# WTA: A Static Taint Analysis Framework for PHP Webshell
## 3 Motivation
There are several challenges that need to be solved to implement this architecture:

(1) The data structures of the taint variables list, taint import functions list, taint propagation chain, dangerous functions list;

(2) Taint propagation rules [31] of the PHP Opline;

(3) Taint sink rules of the PHP Opline. These difficulties will be addressed in the next section. ## 5 Methodology

### Data Structures of Auxiliary Lists

The data structures of auxiliary lists refer to the taint variables list, taint import functions list, taint propagation chain, and dangerous functions list in the initialization module, while the taint source rules are hard coded in the corresponding functions, so they do not need initialization and data structures. The taint variables list, taint import functions list, and dangerous functions list are built based on the Zend_Hash [32] API of the ZendVM. During the initialization, the taint import functions list and dangerous functions list add the user-configured name array of the taint import functions and dangerous functions to Zend_Hash, in order to improve the retrieval speed of the taint import functions and dangerous functions. The taint variables list in initialization module only finishes the initialization of the memory space, and does not insert any data. Variables in the Opline sequences are displayed in sequential Arabic numerals, and when a variable is marked as a taint variable, the Arabic number representing that variable is inserted into the taint variables list. The taint propagation chain is constructed by a common doubly linked list. In fact, the taint propagation chain is an array storing the doubly linked list. Whenever a taint source is imported, a new doubly linked list will be created, and the head node of the linked list is the variable just imported by the taint source. When each taint variable (thisVar) is propagated to the next taint variable (nextVar), it will determine whether there is thisVar in the propagation chains according to the propagation relationship and insert nextVar into the next node of thisVar (Situation I). If it is found that thisVar node is not the tail node of the taint propagation chain, but the middle node (which means that the taint propagation chain is divided into two or more paths), then it will copy a new taint propagation list with thisVar as the tail node and insert nextVar into the next node of thisVar (Situation II). This is shown in $a = convert_uudecode(Sa); returnSa; } functionnewassert(){ $11

### Taint Propagation Rules

The ZendVM has a unique instruction set of Oplines. Taint analysis based on Oplines needs a user-defined data flow logic. This section first introduces three definitions: Taint Attribute, Taint Map, and Predefined Taint. Next, it introduces the data flow logic of the ZendVM. **Definition 1** (Taint Attribute). : _Taint Attribute is an accessoryattribute of a variable in the Opline sequences and is a Boolean value. When a variable's Taint Attribute is True, it is a taint variable, and when its Taint Attribute is False, it is a normal variable._

**Definition 2** (Taint Map T(\(\cdot\))). : _Regard \(v\) as a variable. T(\(v\)) will return the value of the variable \(v\)'s Taint Attribute. The semantics of T(\(v\)) is related to the position of \(\leftarrow\). When T(\(v_{1}\)) is on the right of \(\leftarrow\), it represents the acquisition of \(v_{1}\)'s Taint Attribute. When T(\(v_{1}\)) is on the left of \(\leftarrow\), it represents the reception of the Taint Attribute, which represents that \(v_{1}\)'s Taint Attribute is set to a Taint Attribute on the right. For example, T(\(v_{1}\))\(\leftarrow\)T(\(v_{2}\)) means \(v_{2}\)'s Taint Attribute is passed to \(v_{1}\)._

**Definition 3** (Predefined Taint). : _Predefined Taint TAINT is a variable that has been pre-identified as a taint due to the characteristics of the PHP language and the ZendVM.