BranchesTags

Latest commit

History

12 Commits

Folders and files

NameName
Last commit message
Last commit date
analysis
analysis
rewriting
rewriting
README.md
README.md
selectivetaint_instructions.pdf
selectivetaint_instructions.pdf

Repository files navigation

SelectiveTaint

SelectiveTaint is an efficient selective taint analysis framework for binary executables. The key idea is to selectively instrument the instructions involving taint analysis using static binary rewriting instead of dynamic binary instrumentation. At a high level, SelectiveTaint statically scans taint sources of interest in the binary code, leverages value set analysis to conservatively determine whether an instruction operand needs to be tainted or not, and then selectively taints the instructions of interest. For more details, please see our paper (USENIX Security 2021).

SelectiveTint has four key components inside:

  • (1) CFG Reconstruction. When given an application binary, we will first disassemble and build its CFG starting from the main function. If there is a library call, we will resolve the calling target and use the function summaries to decide whether further instrumentation of the library is needed. If an indirect jmp/call is encountered, we will perform backward slicing and use the VSA and type information to resolve the target.

  • (2) Value Set Analysis. VSA has become a standard technique in static binary analysis for determining the possible values of a register or a symbolic memory address. We use the VSA to help identify the instruction operands that are never involved in the taint analysis.

  • (3) Taint Instruction Identification. Selective tainting essentially aims to identify the instructions that are involved in the taint analysis. With the identification of Iu by VSA, we then start from the instructions that introduce the taint sources, and systematically identify the rest of instructions that are not in Iu.

  • (4) Binary Rewriting. Having identified the instructions that need to be tainted, we then use the static binary rewriting to insert the taint analysis logic including tracking of the taint sources and taint propagations as well as the taint checks at the taint sinks.

SelectiveTaint passed USENIX 2021 Artifact Evaluation and the artifact evaluation instructions can be found in selectivetaint_instructions.pdf.

Downloads

Please refer to selectivetaint_instructions.pdf on how to download and use SelectiveTaint.

Run Command Examples

Please set up environment according to selectivetaint_instructions.pdf.

As for static analysis, change to analysis directory and execute corresponding command. For instance, for perlbench:

cd analysis
python3 static.py -input ./perlbench_base.i386-m32-gcc42-nn -taintsources read fread fgetc

As for static rewriting, change to rewriting directory and execute corresponding command. For instance, for perlbench:

cd ../rewriting
. ./scripts/set_environment.sh
make
./selectivetaint -i ./perlbench_base.i386-m32-gcc42-nn -o ./perlbench_base.i386-m32-gcc42-nn_selective -t ./tests/perlbench_base.i386-m32-gcc42-nn_tainted_insn_typed_output_file

Citing

If you create a research work that uses our work, please citing the associated paper:

@inproceedings {Chen:2021:SelectiveTaint,
author = {Sanchuan Chen and Zhiqiang Lin and Yinqian Zhang},
title = {SelectiveTaint: Efficient Data Flow Tracking With Static Binary Rewriting},
booktitle = {30th {USENIX} Security Symposium ({USENIX} Security 21)},
year = {2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/chen-sanchuan},
publisher = {{USENIX} Association},
month = aug,
}

About

No description, website, or topics provided.

Resources

Readme
Activity
Custom properties

Stars

84 stars

Watchers

5 watching

Forks

5 forks
Report repository

Releases

Packages

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
BranchesTags
Latest commit
History
12 Commits
Folders and files
NameName
Last commit message
Last commit date
analysis
analysis
rewriting
rewriting
README.md
README.md
selectivetaint_instructions.pdf
selectivetaint_instructions.pdf
Repository files navigation
SelectiveTaint
SelectiveTaint is an efficient selective taint analysis framework for binary executables. The key idea is to selectively instrument the instructions involving taint analysis using static binary rewriting instead of dynamic binary instrumentation. At a high level, SelectiveTaint statically scans taint sources of interest in the binary code, leverages value set analysis to conservatively determine whether an instruction operand needs to be tainted or not, and then selectively taints the instructions of interest. For more details, please see our paper (USENIX Security 2021).
SelectiveTint has four key components inside:
  • (1) CFG Reconstruction. When given an application binary, we will first disassemble and build its CFG starting from the main function. If there is a library call, we will resolve the calling target and use the function summaries to decide whether further instrumentation of the library is needed. If an indirect jmp/call is encountered, we will perform backward slicing and use the VSA and type information to resolve the target.
  • (2) Value Set Analysis. VSA has become a standard technique in static binary analysis for determining the possible values of a register or a symbolic memory address. We use the VSA to help identify the instruction operands that are never involved in the taint analysis.
  • (3) Taint Instruction Identification. Selective tainting essentially aims to identify the instructions that are involved in the taint analysis. With the identification of Iu by VSA, we then start from the instructions that introduce the taint sources, and systematically identify the rest of instructions that are not in Iu.
  • (4) Binary Rewriting. Having identified the instructions that need to be tainted, we then use the static binary rewriting to insert the taint analysis logic including tracking of the taint sources and taint propagations as well as the taint checks at the taint sinks.
SelectiveTaint passed USENIX 2021 Artifact Evaluation and the artifact evaluation instructions can be found in selectivetaint_instructions.pdf.
Downloads
Please refer to selectivetaint_instructions.pdf on how to download and use SelectiveTaint.
Run Command Examples
Please set up environment according to selectivetaint_instructions.pdf.
As for static analysis, change to analysis directory and execute corresponding command. For instance, for perlbench:
cd analysis
python3 static.py -input ./perlbench_base.i386-m32-gcc42-nn -taintsources read fread fgetc

As for static rewriting, change to rewriting directory and execute corresponding command. For instance, for perlbench:
cd ../rewriting
. ./scripts/set_environment.sh
make
./selectivetaint -i ./perlbench_base.i386-m32-gcc42-nn -o ./perlbench_base.i386-m32-gcc42-nn_selective -t ./tests/perlbench_base.i386-m32-gcc42-nn_tainted_insn_typed_output_file

Citing
If you create a research work that uses our work, please citing the associated paper:
@inproceedings {Chen:2021:SelectiveTaint,
author = {Sanchuan Chen and Zhiqiang Lin and Yinqian Zhang},
title = {SelectiveTaint: Efficient Data Flow Tracking With Static Binary Rewriting},
booktitle = {30th {USENIX} Security Symposium ({USENIX} Security 21)},
year = {2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/chen-sanchuan},
publisher = {{USENIX} Association},
month = aug,
}

About
No description, website, or topics provided.
Resources
Readme
Activity
Custom properties
Stars
84 stars
Watchers
5 watching
Forks
5 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
12 Commits
Folders and files
NameName
Last commit message
Last commit date
analysis
analysis
rewriting
rewriting
README.md
README.md
selectivetaint_instructions.pdf
selectivetaint_instructions.pdf
Repository files navigation
SelectiveTaint
SelectiveTaint is an efficient selective taint analysis framework for binary executables. The key idea is to selectively instrument the instructions involving taint analysis using static binary rewriting instead of dynamic binary instrumentation. At a high level, SelectiveTaint statically scans taint sources of interest in the binary code, leverages value set analysis to conservatively determine whether an instruction operand needs to be tainted or not, and then selectively taints the instructions of interest. For more details, please see our paper (USENIX Security 2021).
SelectiveTint has four key components inside:
  • (1) CFG Reconstruction. When given an application binary, we will first disassemble and build its CFG starting from the main function. If there is a library call, we will resolve the calling target and use the function summaries to decide whether further instrumentation of the library is needed. If an indirect jmp/call is encountered, we will perform backward slicing and use the VSA and type information to resolve the target.
  • (2) Value Set Analysis. VSA has become a standard technique in static binary analysis for determining the possible values of a register or a symbolic memory address. We use the VSA to help identify the instruction operands that are never involved in the taint analysis.
  • (3) Taint Instruction Identification. Selective tainting essentially aims to identify the instructions that are involved in the taint analysis. With the identification of Iu by VSA, we then start from the instructions that introduce the taint sources, and systematically identify the rest of instructions that are not in Iu.
  • (4) Binary Rewriting. Having identified the instructions that need to be tainted, we then use the static binary rewriting to insert the taint analysis logic including tracking of the taint sources and taint propagations as well as the taint checks at the taint sinks.
SelectiveTaint passed USENIX 2021 Artifact Evaluation and the artifact evaluation instructions can be found in selectivetaint_instructions.pdf.
Downloads
Please refer to selectivetaint_instructions.pdf on how to download and use SelectiveTaint.
Run Command Examples
Please set up environment according to selectivetaint_instructions.pdf.
As for static analysis, change to analysis directory and execute corresponding command. For instance, for perlbench:
cd analysis
python3 static.py -input ./perlbench_base.i386-m32-gcc42-nn -taintsources read fread fgetc

As for static rewriting, change to rewriting directory and execute corresponding command. For instance, for perlbench:
cd ../rewriting
. ./scripts/set_environment.sh
make
./selectivetaint -i ./perlbench_base.i386-m32-gcc42-nn -o ./perlbench_base.i386-m32-gcc42-nn_selective -t ./tests/perlbench_base.i386-m32-gcc42-nn_tainted_insn_typed_output_file

Citing
If you create a research work that uses our work, please citing the associated paper:
@inproceedings {Chen:2021:SelectiveTaint,
author = {Sanchuan Chen and Zhiqiang Lin and Yinqian Zhang},
title = {SelectiveTaint: Efficient Data Flow Tracking With Static Binary Rewriting},
booktitle = {30th {USENIX} Security Symposium ({USENIX} Security 21)},
year = {2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/chen-sanchuan},
publisher = {{USENIX} Association},
month = aug,
}

About
No description, website, or topics provided.
Resources
Readme
Activity
Custom properties
Stars
84 stars
Watchers
5 watching
Forks
5 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
12 Commits
Folders and files
NameName
Last commit message
Last commit date
analysis
analysis
rewriting
rewriting
README.md
README.md
selectivetaint_instructions.pdf
selectivetaint_instructions.pdf
Repository files navigation
SelectiveTaint
SelectiveTaint is an efficient selective taint analysis framework for binary executables. The key idea is to selectively instrument the instructions involving taint analysis using static binary rewriting instead of dynamic binary instrumentation. At a high level, SelectiveTaint statically scans taint sources of interest in the binary code, leverages value set analysis to conservatively determine whether an instruction operand needs to be tainted or not, and then selectively taints the instructions of interest. For more details, please see our paper (USENIX Security 2021).
SelectiveTint has four key components inside:
  • (1) CFG Reconstruction. When given an application binary, we will first disassemble and build its CFG starting from the main function. If there is a library call, we will resolve the calling target and use the function summaries to decide whether further instrumentation of the library is needed. If an indirect jmp/call is encountered, we will perform backward slicing and use the VSA and type information to resolve the target.
  • (2) Value Set Analysis. VSA has become a standard technique in static binary analysis for determining the possible values of a register or a symbolic memory address. We use the VSA to help identify the instruction operands that are never involved in the taint analysis.
  • (3) Taint Instruction Identification. Selective tainting essentially aims to identify the instructions that are involved in the taint analysis. With the identification of Iu by VSA, we then start from the instructions that introduce the taint sources, and systematically identify the rest of instructions that are not in Iu.
  • (4) Binary Rewriting. Having identified the instructions that need to be tainted, we then use the static binary rewriting to insert the taint analysis logic including tracking of the taint sources and taint propagations as well as the taint checks at the taint sinks.
SelectiveTaint passed USENIX 2021 Artifact Evaluation and the artifact evaluation instructions can be found in selectivetaint_instructions.pdf.
Downloads
Please refer to selectivetaint_instructions.pdf on how to download and use SelectiveTaint.
Run Command Examples
Please set up environment according to selectivetaint_instructions.pdf.
As for static analysis, change to analysis directory and execute corresponding command. For instance, for perlbench:
cd analysis
python3 static.py -input ./perlbench_base.i386-m32-gcc42-nn -taintsources read fread fgetc

As for static rewriting, change to rewriting directory and execute corresponding command. For instance, for perlbench:
cd ../rewriting
. ./scripts/set_environment.sh
make
./selectivetaint -i ./perlbench_base.i386-m32-gcc42-nn -o ./perlbench_base.i386-m32-gcc42-nn_selective -t ./tests/perlbench_base.i386-m32-gcc42-nn_tainted_insn_typed_output_file

Citing
If you create a research work that uses our work, please citing the associated paper:
@inproceedings {Chen:2021:SelectiveTaint,
author = {Sanchuan Chen and Zhiqiang Lin and Yinqian Zhang},
title = {SelectiveTaint: Efficient Data Flow Tracking With Static Binary Rewriting},
booktitle = {30th {USENIX} Security Symposium ({USENIX} Security 21)},
year = {2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/chen-sanchuan},
publisher = {{USENIX} Association},
month = aug,
}

About
No description, website, or topics provided.
Resources
Readme
Activity
Custom properties
Stars
84 stars
Watchers
5 watching
Forks
5 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
BranchesTags
Latest commit
History
12 Commits
Folders and files
NameName
Last commit message
Last commit date
analysis
analysis
rewriting
rewriting
README.md
README.md
selectivetaint_instructions.pdf
selectivetaint_instructions.pdf
Repository files navigation
SelectiveTaint
SelectiveTaint is an efficient selective taint analysis framework for binary executables. The key idea is to selectively instrument the instructions involving taint analysis using static binary rewriting instead of dynamic binary instrumentation. At a high level, SelectiveTaint statically scans taint sources of interest in the binary code, leverages value set analysis to conservatively determine whether an instruction operand needs to be tainted or not, and then selectively taints the instructions of interest. For more details, please see our paper (USENIX Security 2021).
SelectiveTint has four key components inside:
  • (1) CFG Reconstruction. When given an application binary, we will first disassemble and build its CFG starting from the main function. If there is a library call, we will resolve the calling target and use the function summaries to decide whether further instrumentation of the library is needed. If an indirect jmp/call is encountered, we will perform backward slicing and use the VSA and type information to resolve the target.
  • (2) Value Set Analysis. VSA has become a standard technique in static binary analysis for determining the possible values of a register or a symbolic memory address. We use the VSA to help identify the instruction operands that are never involved in the taint analysis.
  • (3) Taint Instruction Identification. Selective tainting essentially aims to identify the instructions that are involved in the taint analysis. With the identification of Iu by VSA, we then start from the instructions that introduce the taint sources, and systematically identify the rest of instructions that are not in Iu.
  • (4) Binary Rewriting. Having identified the instructions that need to be tainted, we then use the static binary rewriting to insert the taint analysis logic including tracking of the taint sources and taint propagations as well as the taint checks at the taint sinks.
SelectiveTaint passed USENIX 2021 Artifact Evaluation and the artifact evaluation instructions can be found in selectivetaint_instructions.pdf.
Downloads
Please refer to selectivetaint_instructions.pdf on how to download and use SelectiveTaint.
Run Command Examples
Please set up environment according to selectivetaint_instructions.pdf.
As for static analysis, change to analysis directory and execute corresponding command. For instance, for perlbench:
cd analysis
python3 static.py -input ./perlbench_base.i386-m32-gcc42-nn -taintsources read fread fgetc

As for static rewriting, change to rewriting directory and execute corresponding command. For instance, for perlbench:
cd ../rewriting
. ./scripts/set_environment.sh
make
./selectivetaint -i ./perlbench_base.i386-m32-gcc42-nn -o ./perlbench_base.i386-m32-gcc42-nn_selective -t ./tests/perlbench_base.i386-m32-gcc42-nn_tainted_insn_typed_output_file

Citing
If you create a research work that uses our work, please citing the associated paper:
@inproceedings {Chen:2021:SelectiveTaint,
author = {Sanchuan Chen and Zhiqiang Lin and Yinqian Zhang},
title = {SelectiveTaint: Efficient Data Flow Tracking With Static Binary Rewriting},
booktitle = {30th {USENIX} Security Symposium ({USENIX} Security 21)},
year = {2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/chen-sanchuan},
publisher = {{USENIX} Association},
month = aug,
}

About
No description, website, or topics provided.
Resources
Readme
Activity
Custom properties
Stars
84 stars
Watchers
5 watching
Forks
5 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
12 Commits
Folders and files
NameName
Last commit message
Last commit date
analysis
analysis
rewriting
rewriting
README.md
README.md
selectivetaint_instructions.pdf
selectivetaint_instructions.pdf
Repository files navigation
SelectiveTaint
SelectiveTaint is an efficient selective taint analysis framework for binary executables. The key idea is to selectively instrument the instructions involving taint analysis using static binary rewriting instead of dynamic binary instrumentation. At a high level, SelectiveTaint statically scans taint sources of interest in the binary code, leverages value set analysis to conservatively determine whether an instruction operand needs to be tainted or not, and then selectively taints the instructions of interest. For more details, please see our paper (USENIX Security 2021).
SelectiveTint has four key components inside:
  • (1) CFG Reconstruction. When given an application binary, we will first disassemble and build its CFG starting from the main function. If there is a library call, we will resolve the calling target and use the function summaries to decide whether further instrumentation of the library is needed. If an indirect jmp/call is encountered, we will perform backward slicing and use the VSA and type information to resolve the target.
  • (2) Value Set Analysis. VSA has become a standard technique in static binary analysis for determining the possible values of a register or a symbolic memory address. We use the VSA to help identify the instruction operands that are never involved in the taint analysis.
  • (3) Taint Instruction Identification. Selective tainting essentially aims to identify the instructions that are involved in the taint analysis. With the identification of Iu by VSA, we then start from the instructions that introduce the taint sources, and systematically identify the rest of instructions that are not in Iu.
  • (4) Binary Rewriting. Having identified the instructions that need to be tainted, we then use the static binary rewriting to insert the taint analysis logic including tracking of the taint sources and taint propagations as well as the taint checks at the taint sinks.
SelectiveTaint passed USENIX 2021 Artifact Evaluation and the artifact evaluation instructions can be found in selectivetaint_instructions.pdf.
Downloads
Please refer to selectivetaint_instructions.pdf on how to download and use SelectiveTaint.
Run Command Examples
Please set up environment according to selectivetaint_instructions.pdf.
As for static analysis, change to analysis directory and execute corresponding command. For instance, for perlbench:
cd analysis
python3 static.py -input ./perlbench_base.i386-m32-gcc42-nn -taintsources read fread fgetc

As for static rewriting, change to rewriting directory and execute corresponding command. For instance, for perlbench:
cd ../rewriting
. ./scripts/set_environment.sh
make
./selectivetaint -i ./perlbench_base.i386-m32-gcc42-nn -o ./perlbench_base.i386-m32-gcc42-nn_selective -t ./tests/perlbench_base.i386-m32-gcc42-nn_tainted_insn_typed_output_file

Citing
If you create a research work that uses our work, please citing the associated paper:
@inproceedings {Chen:2021:SelectiveTaint,
author = {Sanchuan Chen and Zhiqiang Lin and Yinqian Zhang},
title = {SelectiveTaint: Efficient Data Flow Tracking With Static Binary Rewriting},
booktitle = {30th {USENIX} Security Symposium ({USENIX} Security 21)},
year = {2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/chen-sanchuan},
publisher = {{USENIX} Association},
month = aug,
}

About
No description, website, or topics provided.
Resources
Readme
Activity
Custom properties
Stars
84 stars
Watchers
5 watching
Forks
5 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
12 Commits
Folders and files
NameName
Last commit message
Last commit date
analysis
analysis
rewriting
rewriting
README.md
README.md
selectivetaint_instructions.pdf
selectivetaint_instructions.pdf
Repository files navigation
SelectiveTaint
SelectiveTaint is an efficient selective taint analysis framework for binary executables. The key idea is to selectively instrument the instructions involving taint analysis using static binary rewriting instead of dynamic binary instrumentation. At a high level, SelectiveTaint statically scans taint sources of interest in the binary code, leverages value set analysis to conservatively determine whether an instruction operand needs to be tainted or not, and then selectively taints the instructions of interest. For more details, please see our paper (USENIX Security 2021).
SelectiveTint has four key components inside:
  • (1) CFG Reconstruction. When given an application binary, we will first disassemble and build its CFG starting from the main function. If there is a library call, we will resolve the calling target and use the function summaries to decide whether further instrumentation of the library is needed. If an indirect jmp/call is encountered, we will perform backward slicing and use the VSA and type information to resolve the target.
  • (2) Value Set Analysis. VSA has become a standard technique in static binary analysis for determining the possible values of a register or a symbolic memory address. We use the VSA to help identify the instruction operands that are never involved in the taint analysis.
  • (3) Taint Instruction Identification. Selective tainting essentially aims to identify the instructions that are involved in the taint analysis. With the identification of Iu by VSA, we then start from the instructions that introduce the taint sources, and systematically identify the rest of instructions that are not in Iu.
  • (4) Binary Rewriting. Having identified the instructions that need to be tainted, we then use the static binary rewriting to insert the taint analysis logic including tracking of the taint sources and taint propagations as well as the taint checks at the taint sinks.
SelectiveTaint passed USENIX 2021 Artifact Evaluation and the artifact evaluation instructions can be found in selectivetaint_instructions.pdf.
Downloads
Please refer to selectivetaint_instructions.pdf on how to download and use SelectiveTaint.
Run Command Examples
Please set up environment according to selectivetaint_instructions.pdf.
As for static analysis, change to analysis directory and execute corresponding command. For instance, for perlbench:
cd analysis
python3 static.py -input ./perlbench_base.i386-m32-gcc42-nn -taintsources read fread fgetc

As for static rewriting, change to rewriting directory and execute corresponding command. For instance, for perlbench:
cd ../rewriting
. ./scripts/set_environment.sh
make
./selectivetaint -i ./perlbench_base.i386-m32-gcc42-nn -o ./perlbench_base.i386-m32-gcc42-nn_selective -t ./tests/perlbench_base.i386-m32-gcc42-nn_tainted_insn_typed_output_file

Citing
If you create a research work that uses our work, please citing the associated paper:
@inproceedings {Chen:2021:SelectiveTaint,
author = {Sanchuan Chen and Zhiqiang Lin and Yinqian Zhang},
title = {SelectiveTaint: Efficient Data Flow Tracking With Static Binary Rewriting},
booktitle = {30th {USENIX} Security Symposium ({USENIX} Security 21)},
year = {2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/chen-sanchuan},
publisher = {{USENIX} Association},
month = aug,
}

About
No description, website, or topics provided.
Resources
Readme
Activity
Custom properties
Stars
84 stars
Watchers
5 watching
Forks
5 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
BranchesTags
Latest commit
History
12 Commits
Folders and files
NameName
Last commit message
Last commit date
analysis
analysis
rewriting
rewriting
README.md
README.md
selectivetaint_instructions.pdf
selectivetaint_instructions.pdf
Repository files navigation
SelectiveTaint
SelectiveTaint is an efficient selective taint analysis framework for binary executables. The key idea is to selectively instrument the instructions involving taint analysis using static binary rewriting instead of dynamic binary instrumentation. At a high level, SelectiveTaint statically scans taint sources of interest in the binary code, leverages value set analysis to conservatively determine whether an instruction operand needs to be tainted or not, and then selectively taints the instructions of interest. For more details, please see our paper (USENIX Security 2021).
SelectiveTint has four key components inside:
  • (1) CFG Reconstruction. When given an application binary, we will first disassemble and build its CFG starting from the main function. If there is a library call, we will resolve the calling target and use the function summaries to decide whether further instrumentation of the library is needed. If an indirect jmp/call is encountered, we will perform backward slicing and use the VSA and type information to resolve the target.
  • (2) Value Set Analysis. VSA has become a standard technique in static binary analysis for determining the possible values of a register or a symbolic memory address. We use the VSA to help identify the instruction operands that are never involved in the taint analysis.
  • (3) Taint Instruction Identification. Selective tainting essentially aims to identify the instructions that are involved in the taint analysis. With the identification of Iu by VSA, we then start from the instructions that introduce the taint sources, and systematically identify the rest of instructions that are not in Iu.
  • (4) Binary Rewriting. Having identified the instructions that need to be tainted, we then use the static binary rewriting to insert the taint analysis logic including tracking of the taint sources and taint propagations as well as the taint checks at the taint sinks.
SelectiveTaint passed USENIX 2021 Artifact Evaluation and the artifact evaluation instructions can be found in selectivetaint_instructions.pdf.
Downloads
Please refer to selectivetaint_instructions.pdf on how to download and use SelectiveTaint.
Run Command Examples
Please set up environment according to selectivetaint_instructions.pdf.
As for static analysis, change to analysis directory and execute corresponding command. For instance, for perlbench:
cd analysis
python3 static.py -input ./perlbench_base.i386-m32-gcc42-nn -taintsources read fread fgetc

As for static rewriting, change to rewriting directory and execute corresponding command. For instance, for perlbench:
cd ../rewriting
. ./scripts/set_environment.sh
make
./selectivetaint -i ./perlbench_base.i386-m32-gcc42-nn -o ./perlbench_base.i386-m32-gcc42-nn_selective -t ./tests/perlbench_base.i386-m32-gcc42-nn_tainted_insn_typed_output_file

Citing
If you create a research work that uses our work, please citing the associated paper:
@inproceedings {Chen:2021:SelectiveTaint,
author = {Sanchuan Chen and Zhiqiang Lin and Yinqian Zhang},
title = {SelectiveTaint: Efficient Data Flow Tracking With Static Binary Rewriting},
booktitle = {30th {USENIX} Security Symposium ({USENIX} Security 21)},
year = {2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/chen-sanchuan},
publisher = {{USENIX} Association},
month = aug,
}

About
No description, website, or topics provided.
Resources
Readme
Activity
Custom properties
Stars
84 stars
Watchers
5 watching
Forks
5 forks
Report repository
Releases
Packages
Contributors
Languages