bool init_plugin(void *self) { panda_cb pcb; printf("Initializing plugin memstrings\n"); panda_arg_list *args = panda_get_args("memstrings"); const char *prefix = panda_parse_string(args, "name", "memstrings"); min_strlen = panda_parse_ulong(args, "len", 4); char matchfile[128] = {}; sprintf(matchfile, "%s_strings.txt.gz", prefix); mem_report = gzopen(matchfile, "w"); if(!mem_report) { printf("Couldn't write report:\n"); perror("fopen"); return false; } // Need this to get EIP with our callbacks panda_enable_precise_pc(); // Enable memory logging panda_enable_memcb(); pcb.virt_mem_write = mem_write_callback; panda_register_callback(self, PANDA_CB_VIRT_MEM_WRITE, pcb); pcb.virt_mem_read = mem_read_callback; panda_register_callback(self, PANDA_CB_VIRT_MEM_READ, pcb); return true; }
bool init_plugin(void *self) { printf("Initializing taint plugin\n"); plugin_ptr = self; panda_cb pcb; panda_enable_memcb(); panda_disable_tb_chaining(); pcb.guest_hypercall = guest_hypercall_callback; panda_register_callback(self, PANDA_CB_GUEST_HYPERCALL, pcb); pcb.before_block_exec_invalidate_opt = before_block_exec_invalidate_opt; panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC_INVALIDATE_OPT, pcb); /* pcb.replay_handle_packet = handle_packet; panda_register_callback(plugin_ptr, PANDA_CB_REPLAY_HANDLE_PACKET, pcb); */ panda_arg_list *args = panda_get_args("taint2"); tainted_pointer = !panda_parse_bool(args, "no_tp"); inline_taint = panda_parse_bool(args, "inline"); if (inline_taint) { printf("taint2: Inlining taint ops by default.\n"); } else { printf("taint2: Instructed not to inline taint ops.\n"); } if (panda_parse_bool(args, "binary")) mode = TAINT_BINARY_LABEL; if (panda_parse_bool(args, "word")) granularity = TAINT_GRANULARITY_WORD; optimize_llvm = panda_parse_bool(args, "opt"); panda_require("callstack_instr"); assert(init_callstack_instr_api()); return true; }
bool init_plugin(void *self) { #if defined(TARGET_I386) if (cs_open(CS_ARCH_X86, CS_MODE_32, &cs_handle_32) != CS_ERR_OK) #if defined(TARGET_X86_64) if (cs_open(CS_ARCH_X86, CS_MODE_64, &cs_handle_64) != CS_ERR_OK) #endif #elif defined(TARGET_ARM) if (cs_open(CS_ARCH_ARM, CS_MODE_ARM, &cs_handle_32) != CS_ERR_OK) #elif defined(TARGET_PPC) if (cs_open(CS_ARCH_PPC, CS_MODE_32, &cs_handle_32) != CS_ERR_OK) #endif return false; // Need details in capstone to have instruction groupings cs_option(cs_handle_32, CS_OPT_DETAIL, CS_OPT_ON); #if defined(TARGET_X86_64) cs_option(cs_handle_64, CS_OPT_DETAIL, CS_OPT_ON); #endif panda_cb pcb; panda_enable_memcb(); panda_enable_precise_pc(); pcb.after_block_translate = after_block_translate; panda_register_callback(self, PANDA_CB_AFTER_BLOCK_TRANSLATE, pcb); pcb.after_block_exec = after_block_exec; panda_register_callback(self, PANDA_CB_AFTER_BLOCK_EXEC, pcb); pcb.before_block_exec = before_block_exec; panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb); return true; }
bool init_plugin(void *self) { printf("Initializing taint plugin\n"); plugin_ptr = self; panda_cb pcb; panda_enable_memcb(); panda_disable_tb_chaining(); pcb.guest_hypercall = guest_hypercall_callback; panda_register_callback(self, PANDA_CB_GUEST_HYPERCALL, pcb); #ifndef CONFIG_SOFTMMU pcb.user_after_syscall = user_after_syscall; panda_register_callback(self, PANDA_CB_USER_AFTER_SYSCALL, pcb); #endif return true; }
bool init_plugin(void *self) { panda_cb pcb; printf("Initializing plugin tapindex\n"); // Need this to get EIP with our callbacks panda_enable_precise_pc(); // Enable memory logging panda_enable_memcb(); pcb.virt_mem_read = mem_read_callback; panda_register_callback(self, PANDA_CB_VIRT_MEM_READ, pcb); pcb.virt_mem_write = mem_write_callback; panda_register_callback(self, PANDA_CB_VIRT_MEM_WRITE, pcb); return true; }
bool init_plugin(void *self) { panda_cb pcb; printf("Initializing plugin correlatetaps\n"); if(!init_callstack_instr_api()) return false; // Need this to get EIP with our callbacks panda_enable_precise_pc(); // Enable memory logging panda_enable_memcb(); pcb.virt_mem_write = mem_write_callback; panda_register_callback(self, PANDA_CB_VIRT_MEM_WRITE, pcb); return true; }
bool init_plugin(void *self) { printf("Initializing plugin llvm_trace\n"); // Look for llvm_trace:base=dir for (int i = 0; i < panda_argc; i++) { if(0 == strncmp(panda_argv[i], "llvm_trace", 10)) { basedir = strrchr(panda_argv[i], '='); if (basedir) basedir++; // advance past '=' } } if (basedir == NULL) { basedir = default_basedir; } if (tubtf_on) { char tubtf_path[256]; strcpy(tubtf_path, basedir); strcat(tubtf_path, "/tubtf.log"); tubtf_open(tubtf_path, TUBTF_COLW_64); panda_enable_precise_pc(); } else { // XXX: unsafe string manipulations char memlog_path[256]; char funclog_path[256]; strcpy(memlog_path, basedir); strcat(memlog_path, "/llvm-memlog.log"); open_memlog(memlog_path); strcpy(funclog_path, basedir); strcat(funclog_path, "/llvm-functions.log"); funclog = fopen(funclog_path, "w"); } panda_cb pcb; panda_enable_memcb(); pcb.before_block_exec = before_block_exec; panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb); pcb.after_block_exec = after_block_exec; panda_register_callback(self, PANDA_CB_AFTER_BLOCK_EXEC, pcb); pcb.phys_mem_read = phys_mem_read_callback; panda_register_callback(self, PANDA_CB_PHYS_MEM_READ, pcb); pcb.phys_mem_write = phys_mem_write_callback; panda_register_callback(self, PANDA_CB_PHYS_MEM_WRITE, pcb); pcb.cb_cpu_restore_state = cb_cpu_restore_state; panda_register_callback(self, PANDA_CB_CPU_RESTORE_STATE, pcb); #ifndef CONFIG_SOFTMMU pcb.user_after_syscall = user_after_syscall; panda_register_callback(self, PANDA_CB_USER_AFTER_SYSCALL, pcb); #endif if (!execute_llvm){ panda_enable_llvm(); } llvm::llvm_init(); panda_enable_llvm_helpers(); /* * Run instrumentation pass over all helper functions that are now in the * module, and verify module. */ llvm::Module *mod = tcg_llvm_ctx->getModule(); for (llvm::Module::iterator i = mod->begin(); i != mod->end(); i++){ if (i->isDeclaration()){ continue; } PIFP->runOnFunction(*i); } std::string err; if(verifyModule(*mod, llvm::AbortProcessAction, &err)){ printf("%s\n", err.c_str()); exit(1); } return true; }
bool init_plugin(void *self) { printf("Initializing taint plugin\n"); plugin_ptr = self; panda_cb pcb; panda_enable_memcb(); panda_disable_tb_chaining(); pcb.guest_hypercall = guest_hypercall_callback; panda_register_callback(self, PANDA_CB_GUEST_HYPERCALL, pcb); pcb.replay_handle_packet = handle_packet; panda_register_callback(plugin_ptr, PANDA_CB_REPLAY_HANDLE_PACKET, pcb); #ifndef CONFIG_SOFTMMU pcb.user_after_syscall = user_after_syscall; panda_register_callback(self, PANDA_CB_USER_AFTER_SYSCALL, pcb); #endif tob_io_thread = tob_new(tob_io_thread_max_size); panda_arg_list *args = panda_get_args("taint"); int i; if (NULL != args) { for (i = 0; i < args->nargs; i++) { if (0 == strncmp(args->list[i].key, "max_taintset_card", 17)) { max_taintset_card = atoi(args->list[i].value); printf ("max_taintset_card = %d\n", max_taintset_card); } if (0 == strncmp(args->list[i].key, "max_taintset_compute_number", 24)) { max_taintset_compute_number = atoi(args->list[i].value); printf ("max_taintset_compute_number = %d\n", max_taintset_compute_number); } if (0 == strncmp(args->list[i].key, "compute_is_delete", 17)) { compute_is_delete = 1; } if (0 == strncmp(args->list[i].key, "label_incoming_network", 22)) { taint_label_incoming_network_traffic = 1; } if (0 == strncmp(args->list[i].key, "query_outgoing_network", 22)) { taint_query_outgoing_network_traffic = 1; } if (0 == strncmp(args->list[i].key, "no_tainted_pointer", 18)) { tainted_pointer = 0; } if (0 == strncmp(args->list[i].key, "label_mode", 10)) { if (0 == strncmp(args->list[i].value, "binary", 6)){ taint_label_mode = TAINT_BINARY_LABEL; } else if (0 == strncmp(args->list[i].value, "byte", 4)){ taint_label_mode = TAINT_BYTE_LABEL; } else { printf("Invalid taint label_mode. Using default byte label.\n"); taint_label_mode = TAINT_BYTE_LABEL; } } if (0 == strncmp (args->list[i].key, "tainted_instructions", 20)) { tainted_instructions = 1; } } } if (taint_label_mode == TAINT_BYTE_LABEL){ printf("Taint: running in byte labeling mode.\n"); } else if (taint_label_mode == TAINT_BINARY_LABEL){ printf("Taint: running in binary labeling mode.\n"); } printf ("max_taintset_card = %d\n", max_taintset_card); printf ("max_taintset_compute_number = %d\n", max_taintset_compute_number); printf ("taint_label_incoming_network_traffic = %d\n", taint_label_incoming_network_traffic); printf ("taint_query_outgoing_network_traffic = %d\n", taint_query_outgoing_network_traffic); printf ("tainted_pointer = %d\n", tainted_pointer); printf ("compute_is_delete = %d\n", compute_is_delete); printf ("done initializing taint plugin\n"); return true; }
bool init_plugin(void *self) { printf("Initializing taint plugin\n"); panda_cb pcb; panda_enable_memcb(); panda_disable_tb_chaining(); pcb.before_block_exec = before_block_exec; panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb); pcb.after_block_exec = after_block_exec; panda_register_callback(self, PANDA_CB_AFTER_BLOCK_EXEC, pcb); pcb.phys_mem_read = phys_mem_read_callback; panda_register_callback(self, PANDA_CB_PHYS_MEM_READ, pcb); pcb.phys_mem_write = phys_mem_write_callback; panda_register_callback(self, PANDA_CB_PHYS_MEM_WRITE, pcb); pcb.cb_cpu_restore_state = cb_cpu_restore_state; panda_register_callback(self, PANDA_CB_CPU_RESTORE_STATE, pcb); pcb.guest_hypercall = guest_hypercall_callback; panda_register_callback(self, PANDA_CB_GUEST_HYPERCALL, pcb); #ifndef CONFIG_SOFTMMU pcb.user_after_syscall = user_after_syscall; panda_register_callback(self, PANDA_CB_USER_AFTER_SYSCALL, pcb); #endif if (!execute_llvm){ panda_enable_llvm(); } llvm::llvm_init(); panda_enable_llvm_helpers(); /* * Run instrumentation pass over all helper functions that are now in the * module, and verify module. */ llvm::Module *mod = tcg_llvm_ctx->getModule(); for (llvm::Module::iterator i = mod->begin(); i != mod->end(); i++){ if (i->isDeclaration()){ continue; } PIFP->runOnFunction(*i); } std::string err; if(verifyModule(*mod, llvm::AbortProcessAction, &err)){ printf("%s\n", err.c_str()); exit(1); } /* * Taint processor initialization */ //uint32_t ram_size = 536870912; // 500MB each #ifdef TARGET_X86_64 // this is only for the fast bitmap which we currently aren't using for // 64-bit, it only supports 32-bit uint64_t ram_size = 0; #else uint32_t ram_size = 0xffffffff; //guest address space -- QEMU user mode #endif uint64_t hd_size = 536870912; uint64_t io_size = 536870912; uint16_t num_vals = 2000; // LLVM virtual registers shadow = tp_init(hd_size, ram_size, io_size, num_vals); if (shadow == NULL){ printf("Error initializing shadow memory...\n"); exit(1); } taintfpm = new llvm::FunctionPassManager(tcg_llvm_ctx->getModule()); // Add the taint analysis pass to our taint pass manager llvm::FunctionPass *taintfp = llvm::createPandaTaintFunctionPass(15*1048576/* global taint op buffer size, 10MB */, NULL /* existing taint cache */); PTFP = static_cast<llvm::PandaTaintFunctionPass*>(taintfp); taintfpm->add(taintfp); taintfpm->doInitialization(); // Populate taint cache with helper function taint ops for (llvm::Module::iterator i = mod->begin(); i != mod->end(); i++){ if (i->isDeclaration()){ continue; } PTFP->runOnFunction(*i); } return true; }