taint-analysis

To trace attacker-controlled inputs to dangerous sinks, apply forward taint analysis to map tainted execution paths from a target function to APIs like CreateProcess or WriteFile, exposing potential vulnerabilities.

Cross-module taint propagation tracks attacker-controlled data across module boundaries using parameter mapping. It classifies trust boundaries and handles COM/RPC boundaries to uncover complex attack chains.

To find the origins of tainted data, use backward origin analysis to trace caller origins and taint sources back across module boundaries, identifying where attacker-controlled inputs initially entered the execution flow.

Yes, cross-module taint analysis requires module analysis databases to map parameter propagation and classify trust boundaries effectively. You also need Python 3.10+ and internal helper modules for API taxonomy and guard classification.

To identify bypassable guards in data-flow security analysis, perform taint tracing from attacker-controlled inputs to sinks while leveraging guard classification to detect insufficient security checks along the tainted execution paths.