All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)

TLDR

Dynamic taint analysis and forward symbolic execution are rapidly adopted for malware analysis, input filter generation, test case generation, and vulnerability discovery, yet formal definitions and critical issues remain underexplored. This paper aims to formally define the algorithms for dynamic taint analysis and forward symbolic execution and to identify key implementation choices, common pitfalls, and practical considerations. The authors extend the run‑time semantics of a general language to precisely describe these algorithms and analyze implementation decisions and pitfalls in security contexts.

Abstract

Dynamic taint analysis and forward symbolic execution are quickly becoming staple techniques in security analyses. Example applications of dynamic taint analysis and forward symbolic execution include malware analysis, input filter generation, test case generation, and vulnerability discovery. Despite the widespread usage of these two techniques, there has been little effort to formally define the algorithms and summarize the critical issues that arise when these techniques are used in typical security contexts. The contributions of this paper are two-fold. First, we precisely describe the algorithms for dynamic taint analysis and forward symbolic execution as extensions to the run-time semantics of a general language. Second, we highlight important implementation choices, common pitfalls, and considerations when using these techniques in a security context.