bool init_plugin(void *self) {
plugin_self = self;
panda_require("stringsearch");
panda_require("taint2");
#ifdef CONFIG_SOFTMMU
panda_arg_list *args;
args = panda_get_args("tstringsearch");
positional_tainting = panda_parse_bool_opt(args, "pos", "positional taint");
only_first = panda_parse_bool_opt(args, "only_first", "only label first match");
args = panda_get_args("general");
enable_taint_instr_count =
panda_parse_uint64_opt(args, "first_instr", 0,
"enable taint at this instruction");
// this sets up the taint api fn ptrs so we have access
assert(init_taint2_api());
// register the tstringsearch_match fn to be called at the on_ssm site within panda_stringsearch
PPP_REG_CB("stringsearch", on_ssm, tstringsearch_match) ;
return true;
#else
fprintf(stderr, "tstringsearch: plugin does not support linux-user mode\n");
return false;
#endif
}
bool init_plugin(void *self) {
printf("Initializing taint plugin\n");
plugin_ptr = self;
panda_cb pcb;
panda_enable_memcb();
panda_disable_tb_chaining();
pcb.guest_hypercall = guest_hypercall_callback;
panda_register_callback(self, PANDA_CB_GUEST_HYPERCALL, pcb);
pcb.before_block_exec_invalidate_opt = before_block_exec_invalidate_opt;
panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC_INVALIDATE_OPT, pcb);
/*
pcb.replay_handle_packet = handle_packet;
panda_register_callback(plugin_ptr, PANDA_CB_REPLAY_HANDLE_PACKET, pcb);
*/
panda_arg_list *args = panda_get_args("taint2");
tainted_pointer = !panda_parse_bool(args, "no_tp");
inline_taint = panda_parse_bool(args, "inline");
if (inline_taint) {
printf("taint2: Inlining taint ops by default.\n");
} else {
printf("taint2: Instructed not to inline taint ops.\n");
}
if (panda_parse_bool(args, "binary")) mode = TAINT_BINARY_LABEL;
if (panda_parse_bool(args, "word")) granularity = TAINT_GRANULARITY_WORD;
optimize_llvm = panda_parse_bool(args, "opt");
panda_require("callstack_instr");
assert(init_callstack_instr_api());
return true;
}
bool init_plugin(void *self) {
panda_cb pcb;
printf("Initializing plugin memstrings\n");
panda_arg_list *args = panda_get_args("memstrings");
const char *prefix = panda_parse_string(args, "name", "memstrings");
min_strlen = panda_parse_ulong(args, "len", 4);
char matchfile[128] = {};
sprintf(matchfile, "%s_strings.txt.gz", prefix);
mem_report = gzopen(matchfile, "w");
if(!mem_report) {
printf("Couldn't write report:\n");
perror("fopen");
return false;
}
// Need this to get EIP with our callbacks
panda_enable_precise_pc();
// Enable memory logging
panda_enable_memcb();
pcb.virt_mem_write = mem_write_callback;
panda_register_callback(self, PANDA_CB_VIRT_MEM_WRITE, pcb);
pcb.virt_mem_read = mem_read_callback;
panda_register_callback(self, PANDA_CB_VIRT_MEM_READ, pcb);
return true;
}
bool init_plugin(void *self) {
panda_arg_list *args;
args = panda_get_args("rehosting");
kernel_filename = panda_parse_string(args, "kernel", "");
assert (kernel_filename != NULL);
assert (strlen(kernel_filename) > 0);
// this is where we will blit the kernel into memory
const char *base_addr_str = panda_parse_string(args, "base", "");
if (strnlen(base_addr_str,10) != 0) {
base_addr = strtoul(base_addr_str, NULL, 16);
}
// and this is the entry point
const char *entry_addr_str = panda_parse_string(args, "entry", "");
if (strnlen(entry_addr_str,10) != 0) {
entry_addr = strtoul(entry_addr_str, NULL, 16);
}
printf ("rehosting: kernel=[%s]\n", kernel_filename);
printf ("rehosting: base=0x%x entry=0x%x\n", base_addr, entry_addr);
#if defined(TARGET_I386)
panda_cb pcb;
pcb.before_block_exec_invalidate_opt = blit_kernel;
panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC_INVALIDATE_OPT, pcb);
return true;
#else
return false;
#endif
}
bool init_plugin(void *self) {
int i;
char *sclog_filename = NULL;
args = panda_get_args("syscalls");
if (args != NULL) {
for (i = 0; i < args->nargs; i++) {
// Format is syscall:file=<file>
if (0 == strncmp(args->list[i].key, "file", 4)) {
sclog_filename = args->list[i].value;
}
}
}
if (!sclog_filename) {
fprintf(stderr, "warning: Plugin 'syscalls' uses argument: -panda-arg syscalls:file=<file>\nusing default log file %s\n", DEFAULT_LOG_FILE);
char *scdef=new char[strlen(DEFAULT_LOG_FILE)+1];
strcpy(scdef,DEFAULT_LOG_FILE);
sclog_filename=scdef;
}
plugin_log = fopen(sclog_filename, "w");
if(!plugin_log) {
fprintf(stderr, "Couldn't open %s. Abort.\n",sclog_filename);
return false;
}
// Don't bother if we're not on a supported target
#if defined(TARGET_I386) || defined(TARGET_ARM)
panda_cb pcb;
pcb.insn_translate = translate_callback;
panda_register_callback(self, PANDA_CB_INSN_TRANSLATE, pcb);
pcb.insn_exec = exec_callback;
panda_register_callback(self, PANDA_CB_INSN_EXEC, pcb);
pcb.before_block_exec_invalidate_opt = returned_check_callback;
panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC_INVALIDATE_OPT, pcb);
#else
fwrite(stderr,"The syscalls plugin is not currently supported on this platform.\n");
return false;
#endif
#if defined(TARGET_ARM)
syscalls::register_call_fork(vmi_fork_callback);
syscalls::register_call_execve(vmi_execve_callback);
syscalls::register_call_do_mmap2(vmi_do_mmap2_callback);
syscalls::register_call_sys_prctl(vmi_sys_prctl_callback);
syscalls::register_call_clone(vmi_clone_callback);
#endif
syscalls_plugin_self = self;
return true;
}
bool init_plugin(void *self) {
init_callstack_instr_api();
panda_cb pcb = { .before_block_exec = before_block_exec };
panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb);
panda_arg_list *args = panda_get_args("printstack");
blockpc = panda_parse_ulong(args, "pc", 0);
if (blockpc == 0) return false;
return true;
}
bool init_plugin(void *self) {
printf("Initializing plugin file_taint\n");
panda_arg_list *args;
args = panda_get_args("file_taint");
taint_filename = panda_parse_string(args, "filename", "abc123");
positional_labels = panda_parse_bool(args, "pos");
// used to just find the names of files that get
no_taint = panda_parse_bool(args, "notaint");
prob_label_u32 = panda_parse_double(args, "prob_label_u32", 0.0);
end_label = panda_parse_ulong(args, "max_num_labels", 1000000);
end_label = panda_parse_ulong(args, "end", end_label);
start_label = panda_parse_ulong(args, "start", 0);
first_instr = panda_parse_uint64(args, "first_instr", 0);
printf ("taint_filename = [%s]\n", taint_filename);
printf ("positional_labels = %d\n", positional_labels);
printf ("no_taint = %d\n", no_taint);
printf ("prob_label_u32 = %.3f\n", prob_label_u32);
printf ("end_label = %d\n", end_label);
printf ("first_instr = %" PRId64 " \n", first_instr);
panda_require("syscalls2");
// this sets up the taint api fn ptrs so we have access
if (!no_taint) {
panda_require("taint2");
assert(init_taint2_api());
if (first_instr == 0) {
taint2_enable_taint();
}
}
panda_cb pcb;
if (first_instr > 0) {
// only need this callback if we are turning on taint late
pcb.before_block_translate = file_taint_enable;
panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_TRANSLATE, pcb);
}
#if defined(TARGET_I386)
PPP_REG_CB("syscalls2", on_sys_open_enter, open_enter);
PPP_REG_CB("syscalls2", on_sys_open_return, open_return);
PPP_REG_CB("syscalls2", on_sys_read_enter, read_enter);
PPP_REG_CB("syscalls2", on_sys_read_return, read_return);
#endif
return true;
}
bool init_plugin(void *self) {
printf ("Initializing plugin coverage\n");
panda_arg_list *args = panda_get_args("coverage");
process_name = panda_parse_string(args, "process", "");
panda_require("osi");
// this sets up OS introspection API
assert(init_osi_api());
panda_cb pcb;
pcb.before_block_exec = coverage_before_block_exec;
panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb);
return true;
}
bool init_plugin(void *self) {
panda_require("callstack_instr");
assert (init_callstack_instr_api());
panda_require("taint2");
assert (init_taint2_api());
panda_arg_list *args = panda_get_args("tainted_instr");
summary = panda_parse_bool_opt(args, "summary", "only print out a summary of tainted instructions");
if (summary) printf ("tainted_instr summary mode\n"); else printf ("tainted_instr full mode\n");
/*
panda_cb pcb;
pcb.after_block_exec = tbranch_after_block_exec;
panda_register_callback(self, PANDA_CB_AFTER_BLOCK_EXEC, pcb);
*/
PPP_REG_CB("taint2", on_branch2, tbranch_on_branch_taint2);
PPP_REG_CB("taint2", on_non_const_eip, tbranch_on_branch_taint2);
return true;
}
bool init_plugin(void *self) {
printf("Initializing plugin file_taint\n");
panda_arg_list *args;
args = panda_get_args("file_taint");
taint_filename = panda_parse_string(args, "filename", "abc123");
positional_labels = panda_parse_bool(args, "pos");
use_taint2 = !panda_parse_bool(args, "taint1");
// used to just find the names of files that get
no_taint = panda_parse_bool(args, "notaint");
printf ("taint_filename = [%s]\n", taint_filename);
printf ("positional_labels = %d\n", positional_labels);
panda_require("syscalls2");
// this sets up the taint api fn ptrs so we have access
if (!no_taint) {
if (use_taint2) {
panda_require("taint2");
assert(init_taint2_api());
taint2_enable_taint();
} else {
panda_require("taint");
assert(init_taint_api());
taint_enable_taint();
}
}
#if defined(TARGET_I386)
PPP_REG_CB("syscalls2", on_sys_open_enter, open_enter);
PPP_REG_CB("syscalls2", on_sys_open_return, open_return);
PPP_REG_CB("syscalls2", on_sys_read_enter, read_enter);
PPP_REG_CB("syscalls2", on_sys_read_return, read_return);
#endif
return true;
}
bool init_plugin(void* self) {
panda_cb pcb;
panda_arg_list* panda_args = panda_get_args("mmio_trace");
fn_str = panda_parse_string_opt(panda_args, "out_log", nullptr, "File to write MMIO trace log to.");
if (!fn_str) {
std::cerr << "No \'out_log\' specified, MMIO R/W will not be logged!" << std::endl;
}
panda_enable_precise_pc();
pcb.after_mmio_read = buffer_mmio_read;
panda_register_callback(self, PANDA_CB_MMIO_AFTER_READ, pcb);
pcb.after_mmio_write = buffer_mmio_write;
panda_register_callback(self, PANDA_CB_MMIO_AFTER_WRITE, pcb);
return true;
}
rr_end_replay_requested = 1;
}
return 0;
}
bool init_plugin(void *self) {
panda_cb pcb = { .before_block_exec = before_block_exec };
panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb);
start_count = 0;
end_count = UINT64_MAX;
const char *name = "scissors";
panda_arg_list *args = panda_get_args("scissors");
if (args != NULL) {
name = panda_parse_string(args, "name", "scissors");
start_count = panda_parse_uint64(args, "start", 0);
end_count = panda_parse_uint64(args, "end", UINT64_MAX);
}
snprintf(nondet_name, 128, "%s-rr-nondet.log", name);
snprintf(snp_name, 128, "%s-rr-snp", name);
return true;
}
void uninit_plugin(void *self) {
if (snipping && !done) end_snip();
}
/* ******************************************************************
Plugin Initialization/Cleanup
****************************************************************** */
/**
* @brief Initializes plugin.
*/
bool init_plugin(void *self) {
#if defined(TARGET_I386) || defined(TARGET_ARM)
#if (OSI_LINUX_TEST)
panda_cb pcb = { .after_PGD_write = vmi_pgd_changed };
#endif
// Read the name of the kernel configuration to use.
panda_arg_list *plugin_args = panda_get_args(PLUGIN_NAME);
char *kconf_file = g_strdup(panda_parse_string(plugin_args, "kconf_file", DEFAULT_KERNELINFO_FILE));
char *kconf_group = g_strdup(panda_parse_string(plugin_args, "kconf_group", DEFAULT_KERNELINFO_GROUP));
panda_free_args(plugin_args);
// Load kernel offsets.
if (read_kernelinfo(kconf_file, kconf_group, &ki) != 0) {
LOG_ERR("Failed to read kernel info from group \"%s\" of file \"%s\".", kconf_group, kconf_file);
goto error;
}
LOG_INFO("Read kernel info from group \"%s\" of file \"%s\".", kconf_group, kconf_file);
g_free(kconf_file);
g_free(kconf_group);
#if (OSI_LINUX_TEST)
panda_register_callback(self, PANDA_CB_VMI_PGD_CHANGED, pcb);
bool init_plugin(void *self) {
printf("Initializing taint plugin\n");
plugin_ptr = self;
panda_cb pcb;
panda_enable_memcb();
panda_disable_tb_chaining();
pcb.guest_hypercall = guest_hypercall_callback;
panda_register_callback(self, PANDA_CB_GUEST_HYPERCALL, pcb);
pcb.replay_handle_packet = handle_packet;
panda_register_callback(plugin_ptr, PANDA_CB_REPLAY_HANDLE_PACKET, pcb);
#ifndef CONFIG_SOFTMMU
pcb.user_after_syscall = user_after_syscall;
panda_register_callback(self, PANDA_CB_USER_AFTER_SYSCALL, pcb);
#endif
tob_io_thread = tob_new(tob_io_thread_max_size);
panda_arg_list *args = panda_get_args("taint");
int i;
if (NULL != args) {
for (i = 0; i < args->nargs; i++) {
if (0 == strncmp(args->list[i].key, "max_taintset_card", 17)) {
max_taintset_card = atoi(args->list[i].value);
printf ("max_taintset_card = %d\n", max_taintset_card);
}
if (0 == strncmp(args->list[i].key, "max_taintset_compute_number", 24)) {
max_taintset_compute_number = atoi(args->list[i].value);
printf ("max_taintset_compute_number = %d\n", max_taintset_compute_number);
}
if (0 == strncmp(args->list[i].key, "compute_is_delete", 17)) {
compute_is_delete = 1;
}
if (0 == strncmp(args->list[i].key, "label_incoming_network", 22)) {
taint_label_incoming_network_traffic = 1;
}
if (0 == strncmp(args->list[i].key, "query_outgoing_network", 22)) {
taint_query_outgoing_network_traffic = 1;
}
if (0 == strncmp(args->list[i].key, "no_tainted_pointer", 18)) {
tainted_pointer = 0;
}
if (0 == strncmp(args->list[i].key, "label_mode", 10)) {
if (0 == strncmp(args->list[i].value, "binary", 6)){
taint_label_mode = TAINT_BINARY_LABEL;
}
else if (0 == strncmp(args->list[i].value, "byte", 4)){
taint_label_mode = TAINT_BYTE_LABEL;
}
else {
printf("Invalid taint label_mode. Using default byte label.\n");
taint_label_mode = TAINT_BYTE_LABEL;
}
}
if (0 == strncmp (args->list[i].key, "tainted_instructions", 20)) {
tainted_instructions = 1;
}
}
}
if (taint_label_mode == TAINT_BYTE_LABEL){
printf("Taint: running in byte labeling mode.\n");
}
else if (taint_label_mode == TAINT_BINARY_LABEL){
printf("Taint: running in binary labeling mode.\n");
}
printf ("max_taintset_card = %d\n", max_taintset_card);
printf ("max_taintset_compute_number = %d\n", max_taintset_compute_number);
printf ("taint_label_incoming_network_traffic = %d\n",
taint_label_incoming_network_traffic);
printf ("taint_query_outgoing_network_traffic = %d\n",
taint_query_outgoing_network_traffic);
printf ("tainted_pointer = %d\n", tainted_pointer);
printf ("compute_is_delete = %d\n", compute_is_delete);
printf ("done initializing taint plugin\n");
return true;
}
bool init_plugin(void *self) {
printf("Initializing plugin file_taint\n");
#ifdef TARGET_I386
panda_cb pcb;
panda_arg_list *args;
args = panda_get_args("file_taint");
taint_filename = panda_parse_string(args, "filename", "abc123");
positional_labels = panda_parse_bool(args, "pos");
no_taint = panda_parse_bool(args, "notaint");
end_label = panda_parse_ulong(args, "max_num_labels", 1000000);
end_label = panda_parse_ulong(args, "end", end_label);
start_label = panda_parse_ulong(args, "start", 0);
enable_taint_on_open = panda_parse_bool(args, "enable_taint_on_open");
first_instr = panda_parse_uint64(args, "first_instr", 0);
taint_stdin = panda_parse_string(args, "use_stdin_for", nullptr);
printf ("taint_filename = [%s]\n", taint_filename);
printf ("positional_labels = %d\n", positional_labels);
printf ("no_taint = %d\n", no_taint);
printf ("end_label = %d\n", end_label);
printf ("first_instr = %" PRId64 " \n", first_instr);
// you must use '-os os_name' cmdline arg!
assert (!(panda_os_type == OST_UNKNOWN));
panda_require("osi");
assert(init_osi_api());
panda_require("syscalls2");
if (taint_stdin) {
printf("tainting stdin\n");
assert (panda_os_type == OST_LINUX);
}
if (panda_os_type == OST_LINUX) {
panda_require("osi_linux");
assert(init_osi_linux_api());
PPP_REG_CB("syscalls2", on_sys_open_enter, linux_open_enter);
PPP_REG_CB("syscalls2", on_sys_read_enter, linux_read_enter);
PPP_REG_CB("syscalls2", on_sys_read_return, linux_read_return);
PPP_REG_CB("syscalls2", on_sys_pread64_enter, linux_pread_enter);
PPP_REG_CB("syscalls2", on_sys_pread64_return, linux_pread_return);
}
if (panda_os_type == OST_WINDOWS) {
panda_require("wintrospection");
assert(init_wintrospection_api());
PPP_REG_CB("syscalls2", on_NtOpenFile_enter, windows_open_enter);
PPP_REG_CB("syscalls2", on_NtOpenFile_return, windows_open_return);
PPP_REG_CB("syscalls2", on_NtCreateFile_enter, windows_create_enter);
PPP_REG_CB("syscalls2", on_NtCreateFile_return, windows_create_return);
PPP_REG_CB("syscalls2", on_NtReadFile_enter, windows_read_enter);
PPP_REG_CB("syscalls2", on_NtReadFile_return, windows_read_return);
}
// this sets up the taint api fn ptrs so we have access
if (!no_taint) {
if (debug) printf("file_taint: initializing taint2 plugin\n");
panda_require("taint2");
assert(init_taint2_api());
if (!enable_taint_on_open && first_instr == 0) {
if (debug) printf("file_taint: turning on taint at replay beginning\n");
taint2_enable_taint();
}
}
if (!no_taint && first_instr > 0) {
if (debug) printf ("file_taint: turning on taint at instruction %" PRId64 "\n", first_instr);
// only need this callback if we are turning on taint late
pcb.before_block_translate = file_taint_enable;
panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_TRANSLATE, pcb);
}
pcb.before_block_exec = osi_foo;
panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb);
#else
printf ("file_taint: only works for x86 target (really just 32-bit)\n");
return false;
#endif
return true;
}
bool init_plugin(void *self) {
panda_cb pcb;
int i;
char *tblog_filename = NULL;
args = panda_get_args("sample");
if (args != NULL) {
for (i = 0; i < args->nargs; i++) {
// Format is sample:file=<file>
if (0 == strncmp(args->list[i].key, "file", 4)) {
tblog_filename = args->list[i].value;
}
else if (0 == strncmp(args->list[i].key, "easter", 9)) {
// Second parameter just to show how it's done
if (0 == strncmp(args->list[i].value, "egg", 3)) {
printf(
" _____ \n"
" .' '. \n"
" / \\\n"
"Y Y\n"
"|v^v^v^v^v^v|\n"
"|===========|\n"
"|v^v^v^v^v^v|\n"
"Y Y\n"
" \\ /\n"
" '._____.' \n");
}
}
}
}
if (!tblog_filename) {
fprintf(stderr, "Plugin 'sample' needs argument: -panda-arg sample:file=<file>\n");
return false;
}
plugin_log = fopen(tblog_filename, "w");
if(!plugin_log) return false;
// In general you should always register your callbacks last, because
// if you return false your plugin will be unloaded and there may be stale
// pointers hanging around.
pcb.guest_hypercall = guest_hypercall_callback;
panda_register_callback(self, PANDA_CB_GUEST_HYPERCALL, pcb);
pcb.after_block_exec = after_block_callback;
panda_register_callback(self, PANDA_CB_AFTER_BLOCK_EXEC, pcb);
pcb.before_block_exec = before_block_callback;
panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb);
pcb.monitor = monitor_callback;
panda_register_callback(self, PANDA_CB_MONITOR, pcb);
pcb.insn_translate = translate_callback;
panda_register_callback(self, PANDA_CB_INSN_TRANSLATE, pcb);
pcb.insn_exec = exec_callback;
panda_register_callback(self, PANDA_CB_INSN_EXEC, pcb);
#ifdef CONFIG_ANDROID
pcb.before_loadvm = before_loadvm_callback;
panda_register_callback(self, PANDA_CB_BEFORE_REPLAY_LOADVM, pcb);
#endif
return true;
}
