Flayer & LibFLayer
Will Drewry <wad@gmail.com>, Tavis Ormandy <taviso@gmail.com>
Copyright 2007 Google Inc.

DISCLAIMER
----------

This software is a proof of concept.  It is not pretty, but it is functional.
Use at your own risk.  If you'd like to make it better, submit patches and
feedback!


License
-------

All included source, unless otherwise noted, is released on the GPL version 2.
See docs/COPYING for details.

Quick summary
-------------

Flayer is a valgrind plugin   It implements taint tracing and throws
information errors when tainted information is used in a conditional or system
call.  In addition, strlen, strcmp, and other string/memory-related functions
will also throw a "client check" error where forced tainting is used to taint
the output of those functions.

Using this output, Flayer can forcibly bypass conditional jumps and/or step
over function calls.

  $ valgrind --tool=flayer --help
    ......
    ......
    User options for Flayer:
    --alter-fn=0xADDR1:1,...         Inserts a forced jump over the function
                                     called from the given address and sets EAX
                                     to the 32-bit value.
    --taint-string=somestr           Taint bytes read() that match the string
    --alter-branch=0xADDR1:1,...     instrument branches (Ist_Exit) guards
                                     given addresses changing them to 1 or 0
    --taint-stdin=no|yes             enables stdin tainting [no]
    --taint-file=no|yes              enables file tainting [no]
    --taint-network=no|yes           enables network tainting [no]
    --file-filter=/path/prefix       enforces tainting on any files under
                                     the given prefix. []
    --verbose-instrumentation=no|yes enables verbose translation logging [no]




Installing Flayer
------------

If you check out the source from subversion, you can build by running:

  ./configure &&  make &&  make install

Despite valgrind supporting multiple architectures, currently Flayer only works
with 32-bit x86 code.  This is due to the system call wrapping code.  If you'd
like to submit a patch to add more platforms, better system call coverage, or
use of the valgrind syswrap code, please drop me a mail!


Using LibFlayer
---------------

Currently, there is no installer for LibFlayer.  Feel free to send a patch!

Until then, you can try it out by setting your PYTHONPATH. E.g.,

  PYTHONPATH=/opt/libflayer /opt/libflayer/examples/flayersh