chains-project / GoSurface

Static analyzer to find locations to hide malicious code in Go
0 stars 0 forks source link

Assembly analyzer/parser #6

Closed vivi365 closed 2 weeks ago

vivi365 commented 3 weeks ago

This is a draft.

vivi365 commented 3 weeks ago

I think this version is fine but i have an issue:

Vector Occurrences:
[
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2bAVX2_amd64.go",
    "LineNumber": 30,
    "VariableName": "fAVX2"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2bAVX2_amd64.go",
    "LineNumber": 34,
    "VariableName": "fSSE4"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2b_amd64.go",
    "LineNumber": 21,
    "VariableName": "fSSE4"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2b_f_fuzz_test.go",
    "LineNumber": 54,
    "VariableName": "fSSE4"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2b_f_fuzz_test.go",
    "LineNumber": 70,
    "VariableName": "fAVX2"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/curve.go",
    "LineNumber": 235,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp.go",
    "LineNumber": 15,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 54,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 59,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 60,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 151,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "ethereum",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp_test.go",
    "LineNumber": 14,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2bAVX2_amd64.go",
    "LineNumber": 30,
    "VariableName": "fAVX2"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2bAVX2_amd64.go",
    "LineNumber": 34,
    "VariableName": "fSSE4"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2b_amd64.go",
    "LineNumber": 21,
    "VariableName": "fSSE4"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2b_f_fuzz_test.go",
    "LineNumber": 54,
    "VariableName": "fSSE4"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2b_f_fuzz_test.go",
    "LineNumber": 70,
    "VariableName": "fAVX2"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/curve.go",
    "LineNumber": 235,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp.go",
    "LineNumber": 15,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 54,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 59,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 60,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 151,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "crypto",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp_test.go",
    "LineNumber": 14,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "blake2b",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2bAVX2_amd64.go",
    "LineNumber": 30,
    "VariableName": "fAVX2"
  },
  {
    "PackageName": "blake2b",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2bAVX2_amd64.go",
    "LineNumber": 34,
    "VariableName": "fSSE4"
  },
  {
    "PackageName": "blake2b",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2b_amd64.go",
    "LineNumber": 21,
    "VariableName": "fSSE4"
  },
  {
    "PackageName": "blake2b",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2b_f_fuzz_test.go",
    "LineNumber": 54,
    "VariableName": "fSSE4"
  },
  {
    "PackageName": "blake2b",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/blake2b/blake2b_f_fuzz_test.go",
    "LineNumber": 70,
    "VariableName": "fAVX2"
  },
  {
    "PackageName": "bn256",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/curve.go",
    "LineNumber": 235,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "bn256",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp.go",
    "LineNumber": 15,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "bn256",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 54,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "bn256",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 59,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "bn256",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 60,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "bn256",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 151,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "bn256",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp_test.go",
    "LineNumber": 14,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "specifically",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/curve.go",
    "LineNumber": 235,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "specifically",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp.go",
    "LineNumber": 15,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "specifically",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 54,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "specifically",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 59,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "specifically",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 60,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "specifically",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp2.go",
    "LineNumber": 151,
    "VariableName": "gfpNeg"
  },
  {
    "PackageName": "specifically",
    "Type": "assembly",
    "FilePath": "/Users/viviandersson/go-ethereum/crypto/bn256/cloudflare/gfp_test.go",
    "LineNumber": 14,
    "VariableName": "gfpNeg"
  }
]

Counts to 12 invocations and I cannot find why...

╔═════════════════════════════════════════════════════════════════════════╗
║ Attack Surface Analysis: viviandersson                         ║
╠═════════════════════════════════════════════════════════════════════════╣
║ init() function definitions:                                         75 ║
║ global var initialization with functions:                             6 ║
║ exec function invocations:                                           22 ║
║ plugin dynamically loaded:                                            0 ║
║ 'go:generate' directive usage:                                       31 ║
║ testing function definitions:                                      2134 ║
║ Unsafe pointers:                                                     26 ║
║ C function invocations via CGO:                                      21 ║
║ Indirect method calls via interfaces:                              6403 ║
║ Usage of reflection:                                                130 ║
║ Invocation of constructors:                                           0 ║
║ Invocation of assembly functions:                                    12 ║
╚═════════════════════════════════════════════════════════════════════════╝

Also:

vivi365 commented 3 weeks ago

Also, i would like to add which file the signature comes from

vivi365 commented 3 weeks ago

~Count issue fixed: There are duplicate files in different packages, so package need to be included in key when counting. Perhaps this should be implemented for all occurrence counting~

vivi365 commented 3 weeks ago

actually @carminecesarano there is probably an issue in how the directories are traversed

If we look at the example vectors above, the exact same files are traversed 3 times, with different package names.

Ex: Filepath:"/Users/viviandersson/go-ethereum/crypto/blake2b/blake2bAVX2_amd64.go" with packages:

where the only correct one is blake2b