TaintMap.getTaints may return the same taint for different callsites in the same function.

[am009]

Take com.bai.env.funcs.externalfuncs.GetenvFunction as an example. (External function model for char *getenv(const char *name))

the source is:

    public void invoke(PcodeOp pcode, AbsEnv inOutEnv, AbsEnv tmpEnv, Context context, Function callFunc) {
        ALoc retALoc = getReturnALoc(callFunc, false);
        if (retALoc == null) {
            return;
        }
        long taints = TaintMap.getTaints(context, callFunc);
        inOutEnv.set(retALoc, KSet.getTop(taints), true);
    }

context doesn't include the current callsite of external function. So, for different callsites in the current function, TaintMap.getTaints will return the same taint.

If I analyze this shared object:

// clang  -shared -o test.so -fPIC ./test.c 
char *getenv(const char *name);

int main() {
    getenv("test");
    getenv("aaa");
    return 0;
}

and set breakpoint at GetenvFunction.invoke, I can see the same context (main[0, 0, 0]) and the same taints (taints = 2) twice.

I think it should return different taints?

(by the way, I am working on a research project that heavily uses BinAbsInspector)

[am009]

Heap.getHeap doesn't have this issue, because there is a allocSite.

public static Heap getHeap(Address allocSite, Context context, long size, boolean valid)

Heap allocChunk = Heap.getHeap(allocAddress, context, size, true);

[am009]

我还想问问代码里哪里有widening这种加快迭代速度的逻辑吗，看了一圈没看到。

[MatthewShao]

Thanks for reporting this issue, we've confirmed that current TaintMap is not precise enough for your situation. I think one possible solution is adding callsite to TaintMap.Source. It would be greatly appreciated if you sent us a pr. For widening question, since we have K limit for k-set, which replaces the widening mechanism to some context. It means you can lower the K parameter to accelerate analysis.

[zyq8709]

K in K-set is somewhat equivalent to widening operator, however it sacrifices the whole precision. You can still add delay widening or limited widening operators according to the widening points computed by WTO and set K as a super big number to gain better precision.