NSSL-SJTU / SaTC

A prototype of Shared-keywords aware Taint Checking, a novel static analysis approach that tracks the data flow of the user input between front-end and back-end to precisely detect security vulnerabilities.
274 stars 48 forks source link

多文件和ref2share相关问题 #24

Open zhjygit opened 1 year ago

zhjygit commented 1 year ago

当前的测试脚本是基于已测试的固件编写,但并不适用于所有固件; 测试的有效性和脚本的初始化也有关; 例如_cmdi.py中: sinks = ['system', '___system', 'bstar_system', 'popen', 'doSystemCmd', 'doShell', 'twsystem', 'CsteSystem', 'cgi_deal_popen', 'ExeCmd', 'ExecShell', 'exec_shell_popen', 'exec_shell_popen_str' ] 如果测试对象并不包含这些函数,那么测试效果可以想象(所以需要根据实际情况完善脚本); 再比如,ref2share.py中: heuristicMin = 4 sinks = ['nvram_safe_set', 'nvram_bufset', 'setenv'] digest = ['strcpy', 'sprintf', 'memcpy', 'strcat'] 同样的,测试对象中如果并不是通过nvram_safe_set与其他程序交互,那么测试结果必然为空;

不足之处请指正,实际测试中的问题也希望大家能多交流。