// hypercall-initiated taint query of some src-level extent void lava_taint_query (PandaHypercallStruct phs) { extern CPUState *cpu_single_env; CPUState *env = cpu_single_env; if (taintEnabled && (taint2_num_labels_applied() > 0)){ // okay, taint is on and some labels have actually been applied // is there *any* taint on this extent uint32_t num_tainted = 0; for (uint32_t offset=0; offset<phs.len; offset++) { uint32_t va = phs.buf + offset; uint32_t pa = panda_virt_to_phys(env, va); if ((int) pa != -1) { Addr a = make_maddr(pa); if (taint2_query(a)) { num_tainted ++; } } } if (num_tainted) { // ok at least one byte in the extent is tainted // 1. write the pandalog entry that tells us something was tainted on this extent Panda__TaintQueryHypercall *tqh = (Panda__TaintQueryHypercall *) malloc (sizeof (Panda__TaintQueryHypercall)); *tqh = PANDA__TAINT_QUERY_HYPERCALL__INIT; tqh->buf = phs.buf; tqh->len = phs.len; tqh->num_tainted = num_tainted; // obtain the actual data out of memory // NOTE: first 32 bytes only! uint32_t data[32]; uint32_t n = phs.len; if (32 < phs.len) n = 32; for (uint32_t i=0; i<n; i++) { data[i] = 0; uint8_t c; panda_virtual_memory_rw(env, phs.buf+i, &c, 1, false); data[i] = c; } tqh->n_data = n; tqh->data = data; Panda__LogEntry ple = PANDA__LOG_ENTRY__INIT; ple.taint_query_hypercall = tqh; pandalog_write_entry(&ple); free(tqh); // 2. write out src-level info lava_src_info_pandalog(phs); // 3. write out callstack info callstack_pandalog(); // 4. iterate over the bytes in the extent and pandalog detailed info about taint for (uint32_t offset=0; offset<phs.len; offset++) { uint32_t va = phs.buf + offset; uint32_t pa = panda_virt_to_phys(env, va); if ((int) pa != -1) { Addr a = make_maddr(pa); if (taint2_query(a)) { __taint2_query_pandalog(a); } } } } } }
void dd_spit(){ if (pandalog) { printf ("computing dead data and writing to pandalog\n"); } else { printf ("computing dead data and writing to stdout\n"); } uint32_t *al = taint2_labels_applied(); uint32_t n = taint2_num_labels_applied(); for (uint32_t i=0; i<n; i++) { uint32_t l = al[i]; if (dead_data.count(l) == 0) { dead_data[l] = 0; } } free(al); /* for ( auto &kvp : dde ) { uint32_t l = kvp.first; for ( auto &ins : kvp.second ) { dead_data[l] += ((float)(last_tainted_branch - ins) / denom); //dead_data[l] ++; } } */ if (pandalog) { Panda__LogEntry ple = PANDA__LOG_ENTRY__INIT; ple.n_dead_data = n; ple.dead_data = (float *) malloc(sizeof(float) * n); for (uint32_t i=0; i<n; i++) { ple.dead_data[i] = dead_data[i]; } pandalog_write_entry(&ple); } else { printf ("\n\n-----------------------------------------\n"); printf ("Dead Data Summary\n"); for ( auto &kvp : dead_data ) { uint32_t el = kvp.first; float val = kvp.second; printf ("%6d %0.2f\n", el, val); } } }
// hypercall-initiated taint query of some src-level extent void lava_taint_query (Panda__SrcInfoPri *si, target_ulong buf, target_ulong buf_len) { extern CPUState *cpu_single_env; CPUState *env = cpu_single_env; //if (pandalog && taintEnabled && (taint2_num_labels_applied() > 0)){ if (pandalog && taint2_enabled() && (taint2_num_labels_applied() > 0)){ // okay, taint is on and some labels have actually been applied // is there *any* taint on this extent uint32_t num_tainted = 0; bool is_strnlen = false; //bool is_strnlen = ((int) phs.len == -1); uint32_t offset=0; while (true) { // for (uint32_t offset=0; offset<phs.len; offset++) { uint32_t va = buf + offset; //uint32_t va = phs.buf + offset; uint32_t pa = panda_virt_to_phys(env, va); if (is_strnlen) { uint8_t c; panda_virtual_memory_rw(env, pa, &c, 1, false); // null terminator if (c==0) break; } if ((int) pa != -1) { Addr a = make_maddr(pa); if (taint2_query(a)) { num_tainted ++; } } offset ++; // end of query by length or max string length if (!is_strnlen && offset == buf_len) break; //if (!is_strnlen && offset == phs.len) break; if (is_strnlen && (offset == LAVA_TAINT_QUERY_MAX_LEN)) break; } uint32_t len = offset; if (num_tainted) { printf("logging lava query\n"); // ok at least one byte in the extent is tainted // 1. write the pandalog entry that tells us something was tainted on this extent Panda__TaintQueryPri *tqh = (Panda__TaintQueryPri *) malloc (sizeof (Panda__TaintQueryPri)); *tqh = PANDA__TAINT_QUERY_PRI__INIT; tqh->buf = buf; //tqh->buf = phs.buf; tqh->len = len; tqh->num_tainted = num_tainted; // obtain the actual data out of memory // NOTE: first X bytes only! uint32_t data[LAVA_TAINT_QUERY_MAX_LEN]; uint32_t n = len; // grab at most X bytes from memory to pandalog // this is just a snippet. we dont want to write 1M buffer if (LAVA_TAINT_QUERY_MAX_LEN < len) n = LAVA_TAINT_QUERY_MAX_LEN; for (uint32_t i=0; i<n; i++) { data[i] = 0; uint8_t c; panda_virtual_memory_rw(env, buf+i, &c, 1, false); //panda_virtual_memory_rw(env, phs.buf+i, &c, 1, false); data[i] = c; } tqh->n_data = n; tqh->data = data; // 2. write out src-level info //Panda__SrcInfoPri *si = pandalog_src_info_create(phs); tqh->src_info = si; // 3. write out callstack info Panda__CallStack *cs = pandalog_callstack_create(); tqh->call_stack = cs; // 4. iterate over the bytes in the extent and pandalog detailed info about taint std::vector<Panda__TaintQuery *> tq; for (uint32_t offset=0; offset<len; offset++) { uint32_t va = buf + offset; //uint32_t va = phs.buf + offset; uint32_t pa = panda_virt_to_phys(env, va); if ((int) pa != -1) { Addr a = make_maddr(pa); if (taint2_query(a)) { tq.push_back(taint2_query_pandalog(a, offset)); } } } tqh->n_taint_query = tq.size(); tqh->taint_query = (Panda__TaintQuery **) malloc(sizeof(Panda__TaintQuery *) * tqh->n_taint_query); for (uint32_t i=0; i<tqh->n_taint_query; i++) { tqh->taint_query[i] = tq[i]; } Panda__LogEntry ple = PANDA__LOG_ENTRY__INIT; ple.taint_query_pri = tqh; printf("about to write out taint query entry\n"); pandalog_write_entry(&ple); free(tqh->src_info); pandalog_callstack_free(tqh->call_stack); for (uint32_t i=0; i<tqh->n_taint_query; i++) { pandalog_taint_query_free(tqh->taint_query[i]); } free(tqh); } } }
// hypercall-initiated taint query of some src-level extent void lava_taint_query (PandaHypercallStruct phs) { extern CPUState *cpu_single_env; CPUState *env = cpu_single_env; if (pandalog && taintEnabled && (taint2_num_labels_applied() > 0)){ // okay, taint is on and some labels have actually been applied // is there *any* taint on this extent uint32_t num_tainted = 0; for (uint32_t offset=0; offset<phs.len; offset++) { uint32_t va = phs.buf + offset; uint32_t pa = panda_virt_to_phys(env, va); if ((int) pa != -1) { Addr a = make_maddr(pa); if (taint2_query(a)) { num_tainted ++; } } } if (num_tainted) { // ok at least one byte in the extent is tainted // 1. write the pandalog entry that tells us something was tainted on this extent Panda__TaintQueryHypercall *tqh = (Panda__TaintQueryHypercall *) malloc (sizeof (Panda__TaintQueryHypercall)); *tqh = PANDA__TAINT_QUERY_HYPERCALL__INIT; tqh->buf = phs.buf; tqh->len = phs.len; tqh->num_tainted = num_tainted; // obtain the actual data out of memory // NOTE: first 32 bytes only! uint32_t data[32]; uint32_t n = phs.len; // grab at most 32 bytes from memory to pandalog // this is just a snippet. we dont want to write 1M buffer if (32 < phs.len) n = 32; for (uint32_t i=0; i<n; i++) { data[i] = 0; uint8_t c; panda_virtual_memory_rw(env, phs.buf+i, &c, 1, false); data[i] = c; } tqh->n_data = n; tqh->data = data; // 2. write out src-level info Panda__SrcInfo *si = pandalog_src_info_create(phs); tqh->src_info = si; // 3. write out callstack info Panda__CallStack *cs = pandalog_callstack_create(); tqh->call_stack = cs; // 4. iterate over the bytes in the extent and pandalog detailed info about taint std::vector<Panda__TaintQuery *> tq; for (uint32_t offset=0; offset<phs.len; offset++) { uint32_t va = phs.buf + offset; uint32_t pa = panda_virt_to_phys(env, va); if ((int) pa != -1) { Addr a = make_maddr(pa); if (taint2_query(a)) { tq.push_back(__taint2_query_pandalog(a, offset)); } } } tqh->n_taint_query = tq.size(); tqh->taint_query = (Panda__TaintQuery **) malloc(sizeof(Panda__TaintQuery *) * tqh->n_taint_query); for (uint32_t i=0; i<tqh->n_taint_query; i++) { tqh->taint_query[i] = tq[i]; } Panda__LogEntry ple = PANDA__LOG_ENTRY__INIT; ple.taint_query_hypercall = tqh; pandalog_write_entry(&ple); free(tqh->src_info); pandalog_callstack_free(tqh->call_stack); for (uint32_t i=0; i<tqh->n_taint_query; i++) { __pandalog_taint_query_free(tqh->taint_query[i]); } free(tqh); } } }
/** * @brief Hypercall-initiated taint query of some src-level extent. */ void taint_query_hypercall(PandaHypercallStruct phs) { CPUState *cpu = first_cpu; if (pandalog && taintEnabled && (taint2_num_labels_applied() > 0)) { // okay, taint is on and some labels have actually been applied // is there *any* taint on this extent uint32_t num_tainted = 0; bool is_strnlen = ((int) phs.len == -1); uint32_t offset=0; while (true) { uint32_t va = phs.buf + offset; uint32_t pa = panda_virt_to_phys(cpu, va); if (is_strnlen) { uint8_t c; panda_virtual_memory_rw(cpu, pa, &c, 1, false); // null terminator if (c==0) break; } if ((int) pa != -1) { Addr a = make_maddr(pa); if (taint2_query(a)) { num_tainted ++; } } offset ++; // end of query by length or max string length if (!is_strnlen && offset == phs.len) break; if (is_strnlen && (offset == QUERY_HYPERCALL_MAX_LEN)) break; } uint32_t len = offset; if (num_tainted) { // ok at least one byte in the extent is tainted // 1. write the pandalog entry that tells us something was tainted on this extent Panda__TaintQueryHypercall *tqh = (Panda__TaintQueryHypercall *) malloc (sizeof (Panda__TaintQueryHypercall)); *tqh = PANDA__TAINT_QUERY_HYPERCALL__INIT; tqh->buf = phs.buf; tqh->len = len; tqh->num_tainted = num_tainted; // obtain the actual data out of memory // NOTE: first X bytes only! uint32_t data[QUERY_HYPERCALL_MAX_LEN]; uint32_t n = len; // grab at most X bytes from memory to pandalog // this is just a snippet. we dont want to write 1M buffer if (QUERY_HYPERCALL_MAX_LEN < len) n = QUERY_HYPERCALL_MAX_LEN; for (uint32_t i=0; i<n; i++) { data[i] = 0; uint8_t c; panda_virtual_memory_rw(cpu, phs.buf+i, &c, 1, false); data[i] = c; } tqh->n_data = n; tqh->data = data; // 2. write out src-level info Panda__SrcInfo *si = pandalog_src_info_create(phs); tqh->src_info = si; // 3. write out callstack info Panda__CallStack *cs = pandalog_callstack_create(); tqh->call_stack = cs; std::vector<Panda__TaintQuery *> tq; for (uint32_t offset=0; offset<len; offset++) { uint32_t va = phs.buf + offset; uint32_t pa = panda_virt_to_phys(cpu, va); if ((int) pa != -1) { Addr a = make_maddr(pa); if (taint2_query(a)) { tq.push_back(taint2_query_pandalog(a, offset)); } } } tqh->n_taint_query = tq.size(); tqh->taint_query = (Panda__TaintQuery **) malloc(sizeof(Panda__TaintQuery *) * tqh->n_taint_query); for (uint32_t i=0; i<tqh->n_taint_query; i++) { tqh->taint_query[i] = tq[i]; } Panda__LogEntry ple = PANDA__LOG_ENTRY__INIT; ple.taint_query_hypercall = tqh; pandalog_write_entry(&ple); free(tqh->src_info); pandalog_callstack_free(tqh->call_stack); for (uint32_t i=0; i<tqh->n_taint_query; i++) { pandalog_taint_query_free(tqh->taint_query[i]); } free(tqh); } } }