There is no color tainted instruction and color tainted condition.

[YangY-Xiao]

When I try to solve one elf with ponce, there are some errors.

Ponce setting:

Symbolize memory:

Result:

As show in result, there is no colored tainted instructions and colored tainted condition.

Do I set mistakenly? Thanks a lot~~

[0ca]

It looks like the real check is happening inside the call sub_400D40. You should see inside that function if something is tainted.

The taint/symbolic engine is not going to detect things like this:

int check(char myinput)
{
  int flag = 0;
  if (myinput == 'A')  //This condition is tainted
    flag = 1
  else
    flag =- 1;
  return flag; // flag is not tainted!
}

I'm not sure how to solve this problem.

[0ca]

This is not a Ponce issue, it's a limitation of concolic execution.