search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.54k stars 1.7k forks source link

API calls dependency #1365

Open william-vu opened 7 years ago

william-vu commented 7 years ago

is there any way to obtain API call dependency between two function in Cuckoo? In other word, can we determine whether the output of API call X will be used as an input for API call Y? Thank you.

jbremer commented 7 years ago

No, Cuckoo doesn't provide taint information itself, although you can of course create a pintool analysis module and do something like that yourself if you really want to. Does this answer your question?

william-vu commented 7 years ago

Hi Jbremer, indeed I am now want to create a pintool analysis module to do this. May I ask if you know how to do it, or do you know a pointer so that I can take it as a starting point? Thank you very much,