Comments (4)
Hi Michael. There isn't currently much (any) of an API to using taint.
Essentially, you'd have to modify the taint.cpp plug-in code, registering
some new callbacks that would label taint where you want to do so, and also
query taint where you want. Labeling and querying would be a matter of
calling some function in taint_processor.h. That part is easy and well
supported. But there isn't much guest introspection at present, so it
would be up to you to figure out the right time from a whole-system
perspective, to do both those things.
Sorry, that part of PANDA very much still in the works. Hope to have a
better interface soon, though!
Cheers.
Tim
On Wed, Apr 30, 2014 at 2:47 PM, mchen2016 [email protected] wrote:
Hi,
I download the Panda and be able to install and run VM successfully. What
I'm trying to do is taint a memory address in the guest machine, and check
its propagation during the process running. For example, a simple function
call of program, and there is a temp array defined in it, if I taint the
address of the temp array, how could I check the propagate of this tainted
data during the function call executing? I checked the doc and the
description in the taint folder, but I can't find related explanations of
how to do it. I wonder if someone could help? It would be better if could
list detail command. Thanks!Best,
michael chen—
Reply to this email directly or view it on GitHubhttps://github.com/moyix/panda/issues/3
.
When I see an adult on a bicycle, I do not despair for the future of the
human race. - H. G.Wells
from panda.
Hi Tim. Thank you for your kindly reply. I'll try to figure out what I need to do. I'll continue to pay attention to your updates. Thanks!
Best,
Michael
from panda.
Hello. Sorry for the underdeveloped state of affairs with respect to
taint. We are working on it. Hoping to have a much better setup by
summer's end!
Cheers.
Tim
On Fri, Jun 13, 2014 at 7:56 PM, Epeius [email protected] wrote:
Hi,
I find PANDA is a great analysis platform since it supports many archs, so
I want to do some Android taint analysis experiments with PANDA's taint
analysis plugin-PIRATE. But I found that in taint.cpp there was a function
called "guest_hypercall_callback()", which invoked the "enable_taint()"
function. But in guest_hypercall_callback(), code seems to not support ARM
as follows:
int guest_hypercall_callback(CPUState *env){
#ifdef TARGET_I386
target_ulong buf_start = env->regs[R_EBX];
target_ulong buf_len = env->regs[R_ECX];if (env->regs[R_EAX] == 7 || env->regs[R_EAX] == 8){
if (!taintEnabled){
printf("Taint plugin: Label operation detected\n");
printf("Enabling taint processing\n");
taintJustEnabled = true;
taintEnabled = true;
enable_taint();
}#endif // TARGET_I386
return 1;
}So, it seems that this taint plugin doesn't support ARM platform, or on
ARM, there is anthor way to start analysis?Best regards.
B. Zhang—
Reply to this email directly or view it on GitHub
moyix/panda#3 (comment).
When I see an adult on a bicycle, I do not despair for the future of the
human race. - H. G.Wells
from panda.
I think Tim's taint tutorial covers this nicely now, so I'm closing this one.
from panda.
Related Issues (20)
- [CI] Generic pypanda tests broken but reporting passing HOT 1
- windows qcow support HOT 4
- Null Pointer Dereference in OSI
- cosi_strace example attempts to download non-existent volatility profile
- panda_rr2.c uses deprecated openssl APIs HOT 2
- [Security] use-after-free in panda/hw/net/virtio-net.c
- clone error HOT 3
- some python examples or test seem can not run in python3 version>=3.8. HOT 2
- panda.re URL access failed HOT 1
- Move to TCG-Plugin based model HOT 3
- Why is it necessary to turn off translation block chaining when doing taint2?
- Documentation/process for adding new callbacks
- Replaying a recording fails with assert error on g_main_context_acquire or segfault HOT 4
- Examples on Taint Analysis do not work or out of date HOT 1
- OSI_Linux fails to generate kernelinfo for newer versions of kernel HOT 1
- docker run error HOT 2
- Dockerhub images not updating HOT 4
- COSI examples don't work HOT 1
- AArch64 Docker container
- OSI Linux broken since `thread_group` removed HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from panda.