Stain label processing method, apparatus, device, and medium

Abstract

The present application relates to the technical field of taint data propagation analysis, and provides a taint label processing method, device, equipment and medium, the method: obtaining a first-level page table first address corresponding to a program to be analyzed, obtaining a virtual memory address, obtaining page table entry values of different-level page tables according to the virtual memory address, using the multi-level page table for indexing according to the first-level page table first address and the page table entry values of different-level page tables, and obtaining a taint label corresponding to the virtual memory address in a taint label memory space.The present application limits the memory range of the program and configures the multi-level page table, when searching for the taint label, uses the multi-level page table for indexing according to the first-level page table first address and the page table entry values of different-level page tables, and obtains the taint label corresponding to the virtual memory address in the memory range in the taint label memory space, so as to achieve the purposes of effectively reducing the space occupation and quickly indexing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of taint data propagation analysis, and in particular to a taint label processing method, device, equipment and medium. BACKGROUND

[0002] In taint propagation analysis in program dynamic analysis, the taint label in dynamic taint propagation analysis needs to be managed. The input of taint propagation includes taint source information and instructions actually executed by a program, and the support needed includes taint state recording and taint propagation rules. After receiving the taint source information, the taint propagation engine sets a taint source mark at the corresponding position of the taint state recording; then, the execution process of each instruction of the target program is tracked, the taint propagation rules are matched, and it is calculated whether the taint data is contained in the operands before and after the execution of the instruction and the source of the taint data; after the calculation is completed, the taint data state is updated to the taint label recording.

[0003] The taint recording scheme based on software implementation includes two kinds: one is compressed recording, and the other is page table recording.

[0004] That is, the compressed mapping method is used. For example, the memory space of each process of a 32-bit Windows operating system is 4GB, and the compressed mapping method is to use 1 bit to correspond to 1 byte in the memory of the process. Therefore, using 512MB of recording can map 8 times, that is, 4GB of memory space.

[0005] That is, the taint label is recorded by using the page table method. A page table for mapping is manually constructed by real-time application of a memory region in the software system, and the leaf node of the page table points to the real-time allocated / deallocated taint recording. The recording based on the page table has better flexibility than the compressed recording, but also needs a large amount of memory, and the real-time allocation and release of memory in the recording process has a high time complexity.

[0006] In addition, for the hardware-implemented taint recording, due to the insufficient hardware expansion capability, a large amount of taint information cannot be carried on a byte of recording, so it is usually implemented for single-source taint, and only the current data can be marked as taint, and the source of the taint cannot be represented, so it is difficult to support fine-grained taint analysis and taint source backtracking. SUMMARY

[0007] In view of the problems in the prior art, the present application provides a taint label processing method, device, equipment and medium.

[0008] The present application provides a taint label processing method applied to a software execution end side, comprising:

[0009] obtaining a first page table header address corresponding to a program to be analyzed;

[0010] obtaining a virtual memory address, and obtaining a page table entry value of a different level page table according to the virtual memory address;

[0011] indexing in a multi-level page table according to the first level page table head address and the page table entry value of the different level page table, and obtaining a taint label corresponding to the virtual memory address in a taint label memory space.

[0012] According to the taint label processing method provided by the application, the multi-level page table contains a mapping relationship between a page table entry value of an i-level page table and a head address of an i+1-level page table, i is 1, 2, …, n; correspondingly, the indexing in the multi-level page table according to the first level page table head address and the page table entry value of the different level page table, and obtaining the taint label corresponding to the virtual memory address in the taint label memory space, comprises:

[0013] indexing in the multi-level page table according to the mapping relationship between the page table entry value of the i-level page table and the head address of the i+1-level page table, and obtaining a taint label corresponding to a page table entry in a last level page table of the multi-level page table in the taint label memory space.

[0014] According to the taint label processing method provided by the application, the method further comprises: constructing a multi-level page table, comprising:

[0015] constructing a taint label memory space adapted to the program to be analyzed;

[0016] constructing a multi-level page table adapted to the taint label memory space, each level page table comprising a plurality of page table entries and a page table head address, each page table entry having a page table entry value;

[0017] determining a memory range to be analyzed according to a program type of the program to be analyzed;

[0018] obtaining a virtual memory address corresponding to a taint label in the memory range to be analyzed, and obtaining a page table entry value of a different level page table according to the virtual memory address;

[0019] constructing a mapping relationship between a page table entry value of an i-level page table and a head address of an i+1-level page table according to the page table entry value of the different level page table, i is 1, 2, …, n, and establishing a correlation mapping between the taint label and a corresponding page table entry in a last level page table of the multi-level page table;

[0020] storing a first level page table head address of the multi-level page table corresponding to the program to be analyzed.

[0021] According to the method for processing the taint label provided by the application, the first-level page table head address of the multi-level page table corresponding to the program to be analyzed is sent to the auxiliary hardware, so that the auxiliary hardware obtains the first-level page table head address corresponding to the program to be analyzed.

[0022] According to the method for processing the taint label provided by the application, the method further comprises:

[0023] When it is determined that the taint label is greater than the preset value, the taint label memory space is accessed multiple times by using the memory access interface, and the taint label is obtained.

[0024] The application further provides a method for processing a taint label, which is applied to the auxiliary hardware side and comprises the following steps of:

[0025] The first-level page table head address corresponding to the program to be analyzed is obtained.

[0026] The virtual memory address is obtained, and the page table entry values of the page tables of different levels are obtained according to the virtual memory address.

[0027] The multi-level page table is used for indexing according to the first-level page table head address and the page table entry values of the page tables of different levels, and the taint label corresponding to the virtual memory address is obtained in the taint label memory space.

[0028] According to the method for processing the taint label provided by the application, the method further comprises:

[0029] When the bus bit width is smaller than the bit width of the taint label, the special memory reading logic is called, the taint label is read through the bus continuously multiple times, and the taint label is spliced into complete data.

[0030] When the bus bit width is smaller than the bit width of the taint label, the special memory writing logic is called, the taint label is split, and the taint label is written into the taint label memory space through the bus continuously multiple times.

[0031] The application further provides a device for processing a taint label, which comprises:

[0032] The obtaining module is used for obtaining the first-level page table head address corresponding to the program to be analyzed.

[0033] The dividing module is used for obtaining the virtual memory address, and obtaining the page table entry values of the page tables of different levels according to the virtual memory address.

[0034] The processing module is configured to index the multi-level page table according to the first-level page table header address and the page table item values of different-level page tables, and obtain the corresponding taint label of the virtual memory address in the taint label memory space.

[0035] The application further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above-mentioned taint label processing method when executing the program.

[0036] The application further provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program implements the above-mentioned taint label processing method when executed by a processor.

[0037] The application further provides a computer program product, which includes a computer program, and the computer program implements the above-mentioned taint label processing method when executed by a processor.

[0038] The application provides a taint label processing method, device, equipment and medium, by limiting the memory range of the program and configuring the multi-level page table, when searching the taint label, according to the first-level page table header address and the page table item values of different-level page tables, the multi-level page table is indexed, and the taint label corresponding to the virtual memory address in the memory range is obtained in the taint label memory space, so as to achieve the purposes of effectively reducing the space occupation and quickly indexing. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0040] Figure 1 is a flowchart of the taint label processing method provided by the application.

[0041] Figure 2 is a construction flowchart of the multi-level page table provided by the application.

[0042] Figure 3 is a processing flowchart of the software execution side using the multi-level page table to index the taint label provided by the application.

[0043] Figure 4 is a processing flowchart of the auxiliary hardware side using the multi-level page table to index the taint label provided by the application.

[0044] Figure 5 is a processing flowchart of the taint label provided by the application from the combination of software and hardware.

[0045] Figure 6 This is a schematic diagram of the stain label processing device provided by the present invention.

[0046] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0048] Figure 1 A schematic flowchart of a stain label treatment method provided by the present invention is shown below. Figure 1 The method includes the following steps:

[0049] Step 11: Obtain the starting address of the first-level page table corresponding to the program to be analyzed.

[0050] Step 12: Obtain the virtual memory address, and then obtain the page table entry values ​​for different levels of page tables based on the virtual memory address.

[0051] Step 13: Based on the starting address of the first-level page table and the page table entry values ​​of different levels of page tables, use multi-level page tables for indexing to obtain the taint label corresponding to the virtual memory address in the taint label memory space.

[0052] Regarding steps 11-13, it should be noted that this invention specifically relates to taint propagation analysis in dynamic program analysis, managing taint tags in dynamic taint propagation analysis. The inputs for taint propagation include taint source information and the actual instructions executed by the program. Required support includes taint state recording and taint propagation rules. After receiving the taint source information, the taint propagation engine sets a taint source marker at the corresponding position in the taint state record; then, it tracks the execution process of each instruction of the target program, matches the taint propagation rules, calculates whether the operands before and after instruction execution contain tainted data, and the source of the tainted data; after the calculation is completed, it updates the taint data status to the taint tag record.

[0053] In the process of program dynamic analysis, each program has a certain memory range of data that needs to be paid more attention to the taint label, that is, different programs pay attention to different memory ranges. Therefore, the application determines the memory range that needs to be paid attention to according to the type of the program to be analyzed, such as heap, stack area. Since the program code segment generally does not need to consider setting the memory area, for this reason, the application only needs to store the taint label in the memory space for a part of the memory range of a program, which can effectively reduce the use rate of the taint label space. The taint label memory space is virtual memory. The taint label memory space of the application stores the taint label by using a multi-level page table, which is conducive to the retrieval and query of the taint label.

[0054] In the application, in the process of dynamic taint propagation analysis, after it is determined that the propagation data is taint data, the taint label is stored in the taint label memory space in the taint record. In the process of taint propagation, the data in the memory range that needs to be paid attention to has its own virtual memory address. At this time, the virtual memory address of the label data to be retrieved is input, and then the virtual memory address is first divided into multiple parts, and the “value” is obtained by calculating and converting each part. The value has a certain limit and can be used as the index of each level of the multi-level page table, that is, the page table entries of each level of the page table are configured according to the value, and the values are used as the page table entry values. For example, a page table contains 1024 page table entries, and the corresponding page table entry values of each page table entry are 1, 2, 3, …, 1024.

[0055] The taint label memory space is accessed to obtain the corresponding taint label. Different programs configure different taint label memory spaces for easy retrieval. The taint label memory space is configured with a multi-level page table, and the number of page tables is the same as the number of page table entry values of different levels of page tables obtained by dividing and calculating the virtual memory address.

[0056] The first-level page table first address can determine a unique multi-level page table, and the multi-level page table includes a first-level page table and multiple other-level page tables. For example, a three-level page table includes a first-level page table, two second-level page tables, and two third-level page tables. Each table entry of each level of the multi-level page table is associated with the first address of the next level of the page table, and the association mapping of the page tables is completed level by level, that is, the multi-level page table contains the mapping relationship between the page table entry value of the i-level page table and the first address of the i+1-level page table, and i is 1, 2, …, n.

[0057] For example, the page table entry 56 of the first-level page table maps the second-level page table first address a, and the page table entry 233 of the second-level page table maps the third-level page table first address c. The page table entry 37 of the first-level page table maps the second-level page table first address b, and the page table entry 1 of the second-level page table maps the third-level page table first address d.

[0058] To this end, in the process of searching the taint label, the first address of the first-level page table is indexed step by step until the page table entry of the last-level page table is indexed, so that the taint label corresponding to the virtual memory address is obtained, and the taint label in the taint label memory space is obtained. That is, according to the mapping relationship between the page table entry value of the i-level page table and the first address of the i+1-level page table, the first address of the first-level page table and the page table entry value of the different-level page table are indexed in the multi-level page table, and the corresponding page table entry in the last-level page table of the multi-level page table is obtained in the taint label memory space.

[0059] The taint label processing method provided by the application limits the memory range of the program and configures the multi-level page table, so that when searching the taint label, the first address of the first-level page table and the page table entry value of the different-level page table are indexed by using the multi-level page table, and the taint label corresponding to the virtual memory address in the memory range is obtained in the taint label memory space, so that the purpose of effectively reducing the space occupation and quickly indexing is achieved.

[0060] In the further method of the above method, the processing process of constructing the multi-level page table is mainly explained and described as follows:

[0061] The taint label memory space suitable for the program to be analyzed is constructed.

[0062] The multi-level page table suitable for the taint label memory space is constructed, each level of the page table includes a plurality of page table entries and a page table first address, and each page table entry has a page table entry value.

[0063] According to the program type of the program to be analyzed, the memory range to be analyzed is determined.

[0064] The virtual memory address corresponding to the taint label in the memory range to be analyzed is obtained, and the page table entry value of the different-level page table is obtained according to the virtual memory address.

[0065] According to the page table entry value of the different-level page table, the mapping relationship between the page table entry value of the i-level page table and the first address of the i+1-level page table is constructed, i is 1, 2, …, n, and the taint label and the corresponding page table entry in the last-level page table of the multi-level page table are associated and mapped.

[0066] The first address of the first-level page table of the multi-level page table corresponding to the program to be analyzed is stored.

[0067] For this, it needs to be explained that Figure 2 Each program will have more attention to the taint label in a certain memory range, that is, different programs pay attention to different memory ranges. Therefore, the application determines the memory range to be concerned according to the program type to be analyzed, such as heap and stack area. For example, the program code segment generally does not need to consider setting the memory area.

[0068] The software layer establishes a multi-level page table in the memory space of the taint label, which can express the association of each table entry of each level with the first address of the next level page table, and complete the associated mapping of the page table of each level. Finally, the taint label of the memory range of interest is associated in the page table entry of the last level taint page table in the multi-level page table.

[0069] The first level page table address of the multi-level page table is distributed to the software and the auxiliary hardware, and both of them can index the taint label through the first level page table address. That is, the first level page table address of the multi-level page table corresponding to the program to be analyzed is sent to the auxiliary hardware, so that the auxiliary hardware obtains the first level page table address corresponding to the program to be analyzed; the virtual memory address is obtained, and the page table entry values of different levels are obtained according to the virtual memory address; the multi-level page table is indexed according to the first level page table address and the page table entry values of different levels, and the taint label corresponding to the virtual memory address is obtained in the memory space of the taint label.

[0070] Referring to Figure 3 The processing flow diagram for the software execution side to index the taint label by using the multi-level page table is that, in the software layer, the virtual memory address is taken as input, is split into three parts, and each part is calculated and converted to obtain a "value", which has a certain limit and can be used as an index of each level page table in the multi-level page table. Starting from the first address of the first level page table, the memory is accessed and indexed level by level until the page table entry of the last level page table is indexed, so as to obtain the storage position of the taint label corresponding to the address, and thus the taint label is obtained in the memory space of the taint label.

[0071] It should be further noted that when it is determined that the taint label is greater than a preset value (i.e. a large bit-width label), the memory space of the taint label is accessed multiple times by using the memory access interface to obtain the label data.

[0072] Referring to Figure 4 The processing flow diagram for the auxiliary hardware side to index the taint label by using the multi-level page table is that, in the process of executing the program software, the hardware performs business functions, and these hardware need to understand the specific situation of the business data. Therefore, the software sends the first level page table address of the multi-level page table to the auxiliary hardware, the auxiliary hardware determines the multi-level page table through the first level page table address, and takes the virtual memory address as input, splits it into three parts, and calculates and converts each part to obtain a "value", which has a certain limit and can be used as an index of each level page table in the multi-level page table. The memory space is indexed level by level in the same mode as the software using the multi-level page table, starting from the first address of the first level page table, until the page table entry of the last level page table is indexed, so as to obtain the storage position of the taint label corresponding to the address, and thus the taint label is obtained in the memory space of the taint label.

[0073] In the application, the management of the taint label can be realized from the combination of software and hardware, the initialization of the multi-level page table of the taint label and the memory access of the software are realized on the software execution side, only the memory region affected by the taint analysis is initialized and the taint label memory space is established, so that the space occupation is effectively reduced, and the memory access of the large bit width label can be realized, and effective management is achieved.

[0074] The application further provides a taint label processing method applied to an auxiliary hardware side, comprising:

[0075] Obtaining a first page table head address corresponding to a program to be analyzed;

[0076] Obtaining a virtual memory address, and obtaining the page table item value of the different level page tables according to the virtual memory address;

[0077] According to the first page table head address and the page table item value of the different level page tables, the multi-level page table is used for indexing, and the taint label corresponding to the virtual memory address is obtained in the taint label memory space.

[0078] To this end, after the software execution end constructs the label data memory space and the multi-level page table, the first page table head address of the multi-level page table is sent to the auxiliary hardware, the auxiliary hardware determines the corresponding multi-level page table through the first page table head address, and takes the virtual memory address as the input, splits it into three parts, and calculates and converts each part to obtain a "value". The value has a certain limit and can be used as the index of each level page table in the multi-level page table. The memory space uses the same level-by-level indexing mode as the software using the multi-level page table, and starts from the first address of the first page table to index level by level until the page table item of the last level page table is indexed, so as to obtain the storage position of the taint label corresponding to the address, and thus the taint label in the taint label memory space is obtained.

[0079] In addition, when the bus bit width is less than the bit width of the taint label, a special memory reading logic is called, the taint label is read through the bus continuously for multiple times, and is spliced into complete data, and the complete data is assigned to the register and other storage units in the auxiliary hardware.

[0080] When the bus bit width is less than the bit width of the taint label, a special memory writing logic is called, the taint label of the register and other storage units in the auxiliary hardware is split, and is written into the taint label memory space through the bus continuously for multiple times.

[0081] Referring to Figure 5 A taint label processing flowchart is realized from the combination of software and hardware.

[0082] Step 1: setting the memory range to be concerned and analyzed according to the type of the program to be analyzed.

[0083] Step 2: The software layer establishes a multi-level page table in the taint tag memory space, and associates each entry of each level with the starting address of the next level page table, thus completing the association mapping of the page tables level by level.

[0084] Step 3: Place the addresses of the taint tags in the memory range of interest one by one into the taint tag memory space, and associate the taint tags with the corresponding page table entries in the last-level taint page table.

[0085] Step 4: After the multi-level page table initialization is completed, the starting address of the first-level page table of the multi-level page table is distributed to the software layer and auxiliary hardware, that is, the taint tag access method is selected.

[0086] Step 5: When the software layer accesses the taint label corresponding to the virtual memory address, it takes the virtual memory address as input and splits it into three parts, each of which serves as an index to the page tables at each level.

[0087] Step 6: Through memory access, starting from the first address of the first-level page table, calculate step by step to obtain the storage location of the taint tag corresponding to that address.

[0088] Step 7: The software layer directly uses the memory access interface to access memory multiple times to obtain large-width tag data.

[0089] Step 8: The auxiliary hardware uses the same hierarchical indexing mode for the memory space, starting from the first address of the first-level page table and calculating step by step to obtain the storage location of the taint tag corresponding to that address.

[0090] Step 9: The auxiliary hardware uses the large-width memory access module to read and write the large-width taint tag.

[0091] The stain label processing apparatus provided by the present invention is described below. The stain label processing apparatus described below can be referred to in correspondence with the stain label processing method described above.

[0092] Figure 6 A schematic diagram of a stain label treatment device provided by the present invention is shown below. Figure 6 The device includes an acquisition module 61, a division module 62, and a processing module 63, wherein:

[0093] The acquisition module is used to obtain the starting address of the first-level page table corresponding to the program to be analyzed.

[0094] The partitioning module is used to obtain the virtual memory address and, based on the virtual memory address, to obtain the page table entry values ​​for different levels of page tables;

[0095] The processing module is used to index the multi-level page tables based on the starting address of the first-level page table and the page table entry values ​​of different levels of page tables, and obtain the taint label corresponding to the virtual memory address in the taint label memory space.

[0096] Since the device of the embodiment of the present application has the same principle as the above-mentioned embodiment method, more detailed explanation is not repeated here.

[0097] It should be noted that the related function modules in the embodiment of the present application can be realized by an auxiliary hardware processor.

[0098] The memory range of the program is limited and the multi-level page table is configured, so that when the tainted label is searched, the multi-level page table is indexed according to the first address of the first-level page table and the page table entry values of different levels of page tables, and the tainted label corresponding to the virtual memory address under the memory range is obtained in the tainted label memory space, so that the purpose of effectively reducing space occupation and quickly indexing is achieved.

[0099] Figure 7 An example of a schematic diagram of the physical structure of an electronic device is shown in Figure 7 As shown, the electronic device can include a processor 71, a communications interface 72, a memory 73 and a communications bus 74, wherein the processor 71, the communications interface 72 and the memory 73 complete mutual communication through the communications bus 74. The processor 71 can call the logical instructions in the memory 73 to execute the tainted label processing method, which includes: obtaining the first address of the first-level page table corresponding to the program to be analyzed; obtaining a virtual memory address, and obtaining the page table entry values of different levels of page tables according to the virtual memory address; and according to the first address of the first-level page table and the page table entry values of different levels of page tables, indexing the multi-level page table to obtain the tainted label corresponding to the virtual memory address in the tainted label memory space.

[0100] In addition, the logical instructions in the memory 73 described above can be realized in the form of a software function unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0101] In another aspect, the present application also provides a computer program product comprising a computer program, the computer program being stored in a non-transitory computer readable storage medium, and the computer program being executable by a processor to cause a computer to perform the method for processing a taint label provided by any of the above methods, the method comprising: obtaining a first-level page table head address corresponding to a program to be analyzed; obtaining a virtual memory address, and obtaining page table entry values of different-level page tables according to the virtual memory address; and using the multi-level page tables to index according to the first-level page table head address and the page table entry values of different-level page tables, to obtain a taint label corresponding to the virtual memory address in a taint label memory space.

[0102] In yet another aspect, the present application also provides a non-transitory computer readable storage medium having a computer program stored thereon, the computer program being executable by a processor to implement the method for processing a taint label provided by any of the above methods, the method comprising: obtaining a first-level page table head address corresponding to a program to be analyzed; obtaining a virtual memory address, and obtaining page table entry values of different-level page tables according to the virtual memory address; and using the multi-level page tables to index according to the first-level page table head address and the page table entry values of different-level page tables, to obtain a taint label corresponding to the virtual memory address in a taint label memory space.

[0103] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purposes of the embodiments according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0104] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be implemented by means of software plus necessary general hardware platforms, and of course can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the parts that make contributions to the prior art can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0105] It should be pointed out finally that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit the same; and although the present application has been described in detail with reference to the foregoing embodiments, it should be appreciated by those skilled in the art that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features thereof can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for treating stained labels, characterized in that, Applied to the software execution side, including: Obtain the starting address of the first-level page table corresponding to the program to be analyzed; Obtain the virtual memory address, and based on the virtual memory address, obtain the page table entry values ​​for different levels of page tables; Based on the starting address of the first-level page table and the page table entry values ​​of different levels of page tables, the multi-level page tables are used for indexing to obtain the taint label corresponding to the virtual memory address in the taint label memory space; The method further includes: constructing a multi-level page table, including: Construct a memory space for taint labels that is adapted to the program to be analyzed; Construct a multi-level page table that adapts to the memory space of the taint label. Each level of the page table includes multiple page table entries and a page table start address. Each page table entry has a page table entry value. Determine the memory range to be analyzed based on the program type of the program to be analyzed; Obtain the virtual memory address corresponding to the taint label within the memory range to be analyzed, and obtain the page table entry value of different levels of page table based on the virtual memory address; Based on the page table entry values ​​of different levels of page tables, a mapping relationship is constructed between the page table entry value of the i-th level page table and the starting address of the (i+1)-th level page table, where i is 1, 2, ..., n. The taint label is then associated with the corresponding page table entry in the last level page table of the multi-level page table. Store the starting address of the first-level page table of the multi-level page table corresponding to the program to be analyzed; The method further includes: When it is determined that the taint label is greater than the preset value, the taint label memory space is accessed multiple times using the memory access interface to obtain the taint label.

2. The stain label treatment method according to claim 1, characterized in that, The multi-level page table contains a mapping relationship between the page table entry value of the i-th level page table and the starting address of the (i+1)-th level page table, where i is 1, 2, ..., n; correspondingly, the step of using the multi-level page table for indexing based on the starting address of the first-level page table and the page table entry values ​​of different levels of page tables to obtain the taint label corresponding to the virtual memory address in the taint label memory space includes: Based on the mapping relationship between the page table entry value of the i-th level page table and the starting address of the (i+1)-th level page table, the starting address of the first-level page table and the page table entry values ​​of different levels of page tables are indexed in the multi-level page tables to obtain the taint label corresponding to the page table entry in the last level page table of the multi-level page tables in the taint label memory space.

3. The stain label treatment method according to claim 1, characterized in that, The method further includes: sending the starting address of the first-level page table of the multi-level page table corresponding to the program to be analyzed to the auxiliary hardware, so that the auxiliary hardware can obtain the starting address of the first-level page table corresponding to the program to be analyzed; obtaining the virtual memory address, and obtaining the page table entry values ​​of different levels of page tables based on the virtual memory address; and using the multi-level page table for indexing based on the starting address of the first-level page table and the page table entry values ​​of different levels of page tables, obtaining the taint label corresponding to the virtual memory address in the taint label memory space.

4. A method for treating stained labels, characterized in that, Applied to the auxiliary hardware side, including: Obtain the starting address of the first-level page table corresponding to the program to be analyzed; Obtain the virtual memory address, and based on the virtual memory address, obtain the page table entry values ​​for different levels of page tables; Based on the starting address of the first-level page table and the page table entry values ​​of different levels of page tables, the multi-level page tables are used for indexing to obtain the taint label corresponding to the virtual memory address in the taint label memory space; Construct a multi-level page table, including: Construct a memory space for taint labels that is adapted to the program to be analyzed; Construct a multi-level page table that adapts to the memory space of the taint label. Each level of the page table includes multiple page table entries and a page table start address. Each page table entry has a page table entry value. Determine the memory range to be analyzed based on the program type of the program to be analyzed; Obtain the virtual memory address corresponding to the taint label within the memory range to be analyzed, and obtain the page table entry value of different levels of page table based on the virtual memory address; Based on the page table entry values ​​of different levels of page tables, a mapping relationship is constructed between the page table entry value of the i-th level page table and the starting address of the (i+1)-th level page table, where i is 1, 2, ..., n. The taint label is then associated with the corresponding page table entry in the last level page table of the multi-level page table. Store the starting address of the first-level page table of the multi-level page table corresponding to the program to be analyzed.

5. The stain label treatment method according to claim 4, characterized in that, ； The method further includes: When the bus width is less than the width of the taint tag, a dedicated memory read logic is invoked to read the taint tag multiple times through the bus and concatenate them into complete data. When the bus width is less than the width of the taint tag, a dedicated memory write logic is invoked to split the taint tag and write it into the taint tag memory space multiple times via the bus.

6. A stain label treatment apparatus based on the stain label treatment method according to any one of claims 1-3 or claim 4 or 5, characterized in that, include: The acquisition module is used to obtain the starting address of the first-level page table corresponding to the program to be analyzed. The partitioning module is used to obtain the virtual memory address and, based on the virtual memory address, obtain the page table entry values ​​for different levels of page tables; The processing module is used to index the multi-level page tables according to the starting address of the first-level page table and the page table entry values ​​of different level page tables, and obtain the taint tag corresponding to the virtual memory address in the taint tag memory space.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the stain label processing method as described in any one of claims 1-3, or the stain label processing method as described in claim 4 or 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the stain label processing method as described in any one of claims 1-3, or the stain label processing method as described in claim 4 or 5.

Images