TaintEMU: Decoupling Tracking from Functional Domains for Architecture-Agnostic and Efficient Whole-System Taint Tracking

Whole-system taint tracking is vital for security analysis. However, existing methods suffer from limited architecture compatibility and significant performance overhead, mainly due to the tight coupling between the functional and tracking domains. This paper introduces TaintEMU, an architecture-agnostic and efficient solution by fully decoupling the two domains. It separates functional and tracking logic at the QEMU TCG layer, mapping shadow registers to host instead of guest registers, ensuring compatibility across guest CPU architectures. At the host layer, it physically isolates the two domains: general-purpose instructions and registers serve the functional domain, while vector resources are dedicated to tracking, avoiding host resource reuse and enhancing tracking performance. Furthermore, it directly generates tracking instructions from TCG operations on the host, bypassing additional translation and further reducing overhead. We implement TaintEMU on an AMD64 host on QEMU 8.2.2. It supports a wide range of guest architectures (x86, MIPS, ARM, AMD, RISC-V, PPC), reduces performance overhead from 301% (DECAF++) to 101% and successfully detects all vulnerabilities in tests with 8 CVEs across 7 applications.