{"id":50853823,"url":"https://github.com/kuc001/EmTaint","last_synced_at":"2026-07-02T04:00:32.670Z","repository":{"id":244527821,"uuid":"306522500","full_name":"kuc001/EmTaint","owner":"kuc001","description":null,"archived":false,"fork":false,"pushed_at":"2023-05-27T09:13:59.000Z","size":11644,"stargazers_count":20,"open_issues_count":2,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-06-15T11:57:38.958Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kuc001.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-10-23T03:44:51.000Z","updated_at":"2024-06-15T11:57:43.405Z","dependencies_parsed_at":"2024-06-15T12:08:54.934Z","dependency_job_id":null,"html_url":"https://github.com/kuc001/EmTaint","commit_stats":null,"previous_names":["kuc001/emtaint"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/kuc001/EmTaint","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kuc001%2FEmTaint","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kuc001%2FEmTaint/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kuc001%2FEmTaint/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kuc001%2FEmTaint/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kuc001","download_url":"https://codeload.github.com/kuc001/EmTaint/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kuc001%2FEmTaint/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35032145,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-02T02:00:06.368Z","response_time":173,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-14T17:00:21.881Z","updated_at":"2026-07-02T04:00:32.664Z","avatar_url":"https://github.com/kuc001.png","language":"Python","funding_links":[],"categories":["Software Tools"],"sub_categories":["Firmware Taint Analysis"],"readme":"# EmTaint\n\n`EmTaint`, a novel static analysis tool for accurate and fast detection of taint-style vulnerabilities in embedded firmware. \nIn EmTaint, we design a structured symbolic expression-based (SSE-based) on-demand alias analysis technique, which serves as a basis for resolving both implicit data flow and control flow on potential vulnerable paths. Based on it, we come up with indirect call resolution and accurate taint analysis scheme. Combined with sanitization rule checking, EmTaint can eventually discovers a large number of taint-style vulnerabilities accurately within a limited time.\n\n\n## Getting Started\n\n### Requirements\n\n`EmTaint`'s execution environment depends on Angr, which we packaged as an docker image and published to the hub (NOTE: thare are some issues in uploading the large docker image file to zenodo, so we upload it to docker hub instead.). The source code for `EmTaint` is **EmTaint.tar.gz**.\nWe can execute following commands to start the experiment verification.\nWe suggest users to use Linux system as the host machine.\n\n```\ndocker pull doneme123/emtaint:v1.1\ntar -zxvf EmTaint.tar.gz\ncd EmTaint\ndocker run -ti --rm -v `pwd`:/work doneme123/emtaint:v1.1\ncd /work\nworkon EmTaint\n```\n\n\n### Basic functionality\nWe run the following command to test indirect-call resolution and vulnerability detection for binary `httpd` in firmware `R8000_v1.0.4.4`.\n\n```\nbash run.sh main.py ./firmware-binaries/\n```\n\nEstimated Time \u003c 15min\n\nExpected Output: The result will be saved in file **R8000_v1_0_4_4.json** in directory **./data/result_data/**.\n\nThe basic functionality of `EmTaint` is evaluated from three aspects: vulnerability discovery, effectiveness and efficiency of indirect call resolution,\nand effectiveness in finding vulnerability with or without indirect call resolution.\n\n\n#### Evaluation for vulnerability discovery\n\n```\npython collect_result.py ./data/result_data/R8000_v1_0_4_4.json alert\n```\n\nExpected Output: the result show the alerts produced by `EmTaint` for binary `httpd` in firmware `R8000_v1.0.4.4`.\n\n\n#### Evaluation for Effectiveness and Efficiency of indirect call resolution\n\n```\npython collect_result.py ./data/result_data/R8000_v1_0_4_4.json icall\n```\n\nExpected Output: the result show the effectiveness and efficiency of indirect call resolution for binary `httpd` in firmware `R8000_v1.0.4.4`.\n\n\n#### Evaluation for Effectiveness in finding vulnerability with or without indirect call resolution\n\n```\npython collect_result.py ./data/result_data/R8000_v1_0_4_4.json compare\n```\n\nExpected Output: the result show the effectiveness and necessity of indirect call resolution for finding vulnerabilities in embedded firmware.\n\n\n## Detailed Description\nIn Getting Started section, we only evaluate the `EmTaint` on one binary in a firmware image.\nIn Detailed Description, we describe the evaluation of all claims as follows.\nFor vulnerability discovery and indirect call resolution evaluation,\nwe can evaluate it on all 35 firmware images by modifying shell script `run.sh`, where `run.sh` includes commands to evaluate 35 fimware images.\nWe put 32 firmware-related binaries in directory `firmware-binaries/`.\nFor example, the code in `run.sh` below will evaluate firmware `RV130_v.1.0.3.44` for vulnerability discovery and indirect call resolution.\n\n```\nanalyze_binary \"rv130_v44/httpd\" \"rv130\" \"1_0_3_44\"\n```\nExpected Output: The result will be saved in file **rv130_1_0_3_44.json** in directory **./data/result_data/**.\n\nIn addition to the above methods, we can also run the following command to evaluate the functionality of `EmTaint` respectively.\n\n```bash\n# Indirect call resolution\npython main.py -f ./firmware-binaries/rv130_v44/httpd -n rv130 -v 1_0_3_44 -i\n\n# vulnerability discovery with indirect call resolution\npython main.py -f ./firmware-binaries/rv130_v44/httpd -n rv130 -v 1_0_3_44 -t\n\n# vulnerability discovery without indirect call resolution\npython main.py -f ./firmware-binaries/rv130_v44/httpd -n rv130 -v 1_0_3_44 -t --resolve_icall 0\n```\n\n\n## Extension\nIf the user obtain another firmware, which is not involved in our dataset, you can follow the instructions to attemp to run it in `EmTaint`.\n\n1) Use tool `binwalk` (https://github.com/ReFirmLabs/binwalk) to extract the binaries associated with handling network requests in the firmware.\n2) Extract the binary information by running script `./dataflow/ida_plugin/parse_arm_binary.py` in the IDA Pro, which generates two files, `{binary-name}_cfg.json` and `{binary-name}_block_info.json`.\n3) Create directory `./data/ida_data/{name}_{version}` and copy the above two files to it.\n4) Finally, run command `python main.py -f {binary} -n {name} -v {version} -t` to perform vulnerability discovery.\n\n\n\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkuc001%2FEmTaint","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkuc001%2FEmTaint","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkuc001%2FEmTaint/lists"}