining, malicious code detection, and sensitive data leakage detection to improve the security of computer systems.

[0042] Next, the structure of the computer device involved in the stain analysis method provided in the embodiment of the present application is introduced.

[0043] Figure 1 Schematic diagram of the structure of a computer device provided in an embodiment of the present application. Figure 1 As shown, the computer device may include a main processor 101, a coprocessor 102, a communication bus 103 and a memory 104. It should be noted that: Figure 1 The device structure shown does not constitute a limitation on the computer device. The computer device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which is not limited in the embodiments of the present application. Figure 1 A detailed introduction to the various components of computer equipment:

[0044] The main processor 101 is the control center of the computer device, which can be a processor or a general term for multiple processing elements. For example, the main processor 101 can be a general-purpose central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application, such as: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA). Among them, the main processor 101 can execute various functions of the computer device by running or executing software programs stored in the memory 104, and calling data stored in the memory 104. For example, the main processor 101 can execute the target program by calling the binary file of the target program after the plugging stored in the memory 104, and send the instructions in the target program to the coprocessor 102 so that the coprocessor 102 can perform dynamic taint analysis.

[0045] The coprocessor 102 may be a hardware accelerator for performing dynamic taint analysis on the target program executed by the main processor 101. The coprocessor 102 may include general registers. In addition, the coprocessor 102 may also include multiple registers for storing taint tags. The multiple registers may not only store taint tags corresponding to the general registers in the main processor 101, but may also be used to store taint tags corresponding to the program memory space of the target program in the main processor 101. In addition, the coprocessor 102 may access the memory 104. For example, the taint analysis may be performed by running or executing a software program stored in the memory 104. Figure 5 and Figure 6 Taint analysis access shown.

[0046] The communication bus 103 may include a path to transmit information between the above components. The communication bus 103 may be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 1 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0047] As an embodiment, the main processor 101 and the coprocessor 102 can be processors based on the RISC-V architecture. The RISC-V architecture is an open source instruction set architecture. Compared with other open source architectures, the RISC-V architecture is shorter and more powerful, has a higher degree of open source, and has a more complete instruction set architecture. In addition, the RISC-V architecture supports custom instructions and supports custom hardware accelerators. For example, in an embodiment of the present application, when the main processor 101 communicates with the coprocessor 102 through the communication bus 103, a rocket custom coprocessor (rocket custom coprocessor, RoCC) interface can be used for information transmission.

[0048] As an embodiment, the computer device may include multiple main processors and multiple coprocessors, wherein each main processor corresponds to at least one coprocessor. Furthermore, each of the multiple main processors may be a single-CPU processor or a multi-CPU processor.

[0049] The memory 104 refers to an internal memory that directly exchanges data with the main processor 101. It can read and write data at any time, and the speed is very fast. It serves as a temporary data storage for the operating system or other running programs. The memory includes at least two types of memories. For example, the memory can be either a random access memory (RAM) or a read-only memory (ROM). For example, the RAM can be a dynamic random access memory (DRAM) or a storage class memory (SCM). DRAM is a semiconductor memory, and like most random access memories, it is a volatile memory device. SCM is a composite storage technology that combines the characteristics of traditional storage devices and memory. SCM can provide faster read and write speeds than hard disks, but the access speed is slower than DRAM, and the cost is cheaper than DRAM. However, DRAM and SCM are only exemplary descriptions in this embodiment, and the memory can also include other random access memories, such as static random access memory (SRAM). As for the read-only memory, for example, it can be a programmable read only memory (PROM), an erasable programmable read only memory (EPROM), etc. In addition, the memory 104 can also be a dual in-line memory module or a dual in-line memory module (DIMM), that is, a module composed of DRAM. In practical applications, a plurality of memories 104 and different types of memories 104 can be configured in a computer device. This embodiment does not limit the number and type of memory 104. In addition, the memory 104 can exist independently, for example, it can be connected to the main processor 101 and the coprocessor 102 through the communication bus 103. Alternatively, the memory 104 can also be integrated with the main processor 101. For example, see Figure 1 , the memory 104 may include a data cache 1041 and a RAM 1042 shared by the main processor 101 and the coprocessor 102, wherein the data cache 1041 may be integrated with the main processor 101, and the RAM 1042 is connected to the main processor 101 and the coprocessor 102 via the communication bus 103. The memory 104 is used to store the software program for executing the solution provided in the embodiment of the present application, and the coprocessor 102 controls the execution.

[0050] In addition, the computer device may further include a communication interface 105. The communication interface 105 is used to communicate with other devices or communication networks, such as Ethernet, RAN, wireless local area networks (WLAN), etc. The communication interface 105 may include a receiving unit to implement a receiving function, and a sending unit to implement a sending function.

[0051] As an embodiment, the computer device may further include an output device 106 and an input device 107. The output device 106 communicates with the main processor 101 and may display information in a variety of ways. For example, the output device 106 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 107 communicates with the main processor 101 and may receive input in a variety of ways. For example, the input device 107 may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0052] The above-mentioned computer device can be a user terminal or a server. When the computer device is a user terminal, the computer device can be a smart phone, a tablet computer, a portable computer, a desktop computer, a wearable device, etc., which is not limited in the embodiments of the present application.

[0053] Next, we will briefly introduce the basic implementation process of dynamic taint analysis.

[0054] The process of dynamic taint analysis can include three stages: taint marking, taint propagation, and taint detection.

[0055] Taint marking refers to setting a taint label for the data introduced into the target program to indicate whether the data is tainted data and store the taint label. Currently, when the introduced data is located in a general register, it is possible to indicate whether the data is tainted data by setting a taint label for the general register where the data is currently located, wherein the taint label corresponding to the general register can be stored in other registers. When the introduced data is stored in the memory, it is possible to indicate whether the data is tainted data by setting a taint label for the memory unit where the data is located. Among them, the taint label corresponding to the memory unit can be stored in a shadow memory that has a mapping relationship with the memory unit.

[0056] Taint propagation refers to the process of determining whether the destination operand of the instruction to be analyzed in the target program is tainted based on the taint tag of the source operand of the instruction to be analyzed in the target program and the taint propagation rules, and then updating the taint tag of the destination operand based on the determination result. The destination operand is used to indicate a general register or a memory unit. It can be seen that taint propagation is actually determining whether the information stored in the general register or memory unit indicated by the destination operand is tainted based on the taint tag of the source operand in the instruction, and then updating the taint tag corresponding to the general register or memory unit indicated by the destination operand.

[0057] Taint detection refers to the process of detecting whether the instruction to be analyzed in the target program is a sensitive instruction during the execution of the target program, and if the instruction to be analyzed is a sensitive instruction, detecting whether the operand of the sensitive instruction is a contaminated operand, that is, detecting whether the information stored in the general register or memory unit to be operated by the sensitive instruction is contaminated. If the operand of the sensitive instruction is a contaminated operand, an abnormal alarm is triggered.

[0058] At present, hardware-assisted dynamic taint analysis methods include dynamic taint analysis methods based on coprocessors. In this method, a main processor and a coprocessor may be configured in a computer device. The main processor is used to execute the target program to be detected. In the process of the main processor executing the target program, for any instruction in the target program, the coprocessor can read the taint tag corresponding to the source operand of the instruction, and determine whether the destination operand of the instruction is contaminated according to the taint propagation rule and the taint tag corresponding to the source operand, and then update the taint tag corresponding to the destination operand according to the determination result. In the above introduction, it can be seen that the taint tag of the operand is actually the taint tag corresponding to the general register or memory unit indicated by the operand, and the taint tag corresponding to the general register is stored in other registers, and the taint tag corresponding to the memory unit is stored in the shadow memory. Based on this, when the source operand and / or the destination operand of the instruction indicates a memory unit, the coprocessor can read and / or update the taint tag by accessing the memory during the taint propagation process. In this way, the coprocessor will frequently access the memory during the taint analysis process, and the performance overhead is large.

[0059] Based on this, an embodiment of the present application provides a dynamic taint analysis method based on a coprocessor. In the embodiment of the present application, the coprocessor of the computer device includes multiple registers, which can be used not only to store taint information corresponding to multiple general registers in the main processor of the computer device, but also to store taint information corresponding to the program memory space of the target program currently executed by the main processor. In this way, when the coprocessor performs taint propagation on the first instruction, it can access the taint information of the operand of the first instruction by accessing the multiple registers. Compared with accessing the taint information by accessing the memory, the operation is simpler, faster, and has a lower performance overhead.

[0060] Next, the implementation method of storing taint information through multiple registers of a coprocessor provided in an embodiment of the present application is first introduced.

[0061] In the embodiment of the present application, the coprocessor may include, in addition to general registers, a plurality of registers for storing taint information. The plurality of registers may be used not only to store taint information corresponding to a plurality of general registers in the main processor, but also to store taint information corresponding to the program memory space of the target program currently executed by the main processor.

[0062] Exemplarily, the plurality of registers may store a shadow register file and a taint storage file, wherein the shadow register file includes taint information corresponding to a plurality of general registers of the main processor, and the taint storage file includes taint information corresponding to the program memory space of the target program.

[0063] Next, the taint information corresponding to the program memory space of the target program in the taint storage file is introduced.

[0064] The program memory space of the target program can also be called the process memory space, which is the memory space allocated by the computer device to the target program when the target program is running. The program memory space may include a stack area, a heap area, a global area and a code area. Among them, the stack area is used to store data and heap addresses, and the data can be variables of basic types, such as integers, floating point numbers, strings, etc. The heap address may refer to the starting address of the variable of the object type in the heap area. The space size of the stack area is fixed. In the embodiment of the present application, the stack area may include multiple memory units, wherein the size of each memory unit may be the same. For example, a memory unit may be a byte of memory space. The heap area is a memory space dynamically allocated during the operation of the target program, and therefore, the space size of the heap area is uncertain. The heap area may be used to store variables of the object type. The global area is a memory area for storing global variables and static variables, and the global area may include an uninitialized data segment and an initialized data segment. Among them, the uninitialized data segment may also be called a BSS (block started by symbol) segment, which is used to store global variables and / or static variables that are uninitialized or have an initial value of 0 in the program. The initialized data segment may also be referred to as a data segment, which is used to store initialized global variables and / or static variables in the program. The global area may also include multiple memory cells, wherein the size of each memory cell may be the same. For example, in the embodiment of the present application, as with the stack area, a byte of memory space may also be used as a memory cell. The code area is used to store the executable code of the program.

[0065] Based on the above introduction, in a possible implementation, the taint information corresponding to the program memory space of the target program may include the taint information of the memory unit in the stack area. The taint information corresponding to the memory unit in the stack area may include a taint tag and an information type tag, wherein the taint tag is used to indicate whether the information stored in the memory unit is contaminated, and the information type tag is used to indicate whether the information stored in the memory unit is data or a stack address.

[0066] Exemplarily, the taint information corresponding to each memory unit in the stack area may include two bits. Among them, the high-order bit may be a taint label, when the high-order bit is 0, it is used to indicate that the information stored in the memory unit is not contaminated, and when the high-order bit is 1, it is used to indicate that the information stored in the memory unit has been contaminated. The low-order bit may be an information type label, when the low-order bit is 0, it is used to indicate that the information stored in the memory unit is data, and when the low-order bit is 1, it is used to indicate that the information stored in the memory unit is a heap address. It should be noted that when the low-order bit is 1, since the information stored in the memory unit is a heap address, the high-order bit indicates whether the information stored in the memory unit is contaminated, which actually indicates whether the heap address stored by the memory unit is contaminated, that is, whether the data stored on the heap address stored by the memory unit is contaminated. It can be seen that in the embodiment of the present application, the taint information corresponding to the memory unit in the stack area can indirectly indicate the pollution of the heap area.

[0067] In an embodiment of the present application, the taint information corresponding to each memory unit in the stack area can be stored in the taint storage file in order from high to low according to the address of the memory unit. It should be noted that since the amount of data that can be stored in a register is limited, in an embodiment of the present application, more than one register among the multiple registers can be used to store the taint storage file.

[0068] Optionally, the stain storage file may include a first sub-file, and the stain information corresponding to each memory unit in the stack area may be stored in the first sub-file in sequence according to the address of the memory unit from high to low.

[0069] For example, see Figure 2 , a heap address 0x000863e8 is stored in the memory unit at the address 0x0fffff9f8 in the stack area, and a constant string "BBB" is stored in the area at the heap address 0x000863e8 in the heap area. Assuming that the constant string "BBB" is uncontaminated data, the taint information corresponding to the memory unit at the address 0x0fffff9f8 in the stack area stored in the first sub-file is "01", where "1" is the information type tag of the memory unit, indicating that a heap address is stored in the memory unit at the address 0x0fffff9f8, and "0" is the taint tag of the memory unit, indicating that the data stored in the heap address 0x000863e8 stored in the memory unit at the address 0x0fffff9f8 is uncontaminated data.

[0070] For example, see Figure 2, a local variable array "AAA" is stored in the memory unit at address 0x0fffff9f0 in the stack area. Assuming that the local variable array "AAA" has been contaminated, that is, it is a tainted data, the taint information corresponding to the memory unit at address 0x0fffff9f0 stored in the first sub-file is "10". Among them, "0" is the information type tag of the memory unit, which is used to indicate that the memory unit at address 0x0fffff9f0 stores data, and "1" is the taint tag of the memory unit, which is used to indicate that the data "AAA" stored in the memory unit at address 0x0fffff9f0 is contaminated data, that is, tainted data.

[0071] It can be seen that in the embodiment of the present application, the taint information corresponding to each memory unit in the stack area not only includes a taint tag for indicating whether the information stored in the corresponding memory unit is contaminated, but also includes an information type tag for indicating that the information stored in the corresponding memory unit is data or a heap address. Since the heap address in the stack area can be the starting address of the variable of the object type in the heap area, the taint information corresponding to each memory unit in the stack area can not only mark the pollution of the data stored in the stack area, but also mark the pollution of the variable of the object type in the heap area at the same time. That is, the embodiment of the present application can realize the taint marking based on the granularity of the memory unit for the stack area through the taint information corresponding to each memory unit in the stack area, and at the same time, it can also realize the taint marking based on the variable granularity for the heap area. For example, when the size of a memory unit is one byte, the taint marking of the byte granularity of the stack area and the taint marking of the variable granularity of the heap area can be realized through the taint information corresponding to each memory unit in the stack area.

[0072] Optionally, the taint information corresponding to the program memory space of the target program stored in the multiple registers of the coprocessor may also include taint tags corresponding to the memory units in the global area.

[0073] It should be noted that since the global area is used to store global variables and / or static variables, and global variables and static variables are both value type variables, that is, the global area does not include addresses. Therefore, in an embodiment of the present application, the taint information corresponding to each memory unit in the global area may include a taint label but not an information type label. Based on this, the taint information corresponding to each memory unit in the global area can be represented by a bit, which is the taint label corresponding to the corresponding memory unit. Exemplarily, when the bit is 1, it indicates that the data stored in the corresponding memory unit is contaminated, that is, the data stored in the corresponding memory unit is tainted data. When the bit is 0, it indicates that the data stored in the corresponding memory unit is not contaminated and is not tainted data.

[0074] In an embodiment of the present application, the taint information corresponding to each memory unit in the global area and the taint information of each memory unit in the stack area can be stored in the taint storage file in order from high to low according to the addresses of the memory units.

[0075] Optionally, as described above, the taint storage file may include a second subfile in addition to the first subfile. In this case, the taint information corresponding to each memory unit in the global area may be stored in the second subfile in descending order of the address of the memory unit.

[0076] For example, see Figure 3 , a global variable array “CCC” is stored in the memory unit M1 in the global area. Assuming that the array “CCC” is tainted data, the taint information corresponding to the memory unit M1 stored in the second sub-file may be 1.

[0077] It can be seen that in the embodiment of the present application, the taint information corresponding to each memory unit in the global zone can be used to implement the taint marking based on the granularity of the memory unit for the global zone. For example, when one byte is one memory unit, the taint marking based on the byte granularity for the global zone can be implemented through the taint information corresponding to each memory unit in the global zone.

[0078] The above mainly introduces the taint storage file, and introduces the taint information corresponding to multiple general registers in the main processor stored in the shadow register file.

[0079] A general register may refer to a register used to transmit or temporarily store data. Exemplarily, a plurality of general registers in a main processor may include an accumulator, a counter, a base address register, etc. For example, when the main processor is a processor of RSIC-V architecture, the main processor may include 31 general registers.

[0080] In an embodiment of the present application, the taint information corresponding to the general register in the main processor may include a taint tag and an information type tag, wherein the taint tag is used to indicate whether the information stored in the general register is contaminated, and the information type tag is used to indicate that the information stored in the general register is data or a stack address.

[0081] Optionally, when the information type tag corresponding to the general register indicates that the information stored in the general register is a heap address, the taint information corresponding to the general register may also include a storage address of the heap address stored in the general register in the program memory space.

[0082] Exemplarily, in an embodiment of the present application, the taint information corresponding to the general register may include N bits, where N is not less than M+2, and M is the number of bits of the memory address. For example, when M is equal to 16, N may be equal to 32 or 64. Based on this, the highest bit of the N bits may be a taint tag. When the highest bit is 0, that is, when the taint tag is 0, it is used to indicate that the information stored in the corresponding general register is not polluted; when the highest bit is 1, that is, when the taint tag is 1, it is used to indicate that the information stored in the corresponding general register is polluted. The second highest bit of the N bits may be an information type tag. When the second highest bit is 0, that is, when the information type tag is 0, it is used to indicate that the information stored in the corresponding general register is data. In this case, the remaining bits of the N bits may all be 0; when the second highest bit is 1, that is, when the information type tag is 1, it is used to indicate that the information stored in the corresponding general register is a stack address. In this case, the remaining bits of the N bits may represent the storage address of the stack address in the stack area of ​​the program memory space. In addition, when the information stored in the general register is a heap address, the taint tag corresponding to the general register indicates whether the heap address is not tainted, which actually indicates whether the data stored in the heap address is not tainted. It can be seen that in the embodiment of the present application, the taint information corresponding to the general register can not only indicate whether the data in the general register is tainted, but also indicate whether the data in the heap area is tainted.

[0083] In an embodiment of the present application, the taint information corresponding to each general register can be stored in a shadow register file. It should be noted that, since the amount of data that can be stored in a register is limited, in an embodiment of the present application, the shadow register file can be stored by more than one register among the multiple registers. Exemplarily, each general register in the main processor can be mapped to one of the multiple registers included in the coprocessor, that is, each general register has a mapping relationship with one of the multiple registers in the coprocessor for storing taint information, so that the taint information corresponding to each general register in the shadow register file can be stored in the register that has a mapping relationship with the general register.

[0084] For example, see Figure 4, the general register t0 in the main processor stores a stack address 0x000863e8. Assuming that the storage address of the stack address in the stack area is 0x0fffff9f8, and the data stored on the stack address is not polluted, the taint information corresponding to the general register t0 in the shadow register file is 01 0x0fffff9f8, and the taint information can be stored in the register t0' that has a mapping relationship with the general register t0. Among them, the second highest bit "1" in the taint information is used to indicate that the general register t0 stores a stack address, the highest bit "0" is used to indicate that the data in the stack address stored in the general register t0 is not polluted, and the remaining bits "0x0fffff9f8" are the storage address of the stack address stored in the general register t0 in the stack area.

[0085] Still Figure 4 For example, the general register t1 in the main processor stores data 0x0000000a. Assuming that the data is tainted data, the taint information corresponding to the general register t1 in the shadow register file can be 100x00000000, and the taint information can be stored in the register t1' that has a mapping relationship with the general register t1. Among them, the second highest bit "0" in the taint information is used to indicate that the general register t1 stores a data, and the highest bit "1" is used to indicate that the data stored in the general register t1 is polluted and is a tainted data. Since the general register t1 stores data, the remaining bits are "0x00000000".

[0086] It should be noted that in the above Figures 2 to 4 The stack address, general register, data stored in the memory unit, and the address of the memory unit shown are examples given in the embodiment of the present application to illustrate the implementation method of the taint information, and do not constitute a limitation on the embodiment of the present application.

[0087] Based on the implementation method of the stain information introduced above, the embodiment of the present application can be Figure 5 The taint analysis method shown is used to perform dynamic taint analysis, wherein the method can be applied to a coprocessor included in a computer device, see Figure 5 , the method comprises the following steps:

[0088] Step 501: Get the first instruction.

[0089] In an embodiment of the present application, an executable file of a target program after being plugged in may be stored in a computer device. The executable file may be a binary file, and the executable file of the target program after being plugged in includes a code for implementing the main processor to send instruction information to the coprocessor so that the coprocessor can perform taint analysis. The main processor may execute the executable file of the target program to execute the target program. After each execution of an instruction in the target program by the main processor, instruction information of the instruction may be generated, and the instruction information of the instruction may be sent to the coprocessor. The instruction information of the instruction may include an execution log of the instruction, and the execution log of the instruction may include the undecoded instruction. In addition, the execution log of the instruction may also include the program counter value of the instruction, the address of the memory unit and / or general register used by the instruction, and the data used by the instruction. The program counter value of the instruction is used to indicate the storage location of the instruction in the memory.

[0090] Exemplarily, when the main processor is a processor of RISC-V architecture, after generating the instruction information of the instruction, the main processor can send the instruction information to the coprocessor through the RoCC interface. After receiving the instruction information, the coprocessor can decode the undecoded instruction included in the instruction information to obtain the first instruction.

[0091] The first instruction may include an operation code and an operand. The operation code is used to indicate the operation to be performed by the first instruction, and the operand is used to indicate the object to be operated by the first instruction. When the first instruction is a dual-operand instruction, the operand of the first instruction may include a destination operand and a source operand. The destination operand may be used to indicate a first general register among multiple general registers in the main processor or a first memory unit in the program memory space of the target program. The first general register or the first memory unit is the storage location of the data after the first instruction operation. The source operand may be an immediate number, in which case the immediate number is the data to be operated. Alternatively, the source operand may also be used to indicate a second general register among multiple general registers of the main processor or a second memory unit in the program memory space of the target program. The second general register or the second memory unit is the storage location of the data to be operated. Optionally, when the first instruction is a single-operand instruction, the first instruction may include an operand, in which case the operand is both a source operand and a destination operand.

[0092] Optionally, in a possible implementation, the coprocessor may include an instruction information queue for storing instruction information. In this way, after receiving the instruction information sent by the main processor, the coprocessor may store the instruction information in the instruction information queue. Accordingly, the coprocessor may read the first instruction information from the instruction information queue, and decode the undecoded instruction included in the first instruction information, thereby obtaining the first instruction.

[0093] It should be noted that the instruction information queue can be a first-in-first-out queue. Based on this, the coprocessor can put the instruction information sent by the main processor into the tail of the instruction information queue, and read the first instruction information from the head of the instruction information queue. In this way, multiple instruction information submitted by the main processor can be cached through the instruction information queue, and the coprocessor can perform the operations of receiving instruction information and reading and processing instruction information in parallel, thereby improving processing efficiency. Moreover, compared with the method in which the main processor submits one instruction information each time and waits for the coprocessor to complete the analysis before executing the next instruction to submit the next instruction information, the performance overhead caused by the coprocessor blocking the main processor can be effectively reduced.

[0094] Optionally, the target program may contain instructions that are irrelevant to the taint analysis, for example, some instructions that will not cause taint propagation. Based on this, the coprocessor can also filter the instruction information received from the main processor, store the instruction information of instructions related to the taint analysis into the instruction information queue, and discard the instruction information of instructions that are irrelevant to the taint analysis, so as to reduce the number of instructions to be analyzed by the coprocessor, thereby reducing the load and power consumption of the coprocessor.

[0095] Exemplarily, in an embodiment of the present application, when the target program is instrumented, a set of customized auxiliary filtering instructions can be set in advance for the instructions contained in the target program that are not related to the taint analysis. Among them, the auxiliary filtering instructions can include a start filtering instruction and a stop filtering instruction. The start filtering instruction can be inserted before the instruction to be filtered, and the stop filtering instruction can be inserted after the instruction to be filtered, that is, the instruction between the start filtering instruction and the stop filtering instruction is the instruction to be filtered. When the main processor detects an auxiliary filtering instruction during the execution of the target program, it can not execute the auxiliary filtering instruction, but send the auxiliary filtering instruction directly to the coprocessor. Based on this, if the coprocessor receives the start filtering instruction in the auxiliary filtering instruction sent by the main processor, then from the start filtering instruction, each instruction information sent by the main processor that is subsequently received will be discarded until the stop filtering instruction is received, and each instruction information received will continue to be stored in the instruction information queue.

[0096] Optionally, in some possible situations, the number of instruction information that can be stored in the instruction information queue is certain. Based on this, after the coprocessor puts the received instruction information into the instruction information queue, it can also detect whether the instruction information queue is full. If the instruction information queue is full, the coprocessor can send an interrupt instruction to the main processor to instruct the main processor to interrupt the sending of instruction information.

[0097] Exemplarily, the instruction information queue can store a preset number of instruction information. Based on this, the coprocessor can detect the number of instruction information stored in the current instruction information queue. If the number of instruction information stored is equal to the preset number, the coprocessor can send an interrupt instruction to the main processor. After receiving the interrupt instruction, the main processor can suspend the execution of the target program's instructions, thereby suspending the sending of instruction information to the coprocessor, and query the coprocessor at preset time intervals whether the number of instruction information in the instruction information queue is less than the preset number. If the number of instruction information in the instruction information queue is less than the preset number, the main processor starts to continue to execute the instructions in the target program, and continues to send instruction information of the executed instructions to the coprocessor.

[0098] Optionally, in a possible implementation, after the coprocessor decodes an undecoded instruction in an instruction information to obtain a decoded instruction, the decoded instruction may be stored in an instruction cache queue. Accordingly, the coprocessor may read the first instruction from the instruction cache queue. The instruction cache queue is used to store multiple decoded instructions.

[0099] It should be noted that the instruction cache queue can be a first-in-first-out queue. Each time the coprocessor decodes an instruction, the instruction can be stored at the end of the instruction cache queue. Correspondingly, the coprocessor can read the first instruction to be analyzed from the head of the instruction cache queue. By storing multiple decoded instructions in the instruction cache queue, the operation of the coprocessor obtaining instruction information and decoding instructions can be decoupled from the operation of reading the decoded instructions for taint analysis, and they can be executed in parallel in a pipeline manner, thereby improving the efficiency of the coprocessor in taint analysis.

[0100] Step 502: According to the taint propagation rule corresponding to the first instruction, update the taint information corresponding to the first general register or the first memory unit indicated by the destination operand of the first instruction stored in multiple registers of the coprocessor, the multiple general registers of the main processor include the first general register, and the program memory space includes the first memory unit.

[0101] After acquiring the first instruction, the coprocessor can determine the instruction type of the first instruction according to the operation code of the first instruction. If the instruction type of the first instruction is neither a taint detection type nor a taint marking type, the coprocessor can determine the taint propagation rule corresponding to the first instruction from a plurality of pre-configured taint propagation rules according to the instruction type of the first instruction, and acquire the taint information corresponding to the source operand of the first instruction. Afterwards, the coprocessor can update the taint information corresponding to the first general register or the first memory unit indicated by the destination operand of the first instruction according to the acquired taint propagation rule corresponding to the first instruction and the taint information corresponding to the source operand, thereby completing the taint propagation of the first instruction.

[0102] It should be noted that in the embodiment of the present application, instructions can be divided into different types according to the operation to be performed by the instruction indicated by the instruction opcode. Exemplarily, the instruction types may include five types, namely, arithmetic and logic unit (ALU) type, load type, store type, stain detection type, and stain marking type.

[0103] The ALU instructions are instructions for implementing arithmetic and logical operations, such as add instructions and and instructions.

[0104] The load class instruction refers to an instruction used to implement loading data into a general register. For example, the load class instruction may include a load instruction, a mov instruction, and the like.

[0105] Store instructions are instructions used to store data in memory. For example, store instructions may include store instructions, mov instructions, etc. It is worth noting that, depending on the type of source operands and destination operands in the mov instruction, the mov instruction can be used to transfer data in the memory to the register, or to transfer data in the register to the memory. Therefore, the instruction type corresponding to the opcode of the mov instruction may include load and store.

[0106] The taint detection class instruction may refer to an instruction that triggers taint detection. For example, the taint detection class instruction may include instructions for implementing jumps and outputs, such as jump instructions. Since the taint detection class instruction is used to trigger taint detection, in the embodiment of the present application, the taint detection class instruction does not participate in taint propagation, that is, for the taint detection class instruction, the coprocessor can directly perform taint detection based on the taint detection class instruction without performing taint propagation.

[0107] Taint marking instructions are instructions for setting initial taint information for data introduced from the outside. From the above introduction to the implementation method of taint information, it can be seen that in the embodiment of the present application, the taint information corresponding to the memory unit in the stack area and the taint information corresponding to the general register not only include a taint tag for indicating whether the stored information is contaminated, but also include an information type tag for indicating whether the stored information is data or a stack address. Based on this, in the embodiment of the present application, taint marking instructions may include taint marking instructions and address marking instructions. Among them, the taint marking instruction is used to set the initial taint tag for the data introduced from the outside, and the address marking instruction is used to mark the information stored in the general register or memory unit as a stack address. Through the taint marking instruction and the address marking instruction, the initial setting of the taint information introduced above can be implemented.

[0108] For example, the instruction format of the taint marking instruction may be taint a,b. Wherein, a is the destination operand, b is the source operand, and both a and b are register identifiers. Based on this, when a is rs1 and b is 0, it means that the information currently stored in the general register rs1 is polluted. In this case, the taint tag included in the taint information corresponding to rs1 in the shadow register file may be set to 1 to indicate that rs1 is polluted. Optionally, when a is not 0 and b is rs2, what is stored in the general register rs2 is an offset, wherein the offset is used to indicate a memory unit in the program memory space. In this case, based on the offset in rs2, the taint tag included in the taint information of the memory unit indicated by the offset in the program memory space stored in the taint storage file may be set to 1 to indicate that the information stored in the memory unit is polluted.

[0109] Optionally, when a is not 0, for example, when a is rs1, the information stored in the general register rs1 may be a type value, which is used to indicate whether the memory unit indicated by the offset in rs2 is a memory unit in the stack area of ​​the program memory space or a memory unit in the global area. For example, when the type value is 0, it is used to indicate that the memory unit indicated by the offset is a memory unit in the stack area, and when the type value is 1, it is used to indicate that the memory unit indicated by the offset is a memory unit in the global area. In this way, based on the type value, the coprocessor can determine whether to set the taint label of the memory unit in the first subfile or the second subfile of the taint storage file.

[0110] The instruction format of the address tag instruction can be src c, d. Among them, c is the destination operand, d is the source operand, and c and d are both register identifiers. When c is 0 and d is rs1, it means that a stack address is stored in the general register rs1. In this case, the information type tag included in the taint information corresponding to rs1 in the shadow register file can be set to 1. Optionally, when c is not 0 and d is rs2, what is stored in the general register rs2 is an offset, and the offset is used to indicate a memory unit in the program memory space. In this way, based on the offset in rs2, the information type tag included in the taint information of the memory unit indicated by the offset stored in the taint storage file can be set to 1 to indicate that the memory unit stores a stack address.

[0111] Optionally, when c is not 0, for example, when c is rs1, the information stored in the general register rs1 may be a type value, which is used to indicate whether the memory unit indicated by the offset in rs2 is a memory unit in the stack area of ​​the program memory space or a memory unit in the global area. The implementation of the type value may refer to the implementation of the type value in the taint mark instruction described above. In this way, based on the type value in the address mark instruction, the coprocessor may determine whether to set the information type tag corresponding to the memory unit in the first subfile or the second subfile.

[0112] It is worth noting that since the taint mark class instructions are used to set the initial taint information, the taint mark class instructions do not participate in taint propagation, that is, for the taint mark class instructions, the coprocessor does not perform taint propagation operations. In addition, in an embodiment of the present application, after detecting the taint mark class instructions, the main processor can ignore the taint mark class instructions, generate an execution log of the taint mark class instructions, and send the instruction log as the instruction information of the taint mark class instructions to the coprocessor. Among them, the execution log of the taint mark class instructions may include undecoded instructions, the address of the register used by the instruction, and the data used by the instruction, wherein the data used by the instruction includes the information stored in the register used by the instruction, such as the offset.

[0113] Based on the above introduction, a first mapping relationship may be pre-configured in the coprocessor, and the first mapping relationship may include the above-mentioned instruction type and the corresponding opcode. Among them, one opcode may correspond to one instruction type or may correspond to multiple instruction types, and one instruction type may correspond to at least one opcode. On this basis, the coprocessor can obtain the instruction type corresponding to the opcode of the first instruction from the first mapping relationship. If the instruction type obtained is one, the instruction type obtained is the instruction type of the first instruction. Optionally, if the instruction type obtained is multiple, the coprocessor can select one from the multiple instruction types obtained as the instruction type of the first instruction according to the operand of the first instruction.

[0114] For example, for a mov instruction, the instruction type obtained may include a load class and a store class. In this case, the coprocessor may select an instruction type according to the destination operand of the mov instruction. For example, if the destination operand of the mov instruction indicates a memory unit, the instruction type of the first instruction is a store class. If the destination operand of the mov instruction indicates a general register, the instruction type of the first instruction is a load class.

[0115] After obtaining the instruction type of the first instruction, if the instruction type of the first instruction is neither a taint detection type nor a taint marking type, the coprocessor may obtain a taint propagation rule corresponding to the first instruction based on the instruction type of the first instruction.

[0116] Exemplarily, a second mapping relationship may be pre-configured in the coprocessor. The second mapping relationship includes instruction types and corresponding taint propagation rules. Based on this, the coprocessor may obtain the taint propagation rule corresponding to the instruction type of the first instruction from the second mapping relationship, and the obtained taint propagation rule is the taint propagation rule corresponding to the first instruction.

[0117] It should be noted that, from the above introduction, it can be seen that the taint detection class instructions and the taint marking class do not participate in taint propagation. Therefore, the second mapping relationship can include the taint propagation rules corresponding to the ALU class, load class and store class, but does not include the taint propagation rules corresponding to the taint detection class and the taint marking class.

[0118] Among them, for ALU class instructions, when the main processor executes this type of instruction, the data involved is usually transferred between general registers. Therefore, the taint propagation rule corresponding to the ALU class can be to propagate the taint information corresponding to the general register indicated by the source operand to the general register indicated by the destination operand.

[0119] For load class instructions, when the main processor executes this type of instruction, the data will be transferred to the general register. Therefore, the taint propagation rule corresponding to the load class can be to propagate the taint information corresponding to the source operand to the general register indicated by the destination operand.

[0120] For store class instructions, when the main processor executes this type of instruction, the data will be transferred to the memory. Therefore, the taint propagation rule corresponding to the store class can be to propagate the taint information corresponding to the source operand to the memory unit indicated by the destination operand.

[0121] In addition to obtaining the taint propagation rules corresponding to the first instruction, the coprocessor can also obtain the taint information corresponding to the source operand of the first instruction. Afterwards, the coprocessor can update the taint information corresponding to the first general register or the first memory unit indicated by the destination operand of the first instruction based on the taint propagation rules corresponding to the first instruction and the taint information corresponding to the source operand of the first instruction.

[0122] As can be seen from the above introduction, the source operand can be an immediate number, or it can be used to indicate a general register or a memory unit. Based on this, in the first possible case, if the source operand of the first instruction is an immediate number, then the taint information corresponding to the source operand will not exist in the multiple registers corresponding to the coprocessor at this time. In addition, since the first instruction is not a taint mark instruction, the coprocessor can determine that the source operand is not tainted data. In this case, the coprocessor can determine that the information stored in the first general register or the first memory unit indicated by the destination operand of the first instruction is not contaminated based on the taint propagation rule corresponding to the first instruction, and then update the taint tag in the taint information corresponding to the first general register in the shadow register file to 0, or update the taint tag in the taint information corresponding to the first memory unit in the taint storage file to 0. In addition, since the source operand is an immediate number, after the instruction code operation of the first instruction, the information stored in the first general register or the first memory unit indicated by the destination operand will also be data. In this case, the coprocessor can also update the information type tag included in the taint information corresponding to the first general register or the first memory unit to 0, so as to indicate that the first general register or the first memory unit stores data.

[0123] In a second possible scenario, if the source operand of the first instruction indicates the second general register, the coprocessor may obtain the taint information corresponding to the second general register from the shadow register file. Afterwards, the coprocessor may update the taint information corresponding to the first general register or the first memory unit based on the taint propagation rule corresponding to the first instruction and the taint information corresponding to the second general register.

[0124] Exemplarily, if the first instruction is an ALU instruction, the destination operand of the first instruction may be used to indicate the first general register. In this case, the coprocessor may directly update the taint information corresponding to the first general register in the shadow register file to the taint information corresponding to the second general register.

[0125] Optionally, if the first instruction is a store-type instruction, the destination operand of the first instruction may be used to indicate the first memory unit. In this case, the coprocessor may update the taint tag in the taint information corresponding to the first memory unit in the taint storage file to the taint tag in the taint information corresponding to the second general register, and update the information type tag in the taint information corresponding to the first memory unit to the information type tag in the taint information corresponding to the second general register.

[0126] It should be noted that the destination operand of the first instruction can indicate the address of the first memory unit. Therefore, the coprocessor can search for the taint information corresponding to the first memory unit from the taint storage file based on the address of the first memory unit indicated by the destination operand, and then update the taint information corresponding to the first memory unit.

[0127] Optionally, when the information type tag in the taint information corresponding to the second general register indicates that a stack address is stored in the second general register, the taint information corresponding to the second general register will also include the storage address of the stack address in the program memory space, and the storage address is the address of the first memory unit. In this case, the coprocessor can also search for the taint information corresponding to the first memory unit in the taint storage file based on the storage address of the stack address in the program memory space recorded in the taint information corresponding to the second general register, and then update the taint information corresponding to the first memory unit.

[0128] In a third possible scenario, if the source operand of the first instruction indicates the second memory unit, the coprocessor may obtain the taint information corresponding to the second memory unit from the taint storage file. Afterwards, the coprocessor may update the taint information corresponding to the first general register or the first memory unit based on the taint propagation rule corresponding to the first instruction and the taint information corresponding to the second memory unit.

[0129] If the first instruction is a load instruction, the destination operand of the first instruction may indicate the first general register. Based on this, the coprocessor may update the taint tag in the taint information corresponding to the first general register in the shadow register file to the taint tag in the taint information corresponding to the second memory unit.

[0130] In addition, if the information type tag in the taint information corresponding to the second memory unit indicates that the information stored in the second memory unit is data, the coprocessor may update the information type tag in the taint information corresponding to the first general register to the information type tag corresponding to the second memory unit, and update the other bits except the taint tag and the information type tag in the taint information corresponding to the first general register to 0. If the information type tag in the taint information corresponding to the second memory unit indicates that the information stored in the second memory unit is a heap address, the coprocessor may obtain the address of the second memory unit, and then update the information type tag in the taint information corresponding to the first general register to the information type tag corresponding to the second memory unit, and update the other bits except the taint tag and the information type tag in the taint information corresponding to the first general register to the address of the second memory unit.

[0131] The above mainly introduces the process in which the coprocessor performs taint propagation based on the taint propagation rule corresponding to the first instruction when the first instruction includes two operands, that is, the first instruction is a dual-operand instruction. In some possible cases, the first instruction may also be a single-operand instruction. In this case, the operand included in the first instruction is both a source operand and a destination operand. Therefore, the coprocessor can also perform taint propagation based on the above method.

[0132] For any instruction information sent by the main processor, the coprocessor can perform taint propagation on the corresponding instruction through the above method after determining that the decoded instruction corresponding to the instruction information is not a taint detection instruction or a taint marking instruction. For taint detection instructions, the coprocessor can perform taint detection through step 503.

[0133] Step 503: Perform stain detection according to the stain information stored in the multiple registers.

[0134] Exemplarily, after the coprocessor performs taint propagation on the first instruction through the above method, the coprocessor may obtain the second instruction through the method described in the above step 501. If the second instruction is a sensitive instruction and the taint information corresponding to the general register or memory unit indicated by the operand of the second instruction indicates that the stored information is contaminated, the coprocessor may send an interrupt instruction to the main processor and write the program counter value of the second instruction in the specified memory area.

[0135] Wherein, the coprocessor can determine the instruction type of the second instruction according to the operation code of the second instruction. If the instruction type of the second instruction is a taint detection type, the second instruction can be determined to be a sensitive instruction. In this case, the coprocessor can obtain the taint information corresponding to the general register or memory unit indicated by the operand of the second instruction from the taint information stored in multiple registers. Wherein, the operand of the second instruction may include the source operand and / or the destination operand of the second instruction. If the taint tag in the taint information corresponding to the general register or memory unit indicated by the operand of the second instruction indicates that the corresponding general register or memory unit is polluted, it means that the operation performed by the second instruction is an abnormal operation, which may cause information security problems. Therefore, the coprocessor can send an interrupt instruction to the main processor to prompt the main processor. In addition, the coprocessor can also store the program counter value included in the instruction information of the second instruction in a designated memory area. Wherein, the designated memory area is a pre-designated area in the memory for storing the program counter value of the instruction that performs the abnormal operation detected most recently.

[0136] It should be noted that, as can be seen from the introduction in the aforementioned step 501, the coprocessor may include an instruction information queue, and, when the instruction information queue is full, the coprocessor may also send an interrupt instruction to the main processor. Based on this, in an embodiment of the present application, after receiving the interrupt instruction, the main processor may check whether a program count value is stored in the designated memory area. If a program count value is stored in the designated memory area, it can be determined that the interrupt is triggered by an instruction that performs an abnormal operation. In this case, the main processor may interrupt the execution of instructions in the target program, and perform subsequent processing based on the program count value in the designated memory area, delete the program count value in the designated memory area after the processing is completed, and continue to execute subsequent instructions in the target program. Optionally, if the designated memory area is empty, the main processor may determine that the interrupt instruction is an interrupt triggered by a full instruction information queue. In this case, the main processor may interrupt the execution of instructions in the target program, and query whether the instruction information queue is full through the method introduced in the aforementioned step 501. If it is found that the instruction information queue is not full, the subsequent instructions in the target program will continue to be executed.

[0137] In an embodiment of the present application, the coprocessor of the computer device includes a plurality of registers, which can be used not only to store the taint information corresponding to the plurality of general registers in the main processor of the computer device, but also to store the taint information corresponding to the program memory space of the target program currently executed by the main processor. In this way, when the coprocessor performs taint propagation on the first instruction, it can access the taint information of the operand of the first instruction by accessing the plurality of registers, which is simpler to operate, faster, and has a lower performance overhead than accessing the taint information by accessing the memory.

[0138] In addition, in an embodiment of the present application, the taint information corresponding to each memory unit in the stack area of ​​the program memory space includes not only a taint tag for indicating whether the information stored in the corresponding memory unit is contaminated, but also an information type tag for indicating that the information stored in the corresponding memory unit is data or a heap address. Since the heap address in the stack area can be the starting address of the variable of the object type in the heap area, the taint information corresponding to each memory unit in the stack area can not only mark the pollution of the data stored in the stack area, but also indirectly mark the pollution of the variable of the object type in the heap area. That is, the embodiment of the present application can realize the taint marking based on the granularity of the memory unit for the stack area through the taint information corresponding to each memory unit in the stack area, and at the same time, it can also realize the taint marking based on the variable granularity for the heap area. For example, when the size of a memory unit is one byte, the taint marking of the byte granularity of the stack area and the taint marking of the variable granularity of the heap area can be realized through the taint information corresponding to each memory unit in the stack area. In this way, compared with setting a taint tag for each memory unit in the stack area and the heap area of ​​the program memory space, the data amount of the taint tag is reduced, thereby reducing the storage space used to store the taint tag.

[0139] Based on the taint analysis method described in the above embodiment, the present application embodiment also provides a detailed process of a main processor deployed with RSIC-V architecture controlling a corresponding coprocessor to perform taint analysis. Figure 6As shown, the processing core of the main processor can send the execution log of the instruction to the coprocessor through the RoCC interface. The coprocessor can filter the execution log of the received instruction, and store the instruction information of the filtered instructions related to the taint analysis in the instruction information queue Q1. Correspondingly, the coprocessor can obtain the instruction information from the instruction information queue, decode the undecoded instructions in the instruction information, and store the decoded instructions in the instruction cache queue Q2. The coprocessor can obtain the current instruction to be analyzed from the instruction cache queue Q2. If the instruction is not a taint detection instruction and is not a taint marking instruction, the taint propagation rule corresponding to the instruction is obtained from the pre-set taint propagation rules, and the shadow register file and the taint storage file are updated based on the taint propagation rule of the instruction to complete the taint propagation. If the instruction is a taint detection instruction, taint detection is performed by reading the taint information in the shadow register and / or the taint storage file. When it is determined based on the read taint information that the general register or memory unit used by the instruction is polluted, it can be considered that an abnormality is detected. In this case, the coprocessor can send an interrupt instruction to the processing core of the main processor and write the program counter value of the instruction to the shared data cache of the main processor and the coprocessor. If the instruction is a taint marking instruction, the coprocessor can write the taint information corresponding to the general register or memory unit used by the instruction in the shadow register file or the taint storage file based on the instruction. Among them, the implementation method of the coprocessor obtaining the instruction, performing taint marking, taint propagation, and taint detection based on the instruction can refer to the implementation method described in the aforementioned embodiment, and the embodiments of the present application will not be repeated here.

[0140] It should be noted that, in the embodiment of the present application, the coprocessor in the above-mentioned computer device can be a hardware accelerator specifically used for dynamic taint analysis of programs running in the main processor. Based on this, in order to enable the coprocessor to work normally, before using the coprocessor, the coprocessor can first be deployed with corresponding hardware and software.

[0141] Exemplarily, when performing hardware deployment, first use the open source operating system on the computer device to generate a source file, which is used to program the FPGA of the coprocessor so that the FPGA of the coprocessor has a logic circuit that can implement the above-mentioned stain analysis method. After the source file is generated, the source file can be loaded and analyzed using the integrated design component, and the source file is combined with various constraints provided by the integrated design component to finally generate a bitstream file. The bitstream file is burned, and the burned file is loaded into the FPGA of the coprocessor to realize the programming of the FPGA of the coprocessor, thereby completing the hardware deployment of the coprocessor.

[0142] When deploying software, first obtain a source code package containing common Linux commands and tools, and compile the source code package. Then, set the initial RAM file system; compile the Linux kernel; then compile the bootloader; then modify the cross compiler so that the modified cross compiler can perform source code stubs during the compilation of the target program, and obtain the executable file of the inserted target program for execution by the main processor. In addition, the modified cross compiler can also compile the source code for implementing the taint analysis method provided in the embodiment of the present application into an executable file that can be executed by the coprocessor, so that the coprocessor can implement the taint analysis method provided in the embodiment of the present application by executing the executable file.

[0143] Next, the stain analysis device provided in the embodiment of the present application is introduced.

[0144] Figure 7 700 is a schematic diagram of the structure of a taint analysis device 700 provided in an embodiment of the present application. The device can be deployed in the coprocessor of the computer device in the aforementioned embodiment. The coprocessor includes multiple registers, which are used to store taint information corresponding to multiple general registers in the main processor of the computer device and taint information corresponding to the program memory space of the target program currently executed by the main processor. Figure 7 As shown, the taint analysis device includes an instruction acquisition module 701 and a taint propagation module 702 .

[0145] The instruction acquisition module 701 is used to execute step 501 in the above embodiment;

[0146] The taint propagation module 702 is used to execute step 502 in the aforementioned embodiment.

[0147] Optionally, the program memory space includes a stack area, and the taint information corresponding to the program memory space includes taint information corresponding to the memory units in the stack area, and the taint information corresponding to the memory units in the stack area includes a taint tag and an information type tag, and the taint tag corresponding to the memory unit is used to indicate whether the information stored in the memory unit is contaminated, and the information type tag corresponding to the memory unit is used to indicate that the information stored in the memory unit is data or a stack address.

[0148] Optionally, the program memory space also includes a global area, and the taint information corresponding to the program memory space also includes a taint tag corresponding to a memory unit in the global area.

[0149] Optionally, the taint information corresponding to the general register includes a taint tag and an information type tag. The taint tag corresponding to the general register is used to indicate whether the information stored in the general register is contaminated. The information type tag corresponding to the general register is used to indicate that the information stored in the general register is data or a heap address. When the information type tag corresponding to the general register indicates that the information stored in the general register is a heap address, the taint information corresponding to the general register also includes the storage address of the heap address stored in the general register in the program memory space.

[0150] Optionally, the instruction acquisition module 701 is specifically used for:

[0151] A first instruction is read from an instruction cache queue, where the instruction cache queue is used to store a plurality of decoded instructions, where the plurality of instructions are instructions executed by a main processor in a target program.

[0152] Optionally, the instruction acquisition module 701 is further used to:

[0153] Reading first instruction information from an instruction information queue, the instruction information queue is used to store multiple instruction information sent by the main processor, the first instruction information includes an undecoded instruction;

[0154] The undecoded instruction included in the first instruction information is decoded to obtain a first instruction, and the first instruction is stored in the instruction cache queue.

[0155] Optionally, the device 700 is further used for:

[0156] If the instruction information queue is full, an interrupt instruction is sent to the main processor, and the interrupt instruction is used to instruct the main processor to interrupt the sending of instruction information.

[0157] Optionally, the device 700 further includes:

[0158] The stain detection module 703 is used to perform stain detection according to the stain information stored in the multiple registers.

[0159] Optionally, the instruction acquisition module 701 is also used to acquire a second instruction, which is an instruction in the target program; the taint detection module 703 is specifically used to: if the second instruction is a sensitive instruction and the taint information corresponding to the general register or memory unit indicated by the operand of the second instruction indicates that the stored information is contaminated, then an interrupt instruction is sent to the main processor, and the program count value of the second instruction is written in the designated memory area.

[0160] Optionally, the main processor and the coprocessor are processors based on RISC-V architecture.

[0161] In an embodiment of the present application, the coprocessor of the computer device includes a plurality of registers, which can be used not only to store the taint information corresponding to the plurality of general registers in the main processor of the computer device, but also to store the taint information corresponding to the program memory space of the target program currently executed by the main processor. In this way, when the coprocessor performs taint propagation on the first instruction, it can access the taint information of the operand of the first instruction by accessing the plurality of registers, which is simpler to operate, faster, and has a lower performance overhead than accessing the taint information by accessing the memory.

[0162] It should be noted that the division of modules in the stain analysis device provided in the above embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a circuit, or may exist physically separately, or two or more modules may be integrated into one module. The above integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0163] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a processor of a computer device to execute all or part of the steps of the method of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0164] In addition, the stain analysis device and the stain analysis method provided in the above embodiment belong to the same concept, and the specific implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0165] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

Claims

1. A stain analysis method, characterized in that: A coprocessor applied to a computer device, the coprocessor comprising a plurality of registers, the plurality of registers being used to store taint information corresponding to a plurality of general registers in a main processor of the computer device, and taint information corresponding to a program memory space of a target program currently executed by the main processor, the method comprising: Obtaining a first instruction, where the first instruction is an instruction in the target program; According to the taint propagation rule corresponding to the first instruction, the taint information corresponding to the first general register or the first memory unit indicated by the destination operand of the first instruction is updated, the multiple general registers include the first general register, and the program memory space includes the first memory unit.

2. The method according to claim 1, characterized in that The program memory space includes a stack area, and the taint information corresponding to the program memory space includes the taint information corresponding to the memory unit in the stack area, and the taint information corresponding to the memory unit in the stack area includes a taint tag and an information type tag, and the taint tag corresponding to the memory unit is used to indicate whether the information stored in the memory unit is contaminated, and the information type tag corresponding to the memory unit is used to indicate that the information stored in the memory unit is data or a stack address.

3. The method according to claim 2, characterized in that The program memory space also includes a global area, and the taint information corresponding to the program memory space also includes a taint tag corresponding to a memory unit in the global area.

4. The method according to any one of claims 1 to 3, characterized in that: The taint information corresponding to the general register includes a taint tag and an information type tag. The taint tag corresponding to the general register is used to indicate whether the information stored in the general register is contaminated. The information type tag corresponding to the general register is used to indicate that the information stored in the general register is data or a heap address. When the information type tag corresponding to the general register indicates that the information stored in the general register is a heap address, the taint information corresponding to the general register also includes a storage address of the heap address stored in the general register in the program memory space.

5. The method according to any one of claims 1 to 4, characterized in that: The obtaining of the first instruction comprises: The first instruction is read from an instruction cache queue, where the instruction cache queue is used to store a plurality of decoded instructions, where the plurality of instructions are instructions in the target program that have been executed by the main processor.

6. The method according to claim 5, characterized in that The method further comprises: Reading first instruction information from an instruction information queue, the instruction information queue being used to store a plurality of instruction information sent by the main processor, the first instruction information comprising an undecoded instruction; The undecoded instruction included in the first instruction information is decoded to obtain the first instruction, and the first instruction is stored in the instruction cache queue.

7. The method according to claim 6, characterized in that The method further comprises: If the instruction information queue is full, an interrupt instruction is sent to the main processor, where the interrupt instruction is used to instruct the main processor to interrupt the sending of instruction information.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Performing stain detection according to the stain information stored in the plurality of registers.

9. The method according to claim 8, characterized in that The performing stain detection according to the stain information stored in the plurality of registers includes: Obtaining a second instruction, where the second instruction is an instruction in the target program; If the second instruction is a sensitive instruction and the taint information corresponding to the general register or memory unit indicated by the operand of the second instruction indicates that the stored information is contaminated, an interrupt instruction is sent to the main processor and the program counter value of the second instruction is written in the designated memory area.

10. The method according to any one of claims 1 to 9, characterized in that: The main processor and the coprocessor are processors based on the reduced instruction set computer RISC-V architecture.

11. A stain analysis device, characterized in that: A coprocessor deployed in a computer device, the coprocessor comprising a plurality of registers, the plurality of registers being used to store taint information corresponding to a plurality of general registers in a main processor of the computer device, and taint information corresponding to a program memory space of a target program currently executed by the main processor, the device comprising: An instruction acquisition module, used for acquiring a first instruction, where the first instruction is an instruction in the target program; A taint propagation module is used to update the taint information corresponding to the first general register or the first memory unit indicated by the destination operand of the first instruction according to the taint propagation rule corresponding to the first instruction, the multiple general registers including the first general register, and the program memory space including the first memory unit.

12. The device according to claim 11, characterized in that The program memory space includes a stack area, and the taint information corresponding to the program memory space includes the taint information corresponding to the memory unit in the stack area, and the taint information corresponding to the memory unit in the stack area includes a taint tag and an information type tag, and the taint tag corresponding to the memory unit is used to indicate whether the information stored in the memory unit is contaminated, and the information type tag corresponding to the memory unit is used to indicate that the information stored in the memory unit is data or a stack address.

13. The device according to claim 12, characterized in that The program memory space also includes a global area, and the taint information corresponding to the program memory space also includes a taint tag corresponding to a memory unit in the global area.

14. The device according to any one of claims 11 to 13, characterized in that: The taint information corresponding to the general register includes a taint tag and an information type tag. The taint tag corresponding to the general register is used to indicate whether the information stored in the general register is contaminated. The information type tag corresponding to the general register is used to indicate that the information stored in the general register is data or a heap address. When the information type tag corresponding to the general register indicates that the information stored in the general register is a heap address, the taint information corresponding to the general register also includes a storage address of the heap address stored in the general register in the program memory space.

15. The device according to any one of claims 11 to 14, characterized in that: The instruction acquisition module is specifically used for: The first instruction is read from an instruction cache queue, where the instruction cache queue is used to store a plurality of decoded instructions, where the plurality of instructions are instructions in the target program that have been executed by the main processor.

16. The device according to claim 15, characterized in that The instruction acquisition module is also used for: Reading first instruction information from an instruction information queue, the instruction information queue being used to store a plurality of instruction information sent by the main processor, the first instruction information comprising an undecoded instruction; The undecoded instruction included in the first instruction information is decoded to obtain the first instruction, and the first instruction is stored in the instruction cache queue.

17. The device according to claim 16, characterized in that The device is also used for: If the instruction information queue is full, an interrupt instruction is sent to the main processor, where the interrupt instruction is used to instruct the main processor to interrupt the sending of instruction information.

18. The device according to any one of claims 11 to 17, characterized in that The device also includes: The stain detection module is used to perform stain detection according to the stain information stored in the multiple registers.

19. The device according to claim 18, characterized in that The instruction acquisition module is further used to acquire a second instruction, where the second instruction is an instruction in the target program; The taint detection module is specifically used to send an interrupt instruction to the main processor and write the program counter value of the second instruction in a designated memory area if the second instruction is a sensitive instruction and the taint information corresponding to the general register or memory unit indicated by the operand of the second instruction indicates that the stored information is contaminated.

20. The device according to any one of claims 11 to 19, characterized in that The main processor and the coprocessor are processors based on the reduced instruction set computer RISC-V architecture.

21. A computer device, characterized in that: The computer device includes a main processor and a coprocessor, the main processor is used to execute a target program, the coprocessor includes multiple registers, the multiple registers are used to store taint information corresponding to multiple general registers in the main processor of the computer device, and taint information corresponding to the program memory space of the target program currently executed by the main processor, and the coprocessor is used to execute at least one program instruction or code stored in the memory to implement the taint analysis method according to any one of claims 1 to 10.

22. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a coprocessor of a computer device, the coprocessor of the computer device executes the stain analysis method according to any one of claims 1 to 10.

Images