PHP 屬性導向編程鏈自動化檢測機

Abstract

本研究提出自動找 PHP 屬性導向編程鏈的新工具 ChainChecker。這個工具實現符號執行引擎來提取限制式，並且使用 Z3 和 ChatGPT 來解限制式。經過分析實驗後結果，ChainChecker 和最新工具 FUGIO 相比有相當高的精確性，並且大幅改善執行時間。我們也發現 ChatGPT 和 Z3 在解限制式有不錯的效果，若考慮到建模所需花費時間，在找 PHP POP Chain 這類條件數量相對少的應用情景上是可以考慮用 ChatGPT 來替代 Z3。

This study presents a new tool, ChainChecker, for discovering PHP property-oriented programming chains. This tool implements a symbolic execution engine to extract constraints and uses Z3 and ChatGPT to solve the constraints. After analyzing the experimental results, ChainChecker demonstrates a relatively high level of accuracy compared to the latest tool, FUGIO, and significantly improves execution time. We also found that both ChatGPT and Z3 perform well in solving constraints. Considering the time required for modeling, we can consider ChatGPT as an alternative to Z3 in a scenario with relatively fewer constraints, such as finding PHP property-oriented programming chains.