Binary and Malware Analysis

Table of Contents

Taint analysis in practice

In GUI browsers, I have this page themed dynamically, so when it's dark outside, you'll get a dark theme. You need JS enabled if you want the dynamic theme; I don't run any JS-based analytics or tracking.

Taint analysis in practice

What to taint:

data coming from network for attack detection
program input for analysis

How to propagate taint;

on move and arithmetic instructions
clean when you store a constant
don’t propagate on implicit flows and tainted pointers

How to use taint

for attack detection, check targets of control flow instructions
for program analysis, monitor syscalls/lib calls/cmp instructions