Scaling Bottom-Up IFDS Taint Analysis with Optimized Data-Flow Encoding

Accelerating C/C++ Pointer Analysis via Compiler-Based Offline Simplifications

This paper explores a new perspective: applying semantic-preserving compiler optimizations directly to intermediate representation (IR) before pointer analysis, which is modular, analysis-agnostic, and easily integrates with existing tools.

Quantifying the Code-Size Overhead of eBPF JIT Compilation

eBPF allows user-defined programs to safely extend Linux kernel functionality at runtime, but its final machine code comes from a compilation pipeline that differs from native targets, and how efficient that pipeline is has no clear reference point. Our work constructs one: using the standard LLVM x86 backend as an app...

IncSFS: Incremental Full-Sparse Flow-Sensitive Pointer Analysis for C/C++

This work introduces IncSFS, the first incremental full-sparse flow-sensitive pointer analysis algorithm for C/C++ programs that propagates increases and decreases in points-to sets in an interleaved manner, supporting code deletion and insertion within a single analysis pass.

Leveraging Copy-and-Patch JIT Compilation for Low-Overhead Dynamic Program Analysis

This paper explores copy-and-patch as a foundation for dynamic program analysis, and implements four analyses on top of an existing copy-and-patch JIT for R: code instrumentation, code coverage, performance profiling, and native debugging.

Soundness Checking of Taint Flow Models

Existing state-of-the-art static taint flow analyses for imperative programming languages can scale to large applications by using precise user-provided taint flow models of library methods. However, manually and precisely modeling a method's taint flows is tedious and potentially unsound. Furthermore, automatically mo...

TasmScan: Continuation-Aware Taint Analysis for TVM Bytecode with Savelist Abstraction