barf-project
barf-project copied to clipboard
Implement taints as sets
I think one of most flexible and useful ways of taint data to perform static/dynamic binary analysis is using sets to carry different types of data. In this case, the "False" value of a missing taint is replaced by the empty set and the taint disjunction by the union of the taint sets. A POC of the modifications needed for this enhacement is available here.
For example, in dynamic analysis, they can be used to track how different offset bytes of a file taint instructions in a trace.