Jalangi2 vs Iroh.js

Iroh.js and Jalangi2 are both dynamic analysis frameworks for JavaScript, utilizing instrumentation techniques. They share similar dependencies, employing the acorn library to generate the AST tree and esotope for code generation. The instrumentation components for each framework can be found at the following locations:

• Jalangi2: https://github.com/Samsung/jalangi2/tree/master/src/js/instrument
• Iroh.js: https://github.com/maierfelix/Iroh/tree/master/src/patches

Furthermore, the codebase of Iroh.js appears more streamlined compared to that of Jalangi2.

On-the-Fly vs. Offline Instrumentation

Iroh.js and Jalangi2 are typically employed in two distinct manners: on-the-fly instrumentation versus offline instrumentation.

In TheThing, Iroh.js is utilized as follows, with all analysis conducted client-side:

• 1/ Set up the Chrome DevTools Protocol (CDP) to intercept all parsed JavaScript.
• 2/ Inject the Iroh.js browser library on the client for instrumentation and runtime analysis.
• 3/ Inject the generated DOM clobbering payloads based on the clobberable source.
• 4/ Inject the taint engine library, which is activated during runtime analysis.
• 5/ Begin parsing (instrumenting) the intercepted JavaScripts and perform taint analysis in real-time.

Conversely, Jalangi2 supports a different workflow for analyzing client-side code, as illustrated below.

On the Proxy Server:

• 1/ Intercept all JavaScript and HTML files in the response and check the cache.
• 2/ If an instrumented version is available in the cache, return this code to the client's browser.
• 3/ If no instrumented version is available, instrument the code and save it to the cache for future use.

On the browser sides, which is also driven by puppeteer,

• 1/ Inject the Jalangi2 runtime library into the browser.
• 2/ Inject the concolic execution library to enable dynamic analysis.
• 3/ Insert the current DOM clobbering markups to alter the HTML structure as needed.
• 4/ Load the instrumented JavaScript and HTML from the proxy and commence concolic execution.

Advantages of Offline Instrumentation:

• Efficiency: The caching mechanism reduces the overhead associated with instrumentation, which is beneficial for concolic execution.
• Debugging: It is easier to debug since the instrumented version of the JavaScript file is visible on the client side, although it is not dynamically generated.