<div dir="ltr"><div><div>actually, i have increased my memory to 16G, if I use 512 to record and replay, it killed;if i use 256 to record and replay, first time it killed, but second try it succeed (showing below). I just think it is unstable, as for the reason, i am trying to find.<br></div>Thanks for your reply very much!<br></div>sorry for troubling you so long time!<br><div><div><br><br>READ Match of str 0 at: instr_count=5180266230 : 72a7562e b6c79a2a 00c04000<br>tstringsearch: thestring = [passwordisqemu]<br>tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75 <br>tstringsearch: string in memory @ 0xa49002da<br><br>****************************************************************************<br>applying taint labels to search string of length 14 @ p=0xa49002da<br>******************************************************************************<br>api214-20-256: 5244538335 ( 75.00%) instrs. 4643.72 sec. 6.58 GB ram.<br>api214-20-256: 5316190227 ( 76.03%) instrs. 4988.98 sec. 6.60 GB ram.<br>api214-20-256: 5386319700 ( 77.03%) instrs. 5363.67 sec. 6.60 GB ram.<br>api214-20-256: 5456115383 ( 78.03%) instrs. 5714.12 sec. 6.60 GB ram.<br>api214-20-256: 5524071341 ( 79.00%) instrs. 6039.86 sec. 6.62 GB ram.<br>api214-20-256: 5594009950 ( 80.00%) instrs. 6392.84 sec. 6.62 GB ram.<br>api214-20-256: 5665215324 ( 81.02%) instrs. 6760.18 sec. 6.62 GB ram.<br>api214-20-256: 5735561744 ( 82.02%) instrs. 7122.95 sec. 6.62 GB ram.<br>api214-20-256: 5803941321 ( 83.00%) instrs. 7475.05 sec. 6.62 GB ram.<br>api214-20-256: 5874989410 ( 84.02%) instrs. 7839.22 sec. 6.62 GB ram.<br>api214-20-256: 5945687287 ( 85.03%) instrs. 8201.84 sec. 6.62 GB ram.<br>api214-20-256: 6016246771 ( 86.04%) instrs. 8566.35 sec. 6.63 GB ram.<br>api214-20-256: 6086895413 ( 87.05%) instrs. 8929.06 sec. 6.63 GB ram.<br>api214-20-256: 6153429632 ( 88.00%) instrs. 9264.48 sec. 6.65 GB ram.<br>api214-20-256: 6225320269 ( 89.03%) instrs. 9730.16 sec. 6.72 GB ram.<br>api214-20-256: 6293245468 ( 90.00%) instrs. 10102.98 sec. 6.72 GB ram.<br>api214-20-256: 6364596059 ( 91.02%) instrs. 10468.66 sec. 6.72 GB ram.<br>api214-20-256: 6436068665 ( 92.04%) instrs. 10837.40 sec. 6.72 GB ram.<br>api214-20-256: 6503270471 ( 93.00%) instrs. 11192.30 sec. 6.72 GB ram.<br>api214-20-256: 6574434672 ( 94.02%) instrs. 11558.97 sec. 6.72 GB ram.<br>api214-20-256: 6644627703 ( 95.03%) instrs. 11920.98 sec. 6.72 GB ram.<br>api214-20-256: 6715490334 ( 96.04%) instrs. 12288.82 sec. 6.72 GB ram.<br>api214-20-256: 6783347812 ( 97.01%) instrs. 12631.31 sec. 6.72 GB ram.<br>api214-20-256: 6853231196 ( 98.01%) instrs. 12984.73 sec. 6.72 GB ram.<br>api214-20-256: 6922569909 ( 99.00%) instrs. 13338.83 sec. 6.72 GB ram.<br>/home/shentanli/pandanew/scripts/api214-20-256-rr-nondet.log: log is empty.<br>Replay completed successfully.<br>Time taken was: 13702 seconds.<br>Stats:<br>RR_INPUT_1 number = 818, size = 22086 bytes<br>RR_INPUT_2 number = 303, size = 8484 bytes<br>RR_INPUT_4 number = 757989, size = 22739670 bytes<br>RR_INPUT_8 number = 0, size = 0 bytes<br>RR_INTERRUPT_REQUEST number = 1756538, size = 49183064 bytes<br>RR_EXIT_REQUEST number = 0, size = 0 bytes<br>RR_SKIPPED_CALL number = 453631, size = 254126959 bytes<br>RR_DEBUG number = 0, size = 0 bytes<br>max_queue_len = 769<br>768 items on recycle list, 67584 bytes total<br>Replay completed successfully.<br><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-04-21 16:26 GMT-04:00 Brendan Dolan-Gavitt <span dir="ltr"><<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">This is because your system is running out of memory, and so the<br>
kernel is killing the process so the system doesn't crash (as you can<br>
see it's using 10.68 GB ram when it crashes, and your system only has<br>
8GB available). You can verify this by looking at the output of<br>
"dmesg".<br>
<br>
I'm not sure what else you can do, unfortunately (aside from running<br>
this on a system with more RAM). It's possible you can modify the<br>
taint plugin to use less memory (for example, by removing the taint<br>
compute number tracking), but that's not something I have time to help<br>
with at the moment. You'd have to read and understand the taint2<br>
plugin code.<br>
<span class="HOEnZb"><font color="#888888"><br>
-Brendan<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
On Tue, Apr 21, 2015 at 5:40 AM, xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>> wrote:<br>
> and when i record and replay with 256M,it just killed...:<br>
> ****************************************************************************<br>
> applying taint labels to search string of length 14 @ p=0xa73aebab<br>
> ******************************************************************************<br>
> api214-20-256: <a href="tel:4405812542" value="+14405812542">4405812542</a> ( 63.01%) instrs. 750.04 sec. 10.68 GB ram.<br>
> Killed<br>
><br>
><br>
><br>
> 2015-04-21 3:29 GMT-04:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>>:<br>
><br>
>> HI Brendan, if you run continue do you encounter this?<br>
>><br>
>> ****************************************************************************<br>
>> applying taint labels to search string of length 14 @ p=0xa62e82dd<br>
>><br>
>> ******************************************************************************<br>
>> api414-4-20: 2737044888 ( 35.04%) instrs. 1943.11 sec. 14.51 GB ram.<br>
>> terminate called after throwing an instance of 'std::bad_alloc'<br>
>> what(): std::bad_alloc<br>
>> Aborted<br>
>><br>
>> i use the gdb to check the core dump,it shows:<br>
>> Program terminated with signal 6, Aborted.<br>
>> #0 0x00007fdb33f80165 in raise () from /lib/x86_64-linux-gnu/libc.so.6<br>
>><br>
>> seems caused malloc().<br>
>><br>
>><br>
>><br>
>><br>
>> 2015-04-21 1:18 GMT-04:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>>:<br>
>><br>
>>> Thanks for your patience very much and your great work!<br>
>>> now i can use the taint plugin(but it seems a little slow) and take my<br>
>>> next step.<br>
>>><br>
>>> 2015-04-21 12:04 GMT+08:00 Brendan Dolan-Gavitt <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>><br>
>>>> Ok! Another option is to try making a recording with only 256M of RAM,<br>
>>>> which would need only 4GB to replay.<br>
>>>><br>
>>>> One last thing you can try – it is possible that the taint system will<br>
>>>> not actually use all of the memory it allocates. In this case, if you<br>
>>>> allow the kernel to overcommit memory it may succeed. You can do this<br>
>>>> either by setting /proc/sys/vm/overcommit_memory to 1 or by setting<br>
>>>> /proc/sys/vm/overcommit_ratio to a higher value. There are more<br>
>>>> details about this feature here:<br>
>>>> <a href="https://www.kernel.org/doc/Documentation/vm/overcommit-accounting" target="_blank">https://www.kernel.org/doc/Documentation/vm/overcommit-accounting</a><br>
>>>><br>
>>>> -Brendan<br>
>>>><br>
>>>><br>
>>>> On Mon, Apr 20, 2015 at 11:54 PM, xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>><br>
>>>> wrote:<br>
>>>> > sorry i make a mistake: my ram size is:<br>
>>>> > (free -g)<br>
>>>> > total used free shared buffers<br>
>>>> > cached<br>
>>>> > Mem: 7 6 1 0 0<br>
>>>> > 2<br>
>>>> > -/+ buffers/cache: 3 4<br>
>>>> > Swap: 0 0 0<br>
>>>> ><br>
>>>> > before i mistake the size of hardware...<br>
>>>> ><br>
>>>> > there is unlimit.<br>
>>>> > I think i should increase the memory chips.<br>
>>>> > Thanks !<br>
>>>> ><br>
>>>> > 2015-04-20 23:36 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> > <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>> ><br>
>>>> >> It is still not able to allocate the memory for the taint system, it<br>
>>>> >> seems (based on the "Cannot allocate memory" part). Since you said<br>
>>>> >> your host system has 16GB of RAM, I'm not sure what else could be the<br>
>>>> >> problem.<br>
>>>> >><br>
>>>> >> Do you have any memory quota set up on your system? (for example,<br>
>>>> >> does<br>
>>>> >> "ulimit -v" show any limits on the amount of memory you're allowed to<br>
>>>> >> allocate in a single process?)<br>
>>>> >><br>
>>>> >> -Brendan<br>
>>>> >><br>
>>>> >> On Mon, Apr 20, 2015 at 11:28 PM, xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>><br>
>>>> >> wrote:<br>
>>>> >> > use the new version, but still segfault :(<br>
>>>> >> ><br>
>>>> >> > opening nondet log for read :<br>
>>>> >> > /home/shentanli/pandanew/scripts/api414-4-20-rr-nondet.log<br>
>>>> >> > api414-4-20: 81316759 ( 1.04%) instrs. 7.49 sec. 0.61 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 156342747 ( 2.00%) instrs. 16.14 sec. 0.69 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 234368551 ( 3.00%) instrs. 25.29 sec. 0.76 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 312493247 ( 4.00%) instrs. 36.09 sec. 0.83 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 390616091 ( 5.00%) instrs. 44.62 sec. 0.87 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 468738195 ( 6.00%) instrs. 50.08 sec. 0.90 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 547631582 ( 7.01%) instrs. 54.95 sec. 0.93 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 624983872 ( 8.00%) instrs. 58.64 sec. 0.94 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 703122355 ( 9.00%) instrs. 61.98 sec. 0.94 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 783198179 ( 10.03%) instrs. 65.80 sec. 0.95 GB<br>
>>>> >> > ram.<br>
>>>> >> > READ Match of str 0 at: instr_count=812336749 : 72a7562e b6cb2e02<br>
>>>> >> > 0d36c000<br>
>>>> >> > tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> > tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> > tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> > enabling taint at instr count 812336749<br>
>>>> >> > taint2: __taint_enable_taint<br>
>>>> >> > taint2: Creating byte-level taint processor<br>
>>>> >> > taint2: Allocating large fast_shad (8589934592 bytes).<br>
>>>> >> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> > Cannot allocate memory<br>
>>>> >> > taint2: Allocating small fast_shad (12800000 bytes) using malloc @<br>
>>>> >> > 7f38ff62e010.<br>
>>>> >> > taint2: Allocating small fast_shad (256 bytes) using malloc @<br>
>>>> >> > 17cda900.<br>
>>>> >> > taint2: Allocating small fast_shad (1024 bytes) using malloc @<br>
>>>> >> > 17cd91f0.<br>
>>>> >> > taint2: Allocating small fast_shad (867840 bytes) using malloc @<br>
>>>> >> > 17d24e70.<br>
>>>> >> > taint2: Linking taint ops from<br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_taint2_ops.bc<br>
>>>> >> > taint2: Done initializing taint transformation.<br>
>>>> >> > taint2: Done processing helper functions for taint.<br>
>>>> >> > taint2: Done verifying module. Running...<br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> > ****************************************************************************<br>
>>>> >> > applying taint labels to search string of length 14 @ p=0xa70d6212<br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> > ******************************************************************************<br>
>>>> >> > Segmentation fault<br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> > 2015-04-20 23:18 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> >> > <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>> >> ><br>
>>>> >> >> That was caused by some code that was left in by mistake from<br>
>>>> >> >> another<br>
>>>> >> >> branch of the project. I have fixed it and pushed the change. Once<br>
>>>> >> >> again you will need to do git pull && make clean && ./build.sh to<br>
>>>> >> >> rebuild.<br>
>>>> >> >><br>
>>>> >> >> Hopefully this will fix things for you!<br>
>>>> >> >><br>
>>>> >> >> -Brendan<br>
>>>> >> >><br>
>>>> >> >> On Mon, Apr 20, 2015 at 11:11 PM, xiaojuan Li<br>
>>>> >> >> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>><br>
>>>> >> >> wrote:<br>
>>>> >> >> > it is the path that caused terminated.<br>
>>>> >> >> > i can find that panda_hypercall_struct.h in<br>
>>>> >> >> > /qemu/panda_tools/pirate_utils/linux direcroty<br>
>>>> >> >> ><br>
>>>> >> >> > 2015-04-20 23:02 GMT-04:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> ><br>
>>>> >> >> >> while rebuild:<br>
>>>> >> >> >> taint2.cpp:109:61: fatal error:<br>
>>>> >> >> >> ../../../../lava/include/panda_hypercall_struct.h: No such file<br>
>>>> >> >> >> or<br>
>>>> >> >> >> directory<br>
>>>> >> >> >> compilation terminated.<br>
>>>> >> >> >> miss some files to push?<br>
>>>> >> >> >><br>
>>>> >> >> >><br>
>>>> >> >> >> 2015-04-20 22:56 GMT-04:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >><br>
>>>> >> >> >>> you mean that it caused by "allocate at a fixed address"<br>
>>>> >> >> >>> i am going to try and thanks.<br>
>>>> >> >> >>><br>
>>>> >> >> >>> 2015-04-20 22:53 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>> <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>><br>
>>>> >> >> >>>> Ah! I forgot to push the commit I made to stop it from trying<br>
>>>> >> >> >>>> to<br>
>>>> >> >> >>>> allocate at a fixed address.<br>
>>>> >> >> >>>><br>
>>>> >> >> >>>> Could you do a git pull, rebuild, and try again?<br>
>>>> >> >> >>>><br>
>>>> >> >> >>>> -Brendan<br>
>>>> >> >> >>>><br>
>>>> >> >> >>>> On Mon, Apr 20, 2015 at 10:51 PM, xiaojuan Li<br>
>>>> >> >> >>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> wrote:<br>
>>>> >> >> >>>> > 1. the command i use is :<br>
>>>> >> >> >>>> > ./qemu-system-arm 0m 512 -replay api414-4-20 -M android_arm<br>
>>>> >> >> >>>> > -kernel<br>
>>>> >> >> >>>> > /dev/null -android -panda<br>
>>>> >> >> >>>> > "stringsearch:name=test;tstringsearch;tainted_instr"<br>
>>>> >> >> >>>> > 2.the output is:<br>
>>>> >> >> >>>> > Adding PANDA arg stringsearch:name=test.<br>
>>>> >> >> >>>> > adding<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_stringsearch.so<br>
>>>> >> >> >>>> > to panda_plugin_files 0<br>
>>>> >> >> >>>> > adding<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_tstringsearch.so<br>
>>>> >> >> >>>> > to panda_plugin_files 1<br>
>>>> >> >> >>>> > adding<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_tainted_instr.so<br>
>>>> >> >> >>>> > to panda_plugin_files 2<br>
>>>> >> >> >>>> > emulator: registered 'boot-properties' qemud service<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'dalvik.vm.heapsize' =<br>
>>>> >> >> >>>> > '48m'<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'qemu.sf.fake_camera' =<br>
>>>> >> >> >>>> > 'both'<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'qemu.hw.mainkeys' = '0'<br>
>>>> >> >> >>>> > loading<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_stringsearch.so<br>
>>>> >> >> >>>> > Initializing plugin stringsearch<br>
>>>> >> >> >>>> > panda_require: callstack_instr<br>
>>>> >> >> >>>> > loading<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_callstack_instr.so<br>
>>>> >> >> >>>> > Initializing plugin callstack_instr<br>
>>>> >> >> >>>> > Success<br>
>>>> >> >> >>>> > stringsearch: added string of length 14 to search set<br>
>>>> >> >> >>>> > Success<br>
>>>> >> >> >>>> > loading<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_tstringsearch.so<br>
>>>> >> >> >>>> > Initializing tstringsearch<br>
>>>> >> >> >>>> > panda_require: stringsearch<br>
>>>> >> >> >>>> > panda_load_plugin:<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_stringsearch.so<br>
>>>> >> >> >>>> > already loaded<br>
>>>> >> >> >>>> > panda_require: taint2<br>
>>>> >> >> >>>> > loading<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_taint2.so<br>
>>>> >> >> >>>> > Initializing taint plugin<br>
>>>> >> >> >>>> > taint2: Instructed not to inline taint ops.<br>
>>>> >> >> >>>> > panda_require: callstack_instr<br>
>>>> >> >> >>>> > panda_load_plugin:<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_callstack_instr.so<br>
>>>> >> >> >>>> > already loaded<br>
>>>> >> >> >>>> > Success<br>
>>>> >> >> >>>> > Success<br>
>>>> >> >> >>>> > loading<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_tainted_instr.so<br>
>>>> >> >> >>>> > panda_require: taint2<br>
>>>> >> >> >>>> > panda_load_plugin:<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_taint2.so<br>
>>>> >> >> >>>> > already loaded<br>
>>>> >> >> >>>> > panda_require: callstack_instr<br>
>>>> >> >> >>>> > panda_load_plugin:<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_callstack_instr.so<br>
>>>> >> >> >>>> > already loaded<br>
>>>> >> >> >>>> > Success<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_device_bus, base ff001000<br>
>>>> >> >> >>>> > 1000,<br>
>>>> >> >> >>>> > irq 1<br>
>>>> >> >> >>>> > 1<br>
>>>> >> >> >>>> > goldfish_device_bus: ff001000 30<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_int, base ff000000 1000, irq<br>
>>>> >> >> >>>> > 0 0<br>
>>>> >> >> >>>> > goldfish_int: ff000000 38<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_timer, base ff003000 1000,<br>
>>>> >> >> >>>> > irq 3 1<br>
>>>> >> >> >>>> > goldfish_timer: ff003000 40<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_rtc, base ff010000 1000, irq<br>
>>>> >> >> >>>> > 10 1<br>
>>>> >> >> >>>> > goldfish_rtc: ff010000 48<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_tty, base ff002000 1000, irq<br>
>>>> >> >> >>>> > 4 1<br>
>>>> >> >> >>>> > goldfish_tty: ff002000 50<br>
>>>> >> >> >>>> > android_arm_init serial 1 0<br>
>>>> >> >> >>>> > android_arm_init serial 2 0<br>
>>>> >> >> >>>> > android_arm_init serial 3 0<br>
>>>> >> >> >>>> > goldfish_add_device: smc91x, base ff011000 1000, irq 11 1<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_fb, base ff012000 1000, irq<br>
>>>> >> >> >>>> > 12 1<br>
>>>> >> >> >>>> > goldfish_fb: ff012000 68<br>
>>>> >> >> >>>> > Using tmpfile for SD card:<br>
>>>> >> >> >>>> > /tmp/android-shentanli/emulator-P6kmpf<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_mmc, base ff005000 1000, irq<br>
>>>> >> >> >>>> > 13 1<br>
>>>> >> >> >>>> > goldfish_mmc: ff005000 70<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_memlog, base ff006000 1000,<br>
>>>> >> >> >>>> > irq 0<br>
>>>> >> >> >>>> > 0<br>
>>>> >> >> >>>> > goldfish_memlog: ff006000 78<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish-battery, base ff013000 1000,<br>
>>>> >> >> >>>> > irq<br>
>>>> >> >> >>>> > 14 1<br>
>>>> >> >> >>>> > goldfish-battery: ff013000 80<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_events, base ff014000 1000,<br>
>>>> >> >> >>>> > irq 15<br>
>>>> >> >> >>>> > 1<br>
>>>> >> >> >>>> > goldfish_events: ff014000 88<br>
>>>> >> >> >>>> > Using event IRQ<br>
>>>> >> >> >>>> > Invalid system partition size for non-QCOW image:<br>
>>>> >> >> >>>> > 0emulator:<br>
>>>> >> >> >>>> > geometry<br>
>>>> >> >> >>>> > says<br>
>>>> >> >> >>>> > there are 0 blocks<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: Dev size of<br>
>>>> >> >> >>>> > /tmp/android-shentanli/emulator-jxC2Uf is<br>
>>>> >> >> >>>> > 0<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > Invalid data partition size for non-QCOW image: 0emulator:<br>
>>>> >> >> >>>> > Dev<br>
>>>> >> >> >>>> > size<br>
>>>> >> >> >>>> > 0x0 came<br>
>>>> >> >> >>>> > from argument<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: geometry says there are 0 blocks<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: Dev size of<br>
>>>> >> >> >>>> > /tmp/android-shentanli/emulator-2FZLqg is<br>
>>>> >> >> >>>> > 0<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: Dev size 0x0 came from argument<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: geometry says there are 0 blocks<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: Dev size of<br>
>>>> >> >> >>>> > /tmp/android-shentanli/emulator-lyszWg is<br>
>>>> >> >> >>>> > 0<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_nand, base ff015000 1000, irq<br>
>>>> >> >> >>>> > 16 1<br>
>>>> >> >> >>>> > goldfish_nand: ff015000 90<br>
>>>> >> >> >>>> > goldfish_add_device: qemu_pipe, base ff016000 2000, irq 17<br>
>>>> >> >> >>>> > 1<br>
>>>> >> >> >>>> > qemu_pipe: ff016000 98<br>
>>>> >> >> >>>> > emulator: control console listening on port 5554, ADB on<br>
>>>> >> >> >>>> > port<br>
>>>> >> >> >>>> > 5555<br>
>>>> >> >> >>>> > emulator: can't connect to ADB server: Connection refused<br>
>>>> >> >> >>>> > emulator: Realistic sensor emulation is not available,<br>
>>>> >> >> >>>> > since the<br>
>>>> >> >> >>>> > remote<br>
>>>> >> >> >>>> > controller is not accessible:<br>
>>>> >> >> >>>> > Connection refused<br>
>>>> >> >> >>>> > loading snapshot<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'dalvik.vm.heapsize' =<br>
>>>> >> >> >>>> > '48m'<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'qemu.sf.fake_camera' =<br>
>>>> >> >> >>>> > 'both'<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'qemu.hw.mainkeys' = '0'<br>
>>>> >> >> >>>> > Unknown savevm section or instance 'goldfish_tty' 1<br>
>>>> >> >> >>>> > ... done.<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > Logging all cpu states<br>
>>>> >> >> >>>> > CPU #0:<br>
>>>> >> >> >>>> > R00=00000000 R01=c049bcb8 R02=00000000 R03=00000000<br>
>>>> >> >> >>>> > R04=c0480000 R05=c04b9948 R06=c048fd34 R07=c047b374<br>
>>>> >> >> >>>> > R08=c0a05100 R09=410fc090 R10=00000000 R11=00000000<br>
>>>> >> >> >>>> > R12=c049bcb8 R13=c0481fb0 R14=c000e3f4 R15=c00158c8<br>
>>>> >> >> >>>> > PSR=60000093 -ZC- A svc32<br>
>>>> >> >> >>>> > opening nondet log for read :<br>
>>>> >> >> >>>> > /home/shentanli/pandanew/scripts/api414-4-20-rr-nondet.log<br>
>>>> >> >> >>>> > api414-4-20: 81316759 ( 1.04%) instrs. 7.52 sec.<br>
>>>> >> >> >>>> > 0.61 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 156342747 ( 2.00%) instrs. 15.90 sec.<br>
>>>> >> >> >>>> > 0.69 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 234368551 ( 3.00%) instrs. 24.93 sec.<br>
>>>> >> >> >>>> > 0.76 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 312493247 ( 4.00%) instrs. 35.45 sec.<br>
>>>> >> >> >>>> > 0.83 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 390616091 ( 5.00%) instrs. 43.97 sec.<br>
>>>> >> >> >>>> > 0.87 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 468738195 ( 6.00%) instrs. 49.32 sec.<br>
>>>> >> >> >>>> > 0.90 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 547631582 ( 7.01%) instrs. 54.12 sec.<br>
>>>> >> >> >>>> > 0.93 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 624983872 ( 8.00%) instrs. 57.67 sec.<br>
>>>> >> >> >>>> > 0.94 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 703122355 ( 9.00%) instrs. 60.94 sec.<br>
>>>> >> >> >>>> > 0.94 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 783198179 ( 10.03%) instrs. 64.60 sec.<br>
>>>> >> >> >>>> > 0.95 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > READ Match of str 0 at: instr_count=812336749 : 72a7562e<br>
>>>> >> >> >>>> > b6cb2e02<br>
>>>> >> >> >>>> > 0d36c000<br>
>>>> >> >> >>>> > tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> >> >>>> > tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> >> >>>> > tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> >> >>>> > enabling taint at instr count 812336749<br>
>>>> >> >> >>>> > taint2: __taint_enable_taint<br>
>>>> >> >> >>>> > taint2: Creating byte-level taint processor<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad (8589934592 bytes) @<br>
>>>> >> >> >>>> > 0x10000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad (8589934592 bytes) @<br>
>>>> >> >> >>>> > 0x20000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad (8589934592 bytes) @<br>
>>>> >> >> >>>> > 0x30000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad (8589934592 bytes) @<br>
>>>> >> >> >>>> > 0x40000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad (8589934592 bytes) @<br>
>>>> >> >> >>>> > 0x50000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad (8589934592 bytes) @<br>
>>>> >> >> >>>> > 0x60000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad (8589934592 bytes) @<br>
>>>> >> >> >>>> > 0x70000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad (8589934592 bytes) @<br>
>>>> >> >> >>>> > 0x80000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad (8589934592 bytes) @<br>
>>>> >> >> >>>> > 0x90000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > Cannot allocate memory<br>
>>>> >> >> >>>> > taint2: Allocating small fast_shad (12800000 bytes) using<br>
>>>> >> >> >>>> > malloc<br>
>>>> >> >> >>>> > @<br>
>>>> >> >> >>>> > 7f8b608d0010.<br>
>>>> >> >> >>>> > taint2: Allocating small fast_shad (256 bytes) using malloc<br>
>>>> >> >> >>>> > @<br>
>>>> >> >> >>>> > 16be2a70.<br>
>>>> >> >> >>>> > taint2: Allocating small fast_shad (1024 bytes) using<br>
>>>> >> >> >>>> > malloc @<br>
>>>> >> >> >>>> > 171c3540.<br>
>>>> >> >> >>>> > taint2: Allocating small fast_shad (867840 bytes) using<br>
>>>> >> >> >>>> > malloc @<br>
>>>> >> >> >>>> > 1720ddd0.<br>
>>>> >> >> >>>> > taint2: Linking taint ops from<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_taint2_ops.bc<br>
>>>> >> >> >>>> > taint2: Done initializing taint transformation.<br>
>>>> >> >> >>>> > taint2: Done processing helper functions for taint.<br>
>>>> >> >> >>>> > taint2: Done verifying module. Running...<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > ****************************************************************************<br>
>>>> >> >> >>>> > applying taint labels to search string of length 14 @<br>
>>>> >> >> >>>> > p=0xa70d6212<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > ******************************************************************************<br>
>>>> >> >> >>>> > Segmentation fault<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > 2015-04-20 22:42 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> > <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> >> I am currently running your taint replay, and it is (so<br>
>>>> >> >> >>>> >> far)<br>
>>>> >> >> >>>> >> working<br>
>>>> >> >> >>>> >> fine. Here is the (slightly abbreviated) output I get:<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> api414-4-20: 783198179 ( 10.03%) instrs. 218.26 sec.<br>
>>>> >> >> >>>> >> 0.96<br>
>>>> >> >> >>>> >> GB<br>
>>>> >> >> >>>> >> ram.<br>
>>>> >> >> >>>> >> READ Match of str 0 at: instr_count=812336749 : 72a7562e<br>
>>>> >> >> >>>> >> b6cb2e02<br>
>>>> >> >> >>>> >> 0d36c000<br>
>>>> >> >> >>>> >> tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> >> >>>> >> tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> >> >>>> >> tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> >> >>>> >> enabling taint at instr count 812336749<br>
>>>> >> >> >>>> >> taint2: __taint_enable_taint<br>
>>>> >> >> >>>> >> taint2: Creating byte-level taint processor<br>
>>>> >> >> >>>> >> taint2: Allocating large fast_shad (8589934592 bytes).<br>
>>>> >> >> >>>> >> taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> >> taint2: Allocating small fast_shad (12800000 bytes) using<br>
>>>> >> >> >>>> >> malloc @<br>
>>>> >> >> >>>> >> 7fdd165c6010.<br>
>>>> >> >> >>>> >> taint2: Allocating small fast_shad (256 bytes) using<br>
>>>> >> >> >>>> >> malloc @<br>
>>>> >> >> >>>> >> 7fdd0bec21a0.<br>
>>>> >> >> >>>> >> taint2: Allocating small fast_shad (1024 bytes) using<br>
>>>> >> >> >>>> >> malloc @<br>
>>>> >> >> >>>> >> 7fdcfc49ddc0.<br>
>>>> >> >> >>>> >> taint2: Allocating small fast_shad (867840 bytes) using<br>
>>>> >> >> >>>> >> malloc<br>
>>>> >> >> >>>> >> @<br>
>>>> >> >> >>>> >> 7fdcfc4e7db0.<br>
>>>> >> >> >>>> >> taint2: Linking taint ops from<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> /scratch/git/pandroid/qemu/arm-softmmu/panda_plugins/panda_taint2_ops.bc<br>
>>>> >> >> >>>> >> taint2: Done initializing taint transformation.<br>
>>>> >> >> >>>> >> taint2: Done processing helper functions for taint.<br>
>>>> >> >> >>>> >> taint2: Done verifying module. Running...<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ****************************************************************************<br>
>>>> >> >> >>>> >> applying taint labels to search string of length 14 @<br>
>>>> >> >> >>>> >> p=0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ******************************************************************************<br>
>>>> >> >> >>>> >> READ Match of str 0 at: instr_count=812336765 : 72a7562e<br>
>>>> >> >> >>>> >> b6cb2a2a<br>
>>>> >> >> >>>> >> 0d36c000<br>
>>>> >> >> >>>> >> tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> >> >>>> >> tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> >> >>>> >> tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ****************************************************************************<br>
>>>> >> >> >>>> >> applying taint labels to search string of length 14 @<br>
>>>> >> >> >>>> >> p=0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ******************************************************************************<br>
>>>> >> >> >>>> >> READ Match of str 0 at: instr_count=812337316 : 72a7562e<br>
>>>> >> >> >>>> >> b6cb2e4a<br>
>>>> >> >> >>>> >> 0d36c000<br>
>>>> >> >> >>>> >> tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> >> >>>> >> tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> >> >>>> >> tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ****************************************************************************<br>
>>>> >> >> >>>> >> applying taint labels to search string of length 14 @<br>
>>>> >> >> >>>> >> p=0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ******************************************************************************<br>
>>>> >> >> >>>> >> READ Match of str 0 at: instr_count=812337331 : 72a7562e<br>
>>>> >> >> >>>> >> b6cb2a2a<br>
>>>> >> >> >>>> >> 0d36c000<br>
>>>> >> >> >>>> >> tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> >> >>>> >> tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> >> >>>> >> tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ****************************************************************************<br>
>>>> >> >> >>>> >> applying taint labels to search string of length 14 @<br>
>>>> >> >> >>>> >> p=0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ******************************************************************************<br>
>>>> >> >> >>>> >> api414-4-20: 859399601 ( 11.00%) instrs. 658.13 sec.<br>
>>>> >> >> >>>> >> 3.27<br>
>>>> >> >> >>>> >> GB<br>
>>>> >> >> >>>> >> ram.<br>
>>>> >> >> >>>> >> api414-4-20: 937474512 ( 12.00%) instrs. 1017.48 sec.<br>
>>>> >> >> >>>> >> 4.70<br>
>>>> >> >> >>>> >> GB<br>
>>>> >> >> >>>> >> ram.<br>
>>>> >> >> >>>> >> api414-4-20: 1015597970 ( 13.00%) instrs. 1265.76 sec.<br>
>>>> >> >> >>>> >> 5.58<br>
>>>> >> >> >>>> >> GB<br>
>>>> >> >> >>>> >> ram.<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> My command line to replay was:<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> arm-softmmu/qemu-system-arm -m 512 -replay api414-4-20 -M<br>
>>>> >> >> >>>> >> android_arm<br>
>>>> >> >> >>>> >> -cpu cortex-a9 -android -kernel /dev/null -pandalog<br>
>>>> >> >> >>>> >> api.log<br>
>>>> >> >> >>>> >> -panda<br>
>>>> >> >> >>>> >> 'stringsearch:name=api;tstringsearch;tainted_instr'<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> From the screenshot you posted earlier, it looks like<br>
>>>> >> >> >>>> >> yours had<br>
>>>> >> >> >>>> >> already failed by this point. If you are still getting a<br>
>>>> >> >> >>>> >> segfault<br>
>>>> >> >> >>>> >> with<br>
>>>> >> >> >>>> >> this replay, could you post:<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> 1. The full command line you are using (as text, not a<br>
>>>> >> >> >>>> >> screenshot)<br>
>>>> >> >> >>>> >> 2. The full output from PANDA up to the point where the<br>
>>>> >> >> >>>> >> segfault<br>
>>>> >> >> >>>> >> happens (as text, not a screenshot)<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> -Brendan<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> On Mon, Apr 20, 2015 at 7:57 PM, xiaojuan Li<br>
>>>> >> >> >>>> >> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> >> wrote:<br>
>>>> >> >> >>>> >> > i know you are busy.<br>
>>>> >> >> >>>> >> > I just get stuck in this taint step but have no idea no<br>
>>>> >> >> >>>> >> > fix<br>
>>>> >> >> >>>> >> > it...(use<br>
>>>> >> >> >>>> >> > core<br>
>>>> >> >> >>>> >> > dump to find where it segfault )<br>
>>>> >> >> >>>> >> > here is the 512M version:<br>
>>>> >> >> >>>> >> > <a href="http://pan.baidu.com/s/1mgopzIg" target="_blank">http://pan.baidu.com/s/1mgopzIg</a><br>
>>>> >> >> >>>> >> > the content of search string .txt is "passwordisqemu"<br>
>>>> >> >> >>>> >> > thanks!<br>
>>>> >> >> >>>> >> ><br>
>>>> >> >> >>>> >> > 2015-04-20 11:32 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> >> > <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> ><br>
>>>> >> >> >>>> >> >> I will try to reproduce from those instructions in the<br>
>>>> >> >> >>>> >> >> next<br>
>>>> >> >> >>>> >> >> couple<br>
>>>> >> >> >>>> >> >> days.<br>
>>>> >> >> >>>> >> >> Sorry for the delay! Did you post the .rr of the<br>
>>>> >> >> >>>> >> >> recording<br>
>>>> >> >> >>>> >> >> with<br>
>>>> >> >> >>>> >> >> 512M<br>
>>>> >> >> >>>> >> >> somewhere? I only saw the 2G one.<br>
>>>> >> >> >>>> >> >><br>
>>>> >> >> >>>> >> >> Thanks,<br>
>>>> >> >> >>>> >> >> Brendan<br>
>>>> >> >> >>>> >> >><br>
>>>> >> >> >>>> >> >> On Mon, Apr 20, 2015 at 8:07 AM, xiaojuan Li<br>
>>>> >> >> >>>> >> >> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> >> >> wrote:<br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>> about the taint segfault, if you cannot download that<br>
>>>> >> >> >>>> >> >>> .rr i<br>
>>>> >> >> >>>> >> >>> upload<br>
>>>> >> >> >>>> >> >>> before, you can follow the step to reproduce:<br>
>>>> >> >> >>>> >> >>> 1)use android studio to create avd, choose api21<br>
>>>> >> >> >>>> >> >>> target<br>
>>>> >> >> >>>> >> >>> android<br>
>>>> >> >> >>>> >> >>> 5.0.1<br>
>>>> >> >> >>>> >> >>> use<br>
>>>> >> >> >>>> >> >>> the default size;you can get the<br>
>>>> >> >> >>>> >> >>> cache-img,sdcard.img,data.img<br>
>>>> >> >> >>>> >> >>> and<br>
>>>> >> >> >>>> >> >>> system.img and then copy kernel-qemu & rmdisk.img from<br>
>>>> >> >> >>>> >> >>> sdk/systemimg;<br>
>>>> >> >> >>>> >> >>> 2)use pandaCovert.py to convert them and get the<br>
>>>> >> >> >>>> >> >>> (cache,data,system)-pandroid.qcow2 as well as kernel<br>
>>>> >> >> >>>> >> >>> and<br>
>>>> >> >> >>>> >> >>> initramfs;<br>
>>>> >> >> >>>> >> >>> 3)use runpandroid.py(-m 512) to boot emulator;telnet<br>
>>>> >> >> >>>> >> >>> and<br>
>>>> >> >> >>>> >> >>> begin_record<br>
>>>> >> >> >>>> >> >>> 4)run an app and input a string : end_record;<br>
>>>> >> >> >>>> >> >>> 5)use qemu-system-arm to replay(-m 512) with the panda<br>
>>>> >> >> >>>> >> >>> plugins:stringsearch,tstringsearch;tainted_instr.(the<br>
>>>> >> >> >>>> >> >>> search<br>
>>>> >> >> >>>> >> >>> string<br>
>>>> >> >> >>>> >> >>> .txt is<br>
>>>> >> >> >>>> >> >>> the string you input)<br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>> do you guys get the segfault ?<br>
>>>> >> >> >>>> >> >>> how can i fix it?<br>
>>>> >> >> >>>> >> >>> Thanks a lot!<br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>> 2015-04-20 17:51 GMT+08:00 xiaojuan Li<br>
>>>> >> >> >>>> >> >>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>> excuse me, i have noticed that the ida_taint<br>
>>>> >> >> >>>> >> >>>> plugin:"win7<br>
>>>> >> >> >>>> >> >>>> only<br>
>>>> >> >> >>>> >> >>>> but<br>
>>>> >> >> >>>> >> >>>> othre<br>
>>>> >> >> >>>> >> >>>> os could be easily added".<br>
>>>> >> >> >>>> >> >>>> i have installed ida pro in my<br>
>>>> >> >> >>>> >> >>>> system(debian),modified the<br>
>>>> >> >> >>>> >> >>>> ida_taint.bat<br>
>>>> >> >> >>>> >> >>>> with my ida path,when i use it :./ida_taint.bat<br>
>>>> >> >> >>>> >> >>>> name.json<br>
>>>> >> >> >>>> >> >>>> qemu-system-arm<br>
>>>> >> >> >>>> >> >>>> it failed. it seems not available in linux, is it?<br>
>>>> >> >> >>>> >> >>>> Thanks a lot!<br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>> 2015-04-10 21:24 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>> <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>>> Once you have used PANDA's taint system to identify<br>
>>>> >> >> >>>> >> >>>>> the<br>
>>>> >> >> >>>> >> >>>>> portions of<br>
>>>> >> >> >>>> >> >>>>> the<br>
>>>> >> >> >>>> >> >>>>> code that process the data you're interested in, you<br>
>>>> >> >> >>>> >> >>>>> will<br>
>>>> >> >> >>>> >> >>>>> still<br>
>>>> >> >> >>>> >> >>>>> have<br>
>>>> >> >> >>>> >> >>>>> to<br>
>>>> >> >> >>>> >> >>>>> analyze that code do understand how it works. One<br>
>>>> >> >> >>>> >> >>>>> way to<br>
>>>> >> >> >>>> >> >>>>> do<br>
>>>> >> >> >>>> >> >>>>> that<br>
>>>> >> >> >>>> >> >>>>> might be to<br>
>>>> >> >> >>>> >> >>>>> use the scissors plugin to extract out the portion<br>
>>>> >> >> >>>> >> >>>>> of the<br>
>>>> >> >> >>>> >> >>>>> trace<br>
>>>> >> >> >>>> >> >>>>> that<br>
>>>> >> >> >>>> >> >>>>> contains the code you're interested in, and then<br>
>>>> >> >> >>>> >> >>>>> replay<br>
>>>> >> >> >>>> >> >>>>> it<br>
>>>> >> >> >>>> >> >>>>> with<br>
>>>> >> >> >>>> >> >>>>> QEMU's "-d<br>
>>>> >> >> >>>> >> >>>>> in_asm -D asmlog.txt" options to get the disassembly<br>
>>>> >> >> >>>> >> >>>>> for<br>
>>>> >> >> >>>> >> >>>>> that<br>
>>>> >> >> >>>> >> >>>>> code.<br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>>> Alternatively, you could take a memory snapshot at<br>
>>>> >> >> >>>> >> >>>>> some<br>
>>>> >> >> >>>> >> >>>>> point<br>
>>>> >> >> >>>> >> >>>>> when<br>
>>>> >> >> >>>> >> >>>>> the<br>
>>>> >> >> >>>> >> >>>>> code you want to analyze is in memory (using<br>
>>>> >> >> >>>> >> >>>>> something<br>
>>>> >> >> >>>> >> >>>>> like<br>
>>>> >> >> >>>> >> >>>>> the<br>
>>>> >> >> >>>> >> >>>>> pmemsave<br>
>>>> >> >> >>>> >> >>>>> plugin in PANDA), then use Volatility to analyze<br>
>>>> >> >> >>>> >> >>>>> that<br>
>>>> >> >> >>>> >> >>>>> memory<br>
>>>> >> >> >>>> >> >>>>> image<br>
>>>> >> >> >>>> >> >>>>> to<br>
>>>> >> >> >>>> >> >>>>> extract out the binary, which you could look at in<br>
>>>> >> >> >>>> >> >>>>> IDA or<br>
>>>> >> >> >>>> >> >>>>> something<br>
>>>> >> >> >>>> >> >>>>> similar.<br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>>> Basically – disassemble the code that handles the<br>
>>>> >> >> >>>> >> >>>>> data<br>
>>>> >> >> >>>> >> >>>>> you're<br>
>>>> >> >> >>>> >> >>>>> interested in and find out how it works. Exactly<br>
>>>> >> >> >>>> >> >>>>> what<br>
>>>> >> >> >>>> >> >>>>> that<br>
>>>> >> >> >>>> >> >>>>> means<br>
>>>> >> >> >>>> >> >>>>> will depend<br>
>>>> >> >> >>>> >> >>>>> on what you're hoping to accomplish.<br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>>> On Fri, Apr 10, 2015 at 9:07 PM, xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> >> >>>>> wrote:<br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>> Hi,<br>
>>>> >> >> >>>> >> >>>>>> Thanks for your job first.<br>
>>>> >> >> >>>> >> >>>>>> I am a little confused about the result of the<br>
>>>> >> >> >>>> >> >>>>>> tainted.how<br>
>>>> >> >> >>>> >> >>>>>> can<br>
>>>> >> >> >>>> >> >>>>>> I<br>
>>>> >> >> >>>> >> >>>>>> get<br>
>>>> >> >> >>>> >> >>>>>> enough information about the processing code from<br>
>>>> >> >> >>>> >> >>>>>> the<br>
>>>> >> >> >>>> >> >>>>>> binary?<br>
>>>> >> >> >>>> >> >>>>>> use<br>
>>>> >> >> >>>> >> >>>>>> the gdb?<br>
>>>> >> >> >>>> >> >>>>>> Thanks!<br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>> 2015-04-10 12:05 GMT+08:00 xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >>>> >> >>>>>>><br>
>>>> >> >> >>>> >> >>>>>>> Thanks for your guys great work!<br>
>>>> >> >> >>>> >> >>>>>>> and I will try.<br>
>>>> >> >> >>>> >> >>>>>>><br>
>>>> >> >> >>>> >> >>>>>>> 2015-04-10 11:42 GMT+08:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>>>>> <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> Hi,<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> Tim has just updated the tainted_instructions<br>
>>>> >> >> >>>> >> >>>>>>>> tutorial<br>
>>>> >> >> >>>> >> >>>>>>>> so<br>
>>>> >> >> >>>> >> >>>>>>>> that it<br>
>>>> >> >> >>>> >> >>>>>>>> reflects how things work now. Could you look<br>
>>>> >> >> >>>> >> >>>>>>>> through<br>
>>>> >> >> >>>> >> >>>>>>>> that<br>
>>>> >> >> >>>> >> >>>>>>>> tutorial and see<br>
>>>> >> >> >>>> >> >>>>>>>> if it helps with your problem?<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> <a href="https://github.com/moyix/panda/blob/master/docs/tainted_instructions.md" target="_blank">https://github.com/moyix/panda/blob/master/docs/tainted_instructions.md</a><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> Note that you will probably need to do a "git<br>
>>>> >> >> >>>> >> >>>>>>>> pull"<br>
>>>> >> >> >>>> >> >>>>>>>> and<br>
>>>> >> >> >>>> >> >>>>>>>> rebuild<br>
>>>> >> >> >>>> >> >>>>>>>> (make clean ; ./build.sh) in order to make sure<br>
>>>> >> >> >>>> >> >>>>>>>> everything<br>
>>>> >> >> >>>> >> >>>>>>>> works<br>
>>>> >> >> >>>> >> >>>>>>>> as it says<br>
>>>> >> >> >>>> >> >>>>>>>> in the tutorial.<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> On Thu, Apr 9, 2015 at 9:30 AM, xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> >> >>>>>>>> wrote:<br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>> Now that the panda <a href="http://taint.md" target="_blank">taint.md</a> is not fresh,can you<br>
>>>> >> >> >>>> >> >>>>>>>>> guys<br>
>>>> >> >> >>>> >> >>>>>>>>> give<br>
>>>> >> >> >>>> >> >>>>>>>>> me<br>
>>>> >> >> >>>> >> >>>>>>>>> some<br>
>>>> >> >> >>>> >> >>>>>>>>> help?<br>
>>>> >> >> >>>> >> >>>>>>>>> I use the replay plugin,here is my command and<br>
>>>> >> >> >>>> >> >>>>>>>>> the<br>
>>>> >> >> >>>> >> >>>>>>>>> result.<br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>> the content of pk_search_strings.txt is :"sdt"<br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>> I am confused here:in the paper— Repeatable<br>
>>>> >> >> >>>> >> >>>>>>>>> reverse<br>
>>>> >> >> >>>> >> >>>>>>>>> with<br>
>>>> >> >> >>>> >> >>>>>>>>> panda:<br>
>>>> >> >> >>>> >> >>>>>>>>> :<br>
>>>> >> >> >>>> >> >>>>>>>>> it is clear that:if I use the stringsearch and<br>
>>>> >> >> >>>> >> >>>>>>>>> taint<br>
>>>> >> >> >>>> >> >>>>>>>>> plugin,when<br>
>>>> >> >> >>>> >> >>>>>>>>> it<br>
>>>> >> >> >>>> >> >>>>>>>>> matches, the taint label will be put and then<br>
>>>> >> >> >>>> >> >>>>>>>>> taint<br>
>>>> >> >> >>>> >> >>>>>>>>> action<br>
>>>> >> >> >>>> >> >>>>>>>>> will<br>
>>>> >> >> >>>> >> >>>>>>>>> start.but<br>
>>>> >> >> >>>> >> >>>>>>>>> when I use it, it seems wrong(the picture showed<br>
>>>> >> >> >>>> >> >>>>>>>>> before):no<br>
>>>> >> >> >>>> >> >>>>>>>>> taint action<br>
>>>> >> >> >>>> >> >>>>>>>>> execute,and i am confused about the<br>
>>>> >> >> >>>> >> >>>>>>>>> tstringsearch's<br>
>>>> >> >> >>>> >> >>>>>>>>> result.<br>
>>>> >> >> >>>> >> >>>>>>>>> how can i use it to analysis?<br>
>>>> >> >> >>>> >> >>>>>>>>> Thanks a lot!<br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>> 2015-04-08 10:14 GMT+08:00 xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>> I get the replay file by running runandroid<br>
>>>> >> >> >>>> >> >>>>>>>>>> script.<br>
>>>> >> >> >>>> >> >>>>>>>>>> and<br>
>>>> >> >> >>>> >> >>>>>>>>>> i<br>
>>>> >> >> >>>> >> >>>>>>>>>> use<br>
>>>> >> >> >>>> >> >>>>>>>>>> qemu-system-arm command just to do some replay<br>
>>>> >> >> >>>> >> >>>>>>>>>> work.<br>
>>>> >> >> >>>> >> >>>>>>>>>> I may not understand you at all in this emal.do<br>
>>>> >> >> >>>> >> >>>>>>>>>> you<br>
>>>> >> >> >>>> >> >>>>>>>>>> mean<br>
>>>> >> >> >>>> >> >>>>>>>>>> that i<br>
>>>> >> >> >>>> >> >>>>>>>>>> should gdb the original program rather than the<br>
>>>> >> >> >>>> >> >>>>>>>>>> record<br>
>>>> >> >> >>>> >> >>>>>>>>>> file?<br>
>>>> >> >> >>>> >> >>>>>>>>>> Thansk<br>
>>>> >> >> >>>> >> >>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>> 2015-04-08 9:52 GMT+08:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>>>>>>>> <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> Hmm. gdb should normally stop when you get a<br>
>>>> >> >> >>>> >> >>>>>>>>>>> segfault.<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> Are you by any chance running PANDA using the<br>
>>>> >> >> >>>> >> >>>>>>>>>>> runandroid<br>
>>>> >> >> >>>> >> >>>>>>>>>>> script?<br>
>>>> >> >> >>>> >> >>>>>>>>>>> If so, you will need to instead invoke PANDA<br>
>>>> >> >> >>>> >> >>>>>>>>>>> manually,<br>
>>>> >> >> >>>> >> >>>>>>>>>>> i.e.:<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> gdb --args arm-softmmu/qemu-system-arm [...]<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> And then once it crashes, type "bt" at the gdb<br>
>>>> >> >> >>>> >> >>>>>>>>>>> prompt<br>
>>>> >> >> >>>> >> >>>>>>>>>>> to<br>
>>>> >> >> >>>> >> >>>>>>>>>>> get a<br>
>>>> >> >> >>>> >> >>>>>>>>>>> backtrace.<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> On Tue, Apr 7, 2015 at 9:47 PM, xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>> wrote:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>> when gdb,it shows:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>> and then i see the log:it shows segfault:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>> 2015-04-08 9:03 GMT+08:00 xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> maybe i am wrong.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> i use the command<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> line:"taint2:label_mode=binary,query_outgoing_network=1"and<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> I found that<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> when i use taint2, after it loads<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> panda_taint2.so,it<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> shows:"taint2:instructed not to inline taint<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> ops<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> .success".<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> 2015-04-08 8:54 GMT+08:00 xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> ok.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> 1.I want to use taint plugin to get<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> information<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> about<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> some<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> functions(of course, it is<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> closed-source),so I<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> think I<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> can<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> stringsearch<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> potential data and then taint them and next<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> I<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> can<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> locate<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> the functions which<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> solves these data.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> 2.the command line I used is :<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> stringsearch:name=***;taint2:tainted_instructions=1.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> thanks<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> 2015-04-08 8:40 GMT+08:00 Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> Could you provide:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> 1. What information you're trying to get<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> 2. The command line you're using to run<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> PANDA<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> with<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> the<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> taint2<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> plugin<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> ?<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> Right now I believe taint2 does not<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> produce<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> very<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> much<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> output<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> by default. Instead you use the -pandalog<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> <filename><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> command line option,<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> and taint2 will write its results there in<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> pandalog<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> format; you can then<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> read them using pandalog_reader (see<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> panda/pandalog_reader.c for details on<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> that tool).<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> On Tue, Apr 7, 2015 at 8:32 PM, xiaojuan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>> wrote:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> when I tried taint2,it showed the same<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> error<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> with<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> taint1,<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> the olny difference is that taint2 has no<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> segfault<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> error,just uninit taint<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> plugin.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> 2015-04-08 8:28 GMT+08:00 Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> Could you be a little more descriptive<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> about<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> how<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> it<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> failed?<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> Segfault? Error message? Incorrect<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> output?<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> On Tue, Apr 7, 2015 at 8:27 PM, xiaojuan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>> wrote:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> i tried taint2 too,it failed.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> 2015-04-07 5:20 GMT+08:00 Leek, Timothy<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> -<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> 0559<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> -<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> MITLL<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> <<a href="mailto:tleek@ll.mit.edu">tleek@ll.mit.edu</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Also note that the “taint” plugin is<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> somewhat<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> defunct.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> “taint2” is the one we are actively<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> using<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> and<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> developing.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Tim Leek<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Technical Staff<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Cyber System Assessments<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> MIT Lincoln Laboratory<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> 781-981-2975<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> From: Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> <<a href="mailto:brendandg@gatech.edu">brendandg@gatech.edu</a>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Date: Monday, April 6, 2015 at 5:18 PM<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> To: xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Cc: "<a href="mailto:panda-users@mit.edu">panda-users@mit.edu</a>"<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> <<a href="mailto:panda-users@mit.edu">panda-users@mit.edu</a>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Subject: Re: [panda-users] taint<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> segmentation<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> fault<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Could you run that under gdb and<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> provide us<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> with<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> a<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> backtrace when it crashes?<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> On Sunday, April 5, 2015, xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com">xiaotan6666@gmail.com</a>> wrote:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> Hi,<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> excuse me,i have a question about<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> taint<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> plugin:(stringsearch:name=***;taint:tainted_instructions=1)<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> when I started it showed success:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> but when it finished search,it showd<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> "uninit<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> taint<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> plugin segementation fault"<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> how can I fix it?<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> Thanks a lot!<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> _______________________________________________<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> panda-users mailing list<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> <a href="mailto:panda-users@mit.edu">panda-users@mit.edu</a><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> <a href="http://mailman.mit.edu/mailman/listinfo/panda-users" target="_blank">http://mailman.mit.edu/mailman/listinfo/panda-users</a><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>><br>
>>>> >> >> >>>> >> >>>>>>><br>
>>>> >> >> >>>> >> >>>>>>><br>
>>>> >> >> >>>> >> >>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>> --<br>
>>>> >> >> >>>> >> >>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>> --<br>
>>>> >> >> >>>> >> >>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>> --<br>
>>>> >> >> >>>> >> >>> wait and hope~~<br>
>>>> >> >> >>>> >> >><br>
>>>> >> >> >>>> >> >><br>
>>>> >> >> >>>> >> ><br>
>>>> >> >> >>>> >> ><br>
>>>> >> >> >>>> >> ><br>
>>>> >> >> >>>> >> > --<br>
>>>> >> >> >>>> >> > wait and hope~~<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > --<br>
>>>> >> >> >>>> > wait and hope~~<br>
>>>> >> >> >>><br>
>>>> >> >> >>><br>
>>>> >> >> >>><br>
>>>> >> >> >>><br>
>>>> >> >> >>> --<br>
>>>> >> >> >>> wait and hope~~<br>
>>>> >> >> >><br>
>>>> >> >> >><br>
>>>> >> >> >><br>
>>>> >> >> >><br>
>>>> >> >> >> --<br>
>>>> >> >> >> wait and hope~~<br>
>>>> >> >> ><br>
>>>> >> >> ><br>
>>>> >> >> ><br>
>>>> >> >> ><br>
>>>> >> >> > --<br>
>>>> >> >> > wait and hope~~<br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> > --<br>
>>>> >> > wait and hope~~<br>
>>>> ><br>
>>>> ><br>
>>>> ><br>
>>>> ><br>
>>>> > --<br>
>>>> > wait and hope~~<br>
>>><br>
>>><br>
>>><br>
>>><br>
>>> --<br>
>>> wait and hope~~<br>
>><br>
>><br>
>><br>
>><br>
>> --<br>
>> wait and hope~~<br>
>><br>
>> _______________________________________________<br>
>> panda-users mailing list<br>
>> <a href="mailto:panda-users@mit.edu">panda-users@mit.edu</a><br>
>> <a href="http://mailman.mit.edu/mailman/listinfo/panda-users" target="_blank">http://mailman.mit.edu/mailman/listinfo/panda-users</a><br>
>><br>
><br>
><br>
><br>
> --<br>
> wait and hope~~<br>
><br>
> _______________________________________________<br>
> panda-users mailing list<br>
> <a href="mailto:panda-users@mit.edu">panda-users@mit.edu</a><br>
> <a href="http://mailman.mit.edu/mailman/listinfo/panda-users" target="_blank">http://mailman.mit.edu/mailman/listinfo/panda-users</a><br>
><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr">wait and hope~~</div></div>
</div>