search

winter2020 / oo7

oo7, a binary analysis tool to defend against Spectre vulnerabilities
Other
30 stars 3 forks source link

Questions about the results in incidents_profile.txt #2

Open enlighten5 opened 4 years ago

enlighten5 commented 4 years ago

Hi, This is a very interesting work! I tried some simple binaries with it and have some questions about interpreting the results. I was wondering what do s2, s3, and IM1, IM2 in the incidents_profile.txt really mean? To me, it's like s2 is <TB, RS>, and s3 is <TB, RS, LS>. Moreover, is the result of <TB, SW> shown in incidents_profile.txt? or should I enable some options if I want to find <TB, SW>? I think it treats the fread() as a taint source. but I did not observe any tainted branch for some of the binaries. do you think it's something related to the binary itself or the taint propagation? Thank you in advance!

winter2020 commented 4 years ago

The detection of speculative write is enabled. but you have to check the disassembly code at the detected location to know whether it is a read or write.