How to taint a memory address and check its propagation in the guest machine

[maofeichen]

Hi,
I download the Panda and be able to install and run VM successfully. What I'm trying to do is taint a memory address in the guest machine, and check its propagation during the process running. For example, a simple function call of program, and there is a temp array defined in it, if I taint the address of the temp array, how could I check the propagate of this tainted data during the function call executing? I checked the doc and the description in the taint folder, but I can't find related explanations of how to do it. I wonder if someone could help? It would be better if could list detail command. Thanks!

Best,
michael chen

[tleek]

Hi Michael. There isn't currently much (any) of an API to using taint.
Essentially, you'd have to modify the taint.cpp plug-in code, registering
some new callbacks that would label taint where you want to do so, and also
query taint where you want. Labeling and querying would be a matter of
calling some function in taint_processor.h. That part is easy and well
supported. But there isn't much guest introspection at present, so it
would be up to you to figure out the right time from a whole-system
perspective, to do both those things.

Sorry, that part of PANDA very much still in the works. Hope to have a
better interface soon, though!

Cheers.

Tim

On Wed, Apr 30, 2014 at 2:47 PM, mchen2016 notifications@github.com wrote:

Hi,
I download the Panda and be able to install and run VM successfully. What
I'm trying to do is taint a memory address in the guest machine, and check
its propagation during the process running. For example, a simple function
call of program, and there is a temp array defined in it, if I taint the
address of the temp array, how could I check the propagate of this tainted
data during the function call executing? I checked the doc and the
description in the taint folder, but I can't find related explanations of
how to do it. I wonder if someone could help? It would be better if could
list detail command. Thanks!

Best,
michael chen

—
Reply to this email directly or view it on GitHubhttps://github.com/moyix/panda/issues/3
.

When I see an adult on a bicycle, I do not despair for the future of the
human race. - H. G.Wells

[maofeichen]

Hi Tim. Thank you for your kindly reply. I'll try to figure out what I need to do. I'll continue to pay attention to your updates. Thanks!

Best,
Michael

[tleek]

Hello. Sorry for the underdeveloped state of affairs with respect to
taint. We are working on it. Hoping to have a much better setup by
summer's end!

Cheers.

Tim

On Fri, Jun 13, 2014 at 7:56 PM, Epeius notifications@github.com wrote:

Hi,
I find PANDA is a great analysis platform since it supports many archs, so
I want to do some Android taint analysis experiments with PANDA's taint
analysis plugin-PIRATE. But I found that in taint.cpp there was a function
called "guest_hypercall_callback()", which invoked the "enable_taint()"
function. But in guest_hypercall_callback(), code seems to not support ARM
as follows:
int guest_hypercall_callback(CPUState *env){
#ifdef TARGET_I386
target_ulong buf_start = env->regs[R_EBX];
target_ulong buf_len = env->regs[R_ECX];

if (env->regs[R_EAX] == 7 || env->regs[R_EAX] == 8){
if (!taintEnabled){
printf("Taint plugin: Label operation detected\n");
printf("Enabling taint processing\n");
taintJustEnabled = true;
taintEnabled = true;
enable_taint();
}

#endif // TARGET_I386
return 1;
}

So, it seems that this taint plugin doesn't support ARM platform, or on
ARM, there is anthor way to start analysis?

Best regards.
B. Zhang

—

Reply to this email directly or view it on GitHub
moyix/panda#3 (comment).

When I see an adult on a bicycle, I do not despair for the future of the
human race. - H. G.Wells

[moyix]

I think Tim's taint tutorial covers this nicely now, so I'm closing this one.