AI 中文总结
针对Rust程序分析工具尚处早期、缺乏通用动态分析框架的问题，Leaf提供原生框架，通过捕获MIR级语义信息并增强，经DMIR传递给分析。通过三个动态分析展示其实用性与表现力，评估显示其编译时和运行时开销可控。
AI 中文摘要
本文介绍了Leaf，一个基于插桩的Rust动态分析框架。尽管Rust近年来发展迅速，但针对Rust的程序分析工具仍处于相对早期阶段。一个显著差距是缺乏能支持不同分析任务的通用动态分析框架。Leaf旨在通过提供一个原生Rust框架在运行时分析Rust程序来填补这一空白。Rust通过其所有权模型、类型系统、内存模型和编译器级表示提供丰富语义信息。Leaf专注于如何将这些信息用于动态分析。具体而言，Leaf捕获MIR级语义信息，用运行时事实增强它，并通过动态MIR（DMIR）这一事件驱动编程接口将其作为事件流传递给分析。通过三个重要的动态分析——一个混合执行器、一个特定于Rust的清理器和一个控制流跟踪器——我们展示了Leaf的实用性和表现力。我们的评估进一步表明Leaf的编译时和运行时开销虽有但可控。
英文摘要
This paper presents LEAF, an instrumentation-based dynamic analysis framework for Rust. Although Rust has grown rapidly in recent years, the landscape of program analysis tools for Rust is still in relatively early stages. One notable gap is the lack of a general-purpose dynamic analysis framework that can support different analysis tasks. LEAF aims to fill this gap by providing a Rust-native framework for analyzing Rust programs at runtime. Rust provides rich semantic information through its ownership model, type system, memory model, and compiler-level representation. Therefore, LEAF focuses on how to make this information available to dynamic analyses. In particular, LEAF captures MIR-level semantic information, augments it with runtime facts, and delivers it to analyses as an event stream through Dynamic MIR (DMIR), an event-driven programming interface. Through three substantial dynamic analyses -- a concolic executor, a Rust-specific sanitizer, and a control-flow tracer -- we demonstrate the practicality and expressiveness of LEAF. Our evaluation further shows that LEAF's compile-time and runtime overhead is meaningful but manageable.
