chericat

A Capability Analysis Tool for CHERI

The program “chericat” is a standalone tool that runs on CheriBSD. It can be used by attaching to a running process to produce capability-related data, which is stored in a local SQL database. The data can then be queried to retrieve information regarding the capabilities created at that snapshot.

When the -p option is used, chericat uses the procstat utility functions to take a snapshop of the running process with the provided and extract the mmap data. At the same time chericat obtains the ELF data using the ELF Toolchain library. The data is then written to either a SQLite database if a valid database name is provided via the -f option, or to memory just to output the data without storing permanently.

To display formatted data on the console, the -v or -c options can be used. The -v option shows a table with twelve colunms:

Name	Description
START	The address of the start of the scanned vm block
END	The address of the end of the scanned vm block
PRT	Protection flags of the vm block, r=read, w=write, x=executable, R=can read capabilities, W=can write capabilities, -=not allowed
ro	Number of read-only capabilities found in this vm block
rw	Number of read-write capabilities found in this vm block
rx	Number of read-and-executable enabled capabilities found in this vm block
rwx	Number of read-write-executable enabled capabilities found in this vm block
TOTAL	Total number of capabilities found in this vm block
DENSITY	Percentage of capabilities found
FLAGS	Vm mapping flags
TP	Vm object type
PATH	Library name/path where the scanned vm block belongs

To display the obtained symbols for the capabilities within a specific library, use the -c option:

Name	Description
CAP_LOC	Address of the capabilities
CAP_LOC_SYM (TYPE)	Name of the symbol (if found on ELF) for the capability, the type could be NOTYPE if the information is not available, OBJECT if the capability is an object type, or FUNC, if the capability is a function type
CAP_INFO	Referenced address stored in this capability, the permissions, end address of the capability (which in turns shows how big it is)
CAP_SYM (TYPE)	Name of the symbol (if found on ELF) of the referenced capability

Usage: chericat [-d <debug level>] [-f <database name>] [-p <pid>] [-v] [-c <binary name>]
     debug level - 0 = No output; 1 = INFO; 2 = VERBOSE; 3 = TROUBLESHOOT
     pid - pid of the target process for a snapshot of caps info
     database name - name of the database to store data captured by chericat
Options:
     -d Determine the level of debugging messages to be printed. If omitted, the default is INFO level
     -f Provide the database name to capture the data collected by chericat. If omitted, an in-memory db is used
     -p Scan the mapped memory and persist the caps data to a database
     -v Show virtual summary info of capabilities in the target process, arranged in mmap order
     -c Show capabilities with corresponding symbols located in the provided binary

CTSRD-CHERI / chericat

readme

chericat