Data flow tracking via memory monitoring

A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a computing device to perform operations comprising:

• monitoring memory to identify a read operation that reads information from a tainted memory address;
• determining an offset value (O) that identifies a first number of operations performed after the identified read operation, a monitoring window value (M) that identifies a second number of operations performed after the first number of operations, and an upper boundary value (N) that identifies a third number of operations performed after the first number of operations;
• monitoring operations until one of:
• M operations are performed;
• and
• N write operations to untainted addresses are identified;
• marking memory addresses associated with identified write operations as tainted;
• and
• marking memory addresses associated with write operations performed after the Nth operation and memory addresses associated with write operations performed after the Mth operation as untainted.

A computing device, comprising:

• a processor configured with processor-executable instructions to perform operations comprising:
• monitoring memory to identify a read operation that reads information from a tainted memory address;
• determining an offset value (O) that identifies a first number of operations performed after the identified read operation, a monitoring window value (M) that identifies a second number of operations performed after the first number of operations, and an upper boundary value (N) that identifies a third number of operations performed after the first number of operations;
• monitoring operations until one of:
• M operations are performed;
• and
• N write operations to untainted addresses are identified;
• marking memory addresses associated with identified write operations as tainted;
• and
• marking memory addresses associated with write operations performed after the Nth operation and memory addresses associated with write operations performed after the Mth operation as untainted.