-
Notifications
You must be signed in to change notification settings - Fork 1
mxmssh/flayer
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
Flayer & LibFLayer Will Drewry <wad@gmail.com>, Tavis Ormandy <taviso@gmail.com> Copyright 2007 Google Inc. DISCLAIMER ---------- This software is a proof of concept. It is not pretty, but it is functional. Use at your own risk. If you'd like to make it better, submit patches and feedback! License ------- All included source, unless otherwise noted, is released on the GPL version 2. See docs/COPYING for details. Quick summary ------------- Flayer is a valgrind plugin It implements taint tracing and throws information errors when tainted information is used in a conditional or system call. In addition, strlen, strcmp, and other string/memory-related functions will also throw a "client check" error where forced tainting is used to taint the output of those functions. Using this output, Flayer can forcibly bypass conditional jumps and/or step over function calls. $ valgrind --tool=flayer --help ...... ...... User options for Flayer: --alter-fn=0xADDR1:1,... Inserts a forced jump over the function called from the given address and sets EAX to the 32-bit value. --taint-string=somestr Taint bytes read() that match the string --alter-branch=0xADDR1:1,... instrument branches (Ist_Exit) guards given addresses changing them to 1 or 0 --taint-stdin=no|yes enables stdin tainting [no] --taint-file=no|yes enables file tainting [no] --taint-network=no|yes enables network tainting [no] --file-filter=/path/prefix enforces tainting on any files under the given prefix. [] --verbose-instrumentation=no|yes enables verbose translation logging [no] Installing Flayer ------------ If you check out the source from subversion, you can build by running: ./configure && make && make install Despite valgrind supporting multiple architectures, currently Flayer only works with 32-bit x86 code. This is due to the system call wrapping code. If you'd like to submit a patch to add more platforms, better system call coverage, or use of the valgrind syswrap code, please drop me a mail! Using LibFlayer --------------- Currently, there is no installer for LibFlayer. Feel free to send a patch! Until then, you can try it out by setting your PYTHONPATH. E.g., PYTHONPATH=/opt/libflayer /opt/libflayer/examples/flayersh
About
Automatically exported from code.google.com/p/flayer
Resources
Stars
Watchers
Forks
Packages 0
No packages published