Wasabi：一个动态分析WebAssembly的框架
Wasabi: A Framework for Dynamically Analyzing WebAssembly
摘要：
WebAssembly是一种新的Web低级语言，一年多以来已经在所有主要浏览器中实现。为了确保未来Web应用程序的安全性、性能和正确性，迫切需要WebAssembly的动态分析工具。不幸的是，从头开始构建这样的工具需要了解语言的底层细节，甚至可能需要了解它的运行时环境。Wasabi是第一个动态分析WebAssembly的通用框架。Wasabi提供了一个易于使用的高级API，允许实现重量级的动态分析，可以监视所有低级行为。该方法基于二进制插装，它将对用JavaScript编写的分析函数的调用插入到WebAssembly二进制文件中。Wasabi解决了其他二进制插装工具不存在的几个独特挑战，例如使用具有固定类型的分析函数跟踪类型多态指令的问题，我们通过分析调用的按需单态化来解决这个问题。为了控制分析所带来的开销，Wasabi选择性地只使用与分析相关的指令。我们对计算密集型基准测试和实际应用程序的评估表明，Wasabi（i）忠实地保留了原始程序行为，（ii）对重量级动态分析施加了合理的开销（取决于程序和所分析的指令，在1.02x和163x之间），以及（iii）使得直接实现各种动态分析，包括指令计数，调用图提取、内存访问跟踪和污点分析。
英文摘要：
WebAssembly is the new low-level language for the web and has now been implemented in all major browsers since over a year. To ensure the security, performance, and correctness of future web applications, there is a strong need for dynamic analysis tools for WebAssembly. Unfortunately, building such tools from scratch requires knowledge of low-level details of the language, and perhaps even its runtime environment. This paper presents Wasabi, the first general-purpose framework for dynamically analyzing WebAssembly. Wasabi provides an easy-to-use, high-level API that allows implementing heavyweight dynamic analyses that can monitor all low-level behavior. The approach is based on binary instrumentation, which inserts calls to analysis functions written in JavaScript into a WebAssembly binary. Wasabi addresses several unique challenges not present for other binary instrumentation tools, such as the problem of tracing type-polymorphic instructions with analysis functions that have a fixed type, which we address through an on-demand monomorphization of analysis calls. To control the overhead imposed by an analysis, Wasabi selectively instruments only those instructions relevant for the analysis. Our evaluation on compute-intensive benchmarks and real-world applications shows that Wasabi (i) faithfully preserves the original program behavior, (ii) imposes an overhead that is reasonable for heavyweight dynamic analysis (depending on the program and the analyzed instructions, between 1.02x and 163x), and (iii) makes it straightforward to implement various dynamic analyses, including instruction counting, call graph extraction, memory access tracing, and taint analysis.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
