一句话：在 QEMU TCG 层解耦功能域与追踪域，影子寄存器映射到宿主并专用向量资源，实现架构无关、开销更低的全系统污点追踪。
全系统污点追踪对安全分析至关重要，但现有方法架构兼容性有限、性能开销巨大，根源在于功能域与追踪域紧密耦合。本文提出 TaintEMU，通过在 QEMU TCG 层彻底解耦两个域来实现架构无关且高效的全系统污点追踪：在 TCG 层把影子寄存器映射到宿主寄存器而非客户机寄存器，从而兼容多种客户机 CPU 架构；在宿主层物理隔离两个域，通用指令与寄存器服务功能域，向量资源专用于追踪域，避免宿主资源复用冲突并提升追踪性能；同时直接由宿主上的 TCG 操作生成追踪指令，省去额外翻译，进一步降低开销。作者在 AMD64 宿主、QEMU 8.2.2 上实现 TaintEMU，支持 x86、MIPS、ARM、AMD、RISC-V、PPC 等多种客户机架构，将性能开销从 DECAF++ 的 301% 降至 101%，并在 7 个应用、8 个 CVE 的测试中成功检出全部漏洞。
Whole-system taint tracking is vital for security analysis. However, existing methods suffer from limited architecture compatibility and significant performance overhead, mainly due to the tight coupling between the functional and tracking domains. This paper introduces TaintEMU, an architecture-agnostic and efficient solution by fully decoupling the two domains. It separates functional and tracking logic at the QEMU TCG layer, mapping shadow registers to host instead of guest registers, ensuring compatibility across guest CPU architectures. At the host layer, it physically isolates the two domains: general-purpose instructions and registers serve the functional domain, while vector resources are dedicated to tracking, avoiding host resource reuse and enhancing tracking performance. Furthermore, it directly generates tracking instructions from TCG operations on the host, bypassing additional translation and further reducing overhead. We implement TaintEMU on an AMD64 host on QEMU 8.2.2. It supports a wide range of guest architectures (x86, MIPS, ARM, AMD, RISC-V, PPC), reduces performance overhead from 301% (DECAF++) to 101% and successfully detects all vulnerabilities in tests with 8 CVEs across 7 applications.
@inproceedings{CuiXLL25,
title = {TaintEMU: Decoupling Tracking from Functional Domains for Architecture-Agnostic and Efficient Whole-System Taint Tracking},
author = {Lei Cui and Youquan Xian and Peng Liu and Longjin Lu},
booktitle = {ASPLOS},
year = {2025},
doi = {10.1145/3676641.3716023}
}