angorafuzzer / libdft64 Goto Github PK

View Code? Open in Web Editor NEW

231.0 16.0 47.0 290 KB

libdft for Intel Pin 3.x and 64 bit platform. (Dynamic taint tracking, taint analysis)

License: Other

Makefile 0.77% C 12.75% C++ 85.89% Shell 0.18% Dockerfile 0.23% PowerShell 0.18%

security taint-analysis fuzzing dynamic-analysis taint libdft taint-tracking angora

libdft64's Introduction

libdft: Practical Dynamic Data Flow Tracking

These code is modified from VUzzer64, and it is originally from libdft.

News

Update Pin version: pin-3.20-98437-gf02b61307-gcc-linux
Test in ubuntu 20.04

Features

Support Intel Pin 3.x
Support Intel 64 bit platform
Support basic SSE, AVX instructions.
Use BDD data structure described in Angora's paper.

Limitation of our taint propagation rules

Byte level
Ignore implicit flows
Ignore eflags registers

TODO

Contributing guidance

As TaintInduce mentioned, libdft exists the soundness and completeness probelm.

The taint propagation rules may be wrong.
It only supports the basic instructions, and there are many other instructions it need to support.

If you want to contribute to this, modify the instructions in src/libdft_core.cpp, and pull requests on github for us.

Build

Download Intel Pin 3.x and set PIN_ROOT to Pin's directory.

PREFIX=/path-to-install ./install_pin.sh

build libdft64

make

Docker

docker build -t libdft ./
docker run --privileged -v /path-to-dir:/data -it --rm libdft /bin/bash

Test

See tools/mini_test.cpp & tools/track.cpp for more defails

cd tools;
make test_mini

Introduction

Dynamic data flow tracking (DFT) deals with the tagging and tracking of "interesting" data as they propagate during program execution. DFT has been repeatedly implemented by a variety of tools for numerous purposes, including protection from buffer overflow and cross-site scripting attacks, analysis of legitimate and malicious software, detection and prevention of information leaks, etc. libdft is a dynamic DFT framework that is at once fast, reusable, and works with commodity software and hardware. It provides an API, which can be used to deliver DFT-enabled tools that can be applied on unmodified binaries running on common operating systems and hardware, thus facilitating research and rapid prototyping.

Installation & Usage

libdft relies on Intel Pin, which is a dynamic binary instrumentation (DBI) framework from Intel. In order to install libdft you first need a working copy on the latest Pin build, as well as the essential build tools for GNU/Linux (i.e., GCC, GNU Make, etc). After downloading and installing Intel Pin please follow the libdft installation instructions.

Tools

libdft is designed to facilitate the creation of "Pin tools" that employ dynamic DFT. As the name implies, libdft is also a shared library, which can be used to transparently perform DFT on binaries. Additionally, it provides an API that enables tool authors to adjust the applied DFT by specifying data sources and sinks, and customize the tag propagation policy. We have included three simple Pin tools inside the tools subdirectory to aid the development of DFT-powered Pintools:

nullpin is essentially a null tool that runs a process using Pin without any form of instrumentation or analysis. This tool can be used to measure the overhead imposed by Pin's runtime environment.
libdft uses libdft to apply DFT on the application being executed, but does not use any of the API functions to define data sources and sinks (i.e., it does not customize the applied DFT). This tool can be used to evaluate the overhead imposed by libdft.
track is an example tool that uses the API of libdft, and serves as template for future meta-tools. In particular, it implements a dynamic taint analysis (DTA) platform by transparently utilizing DFT in unmodified x86 Linux binaries. The sources are arguemnts in __libdft_set_taint, and sinks are arguments in __libdft_get_taint and __libdft_getval_taint. libdft64 is also used in Angora for taint tracking. You can reading code at https://github.com/AngoraFuzzer/Angora/tree/master/pin_mode as example.

DTA operates by tagging all data coming from the network as "tainted", tracking their propagation, and alerting the user when they are used in a way that could compromise his system. In this case, the network is the source of "interesting" data, while instructions that are used to control a program's flow are the sinks. For the x86 architecture, these are jumps and function calls with non-immediate operands, as well as function returns. Oftentimes, attackers are able to manipulate the operands of such instructions by abusing various types of software memory errors such as buffer overflows, format string vulnerabilities, dangling pointers, etc. They can then seize control of a program by redirecting execution to existing code (e.g., return-to-libc, ROP), or their own injected instructions. libdft-dta checks if tainted data are used in indirect control transfers, and if so, it halts execution with an informative message containing the offending instruction and the contents of the instruction pointer EIP.

Usage

After building both libdft and the accompanying tools (i.e., nullpin, libdft, and track), you can apply them directly in unmodified x86 Linux binaries as follows (assuming that you have added Pin's location to your PATH, and installed libdft in your home directory):

pin -t obj-intel64/track.so -- obj-intel64/mini_test.exe  cur_input

Arguments processed by Pin

-follow_execv: Instructs Pin to also instrument all processes spawned using the exec(3) class system calls by the program.
-t: Specifies the Pin tool to be used.

Research

Following are some publications that rely on libdft:

libdft: Practical Dynamic Data Flow Tracking for Commodity Systems. Vasileios P. Kemerlis, Georgios Portokalidis, Kangkook Jee, and Angelos D. Keromytis. In Proceedings of the 8th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE). March 2012, London, UK.
A General Approach for Efficiently Accelerating Software-based Dynamic Data Flow Tracking on Commodity Hardware. Kangkook Jee, Georgios Portokalidis, Vasileios P. Kemerlis, Soumyadeep Ghosh, David I. August, and Angelos D. Keromytis. In Proceedings of the 19th Internet Society (ISOC) Symposium on Network and Distributed System Security (NDSS). February 2012, San Diego, CA.
Angora: Efficient Fuzzing by Principled Search In Proceedings of the IEEE Symposium on Security and Privacy (SP). San Francisco, CA, May 2018.
VUzzer: Application-aware Evolutionary Fuzzing In Proceedings of the Internet Society (ISOC) Symposium on Network and Distributed System Security (NDSS). Feb 2017.

libdft64's People

Stargazers

Watchers

Forkers

roelvdp 0x6b7966 dipanjan fuzzamos gavz crackercat vbty tiandiyixian coffeevapple sunr1sesun seshagiriprabhu jack51706 caher-gh uerfan michael-hahn zytmatrix ekzhang nullrefexceptions jikk angr awen-li xposimon ucchiee richinseattle stevens-s3lab assafcarlsbad bb33bb xubenji blu3sh0rk gmh5225 clayne rnshah9 m4nval antonislouca tricker-z lambangaw uenojp ru0ch3n 923310233 paetscan 5l1v3r1 1049588147 hyunjungg drewrip komorogrov

libdft64's Issues

Cannot build libdft64

I got these errors while installing libdft64 from source:
~/libdft64$ make
cd src && CPPFLAGS= DFTFLAGS= make
make[1]: Entering directory '/home/admin/libdft64/src'
Makefie:20: ../Config/makefile.config: No such file or directoryl
Makefile:22: /Config/makefile.default.rules: No such file or directory
make[1]: *** No rule to make target '/Config/makefile.default.rules'. Stop.
make[1]: Leaving directory '/home/admin/libdft64/src'
Makefile:17: recipe for target 'dftsrc' failed
make: *** [dftsrc] Error 2

64 bit support

I am still getting familiar with the API of the library, I would like to as if the example "libdft-dta.cpp", is supposed to work with 64 bits. As i understand it is not, and works for 32 and 16-bit only. Also, shouldn't the tagmap_getl(), and tagmap_setl() functions work for 64 bit ?

running libdft-dta problem.

When I tried to run the libdft-dta.so with intel pin, I got this error. Does someone come across it back on?

root@localhost:~/libdft/libdft64# /root/libdft/libdft64/pin-3.20-98437-gf02b61307-gcc-linux/pin -pause_tool 50 -t /root/libdft/libdft64/tools/obj-intel64/libdft-dta.so -- /root/libdft/libdft64/tools/test_overflow.d/testoverflow.bin
E: Unable to load /root/libdft/libdft64/tools/obj-intel64/libdft-dta.so: dlopen failed: cannot locate symbol "thread_ctx_ptr" referenced by "/root/libdft/libdft64/tools/obj-intel64/libdft-dta.so"...

Instruction list

Can libdft64 check the bad kernel modules?

I found that the Intel pin can't check the program running in the kernel mode. so, most of the kernel modules running in kernel mode. I think the libdft64 can't track the taint in the kernel mode, is it?

Building libdft-dta?

Hi, I'm having some issues building libdft-dta.

I followed the instructions and was able to successfully build source and tools, but in the tools directory when I would run make libdft-dta id get error messages that headers were missing. I went ahead and added the src directory to the include search path and fixed some, but then I also had to add pin's include directory, and it still didn't work.

What directory should I try and build libdft-dta from?
Are there extra steps not written in the install instructions that we can write down?

Thanks for your time

MUL instruction?

I noticed that MUL instruction was treated as ins_unitary_op. However, if rax/rdx is not tainted before, MUL instruction might taint them. I am wondering how to solve this. :)

a little bug

in libdft_api.cpp,

I think "int ins_clr_post(syscall_desc_t *desc)" should be "int ins_clr_post(ins_desc_t *desc)"

Can't build Pin Tools

Hi,

I've been using the Docker image and followed the steps listed here: https://github.com/AngoraFuzzer/libdft64/blob/master/INSTALL.md
But the make command doesn't seem to work because none of the tools are created.

After running 'make' in src/ and 'make tools' in tools/ only obj-intel64/ is created.

Errors building libdft-dta

Hi,

I encountered several compilation errors when building libdft-dta, while track, nullpin, libdft were built without any errors. I used pin-3.7-97619-g0d0c92f4f-gcc-linux, which was downloaded using the install_pin.sh script, on Ubuntu 16.04. Below are the error messages. Can you please take a look? Thank you.

libdft-dta.cpp: In function ‘void alert(ADDRINT, ADDRINT)’:
libdft-dta.cpp:116:25: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 4 has type ‘ADDRINT {aka long unsigned int}’ [-Werror=format=]
getpid(), ins, bt);
^
libdft-dta.cpp:116:25: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 5 has type ‘ADDRINT {aka long unsigned int}’ [-Werror=format=]
libdft-dta.cpp: In function ‘ADDRINT assert_reg32(thread_ctx_t*, uint32_t, uint32_t)’:
libdft-dta.cpp:151:53: error: ‘tagmap_getl’ was not declared in this scope
return thread_ctx->vcpu.gpr[reg] | tagmap_getl(addr);
^
libdft-dta.cpp: In function ‘ADDRINT assert_reg16(thread_ctx_t*, uint32_t, uint32_t)’:
libdft-dta.cpp:171:38: error: ‘VCPU_MASK16’ was not declared in this scope
return (thread_ctx->vcpu.gpr[reg] & VCPU_MASK16)
^
libdft-dta.cpp:172:21: error: ‘tagmap_getw’ was not declared in this scope
| tagmap_getw(addr);
^
libdft-dta.cpp: In function ‘ADDRINT assert_mem32(ADDRINT, ADDRINT)’:
libdft-dta.cpp:188:26: error: ‘tagmap_getl’ was not declared in this scope
return tagmap_getl(paddr) | tagmap_getl(taddr);
^
libdft-dta.cpp: In function ‘ADDRINT assert_mem16(ADDRINT, ADDRINT)’:
libdft-dta.cpp:204:26: error: ‘tagmap_getw’ was not declared in this scope
return tagmap_getw(paddr) | tagmap_getw(taddr);
^
libdft-dta.cpp: In function ‘void dta_instrument_jmp_call(LEVEL_CORE::INS)’:
libdft-dta.cpp:245:33: error: ‘REG32_INDX’ was not declared in this scope
IARG_UINT32, REG32_INDX(reg),
^
libdft-dta.cpp:259:33: error: ‘REG16_INDX’ was not declared in this scope
IARG_UINT32, REG16_INDX(reg),
^
libdft-dta.cpp: In function ‘void post_read_hook(syscall_ctx_t*)’:
libdft-dta.cpp:373:62: error: ‘tagmap_setn’ was not declared in this scope
tagmap_setn(ctx->arg[SYSCALL_ARG1], (size_t)ctx->ret);
^
libdft-dta.cpp: In function ‘void post_readv_hook(syscall_ctx_t*)’:
libdft-dta.cpp:415:60: error: ‘tagmap_setn’ was not declared in this scope
tagmap_setn((size_t)iov->iov_base, iov_tot);
^
libdft-dta.cpp: In function ‘void post_socketcall_hook(syscall_ctx_t*)’:
libdft-dta.cpp:474:8: error: ‘SYS_ACCEPT’ was not declared in this scope
case SYS_ACCEPT:
^
libdft-dta.cpp:475:8: error: ‘SYS_ACCEPT4’ was not declared in this scope
case SYS_ACCEPT4:
^
libdft-dta.cpp:488:8: error: ‘SYS_GETSOCKNAME’ was not declared in this scope
case SYS_GETSOCKNAME:
^
libdft-dta.cpp:489:8: error: ‘SYS_GETPEERNAME’ was not declared in this scope
case SYS_GETPEERNAME:
^
libdft-dta.cpp:504:8: error: ‘SYS_SOCKETPAIR’ was not declared in this scope
case SYS_SOCKETPAIR:
^
libdft-dta.cpp:512:8: error: ‘SYS_RECV’ was not declared in this scope
case SYS_RECV:
^
libdft-dta.cpp:521:24: error: ‘tagmap_setn’ was not declared in this scope
(size_t)ctx->ret);
^
libdft-dta.cpp:527:8: error: ‘SYS_RECVFROM’ was not declared in this scope
case SYS_RECVFROM:
^
libdft-dta.cpp:536:23: error: ‘tagmap_setn’ was not declared in this scope
(size_t)ctx->ret);
^
libdft-dta.cpp:552:8: error: ‘SYS_GETSOCKOPT’ was not declared in this scope
case SYS_GETSOCKOPT:
^
libdft-dta.cpp:564:8: error: ‘SYS_RECVMSG’ was not declared in this scope
case SYS_RECVMSG:
^
libdft-dta.cpp:592:26: error: ‘tagmap_setn’ was not declared in this scope
msg->msg_controllen);
^
libdft-dta.cpp:623:16: error: ‘tagmap_setn’ was not declared in this scope
iov_tot);
^
libdft-dta.cpp: In function ‘int main(int, char**)’:
libdft-dta.cpp:773:65: error: invalid conversion from ‘void ()(syscall_ctx_t)’ to ‘void ()(LEVEL_VM::THREADID, syscall_ctx_t) {aka void ()(unsigned int, syscall_ctx_t)}’ [-fpermissive]
(void)syscall_set_post(&syscall_desc[__NR_read], post_read_hook);
^
In file included from libdft-dta.cpp:51:0:
/home/user/code/libdft64/src/syscall_desc.h:21:5: note: initializing argument 2 of ‘int syscall_set_post(syscall_desc_t*, void ()(LEVEL_VM::THREADID, syscall_ctx_t))’
int syscall_set_post(syscall_desc_t , void ()(THREADID, syscall_ctx_t ));
^
libdft-dta.cpp:776:67: error: invalid conversion from ‘void ()(syscall_ctx_t*)’ to ‘void ()(LEVEL_VM::THREADID, syscall_ctx_t) {aka void ()(unsigned int, syscall_ctx_t)}’ [-fpermissive]
(void)syscall_set_post(&syscall_desc[__NR_readv], post_readv_hook);
^
In file included from libdft-dta.cpp:51:0:
/home/user/code/libdft64/src/syscall_desc.h:21:5: note: initializing argument 2 of ‘int syscall_set_post(syscall_desc_t*, void ()(LEVEL_VM::THREADID, syscall_ctx_t))’
int syscall_set_post(syscall_desc_t , void ()(THREADID, syscall_ctx_t ));
^
libdft-dta.cpp:780:40: error: ‘__NR_socketcall’ was not declared in this scope
(void)syscall_set_post(&syscall_desc[__NR_socketcall],
^
libdft-dta.cpp:784:63: error: invalid conversion from ‘void ()(syscall_ctx_t*)’ to ‘void ()(LEVEL_VM::THREADID, syscall_ctx_t) {aka void ()(unsigned int, syscall_ctx_t)}’ [-fpermissive]
(void)syscall_set_post(&syscall_desc[__NR_dup], post_dup_hook);
^
In file included from libdft-dta.cpp:51:0:
/home/user/code/libdft64/src/syscall_desc.h:21:5: note: initializing argument 2 of ‘int syscall_set_post(syscall_desc_t*, void ()(LEVEL_VM::THREADID, syscall_ctx_t))’
int syscall_set_post(syscall_desc_t , void ()(THREADID, syscall_ctx_t ));
^
libdft-dta.cpp:785:64: error: invalid conversion from ‘void ()(syscall_ctx_t*)’ to ‘void ()(LEVEL_VM::THREADID, syscall_ctx_t) {aka void ()(unsigned int, syscall_ctx_t)}’ [-fpermissive]
(void)syscall_set_post(&syscall_desc[__NR_dup2], post_dup_hook);
^
In file included from libdft-dta.cpp:51:0:
/home/user/code/libdft64/src/syscall_desc.h:21:5: note: initializing argument 2 of ‘int syscall_set_post(syscall_desc_t*, void ()(LEVEL_VM::THREADID, syscall_ctx_t))’
int syscall_set_post(syscall_desc_t , void ()(THREADID, syscall_ctx_t ));
^
libdft-dta.cpp:788:67: error: invalid conversion from ‘void ()(syscall_ctx_t*)’ to ‘void ()(LEVEL_VM::THREADID, syscall_ctx_t) {aka void ()(unsigned int, syscall_ctx_t)}’ [-fpermissive]
(void)syscall_set_post(&syscall_desc[__NR_close], post_close_hook);
^
In file included from libdft-dta.cpp:51:0:
/home/user/code/libdft64/src/syscall_desc.h:21:5: note: initializing argument 2 of ‘int syscall_set_post(syscall_desc_t*, void ()(LEVEL_VM::THREADID, syscall_ctx_t))’
int syscall_set_post(syscall_desc_t , void ()(THREADID, syscall_ctx_t ));
^
libdft-dta.cpp:793:19: error: invalid conversion from ‘void ()(syscall_ctx_t*)’ to ‘void ()(LEVEL_VM::THREADID, syscall_ctx_t) {aka void ()(unsigned int, syscall_ctx_t)}’ [-fpermissive]
post_open_hook);
^
In file included from libdft-dta.cpp:51:0:
/home/user/code/libdft64/src/syscall_desc.h:21:5: note: initializing argument 2 of ‘int syscall_set_post(syscall_desc_t*, void ()(LEVEL_VM::THREADID, syscall_ctx_t))’
int syscall_set_post(syscall_desc_t , void ()(THREADID, syscall_ctx_t ));
^
libdft-dta.cpp:795:19: error: invalid conversion from ‘void ()(syscall_ctx_t*)’ to ‘void ()(LEVEL_VM::THREADID, syscall_ctx_t) {aka void ()(unsigned int, syscall_ctx_t)}’ [-fpermissive]
post_open_hook);
^
In file included from libdft-dta.cpp:51:0:
/home/user/code/libdft64/src/syscall_desc.h:21:5: note: initializing argument 2 of ‘int syscall_set_post(syscall_desc_t*, void ()(LEVEL_VM::THREADID, syscall_ctx_t))’
int syscall_set_post(syscall_desc_t , void ()(THREADID, syscall_ctx_t *));
^
cc1plus: all warnings being treated as errors

How to track multi-process program?

Hi, I tried to attach the program by using the following command:

pin -follow-exec -t libdft.so -- /path/to/my/exec

Specifically, my traced program is a nginx web server and I'd like to track the taint propagation in its worker processes.

Currently, my naive approach is to use LOGD defined in libdft to track the syscalls and taint tags.
However, it seems the instrumentation stops when the master process spawns and executes its work process, even though I've set the option -follow-exec.

Install_pin script

Could this be updated to point a slightly newer version of the pin tool such as version 3.8? I would pull this tar.gz file myself but cannot find the exact name of the file on the intel website (due to unknown g number in the file name). I am unable to build this project with later versions of pin (pin 3.13 and above) but I cannot build other software with the older pin 3.7 version which the install file fetches

Cannot Compile on Windows following INSTALL.md

When I tried to build the lib on Windows 10 (I follow https://github.com/AngoraFuzzer/libdft64/blob/master/INSTALL.md):
The output is:

C:\Users\Administrator\Desktop\projects\libdft64>C:\ProgramData\chocolatey\bin\make.exe
cd src && CPPFLAGS= DFTFLAGS= make
make[1]: Entering directory '/cygdrive/c/Users/Administrator/Desktop/projects/libdft64/src'
make objects
make[2]: Entering directory '/cygdrive/c/Users/Administrator/Desktop/projects/libdft64/src'
cl /EHs- /EHa- /wd4530 /DTARGET_WINDOWS /nologo /Gy /Oi- /GR- /GS- /DPIN_CRT=1 /D_WINDOWS_H_PATH_="C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\um" /D__LP64__ /Zc:threadSafeInit- /Zc:sizedDealloc- /wd5208 /DTARGET_IA32E /DHOST_IA32E /IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/source/include/pin /IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/source/include/pin/gen -IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/extras/stlport/include -IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/extras -IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/extras/libstdc++/include -IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/extras/crt/include -IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/extras/crt -IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/extras/crt/include/arch-x86_64 -IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/extras/crt/include/kernel/uapi -IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/extras/crt/include/kernel/uapi/asm-x86 /FIinclude/msvc_compat.h /IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/extras/components/include /IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/extras/xed-intel64/include/xed /IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/source/tools/Utils /IC:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/source/tools/InstLib /MD /O2 /c /Foobj-intel64/libdft_api.obj libdft_api.cpp
libdft_api.cpp
libdft_api.cpp: fatal error C1083: Cannot open include file: 'include/msvc_compat.h': No such file or directory
make[2]: *** [C:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/source/tools/Config/makefile.default.rules:233: obj-intel64/libdft_api.obj] Error 2
make[2]: Leaving directory '/cygdrive/c/Users/Administrator/Desktop/projects/libdft64/src'
make[1]: *** [C:\Users\Administrator\Desktop\projects\pin-3.28-msvc-windows/source/tools/Config/makefile.config:369: all] Error 2
make[1]: Leaving directory '/cygdrive/c/Users/Administrator/Desktop/projects/libdft64/src'
make: *** [Makefile:16: dftsrc] Error 2

It seems that the building procedure require cl.exe so I used VS 2022 Prompt and the build has an error at /FIinclude/msvc_compat.h, the file exists but cl.exe cannot find it.
Where shall I change to make it compilable? Thanks!

API usage question

Good day.
I have a common question.
How can I use your taint engine for tracking arbitrary data in common case?
For example I don't know which function will touch some input data. I manual implement a searching my input data in whole memory and in case if I found them I will mark memory.
I am looking for functions like a:

add_mem_taint(addr, len)
add_reg_taint(reg)

Like a http://shell-storm.org/blog/Taint-analysis-and-pattern-matching-with-Pin/

Printing taint tracked instructions

Hi,

I tried to print the instructions using taint tracked data by uncommenting the following code: https://github.com/AngoraFuzzer/libdft64/blob/master/src/libdft_api.cpp#L302

But it seems to print all the instructions which are executed after tainted = true set in here: https://github.com/AngoraFuzzer/libdft64/blob/master/src/syscall_hook.cpp#L19

Is there another way to print the taint tracked instructions?

Warning when using the latest Intel PIN 3.27 version

Hello,

This warning is possibly not important as it didn't have any impact on the core functionality of libdft64 (at least from my understanding), but just wanted to raise an issue that when I try to use the latest version of PIN (Version 3.27 https://software.intel.com/sites/landingpage/pintool/docs/98718/Pin/doc/html/index.html) with libdft, I get a warning message such as this:

...
/usr/bin/ld: warning: /home/taint_analysis/pin-3.27_build/intel64/runtime/pincrt/libc++abi.so: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0010001                                
/usr/bin/ld: warning: /home/taint_analysis/pin-3.27_build/intel64/runtime/pincrt/libc++abi.so: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0010002                                
/usr/bin/ld: warning: /home/taint_analysis/pin-3.27_build/intel64/runtime/pincrt/libm-dynamic.so: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0010001                             
/usr/bin/ld: warning: /home/taint_analysis/pin-3.27_build/intel64/runtime/pincrt/libm-dynamic.so: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0010002                             
/usr/bin/ld: warning: /home/taint_analysis/pin-3.27_build/intel64/runtime/pincrt/libc-dynamic.so: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0010001                             
/usr/bin/ld: warning: /home/taint_analysis/pin-3.27_build/intel64/runtime/pincrt/libc-dynamic.so: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0010002                             
/usr/bin/ld: warning: /home/taint_analysis/pin-3.27_build/intel64/runtime/pincrt/libunwind-dynamic.so: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0010001                        
/usr/bin/ld: warning: /home/taint_analysis/pin-3.27_build/intel64/runtime/pincrt/libunwind-dynamic.so: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0010002

I have tried solving this issue by myself, but after a few hours of trying to figure it out by testing with different compiler flags and such, I was unable to fix it.

I updated TAR_NAME= in the install_pin.sh with pin-3.27-98718-gbeaa5d51e-gcc-linux and everything seemed to work fine until the above warning messages (which is where I dived a little bit deeper into Makefile and other things).

I believe the issue arises from new libraries Intel PIN added (e.g., libdwarf starting from version 3.26) which may have some conflict issue in terms of version with libdft64. IF anyone might have solved this, that would be great to know, thank you in advance.

STOSD & STOSQ taint propogation issue

Hi,

looks like at line:472 & 480 in https://github.com/AngoraFuzzer/libdft64/blob/master/src/ins_xfer_op.cpp

We are giving the wrong callback, it should be r2m_xfer_opl & r2m_xfer_opq respectively. please confirm and fix.

Thanks

Bug) accept() syscall returned fd > 7 will unintentionally end the hooked application

Hello, thank you for sharing the code of libdft64.

I just wanted to inform an interesting bug with this line of code with accept system call handling part of the code:

case __NR_accept:
case __NR_accept4:
	/* not successful; optimized branch */
	if (unlikely((long)ctx->ret < 0))
		return;
	       /*
		* if the socket argument is interesting,
		* the returned handle of accept(2) is also
		* interesting
		*/
	if (likely(fdset.find(args[SYSCALL_ARG0]) !=
				fdset.end()))
		/* add the descriptor to the monitored set */
		fdset.insert((int)ctx->ret);

It is stated in the manual: https://man7.org/linux/man-pages/man2/accept.2.html that accept() returns a new file descriptor referring to that socket, and whenever (int)ctx->ret value is greater than 7, the hooked program abruptly ends. This is a key part because there is no segmentation fault or anything of an error, but just that the program gracefully exits.

The output looks like this:

pin-3.20_build/pin -follow-execv -t /home/lib/libdft-dta.so -- ./redis-server
...
210032:M 23 Mar 2023 17:53:44.985 * Increased maximum number of open files to 10032 (it was originally set to 1024).
        ► socket(2) fd add 6
        ► socket(2) fd add 7
                _._
           _.-``__ ''-._
      _.-``    `.  `_.  ''-._           Redis 5.0.4 (00000000/0) 64 bit
  .-`` .-```.  ```\/    _.,_ ''-._
 (    '      ,       .-`  | `,    )     Running in standalone mode
 |`-._`-...-` __...-.``-._|'` _.-'|     Port: 6379
 |    `-._   `._    /     _.-'    |     PID: 210032
  `-._    `-._  `-./  _.-'    _.-'
 |`-._`-._    `-.__.-'    _.-'_.-'|
 |    `-._`-._        _.-'_.-'    |           http://redis.io
  `-._    `-._`-.__.-'_.-'    _.-'
 |`-._`-._    `-.__.-'    _.-'_.-'|
 |    `-._`-._        _.-'_.-'    |
  `-._    `-._`-.__.-'_.-'    _.-'
      `-._    `-.__.-'    _.-'
          `-._        _.-'
              `-.__.-'

read(2) fd: 8
read(2) taint clear
210032:M 23 Mar 2023 17:53:46.708 # WARNING you have Transparent Huge Pages (THP) support enabled in your kernel. This will create latency and memory usage issues with Redis. To fix this issue run the command 'echo never > /sys/kernel/mm/transparent_hugepage/enabled' as root, and add it to your /etc/rc.local in ord
er to retain the setting after a reboot. Redis must be restarted after THP is disabled.
210032:M 23 Mar 2023 17:53:46.720 * Ready to accept connections
...

and then on the other terminal, if I were to execute ./redis-cli, then the above screen will output

...
read(2) fd: 8
read(2) taint clear
fd add accept
read(2) fd: 9
read(2) taint clear
read(2) fd: 8

and the program ends with the connection closed on the other terminal.

I have statically replaced (int)ctx->ret with a value less than 8, and was able to successfully determine that the file descriptor number is the issue. I have also tested using std::list and std::hash_set instead of

/* set of interesting descriptors (sockets) */
static set<int> fdset;

Doesn't seem to fix it though... Also tried GDBing the libdft-dta.so, but nothing useful came out of there either.

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.