An inter-procedural taint analysis method and system for a binary program

Abstract

This invention provides a method and system for inter-process taint analysis of binary programs. The method includes the following steps: analyzing the binary program using a preset static decompilation tool to obtain corresponding binary program information; determining the function call relationships in the binary program based on the binary program information and constructing a call relationship graph; marking the calling functions of taint source functions from the functions in the call relationship graph based on a preset taint information database; identifying the starting analysis position in the call relationship graph based on the calling functions of the taint source functions; determining the inter-process control flow graph based on the call relationship graph with the identified starting analysis position; and determining whether the taint information generated by the taint source functions in the inter-process control flow graph is passed to a specified position in the sink function. If so, it is recorded as a system vulnerability. This solution reduces the computational load and improves analysis efficiency in the final vulnerability analysis by identifying the starting analysis position in the call relationship graph.

Description

Technical Field

[0001] This invention relates to the field of taint analysis technology, and in particular to an inter-process taint analysis method and system for binary programs. Background Technology

[0002] Software released by various vendors is often closed-source, making vulnerability discovery in binary programs of significant practical importance. Taint analysis of binary programs is a technique used to trace the flow of data within a program, particularly for detecting potential security vulnerabilities such as buffer overflows, format string vulnerabilities, and information leaks. Taint analysis identifies potential security issues by marking input data and tracing its propagation path within the program.

[0003] Static binary program vulnerability discovery techniques are more adaptable than dynamic techniques, as they are independent of instrumentation, runtime environment, and program input, and theoretically can detect the entire program space. Among them, taint analysis based on data flow analysis is currently the most widely used and effective static technique. It discovers potential vulnerabilities in the program by detecting the data flow propagation information between taint sources and convergence points, providing information for manual analysis or guiding the direction of dynamic analysis. However, existing taint analysis schemes are relatively inefficient. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method and system for inter-process taint analysis of binary programs to eliminate or improve one or more defects existing in the prior art.

[0005] One aspect of the present invention provides a method for inter-procedural taint analysis of a binary program, the method comprising the steps of:

[0006] The binary program is analyzed using a pre-set static decompilation tool to obtain the corresponding binary program information;

[0007] The function call relationships in the binary program are determined based on the binary program information, and a call relationship graph is constructed based on the call relationships, which includes multiple sub-relationship graphs;

[0008] Based on a pre-set taint information database, the calling functions of taint source functions are marked from the functions in the call relationship graph, and the starting analysis position of the call relationship graph is delineated based on the calling functions of the taint source functions;

[0009] Based on the call relationship graph that defines the starting analysis position, the control flow graph between processes is determined. It is then determined whether the taint information generated by the taint source function in the control flow graph between processes is passed to the specified position of the sink function. If so, it is recorded as a system vulnerability.

[0010] Using the above approach, this method first analyzes the binary program using a static decompilation tool and constructs an initial call relationship graph from the function call relationships. Within the loop, the starting analysis position of the call relationship graph is determined using a taint information database. After completing the loop analysis for basic blocks with back edges, the computational load is reduced and the analysis efficiency is improved during the final system vulnerability analysis process.

[0011] In some embodiments of the present invention, the method further includes aggregating comprehensive system vulnerabilities obtained from the control flow graph analysis between processes and generating a vulnerability report.

[0012] In some embodiments of the present invention, in the step of marking the calling functions of tainted source functions from the functions in the call graph based on a preset taint information database, the functions in the taint information database are matched with the functions in the call graph.

[0013] In some embodiments of the present invention, in the step of delineating the starting analysis position of the call relationship graph based on the calling function of the taint source function, for each sub-relationship graph of the call relationship graph, it is determined whether the sub-relationship graph includes the calling function of the taint source function. If the sub-relationship graph includes the calling function of the taint source function, then the position is taken as the starting analysis position.

[0014] In some embodiments of the present invention, in the step of determining the control flow graph between processes based on the call relationship graph that delineates the starting analysis position, the control flow graph of each function in the call relationship graph is obtained, and the control flow graph between processes is constructed based on the position between functions in the call relationship graph.

[0015] In some embodiments of the present invention, in the step of determining the control flow graph between processes based on the call relationship graph that delineates the starting analysis position, the microcode of the basic block of the control flow graph between processes is analyzed to determine whether the function in the sub-relationship graph modifies the parameters of the function called by the function. If so, the data stream that modifies the parameters of the function called by the function is stored.

[0016] In some embodiments of the present invention, in the step of determining whether the sub-relationship graph includes the calling function of the taint source function, the analysis starts from the function corresponding to the root node of the sub-relationship graph.

[0017] In some embodiments of the present invention, in the step of determining whether taint information generated by a taint source function in the control flow graph between processes is passed to a specified location of the sink function:

[0018] Determine whether there are back edges between basic blocks in the control flow graph between processes;

[0019] If a back edge exists, the number of loop analysis times is determined based on a preset loop determination threshold. Once the loop analysis for the basic block within the loop has been completed for the specified number of loop analysis times, the analysis at that back edge ends.

[0020] In some embodiments of the present invention, in the step of determining whether taint information generated by a taint source function in the control flow graph between processes is passed to a specified position of a sink function, the sink function includes at least one input position, the input position is a sensitive position or a non-sensitive position, and the specified position of the sink function is a sensitive position.

[0021] A second aspect of the present invention also provides an inter-process taint analysis system for a binary program, the system comprising a computer device including a processor and a memory, the memory storing computer instructions, the processor executing the computer instructions stored in the memory, and the system implementing the steps of the method described above when the computer instructions are executed by the processor.

[0022] A third aspect of the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned inter-process taint analysis method for binary programs.

[0023] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the text, or may be learned by practice of the invention. The objects and other advantages of the invention will become apparent from the description and the accompanying drawings.

[0024] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0025] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to limit the scope of the invention.

[0026] Figure 1 This is a schematic diagram illustrating one implementation of the inter-procedural taint analysis method for binary programs in this scheme.

[0027] Figure 2 This is a schematic diagram illustrating another implementation of the inter-procedural taint analysis method for binary programs in this scheme;

[0028] Figure 3 This is a schematic diagram of the architecture of this solution;

[0029] Figure 4 This is a schematic diagram showing the basic function blocks of this scheme;

[0030] Figure 5 This is a schematic diagram of the relationship diagram for this solution. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0032] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0033] like Figure 1 and 3 As shown, this invention proposes an inter-procedural taint analysis method for binary programs, the steps of which include:

[0034] Step S100: Analyze the binary program using a preset static decompilation tool to obtain the corresponding binary program information;

[0035] In practice, the static decompilation tool used is IDA Pro, Ghidra, or Hopper, with IDA Pro being preferred. The decompiled code obtained is treated as source code. When analyzing source code using source code-specific methods, errors and omissions often occur because the disassembled code lacks most of the structural information compared to the source code and may not accurately reflect the true semantics of the binary code. This paper uses IDA Pro's microcode intermediate representation as the analysis object, which preserves the semantics of the underlying binary program while optimizing most intermediate operations.

[0036] IDA Pro is a powerful reverse engineering tool that can statically analyze binary programs and provide information such as basic block addresses, predecessors and successors of basic blocks within a procedure. This information is used to construct the control flow graph within the procedure and can elevate binary program code to intermediate microcode representations at different optimization levels. After analyzing the expression structure of the microcode, this paper implements a stable analysis engine for all microcode operations. Any input data stream value can be transformed into an output data stream value after passing through this engine, completing the main operations of data flow analysis.

[0037] Since IDA Pro does not include the predecessor and successor relationships between processes, this solution also designs an algorithm that dynamically expands the control flow graph within a process into an inter-process algorithm during the analysis process. When the microcode analysis engine processes a function call, it synchronously updates the predecessor and successor of the nodes in the control flow graph, and can analyze the specific content of the function parameters or the address of the indirectly called target function from the data flow value at this time, thereby obtaining more accurate inter-process analysis results.

[0038] In the specific implementation process, the binary program information includes the function call relationships in the binary program.

[0039] Step S200: Determine the function call relationship in the binary program based on the binary program information, and construct a call relationship graph based on the call relationship, wherein the call relationship graph includes multiple sub-relationship graphs;

[0040] In the specific implementation process, in the step of constructing a call relationship graph based on the call relationship, each function is treated as a node, the nodes corresponding to functions with call relationships are connected by edges, and a directional relationship is constructed based on the call relationship.

[0041] like Figure 5 As shown, in the specific implementation process, in the call relationship graph, functions with call relationships are constructed into a sub-relationship graph, and all sub-relationship graphs constitute the call relationship graph.

[0042] Step S300: Based on a pre-set taint information database, mark the calling functions of taint source functions from the functions in the call relationship graph, and delineate the starting analysis position of the call relationship graph based on the calling functions of the taint source functions;

[0043] In practice, the taint information database includes taint function names, taint types, and taint filtering rules.

[0044] In the specific implementation process, during the step of defining the starting analysis position in the call relationship graph based on the calling functions of the taint source functions, there are also call relationships between the functions that call the taint functions. A sub-relationship graph is constructed based on this call relationship, and the function with an in-degree of 0 in each sub-relationship graph is used as the starting analysis position. This avoids repeated analysis of different taint calling functions. Therefore, defining the starting analysis position narrows the scope of analysis and improves analysis efficiency.

[0045] In some embodiments of the present invention, in the step of marking the calling functions of tainted source functions from the functions in the call relationship graph based on a preset taint information database, the functions in the call relationship graph that have a reference relationship with the tainted functions in the taint information database are the calling functions of the tainted source functions.

[0046] Step S400: Based on the call relationship graph that defines the starting analysis position, determine the control flow graph between processes. Determine whether the taint information generated by the taint source function in the control flow graph between processes is passed to the specified position of the sink function. If so, record it as a system vulnerability.

[0047] In the specific implementation process, if a system vulnerability exists, the path from the call location of the tainted source function to the call location of the sink function corresponding to the system vulnerability is recorded.

[0048] This paper maintains the local stack within a function and the memory space across functions. During parameter mapping and function return, the data flow between processes is analyzed by merging the memory spaces across functions.

[0049] The proposed method implements an analysis engine for all operations of microcode, which can dynamically generate cross-process control flow graphs during runtime, dynamically read function models and taint source and sink points from files, and suppress path explosion by identifying loops in terms of efficiency, and select the analysis scope based on the calls to taint sources.

[0050] In some embodiments of this invention, lattice- and fixed-point-based data flow analysis is a primary method for taint analysis. Data flow analysis is a technique used to obtain information about how relevant data flows along the program execution path. It involves collecting data flow values ​​of a computer program at different program points—an abstract representation of the set of all program states observed at that point—analyzing state transition functions, and solving constraint equations.

[0051] Using the above approach, this method first analyzes the binary program using a static decompilation tool and constructs an initial call relationship graph from the function call relationships. Within the loop, the starting analysis position of the call relationship graph is determined using a taint information database. After completing the loop analysis for basic blocks with back edges, the computational load is reduced and the analysis efficiency is improved during the final system vulnerability analysis process.

[0052] like Figure 2 As shown, in some embodiments of the present invention, the method further includes step S500, which involves aggregating the comprehensive system vulnerabilities obtained from the control flow graph analysis between processes and generating a vulnerability report.

[0053] In the specific implementation process, in the step of aggregating the comprehensive system vulnerabilities obtained from the control flow graph analysis between processes and generating a vulnerability report, the path from the call location of the tainted source function to the call location of the sink function corresponding to each system vulnerability is represented in the vulnerability report.

[0054] In the specific implementation process, the vulnerability report will be fed back to the control terminal, which can be the mobile terminal of the staff.

[0055] By adopting the above solution, this solution can record and provide feedback through vulnerability reports, enabling staff to handle vulnerabilities and ensure security.

[0056] In practice, if the called function is a tainted source function, a tainted variable is initialized and stored in the data stream value based on the user-provided parameters. Since we record all function-related information, including return value variables and function parameters, when dynamically generating the control flow graph between processes in the microcode analysis engine, the position of this parameter can be a return value, a function parameter, or even a member variable of a structure. Simply replacing this information provides maximum freedom for user customization.

[0057] If the called function is a taint convergence point function, it will also automatically check whether there is a taint variable at the corresponding position based on the parameters provided by the user, and determine whether the taint variable is a false alarm based on the filtering rules.

[0058] For example, the function `memcpy(dest_buf, source_buf, source_len)` copies `source_len` bytes from `source_buf` to `dest_buf`. When a taint is passed to the second parameter `source_buf` of `memcpy`, if the length of `source_buf` is greater than that of `dest_buf`, there may be a security risk. However, if the first parameter `dest_buf` is also related to the taint, for example, if its length is equal to that of `source_buf`, or if the third parameter `source_len` is a fixed constant, then there is no security risk. Therefore, our provided filtering rules can analyze whether the corresponding parameters meet the corresponding conditions; if not, it can be determined as a false positive.

[0059] If the analysis conditions are met, the propagation path, call context, taint source call point, and current call point stored in the taint variable will be output as a vulnerability report.

[0060] In programs, there are library functions that are defined but not implemented, such as strctr and memchr. In order to analyze the data stream more accurately and obtain the complete propagation direction of taints, this solution provides a function model interface that supports user-defined function models, thereby improving the accuracy of analysis and reducing false negatives.

[0061] The function model interface includes all parameters of the current function and the current data stream value. Users can either provide only the propagation method of taints between these parameters and the return value, and let the system automatically implement the function model, or they can directly manipulate the data stream value to implement a customized function model.

[0062] In some embodiments of the present invention, in the step of marking the calling functions of tainted source functions from the functions in the call graph based on a preset taint information database, the functions in the taint information database are matched with the functions in the call graph.

[0063] In the implementation process, considering that taint information, including taint functions, taint source parameters, sink functions, and sink parameters, is defined differently in different programs, we implemented a user-customizable taint file. Users can achieve customized taint propagation by writing the corresponding taint information. Furthermore, we provide corresponding filtering rules to filter out and delete taints that do not meet the conditions, reducing false positives.

[0064] The import of taint information involves matching all function names in the taint function to find the call locations of all taint source functions, and then determining the starting position of the analysis based on the relationships between these taint source function calls.

[0065] In some embodiments of the present invention, in the step of delineating the starting analysis position of the call relationship graph based on the calling function of the taint source function, for each sub-relationship graph of the call relationship graph, it is determined whether the sub-relationship graph includes the calling function of the taint source function. If the sub-relationship graph includes the calling function of the taint source function, then the position is taken as the starting analysis position.

[0066] In some embodiments of the present invention, after determining that all basic blocks in the control flow graph have converged, the determination of all sub-relationship graphs in the call relationship graph is completed.

[0067] like Figure 4 As shown, in some embodiments of the present invention, in the step of determining the control flow graph between processes based on the call relationship graph that delineates the starting analysis position, the control flow graph of each function in the call relationship graph is obtained, and the control flow graph between processes is constructed based on the position between functions in the call relationship graph.

[0068] In some embodiments of the present invention, in the step of determining the control flow graph between processes based on the call relationship graph that delineates the starting analysis position, the microcode of the basic block of the control flow graph between processes is analyzed to determine whether the function in the sub-relationship graph modifies the parameters of the function called by the function. If so, the data stream that modifies the parameters of the function called by the function is stored.

[0069] Using the above scheme, this scheme implements a cross-process data flow analysis framework based on the basic definition of data flow analysis. When performing inter-process processing, an additional cross-process side effect memory space is defined outside the local stack space. Whenever a called function produces a side effect on the calling function, such as the called function modifying the content of a pointer type parameter, it will affect the operation of the data flow value after the calling function calls the called function. This side effect is recorded in this memory space.

[0070] In some embodiments of the present invention, in the step of determining whether the sub-relationship graph includes the calling function of the taint source function, the analysis starts from the function corresponding to the root node of the sub-relationship graph.

[0071] In the specific implementation process, when determining whether the sub-relationship graph includes the calling function of the taint source function, the microcode analysis engine is used for analysis. Specifically, microcode is an intermediate representation generated by IDA Pro across architectures, between machine code and high-level languages. It can simplify instruction representation, ignore the complexity of the underlying CPU, and optimize control flow. It also supports users to directly manipulate microcode through plugins and scripts for more advanced custom analysis.

[0072] Based on the microcode definition document, this solution implements a microcode analysis engine that can process all microcode opcodes and is independent of specific data stream value definitions and data stream analysis frameworks, making it easy to extend.

[0073] Based on the analysis engine results, this solution extends the functionality of dynamically generating inter-process control flow graphs. When analyzing the operation of calling a function, it records information such as the called object and calling parameters obtained from the analysis of microcode and data flow values, generates a side effect memory space and passes it to the called function, and generates corresponding predecessors and successors at the nodes of the current control flow graph, thus completing the parameter mapping and control flow graph update between processes.

[0074] In some embodiments of the present invention, in the step of determining whether taint information generated by a taint source function in the control flow graph between processes is passed to a specified location of the sink function:

[0075] Determine whether there are back edges between basic blocks in the control flow graph between processes;

[0076] If a back edge exists, the number of loop analysis times is determined based on a preset loop determination threshold. Once the loop analysis for the basic block within the loop has been completed for the specified number of loop analysis times, the analysis at that back edge ends.

[0077] like Figure 4 As shown, in some embodiments of the present invention, it is determined whether there are back edges between basic blocks in the sub-relationship graph, that is, whether the successor of a certain basic block contains the ancestor node of this node. Based on the identified back edges, all basic block addresses within the range from this basic block to its ancestor node are obtained to form a cycle. When updating the basic block analysis list, this scheme collects the analysis count of this basic block. If the currently analyzed basic block address is in the found cycle and its analysis count has reached the analysis limit of the cycle, then it is forcibly determined that the basic block has converged and will not be added to the basic block analysis list.

[0078] In some embodiments of the present invention, in the step of determining whether taint information generated by a taint source function in the control flow graph between processes is passed to a specified position of a sink function, the sink function includes at least one input position, the input position is a sensitive position or a non-sensitive position, and the specified position of the sink function is a sensitive position.

[0079] In its implementation, this solution's basic principle is to first obtain fundamental information about the target binary program using IDA Pro. This involves reading user-defined function models and source / convergence point information from a file, constructing a control flow graph within the process based on basic block information, and identifying loops within functions. Subsequently, a data flow analysis framework is used to transform data flow values ​​using the microcode analysis engine. Based on function call operations, the control flow graph within the process is dynamically expanded to inter-process graphs, thus completing parameter mapping. Then, by merging data flow values ​​from different states, convergence fixed points are determined. When a taint is passed from the source point to a specified parameter location at the convergence point, a corresponding vulnerability report is generated.

[0080] The beneficial effects of this plan include:

[0081] 1. This solution proposes a universal method for inter-procedural taint analysis of binary programs, which can be used to analyze most binary programs;

[0082] 2. This solution proposes a method for dynamically generating control flow graphs between processes, and maintains a cross-process memory space based on the control flow graphs between processes to handle complex cross-process data flows;

[0083] 3. This solution proposes and implements a microcode analysis engine that does not depend on the specific implementation of data stream values ​​and is easily extensible;

[0084] 4. This solution implements a method that allows for externally customized function models and taint information, and provides corresponding filtering rules to reduce false alarms;

[0085] 5. This solution proposes an efficiency optimization method based on the division of analysis scope by taint source, and implements an optimization strategy that limits the number of loop iterations, thereby accelerating the speed of taint analysis.

[0086] This invention also provides an inter-process taint analysis system for binary programs. The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method described above.

[0087] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned inter-procedural taint analysis method for binary programs. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0088] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0089] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0090] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0091] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for inter-procedural taint analysis in binary programs, characterized in that, The steps of this method include: The binary program is analyzed using a pre-set static decompilation tool to obtain the corresponding binary program information; The function call relationships in the binary program are determined based on the binary program information, and a call relationship graph is constructed based on the call relationships, which includes multiple sub-relationship graphs; Based on a pre-set taint information database, the calling functions of taint source functions are marked from the functions in the call relationship graph, and the starting analysis position of the call relationship graph is delineated based on the calling functions of the taint source functions; Based on the call relationship graph that defines the starting analysis position, the control flow graph between processes is determined. It is then determined whether the taint information generated by the taint source function in the control flow graph between processes is passed to the specified position of the sink function. If so, it is recorded as a system vulnerability.

2. The inter-procedural taint analysis method for binary programs according to claim 1, characterized in that, The method further includes aggregating comprehensive system vulnerabilities obtained from the control flow graph analysis between processes and generating a vulnerability report.

3. The inter-procedural taint analysis method for binary programs according to claim 1, characterized in that, In the step of marking the calling functions of tainted source functions from the functions in the call graph based on a pre-set taint information database, the functions in the taint information database are matched with the functions in the call graph.

4. The inter-procedural taint analysis method for binary programs according to claim 1, characterized in that, In the step of determining the starting analysis position of the call relationship graph based on the calling function of the tainted source function, for each sub-graph of the call relationship graph, it is determined whether the sub-graph includes the calling function of the tainted source function. If the sub-graph includes the calling function of the tainted source function, then the position is taken as the starting analysis position.

5. The inter-procedural taint analysis method for binary programs according to claim 4, characterized in that, In the step of determining the control flow graph between processes based on the call relationship graph that delineates the starting analysis position, the control flow graph of each function in the call relationship graph is obtained, and the control flow graph between processes is constructed based on the position between functions in the call relationship graph.

6. The inter-procedural taint analysis method for binary programs according to claim 5, characterized in that, In the step of determining the control flow graph between processes based on the call relationship graph that delineates the starting analysis position, the microcode of the basic block of the control flow graph between processes is analyzed to determine whether the function in the sub-relationship graph modifies the parameters of the function called by the function. If so, the data stream that modifies the parameters of the function called by the function is stored.

7. The inter-procedural taint analysis method for binary programs according to claim 6, characterized in that, In the step of determining whether the sub-relationship graph includes the calling function of the taint source function, the analysis begins from the function corresponding to the root node of the sub-relationship graph.

8. The inter-procedural taint analysis method for binary programs according to claim 6, characterized in that, In the step of determining whether taint information generated by taint source functions in the control flow graph between processes is passed to the specified location of the sink function: Determine whether there are back edges between basic blocks in the control flow graph between processes; If a back edge exists, the number of loop analysis times is determined based on a preset loop determination threshold. Once the loop analysis for the basic block within the loop has been completed for the specified number of loop analysis times, the analysis at that back edge ends.

9. The method for inter-procedural taint analysis of binary programs according to any one of claims 1 to 8, characterized in that, In the step of determining whether taint information generated by a taint source function in the control flow graph of a process is passed to a specified position of a sink function, the sink function includes at least one input position, the input position is a sensitive position or a non-sensitive position, and the specified position of the sink function is a sensitive position.

10. An inter-procedural taint analysis system for binary programs, characterized in that, The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method as described in any one of claims 1 to 9.

Images