search

NSSL-SJTU / SaTC

A prototype of Shared-keywords aware Taint Checking, a novel static analysis approach that tracks the data flow of the user input between front-end and back-end to precisely detect security vulnerabilities.
274 stars 48 forks source link

No handler found when running program #7

Open nickylimjj opened 2 years ago

nickylimjj commented 2 years ago 
$ python satc.py -d /pwd -o results --ghidra_script=ref2sink_bof -b /pwd/www/htdocs/web.cgi --taint_check

[...snip]...

2021-10-11 11:43:18,157-root-logger.py-[line:111]-DEBUG : [*] Find Binary file : /pwd/lib/lighttpd/mod_cgi.so
2021-10-11 11:43:18,157-root-logger.py-[line:111]-DEBUG : [*] Find Binary file : /pwd/lib/lighttpd/mod_compress.so
2021-10-11 11:43:18,158-root-logger.py-[line:111]-DEBUG : [*] Find Binary file : /pwd/lib/lighttpd/mod_access.so
No handlers could be found for logger "root"
/home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/cffi/cparser.py:165: UserWarning: Global variable 'r' in cdef(): for consistency with C it should have a storage class specifier (usually 'extern')
  "(usually 'extern')" % (decl.name,))

I do not undersand what is meant by No handlers could be found for logger "root". Do you have any advice? web.cgi is a CGI binary. The lighttpd.conf is as such

[...snip...]

fastcgi.server = (
        "/www/" => (( "socket" => "/tmp/webserver.socket", "bin-path" => "/pwd/www/htdocs/web.cgi", "max-procs" => 1 )),
[...snip...]
Re1own commented 2 years ago

So do I

smile0304 commented 2 years ago

No handlers could be found for logger "root" This is a compatibility issue that occurs when modifying the code operating environment, so just ignore it.

If web.cgi is a boundary program, you can use the -b parameter to specify. python satc.py -d /pwd -o results --ghidra_script=ref2sink_bof -b web.cgi --taint_check ✅ python satc.py -d /pwd -o results --ghidra_script=ref2sink_bof -b /pwd/www/htdocs/web.cgi --taint_check ❌

cyc-god commented 2 years ago

No handlers could be found for logger "root" /home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/cffi/cparser.py:165: UserWarning: Global variable 'r' in cdef(): for consistency with C it should have a storage class specifier (usually 'extern') "(usually 'extern')" % (decl.name,))

I don't know how to fix it this is my command python satc.py -d /home/satc/SaTC_dateset/firmware_SaTC/D-Link/D-Link_878 -o /home/satc/res --ghidra_script=ref2sink_cmdi --ghidra_script=ref2sink_bof --taint_check

smile0304 commented 2 years ago

You can ignore this problem. It does not affect the operation of SaTC

ZhiAoWei commented 2 years ago

Me too, and my problem hasn't been solved yet.

LmDeng0 commented 1 year ago

How to solve this problem? It's seems can't be ignored.

DaDong-G commented 1 year ago

(SaTC) satc@e0cecd079e5d:~/SaTC$ python satc.py -d /tmp/firmware/D-Link/D-Link_878/ -o /home/satc/res --ghidra_script=ref2sink_cmdi -b prog.cgi --taint_check /home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/colorlog/init.py:52: UserWarning: Colorlog 6.0.0 will require Python 3.5 or above. Pin 'colorlog<5' to your dependencies if you require compatibility with older versions of Python. See https://github.com/borntyping/python-colorlog#status for more information. "Colorlog 6.0.0 will require Python 3.5 or above. Pin 'colorlog<5' to your " 2022-11-29 03:30:42,437-root-logger.py-[line:109]-INFO : Start analysis time : 2022-11-29 03:30:42.437013 2022-11-29 03:30:42,438-root-logger.py-[line:109]-INFO : Start Analysise xml File 2022-11-29 03:30:42,438-root-logger.py-[line:109]-INFO : Start Analysise html File 2022-11-29 03:30:42,438-root-logger.py-[line:109]-INFO : Start Analysise php File 2022-11-29 03:30:42,438-root-logger.py-[line:109]-INFO : Start Analysise asp File 2022-11-29 03:30:42,439-root-logger.py-[line:109]-INFO : Start Analysise js File No handlers could be found for logger "root" /home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/cffi/cparser.py:165: UserWarning: Global variable 'r' in cdef(): for consistency with C it should have a storage class specifier (usually 'extern') "(usually 'extern')" % (decl.name,)) How to solve this problem?

zhjygit commented 1 year ago

(SaTC) satc@e0cecd079e5d:~/SaTC$ python satc.py -d /tmp/firmware/D-Link/D-Link_878/ -o /home/satc/res --ghidra_script=ref2sink_cmdi -b prog.cgi --taint_check /home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/colorlog/init.py:52: UserWarning: Colorlog 6.0.0 will require Python 3.5 or above. Pin 'colorlog<5' to your dependencies if you require compatibility with older versions of Python. See https://github.com/borntyping/python-colorlog#status for more information. "Colorlog 6.0.0 will require Python 3.5 or above. Pin 'colorlog<5' to your " 2022-11-29 03:30:42,437-root-logger.py-[line:109]-INFO : Start analysis time : 2022-11-29 03:30:42.437013 2022-11-29 03:30:42,438-root-logger.py-[line:109]-INFO : Start Analysise xml File 2022-11-29 03:30:42,438-root-logger.py-[line:109]-INFO : Start Analysise html File 2022-11-29 03:30:42,438-root-logger.py-[line:109]-INFO : Start Analysise php File 2022-11-29 03:30:42,438-root-logger.py-[line:109]-INFO : Start Analysise asp File 2022-11-29 03:30:42,439-root-logger.py-[line:109]-INFO : Start Analysise js File No handlers could be found for logger "root" /home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/cffi/cparser.py:165: UserWarning: Global variable 'r' in cdef(): for consistency with C it should have a storage class specifier (usually 'extern') "(usually 'extern')" % (decl.name,)) How to solve this problem?

这主要是因为你的固件是mips，目前跑了几个，mips都不行，基本都会报错： File "/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py", line 200, in _load_plt guessed_addr = plt_sec.vaddr AttributeError: 'NoneType' object has no attribute 'vaddr' 比如这里的plt_sec应该是没找到，所以会有一个NoneType.vaddr的错误； 具体是啥原因，还不可知；可能和mips架构的符号识别有关。

zhjygit commented 1 year ago

pip install -U cffi==1.13.0后，不报cffi的错误了，但是没有解决“No handlers could be found for logger "root"”报错的问题；同时，AttributeError: 'NoneType' object has no attribute 'vaddr'的报错也没有解决。 我的报错代码如下： Find 1 new params heuristicly: wpapsk_crypto_5g INFO ANALYZING changes made by post scripts: /home/satc/SaTC/tenda-ax12-squashfs-root/usr/sbin/httpd (HeadlessAnalyzer)
INFO REPORT: Post-analysis succeeded for file: /home/satc/SaTC/tenda-ax12-squashfs-root/usr/sbin/httpd (HeadlessAnalyzer)
INFO REPORT: Save succeeded for file: /httpd (HeadlessAnalyzer)
No handlers could be found for logger "root" Converting Ghidra output to simple data... Convert success, output in ./result/ghidra_extract_result/httpd/httpd_ref2sink_cmdi.result-alter2 Traceback (most recent call last): File "satc.py", line 310, in main() File "satc.py", line 301, in main taint_stain_analysis(bin_path, ghidra_result, args.output) File "/home/satc/SaTC/taint_check/main.py", line 133, in taint_stain_analysis proj = angr.Project(binary, auto_load_libs=False, use_sim_procedures=True) File "/home/satc/deps/angr-dev/angr/angr/project.py", line 154, in init self.loader = cle.Loader(self.filename, *load_options) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 124, in init self.initial_load_objects = self._internal_load(main_binary, force_load_libs) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 475, in _internal_load main_obj = self._load_object_isolated(main_spec) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 569, in _load_object_isolated return backend_cls(full_spec, is_main_bin=self.main_object is None, loader=self, **options) File "/home/satc/deps/angr-dev/cle/cle/backends/elf/elf.py", line 114, in init self._load_plt() File "/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py", line 200, in _load_plt guessed_addr = plt_sec.vaddr AttributeError: 'NoneType' object has no attribute 'vaddr'

定位了一下报错的代码：/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py image 这里，貌似是没有得到plt表。怎么解决呢？

我的命令是：python satc.py -d tenda-ax12-squashfs-root/ -o result/ --ghidra_script=ref2sink_cmdi -b httpd --taint_check

在 2023-03-04 02:02:23，"FallinSlee" @.***> 写道：

/home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/cffi/cparser.py:165: UserWarning: Global variable 'r' in cdef(): for consistency with C it should have a storage class specifier (usually 'extern') "(usually 'extern')" % (decl.name,)) 这条报错可以通过pip install -U cffi==1.13.0解决，但是没有解决dlink878分析失败，输出文件依然是空的

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.***>

FallinSlee commented 1 year ago

pip install -U cffi==1.13.0后，不报cffi的错误了，但是没有解决“No handlers could be found for logger "root"”报错的问题；同时，AttributeError: 'NoneType' object has no attribute 'vaddr'的报错也没有解决。 我的报错代码如下： Find 1 new params heuristicly: wpapsk_crypto_5g INFO ANALYZING changes made by post scripts: /home/satc/SaTC/tenda-ax12-squashfs-root/usr/sbin/httpd (HeadlessAnalyzer) INFO REPORT: Post-analysis succeeded for file: /home/satc/SaTC/tenda-ax12-squashfs-root/usr/sbin/httpd (HeadlessAnalyzer) INFO REPORT: Save succeeded for file: /httpd (HeadlessAnalyzer) No handlers could be found for logger "root" Converting Ghidra output to simple data... Convert success, output in ./result/ghidra_extract_result/httpd/httpd_ref2sink_cmdi.result-alter2 Traceback (most recent call last): File "satc.py", line 310, in main() File "satc.py", line 301, in main taint_stain_analysis(bin_path, ghidra_result, args.output) File "/home/satc/SaTC/taint_check/main.py", line 133, in taint_stain_analysis proj = angr.Project(binary, auto_load_libs=False, use_sim_procedures=True) File "/home/satc/deps/angr-dev/angr/angr/project.py", line 154, in init self.loader = cle.Loader(self.filename, load_options) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 124, in init self.initial_load_objects = self._internal_load(main_binary, *force_load_libs) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 475, in _internal_load main_obj = self._load_object_isolated(main_spec) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 569, in _load_object_isolated return backend_cls(full_spec, is_main_bin=self.main_object is None, loader=self, *options) File "/home/satc/deps/angr-dev/cle/cle/backends/elf/elf.py", line 114, in init self._load_plt() File "/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py", line 200, in _load_plt guessed_addr = plt_sec.vaddr AttributeError: 'NoneType' object has no attribute 'vaddr' 定位了一下报错的代码：/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py image 这里，貌似是没有得到plt表。怎么解决呢？ 我的命令是：python satc.py -d tenda-ax12-squashfs-root/ -o result/ --ghidra_script=ref2sink_cmdi -b httpd --taint_check 在 2023-03-04 02:02:23，"FallinSlee" @.> 写道： /home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/cffi/cparser.py:165: UserWarning: Global variable 'r' in cdef(): for consistency with C it should have a storage class specifier (usually 'extern') "(usually 'extern')" % (decl.name,)) 这条报错可以通过pip install -U cffi==1.13.0解决，但是没有解决dlink878分析失败，输出文件依然是空的 — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.***>

你好，我并没有遇到vaddr这个报错，我尝试分析了tenda ac15和ac18，也会报“No handlers could be found for logger "root"”，但是程序可以正常结束。目前在我的尝试过程中，mips架构的totolink t10，dlink823g都无法正常分析，arm的ac15和ac18，以及R7000都可以得到正常输出。

FallinSlee commented 1 year ago

pip install -U cffi==1.13.0后，不报cffi的错误了，但是没有解决“No handlers could be found for logger "root"”报错的问题；同时，AttributeError: 'NoneType' object has no attribute 'vaddr'的报错也没有解决。 我的报错代码如下： Find 1 new params heuristicly: wpapsk_crypto_5g INFO ANALYZING changes made by post scripts: /home/satc/SaTC/tenda-ax12-squashfs-root/usr/sbin/httpd (HeadlessAnalyzer) INFO REPORT: Post-analysis succeeded for file: /home/satc/SaTC/tenda-ax12-squashfs-root/usr/sbin/httpd (HeadlessAnalyzer) INFO REPORT: Save succeeded for file: /httpd (HeadlessAnalyzer) No handlers could be found for logger "root" Converting Ghidra output to simple data... Convert success, output in ./result/ghidra_extract_result/httpd/httpd_ref2sink_cmdi.result-alter2 Traceback (most recent call last): File "satc.py", line 310, in main() File "satc.py", line 301, in main taint_stain_analysis(bin_path, ghidra_result, args.output) File "/home/satc/SaTC/taint_check/main.py", line 133, in taint_stain_analysis proj = angr.Project(binary, auto_load_libs=False, use_sim_procedures=True) File "/home/satc/deps/angr-dev/angr/angr/project.py", line 154, in init self.loader = cle.Loader(self.filename, load_options) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 124, in init self.initial_load_objects = self._internal_load(main_binary, *force_load_libs) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 475, in _internal_load main_obj = self._load_object_isolated(main_spec) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 569, in _load_object_isolated return backend_cls(full_spec, is_main_bin=self.main_object is None, loader=self, *options) File "/home/satc/deps/angr-dev/cle/cle/backends/elf/elf.py", line 114, in init self._load_plt() File "/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py", line 200, in _load_plt guessed_addr = plt_sec.vaddr AttributeError: 'NoneType' object has no attribute 'vaddr' 定位了一下报错的代码：/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py image 这里，貌似是没有得到plt表。怎么解决呢？ 我的命令是：python satc.py -d tenda-ax12-squashfs-root/ -o result/ --ghidra_script=ref2sink_cmdi -b httpd --taint_check 在 2023-03-04 02:02:23，"FallinSlee" @.> 写道： /home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/cffi/cparser.py:165: UserWarning: Global variable 'r' in cdef(): for consistency with C it should have a storage class specifier (usually 'extern') "(usually 'extern')" % (decl.name,)) 这条报错可以通过pip install -U cffi==1.13.0解决，但是没有解决dlink878分析失败，输出文件依然是空的 — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.***>

你好，请问你可以正常运行satc吗？有些问题可以交流一下吗？

zhjygit commented 1 year ago

pip install -U cffi==1.13.0后，不报cffi的错误了，但是没有解决“No handlers could be found for logger "root"”报错的问题；同时，AttributeError: 'NoneType' object has no attribute 'vaddr'的报错也没有解决。 我的报错代码如下： Find 1 new params heuristicly: wpapsk_crypto_5g INFO ANALYZING changes made by post scripts: /home/satc/SaTC/tenda-ax12-squashfs-root/usr/sbin/httpd (HeadlessAnalyzer) INFO REPORT: Post-analysis succeeded for file: /home/satc/SaTC/tenda-ax12-squashfs-root/usr/sbin/httpd (HeadlessAnalyzer) INFO REPORT: Save succeeded for file: /httpd (HeadlessAnalyzer) No handlers could be found for logger "root" Converting Ghidra output to simple data... Convert success, output in ./result/ghidra_extract_result/httpd/httpd_ref2sink_cmdi.result-alter2 Traceback (most recent call last): File "satc.py", line 310, in main() File "satc.py", line 301, in main taint_stain_analysis(bin_path, ghidra_result, args.output) File "/home/satc/SaTC/taint_check/main.py", line 133, in taint_stain_analysis proj = angr.Project(binary, auto_load_libs=False, use_sim_procedures=True) File "/home/satc/deps/angr-dev/angr/angr/project.py", line 154, in init self.loader = cle.Loader(self.filename, load_options) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 124, in init self.initial_load_objects = self._internal_load(main_binary, _force_load_libs) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 475, in _internal_load main_obj = self._load_object_isolated(main_spec) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 569, in _load_object_isolated return backend_cls(full_spec, is_main_bin=self.main_object is None, loader=self, options) File "/home/satc/deps/angr-dev/cle/cle/backends/elf/elf.py", line 114, in init self._load_plt() File "/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py", line 200, in _load_plt guessed_addr = plt_sec.vaddr AttributeError: 'NoneType' object has no attribute 'vaddr' 定位了一下报错的代码：/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py image 这里，貌似是没有得到plt表。怎么解决呢？ 我的命令是：python satc.py -d tenda-ax12-squashfs-root/ -o result/ --ghidra_script=ref2sink_cmdi -b httpd --taintcheck 在 2023-03-04 02:02:23，"FallinSlee" @.**> 写道： /home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/cffi/cparser.py:165: UserWarning: Global variable 'r' in cdef(): for consistency with C it should have a storage class specifier (usually 'extern') "(usually 'extern')" % (decl.name,)) 这条报错可以通过pip install -U cffi==1.13.0解决，但是没有解决dlink878分析失败，输出文件依然是空的 — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.***>

你好，请问你可以正常运行satc吗？有些问题可以交流一下吗？

啥问题呢？djstmail@163.com

FallinSlee commented 1 year ago

pip install -U cffi==1.13.0后，不报cffi的错误了，但是没有解决“No handlers could be found for logger "root"”报错的问题；同时，AttributeError: 'NoneType' object has no attribute 'vaddr'的报错也没有解决。 我的报错代码如下： Find 1 new params heuristicly: wpapsk_crypto_5g INFO ANALYZING changes made by post scripts: /home/satc/SaTC/tenda-ax12-squashfs-root/usr/sbin/httpd (HeadlessAnalyzer) INFO REPORT: Post-analysis succeeded for file: /home/satc/SaTC/tenda-ax12-squashfs-root/usr/sbin/httpd (HeadlessAnalyzer) INFO REPORT: Save succeeded for file: /httpd (HeadlessAnalyzer) No handlers could be found for logger "root" Converting Ghidra output to simple data... Convert success, output in ./result/ghidra_extract_result/httpd/httpd_ref2sink_cmdi.result-alter2 Traceback (most recent call last): File "satc.py", line 310, in main() File "satc.py", line 301, in main taint_stain_analysis(bin_path, ghidra_result, args.output) File "/home/satc/SaTC/taint_check/main.py", line 133, in taint_stain_analysis proj = angr.Project(binary, auto_load_libs=False, use_sim_procedures=True) File "/home/satc/deps/angr-dev/angr/angr/project.py", line 154, in init self.loader = cle.Loader(self.filename, load_options) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 124, in init self.initial_load_objects = self._internal_load(main_binary, _force_load_libs) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 475, in _internal_load main_obj = self._load_object_isolated(main_spec) File "/home/satc/deps/angr-dev/cle/cle/loader.py", line 569, in _load_object_isolated return backend_cls(full_spec, is_main_bin=self.main_object is None, loader=self, options) File "/home/satc/deps/angr-dev/cle/cle/backends/elf/elf.py", line 114, in init self._load_plt() File "/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py", line 200, in _load_plt guessed_addr = plt_sec.vaddr AttributeError: 'NoneType' object has no attribute 'vaddr' 定位了一下报错的代码：/home/satc/deps/angr-dev/cle/cle/backends/elf/metaelf.py image 这里，貌似是没有得到plt表。怎么解决呢？ 我的命令是：python satc.py -d tenda-ax12-squashfs-root/ -o result/ --ghidra_script=ref2sink_cmdi -b httpd --taintcheck 在 2023-03-04 02:02:23，"FallinSlee" @.**> 写道： /home/satc/.virtualenvs/SaTC/local/lib/python2.7/site-packages/cffi/cparser.py:165: UserWarning: Global variable 'r' in cdef(): for consistency with C it should have a storage class specifier (usually 'extern') "(usually 'extern')" % (decl.name,)) 这条报错可以通过pip install -U cffi==1.13.0解决，但是没有解决dlink878分析失败，输出文件依然是空的 — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.***>

你好，请问你可以正常运行satc吗？有些问题可以交流一下吗？

啥问题呢？djstmail@163.com

请问您使用过share2sink脚本吗？我遇到的问题是，固件dink878中，prog.cgi使用nvram_safe_set设置nvram变量，然后在librcm.so中获取，但是使用命令--ghidra_script=share2sink --ref2share_result=/.../prog.cgi_ref2share.result --ghidra_script=ref2sink_cmdi -b librcm.so --taint_check 后，结果文件librcm.so_share2sink.result为空，没有获取到这个nvram设置的关键词。