Low-interference taint path restoration system and method based on static instrumentation

Abstract

The invention discloses a low-interference taint path restoration system and method based on static instrumentation, and mainly solves the problems of stiff analysis strategy, high operation overhead and result semantic deficiency faced by existing vulnerability mining and security assessment. The system comprises a target data acquisition end and an analysis engine which run independently and are connected through a shared memory channel; lightweight static instrumentation is performed on a source code in a target program compiling stage, and a shared memory channel with an analysis engine is established; by constructing a "producer-consumer" asynchronous decoupling architecture, time-consuming taint rule management and path restoration logic are stripped from a service main thread; a lockless annular buffer area is utilized to efficiently capture a runtime data stream, and a source code level taint propagation path is restored in an independent analysis engine in combination with debugging information and a call stack Hash algorithm. According to the method, a high-precision source code level analysis result can be obtained while low performance loss is kept, and the efficiency and flexibility of vulnerability mining are greatly improved.

Description

Technical Field

[0001] This invention belongs to the field of computer network security technology, and further relates to network data flow analysis and security assessment technology. Specifically, it is a low-interference taint path restoration system and method based on static instrumentation, which can be used to assess the impact of tainted data propagation during network security analysis, as well as in scenarios such as vulnerability mining, interactive analysis, and automated fuzzing enhancement of high-performance software in production environments. Background Technology

[0002] Dynamic taint analysis is a technique that marks and tracks the propagation path of untrusted data (i.e., taints) within a program. It is widely used in vulnerability detection, privacy breach analysis, and malware analysis. The libdft technology, presented at the VEE '12 conference, uses tools like Intel Pin to modify the binary instruction stream in real-time during program execution to insert propagation logic for analysis. While this approach offers versatility by allowing analysis without source code, it suffers from significant performance overhead due to the need for real-time instruction translation and state maintenance. Furthermore, it lacks high-level language type information due to its separation from the compilation environment, making it difficult to pinpoint the root cause of vulnerabilities. The PolyTracker technology, presented at the ISSTA 2024 conference, achieves dynamic tracking of all input data and reduces runtime overhead through compile-time instrumentation. However, its policy configuration relies heavily on environment variables or static rule files, and taint definitions often use a full-scale marking mode, failing to meet the need for flexible attention to specific data segments in interactive analysis. The ShadowReplica technology, presented at the CCS '13 conference, aims to offload heavy analysis logic from the main thread through a multi-core architecture. While this improves throughput to some extent, it introduces significant inter-process data synchronization overhead and is prone to generating massive amounts of redundant logs when dealing with high-frequency execution paths. It also lacks the ability to extract micro-instruction streams into macro-semantic paths.

[0003] Traditional binary instrumentation-based taint analysis synchronously executes complex logical judgments, taint propagation, and logging within the process, severely slowing down the target program's execution speed. In time-sensitive scenarios (such as high-concurrency services or real-time control systems), this latency can lead to program timeouts, connection drops, or abnormal behavior, rendering the analysis unusable. Existing high-performance source code instrumentation solutions typically determine taint sources and convergence points at compile time; once analysis rules need to be modified, analysts must recompile or restart the target program, which is extremely inefficient for long-running services or interactive analysis scenarios requiring frequent strategy adjustments. In production environments, when taint propagation triggers logging, traditional debugging APIs cannot obtain the correct call stack; using in-process resolution of debug symbols consumes significant CPU and memory resources, causing instability in the target process; if only binary addresses are recorded, developers find it difficult to map the analysis results back to the source code for repair. Therefore, as software scale and complexity increase, obtaining high-precision source code-level analysis results while maintaining low performance overhead has become a major challenge in this field. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a low-interference taint path restoration system and method based on static instrumentation. This system aims to solve the problems of rigid analysis strategies, high runtime overhead, and semantic loss of results faced by production-level software during vulnerability discovery and security assessment. First, lightweight static instrumentation is performed on the source code during the target program compilation phase, pre-embedding policy execution hooks and shadow memory operation logic, and establishing a shared memory channel with the analysis engine. By constructing an asynchronous decoupled "producer-consumer" architecture, the time-consuming taint rule management and path restoration logic are separated from the main business thread. Then, a lock-free circular buffer is used to efficiently capture runtime data streams, and in an independent analysis engine, debugging information and call stack hashing algorithms are combined to asynchronously restore accurate source code-level taint propagation paths. A runtime multi-granularity policy injection mechanism is provided, allowing new taint rules to be dynamically issued to pre-embedded instrumentation points (supporting full marking, offset range marking, signature matching, and other granularities) without restarting the target process through inter-process communication. This invention enables hot policy updates, allowing security analysts to adjust their focus in real time based on preliminary analysis results, conduct in-depth interactive analysis, and combine asynchronous debugging information to achieve high-precision source code-level path reconstruction, thereby significantly improving the efficiency and flexibility of vulnerability discovery while ensuring low interference.

[0005] To achieve the above objectives, the technical solution of the present invention includes the following:

[0006] A low-interference taint path restoration system based on static instrumentation includes two parts: a target data acquisition end and an analysis engine. The two parts run independently and are connected through a shared memory channel.

[0007] The target data acquisition terminal consists of a compilation instrumentation unit, a taint rule marking unit, and a taint trajectory recording unit. The compilation instrumentation unit inserts a taint propagation strategy into the test object, the taint rule marking unit marks the test input with tainted data, and the taint trajectory recording unit extracts the taint propagation trajectory and forms a call stack to be sent to the analysis engine.

[0008] The analysis engine consists of a taint rule management unit and a path restoration and compression unit. The taint rule management unit is used to generate and distribute taint rule sets, and at the same time maintain the taint rule set of the target data acquisition end. The path restoration and compression unit is used to read data from the shared memory channel, parse it in combination with debugging information, and finally generate a data report.

[0009] Furthermore, the aforementioned compiler instrumentation unit is the core building module of the target data acquisition end. It is used to inject taint propagation strategy execution instructions and taint trajectory recording instructions into the binary file through compiler instrumentation technology during the compilation phase of the test object; and to link the runtime support component responsible for executing taint rule marking logic to the binary file to construct the taint rule marking unit.

[0010] Furthermore, the aforementioned taint rule marking unit is integrated at the data entry point of the test object, used to receive taint rules from the shared memory channel, and to perform real-time matching and taint tag assignment on the test inputs entering the system according to the rules; the test inputs include network packets and file streams.

[0011] Furthermore, the aforementioned taint trajectory recording units are distributed at the key instruction nodes of the test object. These nodes include memory read / write, data comparison, and memory block transfer operations. They are used to monitor the flow of data with taint tags during the runtime of the test object and capture the current execution context, i.e., call stack information, when a propagation event is triggered.

[0012] Furthermore, the path restoration and compression unit in the aforementioned analysis engine includes a cache query module, an ELF debug information loading module, an address resolution module, and a path compression module. The cache query module reads the original call stack sequence from the circular buffer and queries the cache for the parsing results of the call stack address to be resolved. The ELF debug information loading module loads the .debug_info and .debug_line segments of the ELF format binary file corresponding to the test object. The address resolution module traverses the .debug_info segment to obtain the function base address and calculates the absolute PC address, then locates the corresponding source file name and line number through the .debug_line segment. The path compression module calculates a hash signature on the restored call stack and generates or collapses path nodes based on signature changes. The generated data report contains the source code-level mapping of the taint propagation call stack and the macroscopic path of taint propagation.

[0013] Furthermore, this invention also proposes a low-interference taint path restoration method based on static instrumentation, comprising the following steps:

[0014] (1) At the target data acquisition end, the source code of the test object is statically analyzed by the compilation instrumentation unit, the taint propagation strategy execution instructions and taint trajectory recording instructions are automatically injected into the binary file, and the runtime support component responsible for executing the taint rule marking logic is linked to the binary file to build the taint rule marking unit, generating a binary executable file that retains the .eh_frame segment and DWARF debugging information and can enable the removal of frame pointer optimization;

[0015] (2) Start the analysis engine, initialize the taint rule management unit, path restoration and compression unit, and create a shared memory area; then load and run the instrumented test object and establish a communication connection with the analysis engine;

[0016] (3) Analysts configure taint rule sets through the taint rule management unit according to test requirements, including: generating taint rule sets through the taint rule management unit and dynamically distributing them to the taint rule marking unit through shared memory; when the target data acquisition terminal processes test input, the taint rule marking unit marks taint sources in real time according to the latest rules;

[0017] (4) The target data acquisition terminal executes the business logic of the test object. When the tainted data changes due to the instruction flow, the tainted trajectory recording unit triggers the stack backtracking logic, obtains the current instruction pointer sequence, and writes it into the shared memory. The instruction flow includes memory read and write, data comparison, and memory block transfer operations.

[0018] (5) The path restoration and compression unit continuously retrieves data from shared memory, combines standardized debugging information DWARF to complete source code-level positioning, and executes the path compression algorithm in real time to filter redundant information, and finally outputs the macro attack path or privacy leakage link.

[0019] (6) The system generates an analysis report containing source code-level location information and macro-level attack paths or privacy leakage links, and completes the tainted path restoration process.

[0020] Compared with the prior art, the present invention has the following advantages:

[0021] First, this invention significantly improves the iteration efficiency of analysis strategies. Existing compile-time instrumentation schemes typically suffer from static configuration, meaning taint sources and tracing rules must be hard-coded during the compilation phase. If analysts need to adjust their concerns, they must undergo a time-consuming recompile and service restart process. This invention introduces a runtime strategy injection mechanism based on shared memory, allowing external control to instantly deliver taint rules with byte-level precision via inter-process communication during the target program's execution. These rules are then activated in real-time by pre-embedded hook functions. This design enables analysts to dynamically adjust analysis strategies with millisecond-level response times during vulnerability discovery or interactive debugging of long-running services, without interrupting business operations or resetting the program state.

[0022] Secondly, this invention solves the problem of missing source code location in production-level optimized code. Traditional dynamic analysis tools, when faced with binary programs that have enabled high-level optimizations and removed frame pointers, often cannot correctly trace back the call stack and can only output exposed memory addresses, making it difficult to locate the root cause of vulnerabilities. This invention innovatively combines runtime exception frame unrolling technology with asynchronous debug symbol resolution services. This architecture ensures that even in extreme optimization scenarios with severe register reuse and a corrupted stack frame structure, the system can still accurately capture the execution context and, without blocking the target program's execution, accurately restore the binary instruction addresses to the source code's filename and line number in the background, balancing high program performance and high readability of analysis results.

[0023] Third, this invention significantly reduces the interference of the analysis process on the timing behavior of the target software and enhances the semantic value of the data. While existing decoupled analysis schemes attempt to transfer the analysis logic to auxiliary threads, they still generate a large amount of redundant instruction-level logs when dealing with software containing numerous loops (such as encryption or verification operations), resulting in excessively large output logs that obscure the core logic. This invention employs a "producer-consumer" asynchronous architecture combined with a unique macro-path extraction algorithm. At the data generation end, it performs only low-overhead, lock-free writing, while at the consumption end, it identifies and folds repeated calls in loop structures in real time through a state machine. This mechanism not only compresses massive micro-instruction streams into clear function-level functional jump paths, significantly reducing storage and transmission pressure, but more importantly, it preserves the original timing characteristics of the target software to the greatest extent possible, making it possible to analyze complex timing vulnerabilities in high-concurrency or real-time systems.

[0024] Compared to the industry-leading compile-time instrumentation technologies (such as PolyTracker) and decoupled analysis architectures (such as ShadowReplica), this invention achieves significant technological breakthroughs in three dimensions: flexibility, accuracy, and non-intrusiveness. Attached Figure Description

[0025] Figure 1 This is a diagram of the overall system architecture proposed in this invention;

[0026] Figure 2 This is a schematic diagram of the taint policy injection and activation process during system runtime of the present invention;

[0027] Figure 3 This is a layout diagram of application memory and shadow memory mapping under the x86_64 architecture of this invention;

[0028] Figure 4 This is a schematic diagram illustrating the principles of low-interference asynchronous analysis, source code restoration, and path deduplication in this invention. Detailed Implementation

[0029] The present invention will now be further described with reference to the accompanying drawings.

[0030] Example 1: Refer to Figure 1 The present invention proposes a low-interference taint path restoration system based on static instrumentation, which includes two parts: a target data acquisition end and an analysis engine. The two parts run independently and are connected through a shared memory channel.

[0031] The target data acquisition terminal, such as Figure 1As shown in the left half, it is specifically composed of a compilation instrumentation unit, a taint rule marking unit, and a taint trajectory recording unit. The compilation instrumentation unit inserts a taint propagation strategy into the test object, the taint rule marking unit marks the test input with taint data, and the taint trajectory recording unit extracts the taint propagation trajectory and forms a call stack to be sent to the analysis engine.

[0032] The analysis engine, such as Figure 1 The right half shows that it consists of a taint rule management unit and a path restoration and compression unit. The taint rule management unit is used to generate and distribute taint rule sets, and at the same time maintain the taint rule set of the target data acquisition end. The path restoration and compression unit is used to read data from the shared memory channel, parse it in combination with debugging information, and finally generate a data report.

[0033] In this embodiment, the aforementioned compiler instrumentation unit is the core building module of the target data acquisition end. It is used to inject taint propagation strategy execution instructions and taint trajectory recording instructions into the binary file during the compilation phase of the test object through compiler instrumentation technology (such as LLVM Pass); and to link the runtime support component responsible for executing taint rule marking logic to the binary file to build the taint rule marking unit.

[0034] In this embodiment, the taint rule marking unit is integrated at the data entry point of the test object. It is used to receive taint rules from the shared memory channel and perform real-time matching and taint tag assignment on the test inputs entering the system according to the rules. The test inputs include network packets and file streams.

[0035] In this embodiment, the aforementioned taint trajectory recording unit is distributed in the key instruction nodes of the test object. The node includes memory read / write, data comparison, and memory block transfer operations. It is used to monitor the data flow with taint tags during the runtime of the test object and capture the current execution context, i.e., call stack information, when a propagation event is triggered.

[0036] In this embodiment, the path restoration and compression unit in the analysis engine includes a cache query module, an ELF debug information loading module, an address resolution module, and a path compression module. The cache query module reads the original call stack sequence from the circular buffer and queries the cache to see if there is a resolution result for the call stack address to be resolved. The ELF debug information loading module loads the .debug_info and .debug_line segments of the ELF format binary file corresponding to the test object. The address resolution module traverses the .debug_info segment to obtain the function base address and calculates the absolute PC address, and then locates the corresponding source file name and line number through the .debug_line segment. The path compression module calculates a hash signature on the restored call stack and generates or collapses path nodes based on the signature changes. The generated data report contains the source code-level mapping of the taint propagation call stack and the macroscopic path of taint propagation.

[0037] Example 2: Refer to Figure 1-3 The present invention proposes a low-interference taint path restoration method based on static instrumentation, the specific implementation steps of which include:

[0038] Step 1) At the target data acquisition end, static analysis of the source code of the test object is performed using the compilation instrumentation unit. The taint propagation strategy execution instructions and taint trajectory recording instructions are automatically injected into the binary file. The runtime support component responsible for executing the taint rule marking logic is linked to the binary file to build the taint rule marking unit, generating a binary executable file that retains the .eh_frame segment and DWARF debugging information and can enable frame pointer removal optimization.

[0039] Step 2) Start the analysis engine, initialize the taint rule management unit, path restoration and compression unit, and create a shared memory region; then load and run the instrumented test object and establish a communication connection with the analysis engine.

[0040] Step 3) Analysts configure taint rule sets according to test requirements through the taint rule management unit, including: generating taint rule sets through the taint rule management unit and dynamically distributing them to the taint rule marking unit via shared memory; when the target data acquisition end processes test input, the taint rule marking unit marks taint sources in real time according to the latest rules, such as... Figure 2 As shown;

[0041] The specific implementation process of this step in this embodiment is as follows:

[0042] (3.1) The taint rule management unit responds to the interactive requests of the analysts, generates a set of taint rules that supports full marking, offset marking and feature code matching, and serializes these rules and writes them into the control channel of shared memory;

[0043] (3.2) The taint rule marking unit continuously monitors the shared memory channel. When a new rule is detected to be written, the unit uses the read-copy-update (RCU) mechanism to request new memory, build a copy of the rule list without blocking the business thread, and switch the global rule pointer through atomic operations to complete the lock-free update of the policy.

[0044] (3.3) When an external test enters the input entry of the test object, the taint rule marking unit reads the currently effective global rule chain list without lock, performs real-time scanning and matching of the input data; and when the input data is successfully matched, it sets the shadow byte of the corresponding area to the taint state by operating the shadow memory, thus completing the dynamic injection of taint.

[0045] Step 4) The target data acquisition terminal executes the business logic of the test object. When tainted data changes due to instruction flow, the tainted trajectory recording unit triggers stack backtracking logic to obtain the current instruction pointer sequence and write it to shared memory; the instruction flow includes memory read / write, data comparison, and memory block transfer operations. Figure 3 As shown, the shadow memory described above in this embodiment employs a bitmask-based memory mapping mechanism, specifically including:

[0046] (4a1) During the system initialization phase, the virtual address space is divided into application memory and its corresponding shadow memory region, wherein the shadow memory region is used to store taint label data;

[0047] (4a2) The taint trajectory recording unit uses bitmask Mask operation to map any application memory address to its corresponding shadow memory address; in this embodiment, the specific method is to use the formula: Shadow_Addr = App_Addr ^ Mask to map any application memory address to its corresponding shadow memory address in O(1) time complexity.

[0048] (4a3) During the execution of the test object, when a data movement instruction (such as MOV) or a calculation instruction (such as ADD) is detected, the taint trajectory recording unit automatically checks the shadow memory state of the source operand; if the source operand is tainted, the taint label is propagated to the shadow memory of the destination operand, so that the taint state is automatically updated with the data flow.

[0049] In this embodiment, the aforementioned taint trajectory recording unit triggers stack backtracking logic to obtain the current instruction pointer sequence and write it into shared memory, including the following steps:

[0050] (4b1) When the test object runs and the shadow memory changes, the taint track recording unit immediately reads the .eh_frame segment mapped in memory and parses the call frame information. It iteratively searches for the frame description entry with the current program counter as the index and calculates the canonical frame address and return address of the previous frame until the bottom of the stack. Finally, a set of original call stack sequences containing PC, function entry address and function offset is generated.

[0051] (4b2) The taint trace recording unit encapsulates the captured raw call stack sequence into a structure and writes it to a shared memory ring buffer in a lock-free manner.

[0052] Step 5) The path restoration and compression unit continuously retrieves data from shared memory, combines it with standardized debugging information DWARF to complete source code-level positioning, and executes the path compression algorithm in real time to filter redundant information, and finally outputs the macroscopic attack path or privacy leakage link.

[0053] In this embodiment, the path restoration and compression unit specifically implements source code-level location and path compression according to the following steps:

[0054] (5.1) The path restoration and compression unit acts as a consumer, reads the original call stack sequence in batches from the circular buffer, and uses the parsing result cache to query whether the call stack address to be parsed is already cached. If it is, it reads it directly and executes step (5.5). Otherwise, it executes step (5.2) for parsing.

[0055] (5.2) During parsing, the path restoration and compression unit opens the ELF format binary file corresponding to the test object, loads the debugging information segment inside it, and reads the .debug_info segment containing debugging information entries and the .debug_line segment containing the line number mapping matrix;

[0056] (5.3) For each address to be resolved, traverse the .debug_info segment to find the subroutine tag and match the function name, extract the function base address, and add it to the relative offset within the function to calculate the absolute PC address;

[0057] (5.4) Using the absolute PC address, query the line number matrix of the .debug_line segment to accurately locate and output the corresponding source file name and line number, complete the source code level restoration, and then write the parsing result into the cache;

[0058] (5.5) The restored call stack is processed using the call stack hash algorithm. The hash signature of the current call stack is calculated. If it is the same as the previous state, it is automatically folded. Otherwise, a new path node is generated when the signature changes.

[0059] Step 6) The system generates an analysis report containing source code-level location information and macro-level attack paths or privacy leakage links, completing the tainted path restoration process.

[0060] Example 3: The overall implementation steps of the path restoration method provided in this example are the same as in Example 2. Refer to the example below. Figure 4 Specific examples are provided to further describe in detail the implementation process of the asynchronous path restoration and compression mechanism in this invention:

[0061] This mechanism adopts an asynchronous decoupled "producer-consumer" architecture, where the producer corresponds to the taint trajectory recording unit, and the consumer corresponds to the path restoration and compression unit. This mechanism is responsible for transforming the underlying micro-level records into macro-level semantic paths. The specific execution steps are as follows:

[0062] Step S1: When the test object runs and the shadow memory changes (i.e., taint propagation occurs), the taint trajectory recording unit immediately reads the .eh_frame segment mapped in memory and parses the call frame information. Using the current program counter as the index, it iteratively searches for the frame description entry and calculates the canonical frame address and return address of the previous frame until the bottom of the stack, thereby generating a set of original call stack sequences containing PC, function entry address and function offset.

[0063] Step S2: The taint trace recording unit encapsulates the captured original instruction address sequence into a structure and writes it into the shared memory ring buffer without locking, thus completing the production process.

[0064] Step S3: The path restoration and compression unit in the analysis engine, acting as a consumer, reads the original address sequence in batches from the circular buffer and executes the following high-precision restoration logic:

[0065] Step S3.1: The system first uses the parsing result cache to check whether the call stack address to be parsed is already cached; if the cache is hit, the previously parsed source code location information is read directly, thereby speeding up the process; if the cache is not hit, the subsequent parsing steps are executed.

[0066] Step S3.2: The path restoration and compression unit opens the ELF format binary file corresponding to the test object, loads the debug information segment inside it, and reads the .debug_info segment containing debug information entries and the .debug_line segment containing the line number mapping matrix.

[0067] Step S3.3: For each address to be resolved, this unit traverses the debug information entries in the .debug_info segment, searches for the entry labeled DW_TAG_subprogram (i.e., subroutine / function), and checks whether the DW_AT_name attribute (function name) of the entry matches the function identifier captured or resolved in step S2.

[0068] Step S3.4: Once the matching function DIE is located, the unit immediately extracts its DW_AT_low_pc attribute from the entry, which records the starting virtual address (function base address) of the function at compile time.

[0069] Step S3.5: This unit adds the extracted function base address (DW_AT_low_pc) to the relative offset within the function captured in step S2, thereby accurately calculating the absolute PC address of the instruction at runtime (calculation formula: absolute address = DW_AT_low_pc + offset).

[0070] Step S3.6 Locate the source code by querying the line number table: Finally, this unit determines the compilation unit (CU) to which the function belongs and searches for the .debug_line segment (line number matrix) associated with that CU. It uses the absolute PC address calculated in the previous step to query the line number matrix, thereby accurately locating and outputting its corresponding source file name and line number (e.g., main.c:150), completing the source code-level reconstruction, and writing the parsing result to the parsing result cache.

[0071] Step S4: To address redundancy issues, the path restoration and compression unit further processes the restored call stack using a call stack hash algorithm. This algorithm calculates the hash signature of the current call stack; if it matches the previous state, it is automatically folded. New path nodes are only generated when the signature changes, ultimately outputting a logically clear macroscopic path report.

[0072] This invention supports real-time adjustment of taint policies and, combined with source code-level backtracking capabilities, enables security researchers to quickly verify attack hypotheses and pinpoint the root cause of crashes when exploring high-frequency vulnerability scenarios such as browsers and office software, significantly improving the efficiency and accuracy of security research. It also provides high-quality, semantically rich data stream feedback for mainstream fuzzing tools such as AFL++, effectively overcoming the limitations of complex verification logic and improving code coverage in fuzzing, helping enterprises identify and fix security flaws early in the development phase. Simultaneously, this invention, combined with DWARF's precise mapping capabilities, can directly assign online captured anomalies to the corresponding code maintainers, achieving automated vulnerability attribution and flow, significantly shortening the average cycle from vulnerability discovery to fix, and effectively promoting the efficient implementation of DevSecOps systems in enterprises. This invention innovatively adopts a call stack hash algorithm, achieving automatic path folding through signature comparison and outputting a logically clear macro-path report, effectively solving the redundancy problem in traditional path analysis and improving the efficiency and readability of path analysis. The technical solution of this invention has broad commercialization prospects and can deeply cover many fields such as security research, software development, and enterprise security operations.

[0073] The parts of this invention not described in detail are common knowledge to those skilled in the art. The above description is only a preferred embodiment of the present invention and is not intended to limit the invention. Obviously, those skilled in the art, after understanding the content and principles of the present invention, may make various modifications and changes in form and detail without departing from the principles and structure of the present invention. However, these modifications and changes based on the concept of the present invention are still within the protection scope of the claims of the present invention.

Claims

1. A low-interference taint path restoration system based on static instrumentation, characterized in that: It consists of two parts: a target data acquisition terminal and an analysis engine. The two operate independently but are connected through a shared memory channel. The target data acquisition terminal consists of a compilation instrumentation unit, a taint rule marking unit, and a taint trajectory recording unit. The compilation instrumentation unit inserts a taint propagation strategy into the test object, the taint rule marking unit marks the test input with tainted data, and the taint trajectory recording unit extracts the taint propagation trajectory and forms a call stack to be sent to the analysis engine. The analysis engine consists of a taint rule management unit and a path restoration and compression unit. The taint rule management unit is used to generate and distribute taint rule sets, and at the same time maintain the taint rule set of the target data acquisition end. The path restoration and compression unit is used to read data from the shared memory channel, parse it in combination with debugging information, and finally generate a data report.

2. The system according to claim 1, characterized in that: The compiler instrumentation unit is the core building module of the target data acquisition terminal. It is used to inject taint propagation strategy execution instructions and taint trajectory recording instructions into the binary file during the compilation phase of the test object through compiler instrumentation technology. The runtime support components responsible for executing taint rule marking logic are linked into the binary file to construct the taint rule marking unit.

3. The system according to claim 2, characterized in that: The taint rule marking unit is integrated at the data entry point of the test object. It is used to receive taint rules from the shared memory channel and perform real-time matching and taint tag assignment on the test inputs entering the system according to the rules. The test inputs include network packets and file streams.

4. The system according to claim 1, characterized in that: The taint trajectory recording unit is distributed at the key instruction nodes of the test object. The node includes memory read / write, data comparison, and memory block transfer operations. It is used to monitor the data flow with taint tags during the runtime of the test object and capture the current execution context, i.e., call stack information, when a propagation event is triggered.

5. The system according to claim 1, characterized in that: The path restoration and compression unit in the analysis engine includes a cache query module, an ELF debug information loading module, an address resolution module, and a path compression module. The cache query module reads the original call stack sequence from the circular buffer and checks if the cache contains the resolution result for the call stack address to be resolved. The ELF debug information loading module loads the .debug_info and .debug_line segments of the ELF format binary file corresponding to the test object. The address resolution module traverses the .debug_info segment to obtain the function base address and calculates the absolute PC address, then locates the corresponding source file name and line number through the .debug_line segment. The path compression module calculates a hash signature on the restored call stack and generates or collapses path nodes based on signature changes. The generated data report contains the source code-level mapping of the taint propagation call stack and the macroscopic path of taint propagation.

6. A method for taint path restoration based on the system of claim 1, characterized in that, Includes the following steps: (1) At the target data acquisition end, the source code of the test object is statically analyzed by the compilation instrumentation unit, the taint propagation strategy execution instructions and taint trajectory recording instructions are automatically injected into the binary file, and the runtime support component responsible for executing the taint rule marking logic is linked to the binary file to build the taint rule marking unit, generating a binary executable file that retains the .eh_frame segment and DWARF debugging information and can enable the removal of frame pointer optimization; (2) Start the analysis engine, initialize the taint rule management unit, path restoration and compression unit, and create a shared memory area; then load and run the instrumented test object and establish a communication connection with the analysis engine; (3) Analysts configure tainted rule sets through the tainted rule management unit according to the test requirements, including: generating tainted rule sets through the tainted rule management unit and dynamically distributing them to the tainted rule marking unit through shared memory; When the target data acquisition terminal processes the test input, the taint rule marking unit marks the taint source in real time according to the latest rules; (4) The target data acquisition terminal executes the business logic of the test object. When the tainted data changes due to the instruction flow, the tainted trajectory recording unit triggers the stack backtracking logic, obtains the current instruction pointer sequence, and writes it into the shared memory. The instruction flow includes memory read and write, data comparison, and memory block transfer operations. (5) The path restoration and compression unit continuously retrieves data from shared memory, combines standardized debugging information DWARF to complete source code-level positioning, and executes the path compression algorithm in real time to filter redundant information, and finally outputs the macro attack path or privacy leakage link. (6) The system generates an analysis report containing source code-level location information and macro-level attack paths or privacy leakage links, and completes the tainted path restoration process.

7. The method according to claim 6, characterized in that: The specific implementation steps for configuring the taint rule set through the taint rule management unit in step (3) are as follows: (3.1) The taint rule management unit responds to the interactive requests of the analysts, generates a set of taint rules that supports full marking, offset marking and feature code matching, and serializes these rules and writes them into the control channel of shared memory; (3.2) The taint rule marking unit continuously monitors the shared memory channel. When a new rule is detected to be written, the unit uses a read-copy-update mechanism to request new memory, build a copy of the rule list without blocking the business thread, and switch the global rule pointer through atomic operations to complete the lock-free update of the policy. (3.3) When an external test enters the input entry of the test object, the taint rule marking unit reads the currently effective global rule chain list without lock, performs real-time scanning and matching of the input data; and when the input data is successfully matched, it sets the shadow byte of the corresponding area to the taint state by operating the shadow memory, thus completing the dynamic injection of taint.

8. The method according to claim 6, characterized in that: The shadow memory mentioned in step (4) employs a bitmask-based memory mapping mechanism, specifically including: (4a1) During the system initialization phase, the virtual address space is divided into application memory and its corresponding shadow memory region, wherein the shadow memory region is used to store taint label data; (4a2) The taint trajectory recording unit uses bitmask Mask operation to map any application memory address to its corresponding shadow memory address; (4a3) During the execution of the test object, when a data movement instruction or calculation instruction is detected, the taint trajectory recording unit automatically checks the shadow memory state of the source operand; if the source operand is tainted, the taint label is propagated to the shadow memory of the destination operand, so that the taint state is automatically updated with the data flow.

9. The method according to claim 8, characterized in that: The taint trajectory recording unit in step (4) triggers the stack backtracking logic to obtain the current instruction pointer sequence and write it into shared memory, including the following steps: (4b1) When the test object runs and the shadow memory changes, the taint track recording unit immediately reads the .eh_frame segment mapped in memory and parses the call frame information. It iteratively searches for the frame description entry with the current program counter as the index and calculates the canonical frame address and return address of the previous frame until the bottom of the stack. Finally, a set of original call stack sequences containing PC, function entry address and function offset is generated. (4b2) The taint trace recording unit encapsulates the captured raw call stack sequence into a structure and writes it to a shared memory ring buffer in a lock-free manner.

10. The method according to claim 9, characterized in that: The path restoration and compression unit mentioned in step (5) specifically implements source code-level location and path compression according to the following steps: (5.1) The path restoration and compression unit acts as a consumer, reads the original call stack sequence in batches from the circular buffer, and uses the parsing result cache to query whether the call stack address to be parsed is already cached. If it is, it reads it directly and executes step (5.5). Otherwise, it executes step (5.2) for parsing. (5.2) During parsing, the path restoration and compression unit opens the ELF format binary file corresponding to the test object, loads the debugging information segment inside it, and reads the .debug_info segment containing debugging information entries and the .debug_line segment containing the line number mapping matrix; (5.3) For each address to be resolved, traverse the .debug_info segment to find the subroutine tag and match the function name, extract the function base address, and add it to the relative offset within the function to calculate the absolute PC address; (5.4) Using the absolute PC address, query the line number matrix of the .debug_line segment to accurately locate and output the corresponding source file name and line number, complete the source code level restoration, and then write the parsing result into the cache; (5.5) The restored call stack is processed using the call stack hash algorithm. The hash signature of the current call stack is calculated. If it is the same as the previous state, it is automatically folded. Otherwise, a new path node is generated when the signature changes.

Images