一句话：在 LLVM 层插桩实现全程序、全输入的动态信息流追踪，输出可后处理的 TDAG 追踪产物。
PolyTracker 是一个全程序、全输入的动态信息流追踪（DIFT）框架。给定兼容 LLVM 的代码库或已提升为 LLVM IR 的二进制，PolyTracker 在编译期插入静态插桩；插桩后的程序以较小的性能开销正常运行，同时输出一种共同设计的 TDAG（污点有向无环图）运行时追踪产物。TDAG 可被后处理用于多种分析，例如把每个输入字节在程序执行中的传播路径完整追踪出来；TDAG 既可通过在输入语料上运行程序生成，也可借助 fuzzer 等随机输入生成器产生。与面向局部、定向分析的传统 DIFT 不同，TDAG 主要面向全程序运行时探索与缺陷发现、程序运行之间的细粒度信息流差分，以及同一输入规约不同实现之间的比较，而无需模拟和插桩整个运行环境。仓库还提供多个流行开源软件的 PolyTracker 插桩构建示例，以及用 Python 编写的分析库和 REPL，方便用户对 TDAG 进行操作。
We present PolyTracker, a whole-program, whole-input dynamic information flow tracing (DIFT) framework. Given an LLVM compatible codebase or a binary that has been lifted to LLVM intermediate representation (IR), PolyTracker compiles it, adding static instrumentation. The instrumented program will run normally with modest performance overhead, but will additionally output a runtime trace artifact in the co-designed TDAG (Tainted Directed Acyclic Graph) format. TDAGs can be post-processed for a variety of analyses, including tracing every input byte through program execution. TDAGs can be generated either by running the program over a corpus of inputs or by employing a randomized input generator such as a fuzzer. PolyTracker traces (TDAGs) are useful not only for very localized, targeted dynamic program analysis as with smaller-scale DIFT: TDAGs are primarily intended for whole-program runtime exploration and bug finding, granular information-flow diffing between program runs, and comparisons of implementations of the same input specification without any need to emulate and instrument the entire running environment. For user-friendliness and reproducibility, the software repository provides a number of examples of PolyTracker-instrumented builds of popular open-source software projects. We also provide an analysis library and REPL written in Python that are designed to assist users with operating over TDAGs.
DOI 原文 ·
@inproceedings{paperbot8479,
title = {PolyTracker: Whole-Input Dynamic Information Flow Tracing},
author = {Evan Sultanik and Marek Surovič and Henrik Brodin and Kelly Kaoudis and Facundo Tuesca and Carson Harmon and Lisa Overall and Joseph Sweeney and Bradford Larsen},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3685313}
}