search

illera88 / Ponce

IDA 2016 plugin contest winner! Symbolic Execution just one-click away!
https://docs.idaponce.com
Other
1.48k stars 72 forks source link

Hook run/F9 to force stepping #25

Closed 0ca closed 8 years ago

0ca commented 8 years ago

Now when we run a program Ponce will stop at the breakpoint in the main and it would continue from there stepping.

But if we manually stop in a condition, we negate it and we run the progra, F9, we aren't going to do stepping, so from that point we would need to manually step for all the instructions.

I guess the idea is the first time the program run we should run it without stepping until we find a tainted input location (main, recv, fread). From there we do stepping and if the user manually stops the program to do things and he continues, F9, we should force the program to do stepping instead of real executing the program.

0ca commented 8 years ago

I was confusing about the tracing in IDA an the tracing function for the plugins: https://www.hex-rays.com/products/ida/support/sdkdoc/group__dbg__funcs__strace.html#gad244471ed51cd387fb9d9d372126c4a7

Plugins can use these functions to implement a custom tracing engine.

To step trace, IDA activates the step-by-step feature of the processor, and generates a dbg_trace notification after each step in the current thread. This mechanism is currently only available for plugins !

This is working perfectly for us, still we need to think if we want to give the user the possibility to disable the trace or not.

0ca commented 8 years ago

We could use this options to configure the trace and don't go into library functions: https://www.hex-rays.com/products/ida/support/sdkdoc/group___s_t__.html

But we need to go in library functions like memcpy, strcmp, etc... For that the only solution is use heuristics.