Static binary code taint analysis method based on propagation action range

Abstract

The invention discloses a static binary code taint analysis method based on a propagation action scope, and relates to the field of static binary code taint analysis, and the static binary code taint analysis method comprises the following steps: extracting a program instruction set and a control flow structure based on a disassembling result of a target binary code; calculating a value set with a source of the binary code based on the control flow graph; on the basis of the control flow diagram and the value set with the source, executing cross-function stain propagation analysis, and identifying memory positions or registers influenced by pollution in each function and propagation action ranges of the memory positions or the registers; and extracting all instruction sets using the taint data based on the taint and the propagation action range thereof. According to the method, the false alarm rate of static binary taint analysis can be reduced and the instruction set involved in the taint analysis can be reduced without increasing the analysis overhead, so that the method has important significance in improving the instrumentation efficiency and the operation efficiency of dynamic taint analysis and improving the accuracy of protocol reversion, fuzzy testing and vulnerability mining based on the taint analysis.

Description

Technical Field

[0001] The present invention relates to the field of binary code taint analysis, and more particularly to a static binary code taint analysis method based on propagation scope, which is used to accurately identify and track taint propagation paths in binary code. Background Art

[0002] Taint analysis is a technique that marks and tracks the path of "tainted" data during program execution to identify security vulnerabilities caused by untrusted input or to understand program behavior. Taint analysis has become a crucial analytical tool in fields such as software security, malicious code detection, and privacy protection. Taint analysis can be categorized as either source code analysis or binary code analysis. Compared to source code analysis, binary code analysis directly targets the underlying executable code. This makes it applicable not only to scenarios where source code is available, but also to closed-source software, commercial components, legacy systems, and even scenarios where source code is unavailable (such as third-party libraries and malware samples). Furthermore, binary code analysis can uncover security vulnerabilities that are difficult to detect at the source code level, providing core technical support for building reliable security protection technologies.

[0003] Binary code taint analysis methods are categorized into static and dynamic taint analysis, depending on whether the target binary code is executed. Dynamic taint analysis relies on monitoring the execution flow during program execution, analyzing taint propagation by intercepting memory reads, writes, and register operations. Typical implementations include dynamic binary instrumentation (DBI) and virtual machine or bytecode instrumentation. These methods can obtain accurate runtime information, but because they require real-time instrumentation of every relevant instruction, their runtime overhead is typically several or even dozens of times that of the original program, making them unsuitable for deployment in large-scale or real-time scenarios.

[0004] Static taint analysis performs offline analysis on binary or intermediate code before program execution. Through techniques such as disassembly, abstract interpretation, symbolic execution, or static rewriting, it identifies and marks possible taint propagation paths and inserts monitoring logic only where necessary, which can reduce runtime overhead. However, due to the lack of runtime information, static taint analysis methods often need to adopt conservative analysis strategies to avoid missed reports, resulting in a high false alarm rate, too many unnecessary instrumentation points, and ultimately unsatisfactory performance improvement.

[0005] In view of the above shortcomings, this field urgently needs an improved static taint analysis method that can accurately identify the key instructions for taint propagation while ensuring accuracy, minimize the false alarm rate, and achieve an effective balance between overall performance and accuracy. Summary of the Invention

[0006] In light of this, the present invention aims to provide a static binary code taint analysis method based on propagation scope. This method analyzes the contextual propagation of taints by parsing the control flow and data flow dependencies of binary code, combined with source-based value set calculations, to determine taint variables and their scope, ultimately obtaining a set of taint-related instructions. While ensuring the accuracy of taint propagation analysis, this method precisely locates the instructions that truly affect taint propagation, significantly reducing the number of instructions to be analyzed, lowering the false alarm rate, and improving analysis efficiency. This provides an efficient and reliable technical approach for software security testing, malicious code detection, privacy protection, and other fields.

[0007] In order to achieve the above object, the present invention provides the following technical solutions: A static binary code taint analysis method based on propagation scope includes the following steps: Step 1: Get the instruction set I and control flow graph G of the binary code; Step 2: Based on the control flow graph G, calculate the value set V with source of the binary code s Starting from the entry function of the binary code, traverse each instruction according to the control flow graph G and calculate the value set with its source for each instruction; if the current instruction is not a call instruction, for the value it generates, mark the source of the value as the current instruction address, and keep the values ​​and their sources unrelated to the current instruction unchanged; if the current instruction is a call instruction, establish a value set transfer relationship from the call instruction to the called function, and update the value set of the entry instruction of the called function according to the value set transfer relationship; Step 3: Initialize the taint set T to be empty; according to the control flow graph G and the value set V with source s Calculate the taint propagation process; starting from the taint source function, traverse each function involved in the taint propagation analysis according to the control flow graph G, establish the taint context transfer relationship between the current function and the called function, calculate the taint within each function and the taint propagation scope within each function, and store the results in the taint set T until all functions are processed; Step 4: Initialize the instruction set I that uses the tainted data t Empty; traverse the instruction set I, and determine whether the operand of each instruction is a valid taint according to the taint information and propagation scope stored in the taint set T. If so, store the instruction in I t ; After the instruction set I is traversed, output I t ,Finish.

[0008] Furthermore, the step three specifically includes the following steps: Step A1: In the taint set T, for each function f, create a taint set T[f] that marks the taint value in the function and its propagation scope, which is initialized to empty; initialize the task queue W to empty; initialize the processed function set Visited to empty; Step A2: Traverse all pollution source functions f ts , according to the semantic characteristics of the pollution source function, in T[f ts ] In the function, the parameter transfer register to which the taint is propagated is marked as a tainted state, and the propagation scope is marked as the interval [f_start, f_end] consisting of the function's starting address f_start and ending address f_end; Step A3: For each pollution source function f ts , add a processing f to the end of the task queue W ts The task is initialized and the function call index that the task currently needs to process is set to 0; Step A4: Take a task from the head of the task queue W, obtain the function f of the current task, and obtain the index-th function call that needs to be processed by the task; determine whether the current task has a waiting task. If so, and the waiting task has not yet completed, put the current task back to the end of the task queue W and execute step A4 again; otherwise, continue to step A5; Step A5: Process the return process of the index-1 function call; if index-1 < 0, then there is no function call in the function that needs to return, jump to step A6; otherwise, find all functions pointed to by the index-1 function call instruction in the control flow graph G as the set of called functions of the function call, and for each called function f c The parameter passing registers used and the registers that the callee needs to preserve, if one or some of them are in T[f c ], all possible values ​​corresponding to these registers in the value set at the call instruction are added to the taint set T[f] of the function f of the current task, and the starting address of the taint scope is set to the source address of the possible value, and the ending address is set to the ending address f_end of the function f; Step A6: Process the taint propagation process of the instructions between the index-2th function call and the indexth function call; if index-2<0, the starting address of the taint propagation calculation interval is the starting address of this function; otherwise, the index-2th function call instruction is used as the starting address; if index is greater than the index upper limit of all function calls in the function, the ending address of the taint propagation calculation interval is the ending address of this function; otherwise, the indexth function call instruction is used as the ending address; traverse each instruction i in the interval f, according to the taint set T[f] of the current task function and the current instruction value set V s [i f ] and instruction semantics, calculation related i f Taint marks in used memory locations or registers and their range marks; Step A7: Process the taint incoming process of the index-th function call; if index is greater than the number of all function calls in the function, the current function processing is completed, the current function is added to Visited, and jump to step A8; otherwise, find the set of called functions of the index-th function call in the control flow graph G, traverse each called function, and determine the f of each called function. c Whether the parameter transfer registers used and the registers that the callee needs to preserve are valid taints at the index-th function call, and at the same time judge whether T[f c ] is not polluted, if each f c If the two conditions are not met at the same time, the function call index of the current task to be processed is increased by 1, and the process jumps to step A5; otherwise, it means that a new taint is generated and passed in. For the called function where the two conditions are met at the same time, the polluted register is added to the taint set T[f c ], the scope is set to the interval [f_start, f_end] consisting of the starting address f_start and the ending address f_end of the called function. The function call index index to be processed by the current task is increased by 1. At the same time, a new task to process the called function is created, and the function call index to be processed by the new task is initialized to 0. The new task is placed at the end of the queue W; then the current task is placed back at the end of the queue W, and the process jumps to step A3; Step A8: Find the predecessor nodes of the current function in the control flow graph G, that is, all functions that call the current function. If any of these functions has not been processed by any task, create a new task to process the function, initialize the function call index to be processed by the new task to 0, and put the new task at the end of the W queue; Step A9: Determine whether W is empty. If not, the taint propagation analysis process is completed; otherwise, jump to step A3.

[0009] Further, step A6, the traversal of each instruction i in the interval f , according to the taint set T[f] of the current task function and the current instruction value set V s [i f ] and instruction semantics, calculate the taint marks and their range marks in the relevant memory locations or registers, specifically including the following steps: Step B1: In the current instruction i f The value set V s[i f ] to obtain the set V of all possible values ​​of the source operand src and the destination operand dest s [i f ][src]、V s [i f ][dest], and the taint set T[f] of the current function; Step B2: If the current instruction type is a data transfer instruction, an arithmetic operation instruction, or a logical operation instruction, then for the source operand src, traverse its value set V s [i f ][src], if there is any value∈V s [i f ][src]∪src, and T[f][value].start ≤ i f ≤T[f][value].end, it means that src is in scope and is a valid stain; for the target operand dest, traverse its value set V s [i f ][dest], if there is any value∈V s [i f ][dest]∪dest, and T[f][value].start ≤ i f ≤T[f][value].end, it means that dest is in scope and is a valid taint; when src is tainted and dest is not tainted, the interval from the current instruction address to the end of the function is added to the scope of dest; when src is not tainted and dest is tainted, the end of dest's scope is set to the current instruction i; in other cases, the scope is not changed; Step B3: If the current instruction type is a stack operation instruction, maintain a stack within the function. f When the instruction type is a push instruction, the pollution state of its source operand is pushed into the stack; when i f When the instruction type is a pop instruction, the pollution status of the source operand of the corresponding push instruction is popped from the stack, and then the operand of the pop instruction is judged whether it is polluted; when the push instruction operand is polluted and the pop instruction operand is not polluted, the interval from the current instruction address to the end of the function is added to the scope of the pop instruction operand; when the push instruction operand is not polluted and the pop instruction operand is polluted, the end address of the scope of the pop instruction operand is set to i f ; In other cases, the scope is not changed; Step B4: If the current instruction type is other instructions, skip it.

[0010] It can be seen from the above technical solution that, compared with the prior art, the present invention provides a static binary code taint analysis method based on propagation scope. Due to the lack of runtime information, traditional static taint analysis methods need to adopt a conservative strategy to insert all potential taint propagation instructions, resulting in a high false alarm rate, a large number of traced instructions, and low operating efficiency. Based on the static analysis of program control flow and data flow, this method uses contextual relationships to statically and globally track the scope of tainted variables through multi-stage value set iterative calculations. By limiting the effective scope of tainted variables and eliminating interference from irrelevant instructions, the false alarm rate is reduced, the insertion and computational overhead are reduced, and the balance between performance and accuracy is achieved as much as possible. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A schematic diagram of a process flow of a static binary code taint analysis method based on propagation scope provided by the present invention; Figure 2 The instruction set I is a binary executable file; Figure 3 is the control flow graph G of the binary executable file; Figure 4 For a value set V with a source s ; Figure 5 is the set of tainted variables T within the function; Figure 6 For taint analysis related instructions I t . DETAILED DESCRIPTION

[0012] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0013] The present invention provides a static binary code taint analysis method based on propagation scope, comprising the following steps: Step 1: Get the instruction set I and control flow graph G of the binary code; Step 2: Based on G, calculate the value set V of the binary code with the source s. Starting from the entry function of the binary code, traverse each instruction according to G, and calculate the value set with source for each instruction. If the current instruction is not a call instruction, for the value it generates, mark the source of the value as the current instruction address, and keep the values ​​and their sources unrelated to the current instruction unchanged; if the current instruction is a call instruction, establish a value set transfer relationship from the call instruction to the called function, and update the value set of the called function entry instruction according to the value set transfer relationship; Step 3: Initialize the tainted variable set T in the function to be empty. Based on G and the value set V with the source s Calculate the taint propagation process. Starting from the taint source function, traverse each function involved in the taint propagation analysis according to G, establish the taint context transfer relationship between the current function and the called function, calculate the taint within the function and the taint propagation scope within the function, and store the results in T until all functions are processed; Step 4: Initialize the taint analysis related instruction set I t Is empty. Traverse I and determine whether the operand of each instruction is a valid taint according to the taint information and propagation scope stored in T. If so, store the instruction in I t After the traversal is completed, output I t , the algorithm ends.

[0014] Furthermore, the step three includes the following steps: Step A1: For each function f in T, create a taint set T[f] that marks the tainted values ​​within that function and their propagation scopes, initialized to empty. Initialize the task queue W to empty. Initialize the completed task set Visited to empty. Initialize the inter-task waiting relationship map Wait_map to empty.

[0015] Step A2: Traverse all pollution source functions f ts , according to the semantic characteristics of the pollution source function, in T[f ts ] in which the specific parameter passing register is marked as polluted, and the propagation scope is marked as the interval [f_start, f_end] consisting of the starting address f_start and the ending address f_end of the function.

[0016] Table 1 takes x86 as an example to show the relationship between common pollution source functions and the corresponding required pollution registers.

[0017]

[0018] Step A3: For each pollution source function f ts , add a processing f to the end of the task queue W tsThe task is initialized and the function call index that the task currently needs to process is index 0, that is, (f ts ,0) join the end of the W team.

[0019] Step A4: Take a task (f, index) from the head of the task queue W, retrieve the function f of the current task, and retrieve the function call index that the task currently needs to process. Determine whether the current task has a waiting task. That is, determine whether there is a key-value pair with f as the key in Wait_map and the value of this key-value pair is not in Visited. If both of these conditions are met, the task the current task is waiting for has not yet completed. Place the current task back at the end of queue W and repeat step A4. Otherwise, continue with step A5.

[0020] Step A5: Process the return process of the index-1 function call. If index-1 < 0, then there is no function call in the function that needs to return, jump to step A6; otherwise, find the set of called functions of the index-1 function call in the control flow graph G, for each called function f c The parameter passing registers used, as well as the registers that the callee needs to preserve, if one or some of them are in [f c ] indicates that the register is in a polluted state in the called function, and the polluted state needs to be conservatively passed back to f. All possible values ​​corresponding to the polluted registers in the value set at the call site are added to the taint set T[f] of the function f of the current task, and the starting address of the taint scope is set to the source address of the possible value, and the ending address is set to the ending address f_end of the function f.

[0021] Step A6: Process the taint propagation process of the instructions between the index-2th function call and the indexth function call. If index-2<0, the starting address of the taint propagation calculation interval is the starting address of this function; otherwise, the index-2th function call instruction is used as the starting address. If index is greater than the index upper limit of all function calls in the function, the ending address of the taint propagation calculation interval is the ending address of this function; otherwise, the indexth function call instruction is used as the ending address. Traverse each instruction i in the interval f , according to the taint set T[f] of the current task function and the current instruction value set V s [i f ] and instruction semantics, and calculate the taint marks and their range marks in the relevant memory locations or registers.

[0022] Step A7: Process the incoming taint of the index-th function call. If index is greater than the number of all function calls in the function, the current function is processed, the current function is added to Visited, and the process goes to step A8; otherwise, find the set of called functions of the index-th function call in the control flow graph G, traverse each called function, and determine the f of each called function. c Whether the parameter transfer registers used and the registers that the callee needs to preserve are valid taints at the index-th function call, and at the same time judge whether T[f c ] is not polluted, if each f c If the two conditions are not met at the same time, the function call index that the current task needs to process is increased by 1, and the process jumps to step A5; otherwise, it means that a new taint is generated and passed in. For the called function where the two conditions are met at the same time, the polluted register is added to the taint set T[f c ], the scope is set to the interval [f_star, f_end] consisting of the starting address f_start and the ending address f_end of the called function, the function call index index that the current task needs to process is increased by 1, and a new processing called function f is created at the same time. c Initialize the function call index of the new task to be processed as 0, and set the new task (f c ,0) is put into the tail of the queue W. Then put the current task (f, index) back into the tail of the queue W, and wait for the key-value pair f c : Add f to the inter-task waiting relationship graph Wait_map and jump to step A3.

[0023] Step A8: Find the predecessor nodes of the current function in G, that is, all functions that call the current function. If any of the functions f caller If it has not been processed by any task, a new task is created to process the function, and the function call index that the new task needs to process is initialized to 0. caller ,0) is put at the end of W's team.

[0024] Step A9: Determine whether W is empty. If not, the taint propagation analysis process is completed; otherwise, jump to step A3.

[0025] Furthermore, in step A6, for the current instruction i f , according to the taint set T[f] of the current task function and the current instruction value set V s [i f ] and instruction semantics, calculate the taint marks and their range marks in the relevant memory locations or registers, including the following steps: Step B1: In the current instruction i fThe value set V s [i f ] to obtain the set V of all possible values ​​of the source operand src and the destination operand dest s [i f ][src]、V s [i f ][dest], and the taint set T[f] of the current function.

[0026] Step B2: If the current instruction type is a data transfer instruction, an arithmetic operation instruction, or a logical operation instruction, then for the source operand src, traverse its value set V s [i f ][src], if there is any value∈V s [i f ][src]∪src, and T[f][value].start ≤ i f ≤T[f][value].end, it means that src is in scope and is a valid stain; for the target operand dest, traverse its value set V s [i f ][dest], if there is any value∈V s [i f ][dest]∪dest, and T[f][value].start ≤ i f If ≤ T[f][value].end, dest is within the scope and is a valid taint. If src is tainted and dest is untainted, the range from the current instruction address to the end of the function is added to dest's scope. If src is untainted and dest is tainted, the end of dest's scope is set to the current instruction i. In other cases, the scope remains unchanged. The rules are summarized in Table 2.

[0027]

[0028] Step B3: If the current instruction type is a stack operation instruction, maintain a stack within the function. f When the instruction type is a push instruction, the pollution state of its source operand is pushed into the stack; when i f When the instruction type is a pop instruction, the pollution status of the source operand of the corresponding push instruction is popped from the stack, and then the operand of the pop instruction is judged whether it is polluted. When the push instruction operand is polluted and the pop instruction operand is not polluted, the interval from the current instruction address to the end of the function is added to the scope of the pop instruction operand; when the push instruction operand is not polluted and the pop instruction operand is polluted, the end address of the scope of the pop instruction operand is set to i f; In other cases, the scope is not changed, as shown in Table 3.

[0029]

[0030] Step B4: If the current instruction type is other instructions, skip it. Example

[0031] This embodiment discloses a static binary code taint analysis method based on propagation scope, such as Figure 1 As shown, the following steps are included: Input the target binary code to be analyzed into the disassembly tool angr to obtain all instruction sets I and control flow graph G of the target binary executable file.

[0032] Figure 2 An example of an instruction set I of a binary executable file is given, which contains 44 instructions; Figure 3 The control flow graph G of the binary executable file is given.

[0033] Based on G, calculate the value set V of the binary code with the source s . Starting from the entry function of the binary code, traverse each instruction according to G, and calculate the value set with source for each instruction. If the current instruction is not a call instruction, for the value it generates, mark the source of the value as the current instruction address, and keep the values ​​and their sources unrelated to the current instruction unchanged; if the current instruction is a call instruction, establish a value set transfer relationship from the call instruction to the called function, and update the value set of the called function entry instruction according to the value set transfer relationship; Different from the traditional VSA algorithm, this step not only records the possible values ​​in the memory address or register when calculating the value set, but also marks the source instruction address of each possible value, that is, constructs a value set V with the source. s , providing data support for the taint range marking in subsequent steps. For example, when the instruction "22ba: mov 0x3d80(%rip),%eax" moves the contents of a memory address (rip-relative addressing is calculated as 6040) to eax, the instruction generates a new value 6040, indicating that the contents of eax are related to the contents of 6040. The source address of this new value is recorded as the address 22ba of the current instruction, and the tuple (6040, 22ba) is added to the value set of eax. The next instruction "22c0: mov %eax,%edi" only moves the contents of eax to edi without generating a new value. Therefore, the value (6040, 22ba) in eax is copied to the value set of edi. Figure 4 Given a value set V with source for an example binary code s result.

[0034] The tainted variable set T in the initialization function is empty. According to G and the value set V with the source s Calculate the taint propagation process. Starting from the taint source function, traverse each function involved in the taint propagation analysis based on G, establish the taint context transfer relationship between the current function and the called function, calculate the taint within the function and the taint propagation scope within the function, and store the results in T until all functions are processed.

[0035] Step A1: Initialize T to be empty. For each function f in T, create an empty taint set T[f] that marks the tainted values ​​within that function and their scope. Initialize the task queue W to be empty. Initialize the completed task set Visited to be empty. Initialize the inter-task waiting relationship map Wait_map to be empty.

[0036] Step A2: Traverse all pollution source functions f ts , according to the semantic characteristics of the pollution source function, in T[f ts ] in which the specific parameter passing register is marked as polluted, and the propagation scope is marked as the interval [f_start, f_end] consisting of the starting address f_start and the ending address f_end of the function.

[0037] In this embodiment, the pollution source function is recv@plt. According to Table 1, the pollution source function needs to pollute the three registers rdi, rsi, and rdx, and mark the scope as the function's starting address 11c0 and the function's ending address 11cb. Finally, T[recv@plt] is {rdi: [11c0, 11cb], rsi: [11c0, 11cb], rdx: [11c0, 11cb]} Step A3: For each pollution source function f ts , add a processing f to the end of the task queue W ts The task is initialized and the function call index that the task currently needs to process is 0. ts ,0) is added to the tail of the W team. For the pollution source function recv@plt in this example, (recv@plt,0) is added to the tail of the W team.

[0038] Step A4: Take a task (f, index) from the head of task queue W, retrieve the function f of the current task, and retrieve the function call index that the task currently needs to process. Determine whether the current task has a waiting task. That is, determine whether there is a key-value pair with f as the key in Wait_map and the value of this key-value pair is not in Visited. If both of these conditions are met, the task the current task is waiting for has not yet completed. Place the current task back at the end of queue W and repeat this step. Otherwise, continue to A5.

[0039] The task taken from the head of the W team is (recv@plt, 0). There is no key-value pair with this task as the key in the Wait_map. There is no need to wait for any task, and A5 is continued to be executed.

[0040] Step A5: Process the return process of the index-1 function call. If index-1 < 0, then there is no function call in the function that needs to return, jump to step A6; otherwise, find the set of called functions of the index-1 function call in the control flow graph G, and for each called function f c The parameter passing registers rbx, r12, r13, r14, r15, and the registers that the callee needs to preserve, if one or some of them are in T[f c ], all possible values ​​corresponding to these registers in the call value set are added to the taint set T[f] of the function f of the current task, and the starting address of the taint scope is set to the source address of the possible value, and the ending address is set to the ending address f_end of the function f.

[0041] At this time, index is equal to 0, and there is no function call in the function that needs to be returned. The return process of the index-1th function call is skipped and the process jumps to step A6.

[0042] Step A6: Process the taint propagation process of the instructions between the index-2th function call and the indexth function call. If index-2<0, the starting address of the taint propagation calculation interval is the starting address of this function; otherwise, the index-2th function call instruction is used as the starting address. If index is greater than the index upper limit of all function calls in the function, the ending address of the taint propagation calculation interval is the ending address of this function; otherwise, the indexth function call instruction is used as the ending address. Traverse each instruction i in the interval f , according to the taint set T[f] of the current task function and the current instruction value set V s [i f ] and instruction semantics, and calculate the taint marks and their range marks in the relevant memory locations or registers.

[0043] At this time, index-2<0, the starting address 11c0 of recv@plt is used as the starting address, the number of function calls is 0, the index upper limit is -1, index>-1, the ending address 11cb of recv@plt is used as the ending address, and the propagation process is calculated in the interval [11c0,11cb].

[0044] In the current instruction i f The value set V s [if ] to obtain the set V of all possible values ​​of the source operand src and the destination operand dest s [i f ][src]、V s [i f ][dest], and the taint set T[f] of the current function.

[0045] If the current instruction type is a data transfer instruction, an arithmetic operation instruction, or a logical operation instruction, then for the source operand src, traverse its value set V s [i f ][src], if there is any value∈V s [i f ][src]∪src, and T[f][value].start ≤ i f ≤T[f][value].end, it means that src is in scope and is a valid stain; for the target operand dest, traverse its value set V s [i f ][dest], if there is any value∈V s [i f ][dest]∪dest, and T[f][value].start ≤ i f ≤T[f][value].end, dest is in scope and is a valid taint. If src is tainted but dest is not, the range from the current instruction address to the end of the function is added to the scope of dest. If src is not tainted but dest is tainted, the end of dest's scope is set to the current instruction i. In other cases, the scope remains unchanged.

[0046] If the current instruction type is a stack operation instruction, a stack within the function is maintained. f When the instruction type is a push instruction, the pollution state of its source operand is pushed into the stack; when i f When the instruction type is a pop instruction, the pollution status of the source operand of the corresponding push instruction is popped from the stack, and then the operand of the pop instruction is judged whether it is polluted. When the push instruction operand is polluted and the pop instruction operand is not polluted, the interval from the current instruction address to the end of the function is added to the scope of the pop instruction operand; when the push instruction operand is not polluted and the pop instruction operand is polluted, the end address of the scope of the pop instruction operand is set to i f ; In other cases, the scope is not changed.

[0047] If the current instruction type is other instructions, skip it.

[0048] Since recv@plt only contains dynamic jump library function logic, calculating the three instructions within this interval does not modify T[recv@plt] and is not expanded here.

[0049] Step A7: Process the incoming taint of the index-th function call. If index is greater than the number of all function calls in the function, the current function is processed, the current function is added to Visited, and the process goes to step A8; otherwise, find the set of called functions of the index-th function call in the control flow graph G, traverse each called function, and determine the f of each called function. c Whether the parameter transfer registers used and the registers that the callee needs to preserve are valid taints at the index-th function call, and at the same time judge whether T[f c ] is not polluted, if each f c If the two conditions are not met at the same time, the function call index that the current task needs to process is increased by 1, and the process jumps to step A5; otherwise, it means that a new taint is generated and passed in. For the called function where the two conditions are met at the same time, the polluted register is added to the taint set T[f c ], the scope is set to the interval [f_start, f_end] consisting of the starting address f_start and the ending address f_end of the called function. The function call index index that the current task needs to handle is increased by 1. At the same time, a new task that handles the called function is created, the function call index that the new task needs to handle is initialized to 0, and the new task is placed at the end of the queue W. Then, the current task is placed back at the end of the queue W, and the process jumps to step A3.

[0050] There is no function call in the recv@plt function, so there is no function call that needs to be returned. The current function processing is completed, and recv@plt is added to the completed task set Visited.

[0051] Step A8: Find the predecessor nodes of the current function in G, that is, all functions that call the current function. If any of these functions has not been processed by any task, create a new task to process the function, initialize the function call index that the new task needs to process to 0, and put the new task at the end of the W queue.

[0052] From G, we can see that funA calls recv@plt and has not been processed by any task. A new task (funA, 0) is created and put at the end of the W queue.

[0053] Determine whether W is empty. If not, the taint propagation analysis process is completed; otherwise, jump to step A3.

[0054] At this point, W is not empty, so we need to take out tasks from W and perform the above taint propagation process until W is empty. The following shows the processing process of funcA: After processing recv@plt, there is (funcA, 0) in W, and the task is taken out.

[0055] This task has no waiting tasks, so continue; There is no function call to return, so continue; The calculation starts from the starting address 1da7 of funcA and ends at the function call 1dcc at index=0. Since there is no taint in funcA at this time, T[funcA] is still empty after the calculation. Process the taint incoming process of function call 1dcc at index=0. Since the parameter transfer registers used and the registers to be preserved are not valid taints here, no new taint incoming is generated. The index of the current function call to be processed is increased by 1, index=1, and the process returns to step A5 to process the return process of the function call at index-1.

[0056] Process the return process of the function call 1dcc at index-1=0. The only called function in this function call is recv@plt. Based on the parameter passing registers rdi, rsi, rdx, and rcx used in this call, as well as the registers rbx, r12, r13, r14, and r15 that need to be preserved, rdi, rsi, and rdx are in T[recv@plt], indicating that these registers are tainted in the called function. The possible values ​​corresponding to these registers in the value set of the call 1dcc are added to the taint set T[funcA] of the function funcA in the current task. The starting address of the scope is set to the source address of the possible value, and the ending address is set to the ending address 1de3 of funcA. Taking rsi as an example, the value set at 1dcc is [(6488,1da7),(6380,1db8)]. Therefore, add 6488 to Func_taint_var[funcA] and set the scope to [1da7,1de3]. Add 6380 to Func_taint_var[funcA] and set the scope to [1db8,1de3]. After completing this step, T[funcA] is {648a: [1da7,1de3], 6488: [1da7,1de3], 6380: [1db8,1de3], 6040: [1da7,1de3]} At this time, index-2<0, and the starting address 1da7 of funcA is used as the starting address; the number of function calls is 2, the upper limit of the index is 1, and index is not greater than 1. The end address is 1dd9 of the function call at index=1, and the propagation process is calculated within the interval [1da7,1dd9].

[0057] For example, the instruction 1db8: lea 0x45c1(%rip),%rcx is of type lea. The address of its source operand src is calculated to 6380, and the current instruction is within the scope [1db8,1de3] of 6380. Therefore, src is tainted. The value set of its destination operand rcx is empty, not a valid taint, and thus untainted. In this case, src is tainted, while dest is not. The interval [1db8,1de3] from the current instruction 1db8 to the end of the function is added to the scope of rcx, and the new rcx taint is added to T[funcA].

[0058] Process the taint input process at function call 1dd9, index = 1. The called function is close@plt, and the register used in this call is rdi. It can be determined that rdi is a valid taint here. At the same time, rdi in T[close@plt] is not tainted. Therefore, a new taint is input here and added to T[close@plt]. The scope is set to the interval [1270, 127b] consisting of the start and end addresses of close@plt. After the input is completed, the function call index that the current task needs to process is increased by 1, index = 2. The current task needs to wait for the analysis process of the passed tainted function. Therefore, a new task is created to handle close@plt. The function call index that the new task needs to process is initialized to 0. The new task (close@plt, 0) is placed at the end of the queue W. The current task (funcA, 2) is then placed back at the end of the queue W, and the wait relationship key-value pair funcA:close is added to the inter-task wait relationship graph Wait_map.

[0059] At this time, W is [(close@plt, 0), (funcA, 2)], and (close@plt, 0) is taken out from the head of the queue to process close@plt. The processing of close@plt is similar to that of recv@plt and will not be expanded here.

[0060] After completing the close@plt task, (funcA, 2) is taken out from the head of the queue. There is a key-value pair with funcA as the key in Wait_map. The value of this key-value pair, close@plt, is in Visited, indicating that the task function that funcA was waiting for has been processed and the next step can be carried out.

[0061] This handles the return process of the function call 1dd9 at index-1=1. This is similar to the previous return process and will not be repeated here.

[0062] The calculation taint propagation starts from the function call at index-2=0 and ends at the function end address 1de3. The taint propagation process is similar to the previous one and will not be repeated here.

[0063] Process the incoming taint of the function call index = 2. There is no second function call, the current function is processed, and funcA is added to the completed task set Visited.

[0064] In G, we can see that main calls funcA and has not been processed by any task. A new task (main, 0) is created and placed at the end of the W queue.

[0065] At this point, the funcA function is processed. The above taint propagation process is repeated until W is empty, and the step is completed. Figure 5 The final result of T is given. A black cell background indicates that the current instruction will propagate the taint, while a white cell background indicates the opposite.

[0066] 7) Initialize the taint analysis related instruction set I t Is empty. Traverse I and determine whether the operand of each instruction is a valid taint according to the taint information and range stored in T. If so, store the instruction in I t After the traversal is completed, output I t , the algorithm ends.

[0067] Take the instruction "229b: mov %eax,%edi" as an example. Figure 5 From the result of T in the instruction, we can see that the two operands eax and edi are not polluted at 229b and are not valid pollutants, so the instruction will not be stored in I t ; For the "22c0: mov%eax,%edi" instruction, of the two operands, eax is a valid taint at 22c0, so the 22c0 instruction is stored in I t I t The final result is as follows Figure 6 As shown, a black cell background indicates that the current instruction will propagate taint, while a white cell background indicates the opposite.

[0068] Finally, it should be noted that the above description of the disclosed embodiments is provided to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A static binary code taint analysis method based on propagation scope, characterized in that: The following steps are involved: Step 1: Get the instruction set I and control flow graph G of the binary code; Step 2: Based on the control flow graph G, calculate the value set V with source of the binary code s Starting from the entry function of the binary code, traverse each instruction according to the control flow graph G and calculate the value set with its source for each instruction; if the current instruction is not a call instruction, for the value it generates, mark the source of the value as the current instruction address, and keep the values ​​and their sources unrelated to the current instruction unchanged; if the current instruction is a call instruction, establish a value set transfer relationship from the call instruction to the called function, and update the value set of the entry instruction of the called function according to the value set transfer relationship; Step 3: Initialize the taint set T to be empty; according to the control flow graph G and the value set V with source s Calculate the taint propagation process; starting from the taint source function, traverse each function involved in the taint propagation analysis according to the control flow graph G, establish the taint context transfer relationship between the current function and the called function, calculate the taint within each function and the taint propagation scope within each function, and store the results in the taint set T until all functions are processed; Step 4: Initialize the instruction set I that uses the tainted data t Empty; traverse the instruction set I, and determine whether the operand of each instruction is a valid taint according to the taint information and propagation scope stored in the taint set T. If so, store the instruction in I t ; After the instruction set I is traversed, output I t ,Finish.

2. The static binary code taint analysis method according to claim 1, characterized in that: The step three specifically includes the following steps: Step A1: In the taint set T, for each function f, create a taint set T[f] that marks the taint value in the function and its propagation scope, which is initialized to empty; initialize the task queue W to empty; initialize the processed function set Visited to empty; Step A2: Traverse all pollution source functions f ts , according to the semantic characteristics of the pollution source function, in T[f ts ] In the function, the parameter transfer register to which the taint is propagated is marked as a tainted state, and the propagation scope is marked as the interval [f_start, f_end] consisting of the function's starting address f_start and ending address f_end; Step A3: For each pollution source function f ts , add a processing f to the end of the task queue W ts The task is initialized and the function call index that the task currently needs to process is set to 0; Step A4: Take a task from the head of the task queue W, obtain the function f of the current task, and obtain the index-th function call that needs to be processed by the task; determine whether the current task has a waiting task. If so, and the waiting task has not yet completed, put the current task back to the end of the task queue W and execute step A4 again; otherwise, continue to step A5; Step A5: Process the return process of the index-1 function call; If index-1 < 0, then there is no function call in the function that needs to return, and jump to step A6; otherwise, find all functions pointed to by the index-1 function call instruction in the control flow graph G as the set of called functions of the function call, and for each called function f c The parameter passing registers used and the registers that the callee needs to preserve, if one or some of them are in T[f c ], all possible values ​​corresponding to these registers in the value set at the call instruction are added to the taint set T[f] of the function f of the current task, and the starting address of the taint scope is set to the source address of the possible value, and the ending address is set to the ending address f_end of the function f; Step A6: Process the taint propagation process of the instructions between the index-2th function call and the indexth function call; if index-2<0, the starting address of the taint propagation calculation interval is the starting address of this function; otherwise, the index-2th function call instruction is used as the starting address; if index is greater than the index upper limit of all function calls in the function, the ending address of the taint propagation calculation interval is the ending address of this function; otherwise, the indexth function call instruction is used as the ending address; traverse each instruction i in the interval f , according to the taint set T[f] of the current task function and the current instruction value set V s [i f ] and instruction semantics, calculation related i f Taint marks in used memory locations or registers and their range marks; Step A7: Process the taint incoming process of the index-th function call; if index is greater than the number of all function calls in the function, the current function processing is completed, the current function is added to Visited, and jump to step A8; otherwise, find the set of called functions of the index-th function call in the control flow graph G, traverse each called function, and determine the f of each called function. c Whether the parameter transfer registers used and the registers that the callee needs to preserve are valid taints at the index-th function call, and at the same time judge whether T[f c ] is not polluted, if each f c If the two conditions are not met at the same time, the function call index of the current task to be processed is increased by 1, and the process jumps to step A5; otherwise, it means that a new taint is generated and passed in. For the called function where the two conditions are met at the same time, the polluted register is added to the taint set T[f c ], the scope is set to the interval [f_start, f_end] consisting of the starting address f_start and the ending address f_end of the called function. The function call index index to be processed by the current task is increased by 1. At the same time, a new task to process the called function is created, and the function call index to be processed by the new task is initialized to 0. The new task is placed at the end of the queue W; then the current task is placed back at the end of the queue W, and the process jumps to step A3; Step A8: Find the predecessor nodes of the current function in the control flow graph G, that is, all functions that call the current function. If any of these functions has not been processed by any task, create a new task to process the function, initialize the function call index to be processed by the new task to 0, and put the new task at the end of the W queue; Step A9: Determine whether W is empty. If not, the taint propagation analysis process is completed; otherwise, jump to step A3.

3. The static binary code taint analysis method according to claim 2, characterized in that: Step A6, traversing each instruction i in the interval f , according to the taint set T[f] of the current task function and the current instruction value set V s [i f ] and instruction semantics, calculate the taint marks and their range marks in the relevant memory locations or registers, specifically including the following steps: Step B1: In the current instruction i f The value set V s [i f ] to obtain the set V of all possible values ​​of the source operand src and the destination operand dest s [i f ][src]、V s [i f ][dest], and the taint set T[f] of the current function; Step B2: If the current instruction type is a data transfer instruction, an arithmetic operation instruction, or a logical operation instruction, then for the source operand src, traverse its value set V s [i f ][src], if there is any value∈V s [i f ][src]∪src, and T[f][value].start ≤ i f ≤T[f][value].end, it means that src is in scope and is a valid stain; for the target operand dest, traverse its value set V s [i f ][dest], if there is any value∈V s [i f ][dest]∪dest, and T[f][value].start ≤ i f ≤T[f][value].end, it means that dest is in scope and is a valid taint; when src is tainted and dest is not tainted, the interval from the current instruction address to the end of the function is added to the scope of dest; when src is not tainted and dest is tainted, the end of dest's scope is set to the current instruction i; in other cases, the scope is not changed; Step B3: If the current instruction type is a stack operation instruction, maintain a stack within the function. f When the instruction type is a push instruction, the pollution state of its source operand is pushed into the stack; when i f When the instruction type is a pop instruction, the pollution status of the source operand of the corresponding push instruction is popped from the stack, and then the operand of the pop instruction is determined to be polluted. If the push instruction operand is polluted and the pop instruction operand is not polluted, the range from the current instruction address to the end of the function is added to the scope of the pop instruction operand. When the push instruction operand is not polluted, and the pop instruction operand is polluted, the end address of the scope of the pop instruction operand is set to i f ; In other cases, the scope is not changed; Step B4: If the current instruction type is other instructions, skip it.

Images