TaintEMU is a system-level dynamic taint analysis tool based on QEMU, capable of tracking the propagation of labeled data across the entire system. By deeply integrating into QEMU's TCG (Tiny Code Generator) module, this tool achieves efficient taint propagation analysis while maintaining excellent compatibility with multiple instruction set architectures.

✅ Multi-architecture Support

• Select target instruction sets via compile-time parameters (e.g., aarch64-softmmu/x86_64-softmmu)
• Extend support for new instruction sets without modifying core code
• The taint tracking feature currently supports: arm32, aarch64, i386, x86-64, mips, mips64, ppc, ppc64, s390x, riscv32, riscv64

🚀 High Performance

• Taint tracking logic directly compiled into host machine code
• Deep optimization during TCG dynamic binary translation phase
• More efficient than traditional instrumentation methods

🔌 Seamless Integration

• Independent taint tracking module design
• Fully decoupled from QEMU's original features (virtual devices, memory management, etc.)
• Supports standard QEMU command-line parameters

• x86-64 CPU with SIMD instruction support
• Linux operating system
• QEMU dependencies (ninja, glib2, pixman, etc.)

# 1. Get the source code
git clone https://github.com/shinian98/TaintEMU.git
cd TaintEMU

# 2. Configure build options
mkdir build && cd build
../configure \
    --target-list=aarch64-softmmu \  # Specify target architecture
    --enable-taint-engine            # Enable taint engine

# 3. Compile
make -j$(nproc)

📝 The complete user guide and quick examples can be found in the wiki.

We welcome improvements through Issues or development contributions via PRs:

1. Fork this repository
2. Create a feature branch (git checkout -b feature/xxx)
3. Commit your changes (git commit -m 'Add some feature')
4. Push the branch (git push origin feature/xxx)
5. Create a Pull Request

This project is open-sourced under the GNU General Public License v2.0. See the LICENSE file for details.

Note: This tool is suitable for security analysis, vulnerability discovery, and other research scenarios. Please comply with relevant laws and regulations when using it.
For technical questions, contact: lulongjin98@gmail.com