taint

Taint Tracking

In addition to its symbolic execution capabilities Manticore also has taint checking capabilities. Taint analysis lets you mark data at any point in the program with meaningful labels. Any data that is calculated using the tainted data also becomes tainted with the same label. This type of analysis is useful when analyzing how data moves through a computer program.

In Manticore only operations where data from a tainted source is written will taint actually be propagated. Values of data that could be inferred from interacting with tainted data, do not themselves be tainted (such as if tainted data passed an equality check with non-tainted data).

The functions used for interacting with Manticores taint tracking system are located in the helpers library. All of these APIs operate on any type of data.

Relevant functions:

1. get_taints
2. istainted
3. taint_with