一句话：Wasabi 是首个面向 WebAssembly 的通用动态分析框架，基于二进制插桩提供高层 API 并支持重量级动态分析。
WebAssembly 已成为所有主流浏览器支持的低层语言，但为其构建动态分析工具需要深入了解语言与运行时的底层细节，成本高昂。本文提出 Wasabi——首个面向 WebAssembly 的通用动态分析框架。Wasabi 采用二进制插桩，将用 JavaScript 编写的分析函数调用插入到 WebAssembly 二进制中，并向分析者暴露易用的高层 API，从而支持重量级动态分析。针对动态分析 WebAssembly 的独特挑战，例如类型多态指令与固定类型分析函数之间的不匹配，作者提出按需单态化（on-demand monomorphization）予以解决。在计算密集型基准与真实应用上的评估表明：Wasabi 能忠实保持原程序行为，其开销对重量级动态分析而言合理，并能轻松实现指令计数、调用图提取、内存访问追踪和污点分析等多种动态分析。
WebAssembly is the new low-level language for the web and has now been implemented in all major browsers since over a year. To ensure the security, performance, and correctness of future web applications, there is a strong need for dynamic analysis tools for WebAssembly. However, building such tools from scratch requires knowledge of low-level details of the language and its runtime environment. This paper presents Wasabi, the first general-purpose framework for dynamically analyzing WebAssembly. Wasabi provides an easy-to-use, high-level API that supports heavyweight dynamic analyses. It is based on binary instrumentation, which inserts calls to analysis functions written in JavaScript into a WebAssembly binary. Dynamically analyzing WebAssembly comes with several unique challenges, such as the problem of tracing type-polymorphic instructions with analysis functions that have a fixed type, which we address through on-demand monomorphization. Our evaluation on compute-intensive benchmarks and real-world applications shows that Wasabi (i) faithfully preserves the original program behavior, (ii) imposes an overhead that is reasonable for heavyweight dynamic analysis, and (iii) makes it straightforward to implement various dynamic analyses, including instruction counting, call graph extraction, memory access tracing, and taint analysis.
DOI 原文 ·
@inproceedings{paperbot4903,
title = {Wasabi},
author = {Daniel Lehmann and Michael Pradel},
booktitle = {ASPLOS},
year = {2019},
doi = {10.1145/3297858.3304068}
}