论文设计和代码逻辑偏差

[bhxyry]

代码中的矛盾

第一阶段的提示词（第 606-630 行）明确写着：

taint_prompt += """Please perform taint analysis only at this stage.
Use the decompiled code and the reachable test case from fuzzing only to judge whether external input can propagate from the identified source to the sink.
Consider taint aliasing during the analysis.
If taint propagation can be directly determined and cause a vulnerability, report alerts in the following format:
[('alert', source_addr, sink_addr), ...]
If no taint propagation is detected, return [].
Do not generate a PoC packet in this stage.
"""

但紧接着（第 647-659 行），代码却尝试提取PoC：

vuln_content = model.taint_agent(taint_prompt, prompt_count)

if vuln_content:
    vuln_info = self.extract_sink_from_content(vuln_content)
    if vuln_info:
        poc = self.extract_poc(vuln_content)  # ← 这里在提取PoC
        self.sink_function_analysis_flags.append(potential_path.sink_caller_function_addr)
        with open(f"{directory}/vuln_{os.path.basename(self.bin_dir)}_{sink_type}_{model_flag}.md", 'a') as vuln_file:
            vuln_file.write(f"{vuln_info}\n{poc}\n\n")  # ← 保存到文件
        print(f'{vuln_info}\n{poc}\n')

论文原始设计：两阶段分离

• 第一阶段：仅做Taint分析，生成alert（[('alert', source_addr, sink_addr), ...]）
• 第二阶段：在确认alert后，调用另一个LLM模型生成PoC

实际代码实现：

• 代码在第一阶段的提示词中禁止生成PoC
• 但在处理响应时，仍然调用 extract_poc() 尝试提取PoC