HardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
summary
System builds a production-capable dynamic taint pipeline by statically identifying minimal trace points, rewriting binaries to emit only those values via Intel PT PT_WR, streaming compressed PT output over RDMA to remote decoders, and doing parallel graph propagation. It reports about 8.6% runtime overhead, decodes partitions per-PSP to scale to 32 threads, outperforms prior decoupling tools by ~20× and ~17×, and successfully detects all eight tested CVEs on Intel 12th‑gen hardware.
AI-written summary · about
chapters (13)
- 0:00HardTaint intro and dynamic taint analysis
- 1:03Production challenges in taint analysis
- 2:27Hardware tracing insights overview
- 3:53Static analysis for selective tracing
- 6:19Optimizations for trace data reduction
- 8:04Selective binary rewriting with Intel PT
- 8:48Parallel trace decoding
- 9:32Parallel taint propagation
- 10:16Performance evaluation and overhead
- 11:22Selective tracing impact and real-time analysis
- 12:03Comparison with state-of-the-art
- 12:45Summary and conclusion
- 13:28Question and answer session
related talks
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
28mPostmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts
25mRISC-V Zkt: Portable Timing Attack Resistance (via Dynamic Taint Analys...
24mTriaging Crashed With Backward Taint Analysis For Arm Architecture
26mEfficient Protection of Path-Sensitive Control Security
32mEnhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis
28mCOFI break
28mTypes, Deeper Static Analysis, and you