# A Vulnerability Scanning Method for Web Services in Embedded Firmware
## 4 Design
### Vulnerability Path Exploration  
After identifying external data introduction functions and filtering hazardous functions, we treat the external data introduction functions that reference the keywords of Feature 2 and Feature 3 as source points and hazardous functions as sink points for exploring potential vulnerability paths. Initially, we generate function call paths for both source and sink points. Subsequently, we rely on these function call paths and control flow graphs within functions to conduct a taint analysis, aiming to uncover potential vulnerabilities. Although the preceding modules have narrowed down the target of the contamination analysis, a substantial number of pollution sources still require a trace analysis. To enhance the efficiency of this analysis, we first search for function call traces from source to sink points--that is, the sequence of function calls from external data introduction points to potential hazardous functions--before exploring paths. We designate the external data introduction function associated with an introduction point as the root node and employ depth-first traversal to search for calls to hazardous functions within the function's call tree, thus generating a sequence of calls. Should an external data introduction point lack any function call sequences, it is considered to have no reachable paths to potential hazardous functions and, consequently, can be removed from the collection of pollution sources. Our taint analysis relies on the generated function call paths and the control flow graphs within functions. The main factors influencing the efficiency and accuracy of taint analysis are the taint propagation specifications for function calls. As shown in Algorithm \begin{table}
\begin{tabular}{c c c} \hline \hline
**Vulnerability Types** & **Function Types** & **Rules** \\ \hline \multirow{8}{*}{Buffer Overflow} & & not param[1],is\_constant() and \\  & Strncpy-like Functions & not param[1],used\_in\_call\_after([’strlen’]) \\  & & and (not param[2],is\_constant() \\  & & or param[2],is\_morethan(256) ) \\ \cline{2-3}  & & any([(not param[i+1],used\_in\_call\_before([’strlen’]) \\  & & and not param[i+1],is\_constant()) for i in \\  & & range(len(param[1],string\_value(),split(\%))) if \\  & & param[1],string\_value(),split(\%)[i],startswith(*’s)] \\ \hline Command Injection & System-like Functions & not param[0],is\_constant() \\ \hline Formatted String & Print-like Functions & not param[0],is\_constant() \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Example of dangerous function filtering rule. Examples of filtering rules for dangerous functions corresponding to vulnerabilities, such as buffer overflow, command injection, and formatted strings, are shown. 1, we categorize functions into three types: downward-propagating functions, inward-propagating functions, and terminator functions. Functions involved in the function call paths are designated as inward-propagating functions, within which we track the propagation of tainted parameters. Hazardous functions are considered terminator functions; for these, we verify whether tainted parameters correspond to dangerous ones, and if so, we issue an alert. Other functions are classified as downward-propagating functions. For these, we do not trace into the function; instead, we contaminate their parameters and return values and continue the downward propagation of taint in the originating function. The external data introduction functions within the pollution sources serve as the initial downward-propagating functions. As illustrated in Figure 5, the data reception function is in \"Func_A\", and from \"Func_A\" to the hazardous cell point \"Func_sink\", there is a call path \"Func_A -> Func_B -> Func_sink1\". We regard \"Func_B\" on the call chain as a downward-propagating function. \"Func_B\" calls \"Func_D\" before calling \"Func_sink1\", but since \"Func_D\" is not on the call chain, it is considered a downward-propagating function.