[panda-users] taint segmentation fault
Brendan Dolan-Gavitt
brendandg at gatech.edu
Mon Apr 20 11:32:30 EDT 2015
I will try to reproduce from those instructions in the next couple days.
Sorry for the delay! Did you post the .rr of the recording with 512M
somewhere? I only saw the 2G one.
Thanks,
Brendan
On Mon, Apr 20, 2015 at 8:07 AM, xiaojuan Li <xiaotan6666 at gmail.com> wrote:
> about the taint segfault, if you cannot download that .rr i upload before,
> you can follow the step to reproduce:
> 1)use android studio to create avd, choose api21 target android 5.0.1 use
> the default size;you can get the cache-img,sdcard.img,data.img and
> system.img and then copy kernel-qemu & rmdisk.img from sdk/systemimg;
> 2)use pandaCovert.py to convert them and get the
> (cache,data,system)-pandroid.qcow2 as well as kernel and initramfs;
> 3)use runpandroid.py(-m 512) to boot emulator;telnet and begin_record
> 4)run an app and input a string : end_record;
> 5)use qemu-system-arm to replay(-m 512) with the panda
> plugins:stringsearch,tstringsearch;tainted_instr.(the search string .txt is
> the string you input)
>
> do you guys get the segfault ?
> how can i fix it?
> Thanks a lot!
>
> 2015-04-20 17:51 GMT+08:00 xiaojuan Li <xiaotan6666 at gmail.com>:
>
>> excuse me, i have noticed that the ida_taint plugin:"win7 only but othre
>> os could be easily added".
>> i have installed ida pro in my system(debian),modified the ida_taint.bat
>> with my ida path,when i use it :./ida_taint.bat name.json qemu-system-arm
>> it failed. it seems not available in linux, is it?
>> Thanks a lot!
>>
>>
>> 2015-04-10 21:24 GMT-04:00 Brendan Dolan-Gavitt <brendandg at gatech.edu>:
>>
>> Once you have used PANDA's taint system to identify the portions of the
>>> code that process the data you're interested in, you will still have to
>>> analyze that code do understand how it works. One way to do that might be
>>> to use the scissors plugin to extract out the portion of the trace that
>>> contains the code you're interested in, and then replay it with QEMU's "-d
>>> in_asm -D asmlog.txt" options to get the disassembly for that code.
>>>
>>> Alternatively, you could take a memory snapshot at some point when the
>>> code you want to analyze is in memory (using something like the pmemsave
>>> plugin in PANDA), then use Volatility to analyze that memory image to
>>> extract out the binary, which you could look at in IDA or something similar.
>>>
>>> Basically – disassemble the code that handles the data you're interested
>>> in and find out how it works. Exactly what that means will depend on what
>>> you're hoping to accomplish.
>>>
>>> -Brendan
>>>
>>> On Fri, Apr 10, 2015 at 9:07 PM, xiaojuan Li <xiaotan6666 at gmail.com>
>>> wrote:
>>>
>>>> Hi,
>>>> Thanks for your job first.
>>>> I am a little confused about the result of the tainted.how can I get
>>>> enough information about the processing code from the binary? use the gdb?
>>>> Thanks!
>>>>
>>>> 2015-04-10 12:05 GMT+08:00 xiaojuan Li <xiaotan6666 at gmail.com>:
>>>>
>>>>> Thanks for your guys great work!
>>>>> and I will try.
>>>>>
>>>>> 2015-04-10 11:42 GMT+08:00 Brendan Dolan-Gavitt <brendandg at gatech.edu>
>>>>> :
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> Tim has just updated the tainted_instructions tutorial so that it
>>>>>> reflects how things work now. Could you look through that tutorial and see
>>>>>> if it helps with your problem?
>>>>>>
>>>>>>
>>>>>> https://github.com/moyix/panda/blob/master/docs/tainted_instructions.md
>>>>>>
>>>>>> Note that you will probably need to do a "git pull" and rebuild (make
>>>>>> clean ; ./build.sh) in order to make sure everything works as it says in
>>>>>> the tutorial.
>>>>>>
>>>>>> -Brendan
>>>>>>
>>>>>> On Thu, Apr 9, 2015 at 9:30 AM, xiaojuan Li <xiaotan6666 at gmail.com>
>>>>>> wrote:
>>>>>>
>>>>>>> Now that the panda taint.md is not fresh,can you guys give me some
>>>>>>> help?
>>>>>>> I use the replay plugin,here is my command and the result.
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> the content of pk_search_strings.txt is :"sdt"
>>>>>>>
>>>>>>> I am confused here:in the paper— Repeatable reverse with panda:
>>>>>>> :
>>>>>>> it is clear that:if I use the stringsearch and taint plugin,when it
>>>>>>> matches, the taint label will be put and then taint action will start.but
>>>>>>> when I use it, it seems wrong(the picture showed before):no taint action
>>>>>>> execute,and i am confused about the tstringsearch's result.
>>>>>>> how can i use it to analysis?
>>>>>>> Thanks a lot!
>>>>>>>
>>>>>>>
>>>>>>> 2015-04-08 10:14 GMT+08:00 xiaojuan Li <xiaotan6666 at gmail.com>:
>>>>>>>
>>>>>>>> I get the replay file by running runandroid script. and i use
>>>>>>>> qemu-system-arm command just to do some replay work.
>>>>>>>> I may not understand you at all in this emal.do you mean that i
>>>>>>>> should gdb the original program rather than the record file?
>>>>>>>> Thansk
>>>>>>>>
>>>>>>>> 2015-04-08 9:52 GMT+08:00 Brendan Dolan-Gavitt <
>>>>>>>> brendandg at gatech.edu>:
>>>>>>>>
>>>>>>>>> Hmm. gdb should normally stop when you get a segfault.
>>>>>>>>>
>>>>>>>>> Are you by any chance running PANDA using the runandroid script?
>>>>>>>>> If so, you will need to instead invoke PANDA manually, i.e.:
>>>>>>>>>
>>>>>>>>> gdb --args arm-softmmu/qemu-system-arm [...]
>>>>>>>>>
>>>>>>>>> And then once it crashes, type "bt" at the gdb prompt to get a
>>>>>>>>> backtrace.
>>>>>>>>>
>>>>>>>>> -Brendan
>>>>>>>>>
>>>>>>>>> On Tue, Apr 7, 2015 at 9:47 PM, xiaojuan Li <xiaotan6666 at gmail.com
>>>>>>>>> > wrote:
>>>>>>>>>
>>>>>>>>>> when gdb,it shows:
>>>>>>>>>> and then i see the log:it shows segfault:
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> 2015-04-08 9:03 GMT+08:00 xiaojuan Li <xiaotan6666 at gmail.com>:
>>>>>>>>>>
>>>>>>>>>>> maybe i am wrong.
>>>>>>>>>>> i use the command
>>>>>>>>>>> line:"taint2:label_mode=binary,query_outgoing_network=1"and I found that
>>>>>>>>>>> when i use taint2, after it loads panda_taint2.so,it
>>>>>>>>>>> shows:"taint2:instructed not to inline taint ops .success".
>>>>>>>>>>>
>>>>>>>>>>> 2015-04-08 8:54 GMT+08:00 xiaojuan Li <xiaotan6666 at gmail.com>:
>>>>>>>>>>>
>>>>>>>>>>>> ok.
>>>>>>>>>>>> 1.I want to use taint plugin to get information about some
>>>>>>>>>>>> functions(of course, it is closed-source),so I think I can stringsearch
>>>>>>>>>>>> potential data and then taint them and next I can locate the functions
>>>>>>>>>>>> which solves these data.
>>>>>>>>>>>>
>>>>>>>>>>>> 2.the command line I used is : stringsearch:name=***;
>>>>>>>>>>>> taint2:tainted_instructions=1.
>>>>>>>>>>>>
>>>>>>>>>>>> thanks
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> 2015-04-08 8:40 GMT+08:00 Brendan Dolan-Gavitt <
>>>>>>>>>>>> brendandg at gatech.edu>:
>>>>>>>>>>>>
>>>>>>>>>>>>> Could you provide:
>>>>>>>>>>>>>
>>>>>>>>>>>>> 1. What information you're trying to get
>>>>>>>>>>>>> 2. The command line you're using to run PANDA with the taint2
>>>>>>>>>>>>> plugin
>>>>>>>>>>>>>
>>>>>>>>>>>>> ?
>>>>>>>>>>>>>
>>>>>>>>>>>>> Right now I believe taint2 does not produce very much output
>>>>>>>>>>>>> by default. Instead you use the -pandalog <filename> command line option,
>>>>>>>>>>>>> and taint2 will write its results there in pandalog format; you can then
>>>>>>>>>>>>> read them using pandalog_reader (see panda/pandalog_reader.c for details on
>>>>>>>>>>>>> that tool).
>>>>>>>>>>>>>
>>>>>>>>>>>>> -Brendan
>>>>>>>>>>>>>
>>>>>>>>>>>>> On Tue, Apr 7, 2015 at 8:32 PM, xiaojuan Li <
>>>>>>>>>>>>> xiaotan6666 at gmail.com> wrote:
>>>>>>>>>>>>>
>>>>>>>>>>>>>> when I tried taint2,it showed the same error with taint1, the
>>>>>>>>>>>>>> olny difference is that taint2 has no segfault error,just uninit taint
>>>>>>>>>>>>>> plugin.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> 2015-04-08 8:28 GMT+08:00 Brendan Dolan-Gavitt <
>>>>>>>>>>>>>> brendandg at gatech.edu>:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Could you be a little more descriptive about how it failed?
>>>>>>>>>>>>>>> Segfault? Error message? Incorrect output?
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> -Brendan
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> On Tue, Apr 7, 2015 at 8:27 PM, xiaojuan Li <
>>>>>>>>>>>>>>> xiaotan6666 at gmail.com> wrote:
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> i tried taint2 too,it failed.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> 2015-04-07 5:20 GMT+08:00 Leek, Timothy - 0559 - MITLL <
>>>>>>>>>>>>>>>> tleek at ll.mit.edu>:
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> Also note that the “taint” plugin is somewhat defunct.
>>>>>>>>>>>>>>>>> “taint2” is the one we are actively using and developing.
>>>>>>>>>>>>>>>>> --
>>>>>>>>>>>>>>>>> Tim Leek
>>>>>>>>>>>>>>>>> Technical Staff
>>>>>>>>>>>>>>>>> Cyber System Assessments
>>>>>>>>>>>>>>>>> MIT Lincoln Laboratory
>>>>>>>>>>>>>>>>> 781-981-2975
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> From: Brendan Dolan-Gavitt <brendandg at gatech.edu>
>>>>>>>>>>>>>>>>> Date: Monday, April 6, 2015 at 5:18 PM
>>>>>>>>>>>>>>>>> To: xiaojuan Li <xiaotan6666 at gmail.com>
>>>>>>>>>>>>>>>>> Cc: "panda-users at mit.edu" <panda-users at mit.edu>
>>>>>>>>>>>>>>>>> Subject: Re: [panda-users] taint segmentation fault
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> Could you run that under gdb and provide us with a
>>>>>>>>>>>>>>>>> backtrace when it crashes?
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> -Brendan
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> On Sunday, April 5, 2015, xiaojuan Li <
>>>>>>>>>>>>>>>>> xiaotan6666 at gmail.com> wrote:
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>>>> excuse me,i have a question about taint
>>>>>>>>>>>>>>>>>> plugin:(stringsearch:name=***;taint:tainted_instructions=1)
>>>>>>>>>>>>>>>>>> when I started it showed success:
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> but when it finished search,it showd "uninit taint plugin
>>>>>>>>>>>>>>>>>> segementation fault"
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> how can I fix it?
>>>>>>>>>>>>>>>>>> Thanks a lot!
>>>>>>>>>>>>>>>>>> --
>>>>>>>>>>>>>>>>>> wait and hope~~
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> --
>>>>>>>>>>>>>>>> wait and hope~~
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> _______________________________________________
>>>>>>>>>>>>>>>> panda-users mailing list
>>>>>>>>>>>>>>>> panda-users at mit.edu
>>>>>>>>>>>>>>>> http://mailman.mit.edu/mailman/listinfo/panda-users
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --
>>>>>>>>>>>>>> wait and hope~~
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> --
>>>>>>>>>>>> wait and hope~~
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> --
>>>>>>>>>>> wait and hope~~
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> --
>>>>>>>>>> wait and hope~~
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> --
>>>>>>>> wait and hope~~
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>> wait and hope~~
>>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> wait and hope~~
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> wait and hope~~
>>>>
>>>
>>>
>>
>>
>> --
>> wait and hope~~
>>
>
>
>
> --
> wait and hope~~
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.mit.edu/pipermail/panda-users/attachments/20150420/1746dd54/attachment-0001.htm
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gdb2.png
Type: image/png
Size: 194887 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/panda-users/attachments/20150420/1746dd54/attachment-0008.png
-------------- next part --------------
A non-text attachment was scrubbed...
Name: qtainted1.png
Type: image/png
Size: 99277 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/panda-users/attachments/20150420/1746dd54/attachment-0009.png
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gdb1-2.png
Type: image/png
Size: 13244 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/panda-users/attachments/20150420/1746dd54/attachment-0010.png
-------------- next part --------------
A non-text attachment was scrubbed...
Name: qqtaint1.png
Type: image/png
Size: 25300 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/panda-users/attachments/20150420/1746dd54/attachment-0011.png
-------------- next part --------------
A non-text attachment was scrubbed...
Name: qtainted4.png
Type: image/png
Size: 90587 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/panda-users/attachments/20150420/1746dd54/attachment-0012.png
-------------- next part --------------
A non-text attachment was scrubbed...
Name: qtainted2.png
Type: image/png
Size: 118621 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/panda-users/attachments/20150420/1746dd54/attachment-0013.png
-------------- next part --------------
A non-text attachment was scrubbed...
Name: qqtaint2.png
Type: image/png
Size: 12246 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/panda-users/attachments/20150420/1746dd54/attachment-0014.png
-------------- next part --------------
A non-text attachment was scrubbed...
Name: tainted1.jpg
Type: image/jpeg
Size: 63070 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/panda-users/attachments/20150420/1746dd54/attachment-0001.jpg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: qtainted3.png
Type: image/png
Size: 106030 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/panda-users/attachments/20150420/1746dd54/attachment-0015.png
More information about the panda-users
mailing list