Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'm studying program slicing and taint analysis. I know notion of program slicing and taint analysis.
I think Program slicing and taint analysis are similar notion. I don' know difference between program slicing and taint analysis.
What is the difference between program slicing and taint analysis?
In my understanding there are two major differences:
Program Slicing creates a reduced representant of a program which should still produces the same output for a given input. So you reduce the given program to its core functionality and you throw away all the clumpy/insignificant attachments.
In contrast a Taint Analysis traces the path of an information through an application and observes all the objects which are affected/visited/influenced by the corresponding information. Therefor a specific input is labeled or tagged, so it could be tracked during its execution.
So you have a reduced representation of a program with consideration of input output behavior VS the trail of a selected input/variable within a program and its dependencies.
See also detailed descriptions below:
Program slicing tries to reduce a given program P to a minimum form, a so called slice S, which produces the same behavior. More formally taken from these slides:
- produce a slice
Sfrom a given programPby deleting statements- slice must be syntactically correct a given set of variables
V- should produce the same output when given to
SandP
Taint analysis can be seen as a form of Information Flow Analysis. A more formal definition ripped from here:
Information flows from object x to object y, denoted x→y , whenever Information stored in x is transferred to, object y.
I'd say they are essentially the same, with slightly different focus:
Program slicing is, strictly, extracting code that operates on specific variables/memory, while omitting all other code;
Taint analysis is tracking which other variables/memory are affected, via that code, by the ones you chose. Also, tainted data is usually stricter defined as "user-controllable data", while slicing can be done on any var.
