Open jstarink opened 8 months ago
Based on taint_x86_64.py I have come to realize I should enable the taint analysis after the machine is set up, e.g., inside of a @panda.cb_after_machine_init
callback. Is this the typical approach to take or is there another (better) way?
Description
It seems some of the Python examples are not working (anymore). In particular, I am looking into the implementation of taint.py. Running this script as-is does not work / segfaults.
Findings
Based on the errors I received in the stdout, I identified the following problems:
fd_to_fname
returnsbytes
.panda.taint_label_ram
requires alabel
argument.panda.run
is called.Points 1 and 2 are easy enough to address, but with 3 I have some trouble. When I try add the following lines before the call to
panda.run
, PANDA seems to be crashing with a segfault upon calling thepanda.taint_enable
.Example output:
Stack trace according to GDB (see bottom of issue) seems to indicate it happens the
PandaTaintVisitor
class, called by thetaint2_enable_taint
functionAm I missing something?
Details
Full (modified) script:
```python from pandare import Panda panda = Panda(generic='x86_64') @panda.queue_blocking def driver(): panda.revert_sync('root') print(panda.run_serial_cmd("grep root /etc/passwd")) panda.end_analysis() panda.require("osi") panda.require("osi_linux") def fd_to_fname(cpu, fd): proc = panda.plugins['osi'].get_current_process(cpu) procname = panda.ffi.string(proc.name) if proc != panda.ffi.NULL else "error" fname_ptr = panda.plugins['osi_linux'].osi_linux_fd_to_filename(cpu, proc, fd) fname = panda.ffi.string(fname_ptr) if fname_ptr != panda.ffi.NULL else "error" return fname @panda.ppp("syscalls2", "on_sys_read_return") def read(cpu, tb, fd, buf, cnt): fname = fd_to_fname(cpu, fd) print(f"read {fname}") if fname == b"/etc/passwd": # <-- changed to bytes string for idx in range(cnt): panda.taint_label_ram(buf+idx, 1) # <-- added taint label 1 (not sure about the expected type?) @panda.ppp("taint2", "on_branch2") def something(addr, size, from_helper, tainted): print("Tainted branch") # Added plugin loading/enabling panda.load_plugin("taint2") panda.taint_enable() panda.run() ```GDB stack trace
``` 0x00007fc244615bb8 in llvm::PandaTaintVisitor::insertStateOp(llvm::Instruction&) () from /usr/local/lib/panda/x86_64/panda_taint2.so (gdb) bt #0 0x00007fc244615bb8 in llvm::PandaTaintVisitor::insertStateOp(llvm::Instruction&) () from /usr/local/lib/panda/x86_64/panda_taint2.so #1 0x00007fc244619d35 in llvm::PandaTaintFunctionPass::runOnFunction(llvm::Function&) () from /usr/local/lib/panda/x86_64/panda_taint2.so #2 0x00007fc2446094c1 in taint2_enable_taint () from /usr/local/lib/panda/x86_64/panda_taint2.so #3 0x00007fc259622ff5 in ?? () from /lib/x86_64-linux-gnu/libffi.so.7 #4 0x00007fc25962240a in ?? () from /lib/x86_64-linux-gnu/libffi.so.7 #5 0x00007fc2588810a7 in cdata_call (cd=