<div dir="ltr"><div>and I find that:<br></div>i can run successfully with 16G memory(just one time), but with 32G memory,it still be killed,i doubt that there is something wrong with the allocation operation the panda does. it seems allocate as large memory for taint according to the memory of host os. <br></div><div class="gmail_extra"><br><div class="gmail_quote">2015-04-21 19:49 GMT-04:00 xiaojuan Li <span dir="ltr"><<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>actually, i have increased my memory to 16G, if I use 512 to record and replay, it killed;if i use 256 to record and replay, first time it killed, but second try it succeed (showing below). I just think it is unstable, as for the reason, i am trying to find.<br></div>Thanks for your reply very much!<br></div>sorry for troubling you so long time!<br><div><div><br><br>READ Match of str 0 at: instr_count=5180266230 : 72a7562e b6c79a2a 00c04000<br>tstringsearch: thestring = [passwordisqemu]<br>tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75 <br>tstringsearch: string in memory @ 0xa49002da<br><br>****************************************************************************<br>applying taint labels to search string of length 14 @ p=0xa49002da<br>******************************************************************************<br>api214-20-256: 5244538335 ( 75.00%) instrs. 4643.72 sec. 6.58 GB ram.<br>api214-20-256: <a href="tel:5316190227" value="+15316190227" target="_blank">5316190227</a> ( 76.03%) instrs. 4988.98 sec. 6.60 GB ram.<br>api214-20-256: 5386319700 ( 77.03%) instrs. 5363.67 sec. 6.60 GB ram.<br>api214-20-256: 5456115383 ( 78.03%) instrs. 5714.12 sec. 6.60 GB ram.<br>api214-20-256: 5524071341 ( 79.00%) instrs. 6039.86 sec. 6.62 GB ram.<br>api214-20-256: <a href="tel:5594009950" value="+15594009950" target="_blank">5594009950</a> ( 80.00%) instrs. 6392.84 sec. 6.62 GB ram.<br>api214-20-256: <a href="tel:5665215324" value="+15665215324" target="_blank">5665215324</a> ( 81.02%) instrs. 6760.18 sec. 6.62 GB ram.<br>api214-20-256: <a href="tel:5735561744" value="+15735561744" target="_blank">5735561744</a> ( 82.02%) instrs. 7122.95 sec. 6.62 GB ram.<br>api214-20-256: <a href="tel:5803941321" value="+15803941321" target="_blank">5803941321</a> ( 83.00%) instrs. 7475.05 sec. 6.62 GB ram.<br>api214-20-256: <a href="tel:5874989410" value="+15874989410" target="_blank">5874989410</a> ( 84.02%) instrs. 7839.22 sec. 6.62 GB ram.<br>api214-20-256: 5945687287 ( 85.03%) instrs. 8201.84 sec. 6.62 GB ram.<br>api214-20-256: <a href="tel:6016246771" value="+16016246771" target="_blank">6016246771</a> ( 86.04%) instrs. 8566.35 sec. 6.63 GB ram.<br>api214-20-256: <a href="tel:6086895413" value="+16086895413" target="_blank">6086895413</a> ( 87.05%) instrs. 8929.06 sec. 6.63 GB ram.<br>api214-20-256: <a href="tel:6153429632" value="+16153429632" target="_blank">6153429632</a> ( 88.00%) instrs. 9264.48 sec. 6.65 GB ram.<br>api214-20-256: <a href="tel:6225320269" value="+16225320269" target="_blank">6225320269</a> ( 89.03%) instrs. 9730.16 sec. 6.72 GB ram.<br>api214-20-256: <a href="tel:6293245468" value="+16293245468" target="_blank">6293245468</a> ( 90.00%) instrs. 10102.98 sec. 6.72 GB ram.<br>api214-20-256: <a href="tel:6364596059" value="+16364596059" target="_blank">6364596059</a> ( 91.02%) instrs. 10468.66 sec. 6.72 GB ram.<br>api214-20-256: 6436068665 ( 92.04%) instrs. 10837.40 sec. 6.72 GB ram.<br>api214-20-256: <a href="tel:6503270471" value="+16503270471" target="_blank">6503270471</a> ( 93.00%) instrs. 11192.30 sec. 6.72 GB ram.<br>api214-20-256: <a href="tel:6574434672" value="+16574434672" target="_blank">6574434672</a> ( 94.02%) instrs. 11558.97 sec. 6.72 GB ram.<br>api214-20-256: 6644627703 ( 95.03%) instrs. 11920.98 sec. 6.72 GB ram.<br>api214-20-256: 6715490334 ( 96.04%) instrs. 12288.82 sec. 6.72 GB ram.<br>api214-20-256: <a href="tel:6783347812" value="+16783347812" target="_blank">6783347812</a> ( 97.01%) instrs. 12631.31 sec. 6.72 GB ram.<br>api214-20-256: 6853231196 ( 98.01%) instrs. 12984.73 sec. 6.72 GB ram.<br>api214-20-256: 6922569909 ( 99.00%) instrs. 13338.83 sec. 6.72 GB ram.<br>/home/shentanli/pandanew/scripts/api214-20-256-rr-nondet.log: log is empty.<br>Replay completed successfully.<br>Time taken was: 13702 seconds.<br>Stats:<br>RR_INPUT_1 number = 818, size = 22086 bytes<br>RR_INPUT_2 number = 303, size = 8484 bytes<br>RR_INPUT_4 number = 757989, size = 22739670 bytes<br>RR_INPUT_8 number = 0, size = 0 bytes<br>RR_INTERRUPT_REQUEST number = 1756538, size = 49183064 bytes<br>RR_EXIT_REQUEST number = 0, size = 0 bytes<br>RR_SKIPPED_CALL number = 453631, size = 254126959 bytes<br>RR_DEBUG number = 0, size = 0 bytes<br>max_queue_len = 769<br>768 items on recycle list, 67584 bytes total<br>Replay completed successfully.<br><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-04-21 16:26 GMT-04:00 Brendan Dolan-Gavitt <span dir="ltr"><<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">This is because your system is running out of memory, and so the<br>
kernel is killing the process so the system doesn't crash (as you can<br>
see it's using 10.68 GB ram when it crashes, and your system only has<br>
8GB available). You can verify this by looking at the output of<br>
"dmesg".<br>
<br>
I'm not sure what else you can do, unfortunately (aside from running<br>
this on a system with more RAM). It's possible you can modify the<br>
taint plugin to use less memory (for example, by removing the taint<br>
compute number tracking), but that's not something I have time to help<br>
with at the moment. You'd have to read and understand the taint2<br>
plugin code.<br>
<span><font color="#888888"><br>
-Brendan<br>
</font></span><div><div><br>
On Tue, Apr 21, 2015 at 5:40 AM, xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>> wrote:<br>
> and when i record and replay with 256M,it just killed...:<br>
> ****************************************************************************<br>
> applying taint labels to search string of length 14 @ p=0xa73aebab<br>
> ******************************************************************************<br>
> api214-20-256: <a href="tel:4405812542" value="+14405812542" target="_blank">4405812542</a> ( 63.01%) instrs. 750.04 sec. 10.68 GB ram.<br>
> Killed<br>
><br>
><br>
><br>
> 2015-04-21 3:29 GMT-04:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
><br>
>> HI Brendan, if you run continue do you encounter this?<br>
>><br>
>> ****************************************************************************<br>
>> applying taint labels to search string of length 14 @ p=0xa62e82dd<br>
>><br>
>> ******************************************************************************<br>
>> api414-4-20: 2737044888 ( 35.04%) instrs. 1943.11 sec. 14.51 GB ram.<br>
>> terminate called after throwing an instance of 'std::bad_alloc'<br>
>> what(): std::bad_alloc<br>
>> Aborted<br>
>><br>
>> i use the gdb to check the core dump,it shows:<br>
>> Program terminated with signal 6, Aborted.<br>
>> #0 0x00007fdb33f80165 in raise () from /lib/x86_64-linux-gnu/libc.so.6<br>
>><br>
>> seems caused malloc().<br>
>><br>
>><br>
>><br>
>><br>
>> 2015-04-21 1:18 GMT-04:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>><br>
>>> Thanks for your patience very much and your great work!<br>
>>> now i can use the taint plugin(but it seems a little slow) and take my<br>
>>> next step.<br>
>>><br>
>>> 2015-04-21 12:04 GMT+08:00 Brendan Dolan-Gavitt <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>><br>
>>>> Ok! Another option is to try making a recording with only 256M of RAM,<br>
>>>> which would need only 4GB to replay.<br>
>>>><br>
>>>> One last thing you can try – it is possible that the taint system will<br>
>>>> not actually use all of the memory it allocates. In this case, if you<br>
>>>> allow the kernel to overcommit memory it may succeed. You can do this<br>
>>>> either by setting /proc/sys/vm/overcommit_memory to 1 or by setting<br>
>>>> /proc/sys/vm/overcommit_ratio to a higher value. There are more<br>
>>>> details about this feature here:<br>
>>>> <a href="https://www.kernel.org/doc/Documentation/vm/overcommit-accounting" target="_blank">https://www.kernel.org/doc/Documentation/vm/overcommit-accounting</a><br>
>>>><br>
>>>> -Brendan<br>
>>>><br>
>>>><br>
>>>> On Mon, Apr 20, 2015 at 11:54 PM, xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>> wrote:<br>
>>>> > sorry i make a mistake: my ram size is:<br>
>>>> > (free -g)<br>
>>>> > total used free shared buffers<br>
>>>> > cached<br>
>>>> > Mem: 7 6 1 0 0<br>
>>>> > 2<br>
>>>> > -/+ buffers/cache: 3 4<br>
>>>> > Swap: 0 0 0<br>
>>>> ><br>
>>>> > before i mistake the size of hardware...<br>
>>>> ><br>
>>>> > there is unlimit.<br>
>>>> > I think i should increase the memory chips.<br>
>>>> > Thanks !<br>
>>>> ><br>
>>>> > 2015-04-20 23:36 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> > <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>> ><br>
>>>> >> It is still not able to allocate the memory for the taint system, it<br>
>>>> >> seems (based on the "Cannot allocate memory" part). Since you said<br>
>>>> >> your host system has 16GB of RAM, I'm not sure what else could be the<br>
>>>> >> problem.<br>
>>>> >><br>
>>>> >> Do you have any memory quota set up on your system? (for example,<br>
>>>> >> does<br>
>>>> >> "ulimit -v" show any limits on the amount of memory you're allowed to<br>
>>>> >> allocate in a single process?)<br>
>>>> >><br>
>>>> >> -Brendan<br>
>>>> >><br>
>>>> >> On Mon, Apr 20, 2015 at 11:28 PM, xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>> >> wrote:<br>
>>>> >> > use the new version, but still segfault :(<br>
>>>> >> ><br>
>>>> >> > opening nondet log for read :<br>
>>>> >> > /home/shentanli/pandanew/scripts/api414-4-20-rr-nondet.log<br>
>>>> >> > api414-4-20: 81316759 ( 1.04%) instrs. 7.49 sec. 0.61 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 156342747 ( 2.00%) instrs. 16.14 sec. 0.69 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 234368551 ( 3.00%) instrs. 25.29 sec. 0.76 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 312493247 ( 4.00%) instrs. 36.09 sec. 0.83 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 390616091 ( 5.00%) instrs. 44.62 sec. 0.87 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 468738195 ( 6.00%) instrs. 50.08 sec. 0.90 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 547631582 ( 7.01%) instrs. 54.95 sec. 0.93 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 624983872 ( 8.00%) instrs. 58.64 sec. 0.94 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 703122355 ( 9.00%) instrs. 61.98 sec. 0.94 GB<br>
>>>> >> > ram.<br>
>>>> >> > api414-4-20: 783198179 ( 10.03%) instrs. 65.80 sec. 0.95 GB<br>
>>>> >> > ram.<br>
>>>> >> > READ Match of str 0 at: instr_count=812336749 : 72a7562e b6cb2e02<br>
>>>> >> > 0d36c000<br>
>>>> >> > tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> > tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> > tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> > enabling taint at instr count 812336749<br>
>>>> >> > taint2: __taint_enable_taint<br>
>>>> >> > taint2: Creating byte-level taint processor<br>
>>>> >> > taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes).<br>
>>>> >> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> > Cannot allocate memory<br>
>>>> >> > taint2: Allocating small fast_shad (12800000 bytes) using malloc @<br>
>>>> >> > 7f38ff62e010.<br>
>>>> >> > taint2: Allocating small fast_shad (256 bytes) using malloc @<br>
>>>> >> > 17cda900.<br>
>>>> >> > taint2: Allocating small fast_shad (1024 bytes) using malloc @<br>
>>>> >> > 17cd91f0.<br>
>>>> >> > taint2: Allocating small fast_shad (867840 bytes) using malloc @<br>
>>>> >> > 17d24e70.<br>
>>>> >> > taint2: Linking taint ops from<br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_taint2_ops.bc<br>
>>>> >> > taint2: Done initializing taint transformation.<br>
>>>> >> > taint2: Done processing helper functions for taint.<br>
>>>> >> > taint2: Done verifying module. Running...<br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> > ****************************************************************************<br>
>>>> >> > applying taint labels to search string of length 14 @ p=0xa70d6212<br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> > ******************************************************************************<br>
>>>> >> > Segmentation fault<br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> > 2015-04-20 23:18 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> >> > <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>> >> ><br>
>>>> >> >> That was caused by some code that was left in by mistake from<br>
>>>> >> >> another<br>
>>>> >> >> branch of the project. I have fixed it and pushed the change. Once<br>
>>>> >> >> again you will need to do git pull && make clean && ./build.sh to<br>
>>>> >> >> rebuild.<br>
>>>> >> >><br>
>>>> >> >> Hopefully this will fix things for you!<br>
>>>> >> >><br>
>>>> >> >> -Brendan<br>
>>>> >> >><br>
>>>> >> >> On Mon, Apr 20, 2015 at 11:11 PM, xiaojuan Li<br>
>>>> >> >> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>> >> >> wrote:<br>
>>>> >> >> > it is the path that caused terminated.<br>
>>>> >> >> > i can find that panda_hypercall_struct.h in<br>
>>>> >> >> > /qemu/panda_tools/pirate_utils/linux direcroty<br>
>>>> >> >> ><br>
>>>> >> >> > 2015-04-20 23:02 GMT-04:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> ><br>
>>>> >> >> >> while rebuild:<br>
>>>> >> >> >> taint2.cpp:109:61: fatal error:<br>
>>>> >> >> >> ../../../../lava/include/panda_hypercall_struct.h: No such file<br>
>>>> >> >> >> or<br>
>>>> >> >> >> directory<br>
>>>> >> >> >> compilation terminated.<br>
>>>> >> >> >> miss some files to push?<br>
>>>> >> >> >><br>
>>>> >> >> >><br>
>>>> >> >> >> 2015-04-20 22:56 GMT-04:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >><br>
>>>> >> >> >>> you mean that it caused by "allocate at a fixed address"<br>
>>>> >> >> >>> i am going to try and thanks.<br>
>>>> >> >> >>><br>
>>>> >> >> >>> 2015-04-20 22:53 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>> <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>><br>
>>>> >> >> >>>> Ah! I forgot to push the commit I made to stop it from trying<br>
>>>> >> >> >>>> to<br>
>>>> >> >> >>>> allocate at a fixed address.<br>
>>>> >> >> >>>><br>
>>>> >> >> >>>> Could you do a git pull, rebuild, and try again?<br>
>>>> >> >> >>>><br>
>>>> >> >> >>>> -Brendan<br>
>>>> >> >> >>>><br>
>>>> >> >> >>>> On Mon, Apr 20, 2015 at 10:51 PM, xiaojuan Li<br>
>>>> >> >> >>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> wrote:<br>
>>>> >> >> >>>> > 1. the command i use is :<br>
>>>> >> >> >>>> > ./qemu-system-arm 0m 512 -replay api414-4-20 -M android_arm<br>
>>>> >> >> >>>> > -kernel<br>
>>>> >> >> >>>> > /dev/null -android -panda<br>
>>>> >> >> >>>> > "stringsearch:name=test;tstringsearch;tainted_instr"<br>
>>>> >> >> >>>> > 2.the output is:<br>
>>>> >> >> >>>> > Adding PANDA arg stringsearch:name=test.<br>
>>>> >> >> >>>> > adding<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_stringsearch.so<br>
>>>> >> >> >>>> > to panda_plugin_files 0<br>
>>>> >> >> >>>> > adding<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_tstringsearch.so<br>
>>>> >> >> >>>> > to panda_plugin_files 1<br>
>>>> >> >> >>>> > adding<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_tainted_instr.so<br>
>>>> >> >> >>>> > to panda_plugin_files 2<br>
>>>> >> >> >>>> > emulator: registered 'boot-properties' qemud service<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'dalvik.vm.heapsize' =<br>
>>>> >> >> >>>> > '48m'<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'qemu.sf.fake_camera' =<br>
>>>> >> >> >>>> > 'both'<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'qemu.hw.mainkeys' = '0'<br>
>>>> >> >> >>>> > loading<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_stringsearch.so<br>
>>>> >> >> >>>> > Initializing plugin stringsearch<br>
>>>> >> >> >>>> > panda_require: callstack_instr<br>
>>>> >> >> >>>> > loading<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_callstack_instr.so<br>
>>>> >> >> >>>> > Initializing plugin callstack_instr<br>
>>>> >> >> >>>> > Success<br>
>>>> >> >> >>>> > stringsearch: added string of length 14 to search set<br>
>>>> >> >> >>>> > Success<br>
>>>> >> >> >>>> > loading<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_tstringsearch.so<br>
>>>> >> >> >>>> > Initializing tstringsearch<br>
>>>> >> >> >>>> > panda_require: stringsearch<br>
>>>> >> >> >>>> > panda_load_plugin:<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_stringsearch.so<br>
>>>> >> >> >>>> > already loaded<br>
>>>> >> >> >>>> > panda_require: taint2<br>
>>>> >> >> >>>> > loading<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_taint2.so<br>
>>>> >> >> >>>> > Initializing taint plugin<br>
>>>> >> >> >>>> > taint2: Instructed not to inline taint ops.<br>
>>>> >> >> >>>> > panda_require: callstack_instr<br>
>>>> >> >> >>>> > panda_load_plugin:<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_callstack_instr.so<br>
>>>> >> >> >>>> > already loaded<br>
>>>> >> >> >>>> > Success<br>
>>>> >> >> >>>> > Success<br>
>>>> >> >> >>>> > loading<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_tainted_instr.so<br>
>>>> >> >> >>>> > panda_require: taint2<br>
>>>> >> >> >>>> > panda_load_plugin:<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_taint2.so<br>
>>>> >> >> >>>> > already loaded<br>
>>>> >> >> >>>> > panda_require: callstack_instr<br>
>>>> >> >> >>>> > panda_load_plugin:<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_callstack_instr.so<br>
>>>> >> >> >>>> > already loaded<br>
>>>> >> >> >>>> > Success<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_device_bus, base ff001000<br>
>>>> >> >> >>>> > 1000,<br>
>>>> >> >> >>>> > irq 1<br>
>>>> >> >> >>>> > 1<br>
>>>> >> >> >>>> > goldfish_device_bus: ff001000 30<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_int, base ff000000 1000, irq<br>
>>>> >> >> >>>> > 0 0<br>
>>>> >> >> >>>> > goldfish_int: ff000000 38<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_timer, base ff003000 1000,<br>
>>>> >> >> >>>> > irq 3 1<br>
>>>> >> >> >>>> > goldfish_timer: ff003000 40<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_rtc, base ff010000 1000, irq<br>
>>>> >> >> >>>> > 10 1<br>
>>>> >> >> >>>> > goldfish_rtc: ff010000 48<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_tty, base ff002000 1000, irq<br>
>>>> >> >> >>>> > 4 1<br>
>>>> >> >> >>>> > goldfish_tty: ff002000 50<br>
>>>> >> >> >>>> > android_arm_init serial 1 0<br>
>>>> >> >> >>>> > android_arm_init serial 2 0<br>
>>>> >> >> >>>> > android_arm_init serial 3 0<br>
>>>> >> >> >>>> > goldfish_add_device: smc91x, base ff011000 1000, irq 11 1<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_fb, base ff012000 1000, irq<br>
>>>> >> >> >>>> > 12 1<br>
>>>> >> >> >>>> > goldfish_fb: ff012000 68<br>
>>>> >> >> >>>> > Using tmpfile for SD card:<br>
>>>> >> >> >>>> > /tmp/android-shentanli/emulator-P6kmpf<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_mmc, base ff005000 1000, irq<br>
>>>> >> >> >>>> > 13 1<br>
>>>> >> >> >>>> > goldfish_mmc: ff005000 70<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_memlog, base ff006000 1000,<br>
>>>> >> >> >>>> > irq 0<br>
>>>> >> >> >>>> > 0<br>
>>>> >> >> >>>> > goldfish_memlog: ff006000 78<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish-battery, base ff013000 1000,<br>
>>>> >> >> >>>> > irq<br>
>>>> >> >> >>>> > 14 1<br>
>>>> >> >> >>>> > goldfish-battery: ff013000 80<br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_events, base ff014000 1000,<br>
>>>> >> >> >>>> > irq 15<br>
>>>> >> >> >>>> > 1<br>
>>>> >> >> >>>> > goldfish_events: ff014000 88<br>
>>>> >> >> >>>> > Using event IRQ<br>
>>>> >> >> >>>> > Invalid system partition size for non-QCOW image:<br>
>>>> >> >> >>>> > 0emulator:<br>
>>>> >> >> >>>> > geometry<br>
>>>> >> >> >>>> > says<br>
>>>> >> >> >>>> > there are 0 blocks<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: Dev size of<br>
>>>> >> >> >>>> > /tmp/android-shentanli/emulator-jxC2Uf is<br>
>>>> >> >> >>>> > 0<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > Invalid data partition size for non-QCOW image: 0emulator:<br>
>>>> >> >> >>>> > Dev<br>
>>>> >> >> >>>> > size<br>
>>>> >> >> >>>> > 0x0 came<br>
>>>> >> >> >>>> > from argument<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: geometry says there are 0 blocks<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: Dev size of<br>
>>>> >> >> >>>> > /tmp/android-shentanli/emulator-2FZLqg is<br>
>>>> >> >> >>>> > 0<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: Dev size 0x0 came from argument<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: geometry says there are 0 blocks<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > emulator: Dev size of<br>
>>>> >> >> >>>> > /tmp/android-shentanli/emulator-lyszWg is<br>
>>>> >> >> >>>> > 0<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > goldfish_add_device: goldfish_nand, base ff015000 1000, irq<br>
>>>> >> >> >>>> > 16 1<br>
>>>> >> >> >>>> > goldfish_nand: ff015000 90<br>
>>>> >> >> >>>> > goldfish_add_device: qemu_pipe, base ff016000 2000, irq 17<br>
>>>> >> >> >>>> > 1<br>
>>>> >> >> >>>> > qemu_pipe: ff016000 98<br>
>>>> >> >> >>>> > emulator: control console listening on port 5554, ADB on<br>
>>>> >> >> >>>> > port<br>
>>>> >> >> >>>> > 5555<br>
>>>> >> >> >>>> > emulator: can't connect to ADB server: Connection refused<br>
>>>> >> >> >>>> > emulator: Realistic sensor emulation is not available,<br>
>>>> >> >> >>>> > since the<br>
>>>> >> >> >>>> > remote<br>
>>>> >> >> >>>> > controller is not accessible:<br>
>>>> >> >> >>>> > Connection refused<br>
>>>> >> >> >>>> > loading snapshot<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'dalvik.vm.heapsize' =<br>
>>>> >> >> >>>> > '48m'<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'qemu.sf.fake_camera' =<br>
>>>> >> >> >>>> > 'both'<br>
>>>> >> >> >>>> > emulator: Adding boot property: 'qemu.hw.mainkeys' = '0'<br>
>>>> >> >> >>>> > Unknown savevm section or instance 'goldfish_tty' 1<br>
>>>> >> >> >>>> > ... done.<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > Logging all cpu states<br>
>>>> >> >> >>>> > CPU #0:<br>
>>>> >> >> >>>> > R00=00000000 R01=c049bcb8 R02=00000000 R03=00000000<br>
>>>> >> >> >>>> > R04=c0480000 R05=c04b9948 R06=c048fd34 R07=c047b374<br>
>>>> >> >> >>>> > R08=c0a05100 R09=410fc090 R10=00000000 R11=00000000<br>
>>>> >> >> >>>> > R12=c049bcb8 R13=c0481fb0 R14=c000e3f4 R15=c00158c8<br>
>>>> >> >> >>>> > PSR=60000093 -ZC- A svc32<br>
>>>> >> >> >>>> > opening nondet log for read :<br>
>>>> >> >> >>>> > /home/shentanli/pandanew/scripts/api414-4-20-rr-nondet.log<br>
>>>> >> >> >>>> > api414-4-20: 81316759 ( 1.04%) instrs. 7.52 sec.<br>
>>>> >> >> >>>> > 0.61 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 156342747 ( 2.00%) instrs. 15.90 sec.<br>
>>>> >> >> >>>> > 0.69 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 234368551 ( 3.00%) instrs. 24.93 sec.<br>
>>>> >> >> >>>> > 0.76 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 312493247 ( 4.00%) instrs. 35.45 sec.<br>
>>>> >> >> >>>> > 0.83 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 390616091 ( 5.00%) instrs. 43.97 sec.<br>
>>>> >> >> >>>> > 0.87 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 468738195 ( 6.00%) instrs. 49.32 sec.<br>
>>>> >> >> >>>> > 0.90 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 547631582 ( 7.01%) instrs. 54.12 sec.<br>
>>>> >> >> >>>> > 0.93 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 624983872 ( 8.00%) instrs. 57.67 sec.<br>
>>>> >> >> >>>> > 0.94 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 703122355 ( 9.00%) instrs. 60.94 sec.<br>
>>>> >> >> >>>> > 0.94 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > api414-4-20: 783198179 ( 10.03%) instrs. 64.60 sec.<br>
>>>> >> >> >>>> > 0.95 GB<br>
>>>> >> >> >>>> > ram.<br>
>>>> >> >> >>>> > READ Match of str 0 at: instr_count=812336749 : 72a7562e<br>
>>>> >> >> >>>> > b6cb2e02<br>
>>>> >> >> >>>> > 0d36c000<br>
>>>> >> >> >>>> > tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> >> >>>> > tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> >> >>>> > tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> >> >>>> > enabling taint at instr count 812336749<br>
>>>> >> >> >>>> > taint2: __taint_enable_taint<br>
>>>> >> >> >>>> > taint2: Creating byte-level taint processor<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes) @<br>
>>>> >> >> >>>> > 0x10000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes) @<br>
>>>> >> >> >>>> > 0x20000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes) @<br>
>>>> >> >> >>>> > 0x30000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes) @<br>
>>>> >> >> >>>> > 0x40000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes) @<br>
>>>> >> >> >>>> > 0x50000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes) @<br>
>>>> >> >> >>>> > 0x60000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes) @<br>
>>>> >> >> >>>> > 0x70000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes) @<br>
>>>> >> >> >>>> > 0x80000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes) @<br>
>>>> >> >> >>>> > 0x90000000000.<br>
>>>> >> >> >>>> > taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> > Cannot allocate memory<br>
>>>> >> >> >>>> > taint2: Allocating small fast_shad (12800000 bytes) using<br>
>>>> >> >> >>>> > malloc<br>
>>>> >> >> >>>> > @<br>
>>>> >> >> >>>> > 7f8b608d0010.<br>
>>>> >> >> >>>> > taint2: Allocating small fast_shad (256 bytes) using malloc<br>
>>>> >> >> >>>> > @<br>
>>>> >> >> >>>> > 16be2a70.<br>
>>>> >> >> >>>> > taint2: Allocating small fast_shad (1024 bytes) using<br>
>>>> >> >> >>>> > malloc @<br>
>>>> >> >> >>>> > 171c3540.<br>
>>>> >> >> >>>> > taint2: Allocating small fast_shad (867840 bytes) using<br>
>>>> >> >> >>>> > malloc @<br>
>>>> >> >> >>>> > 1720ddd0.<br>
>>>> >> >> >>>> > taint2: Linking taint ops from<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > /home/shentanli/pandanew/qemu/arm-softmmu/panda_plugins/panda_taint2_ops.bc<br>
>>>> >> >> >>>> > taint2: Done initializing taint transformation.<br>
>>>> >> >> >>>> > taint2: Done processing helper functions for taint.<br>
>>>> >> >> >>>> > taint2: Done verifying module. Running...<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > ****************************************************************************<br>
>>>> >> >> >>>> > applying taint labels to search string of length 14 @<br>
>>>> >> >> >>>> > p=0xa70d6212<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > ******************************************************************************<br>
>>>> >> >> >>>> > Segmentation fault<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > 2015-04-20 22:42 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> > <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> >> I am currently running your taint replay, and it is (so<br>
>>>> >> >> >>>> >> far)<br>
>>>> >> >> >>>> >> working<br>
>>>> >> >> >>>> >> fine. Here is the (slightly abbreviated) output I get:<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> api414-4-20: 783198179 ( 10.03%) instrs. 218.26 sec.<br>
>>>> >> >> >>>> >> 0.96<br>
>>>> >> >> >>>> >> GB<br>
>>>> >> >> >>>> >> ram.<br>
>>>> >> >> >>>> >> READ Match of str 0 at: instr_count=812336749 : 72a7562e<br>
>>>> >> >> >>>> >> b6cb2e02<br>
>>>> >> >> >>>> >> 0d36c000<br>
>>>> >> >> >>>> >> tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> >> >>>> >> tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> >> >>>> >> tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> >> >>>> >> enabling taint at instr count 812336749<br>
>>>> >> >> >>>> >> taint2: __taint_enable_taint<br>
>>>> >> >> >>>> >> taint2: Creating byte-level taint processor<br>
>>>> >> >> >>>> >> taint2: Allocating large fast_shad <a href="tel:%288589934592" value="+18589934592" target="_blank">(8589934592</a> bytes).<br>
>>>> >> >> >>>> >> taint2: Hugetlb failed. Trying without.<br>
>>>> >> >> >>>> >> taint2: Allocating small fast_shad (12800000 bytes) using<br>
>>>> >> >> >>>> >> malloc @<br>
>>>> >> >> >>>> >> 7fdd165c6010.<br>
>>>> >> >> >>>> >> taint2: Allocating small fast_shad (256 bytes) using<br>
>>>> >> >> >>>> >> malloc @<br>
>>>> >> >> >>>> >> 7fdd0bec21a0.<br>
>>>> >> >> >>>> >> taint2: Allocating small fast_shad (1024 bytes) using<br>
>>>> >> >> >>>> >> malloc @<br>
>>>> >> >> >>>> >> 7fdcfc49ddc0.<br>
>>>> >> >> >>>> >> taint2: Allocating small fast_shad (867840 bytes) using<br>
>>>> >> >> >>>> >> malloc<br>
>>>> >> >> >>>> >> @<br>
>>>> >> >> >>>> >> 7fdcfc4e7db0.<br>
>>>> >> >> >>>> >> taint2: Linking taint ops from<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> /scratch/git/pandroid/qemu/arm-softmmu/panda_plugins/panda_taint2_ops.bc<br>
>>>> >> >> >>>> >> taint2: Done initializing taint transformation.<br>
>>>> >> >> >>>> >> taint2: Done processing helper functions for taint.<br>
>>>> >> >> >>>> >> taint2: Done verifying module. Running...<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ****************************************************************************<br>
>>>> >> >> >>>> >> applying taint labels to search string of length 14 @<br>
>>>> >> >> >>>> >> p=0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ******************************************************************************<br>
>>>> >> >> >>>> >> READ Match of str 0 at: instr_count=812336765 : 72a7562e<br>
>>>> >> >> >>>> >> b6cb2a2a<br>
>>>> >> >> >>>> >> 0d36c000<br>
>>>> >> >> >>>> >> tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> >> >>>> >> tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> >> >>>> >> tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ****************************************************************************<br>
>>>> >> >> >>>> >> applying taint labels to search string of length 14 @<br>
>>>> >> >> >>>> >> p=0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ******************************************************************************<br>
>>>> >> >> >>>> >> READ Match of str 0 at: instr_count=812337316 : 72a7562e<br>
>>>> >> >> >>>> >> b6cb2e4a<br>
>>>> >> >> >>>> >> 0d36c000<br>
>>>> >> >> >>>> >> tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> >> >>>> >> tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> >> >>>> >> tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ****************************************************************************<br>
>>>> >> >> >>>> >> applying taint labels to search string of length 14 @<br>
>>>> >> >> >>>> >> p=0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ******************************************************************************<br>
>>>> >> >> >>>> >> READ Match of str 0 at: instr_count=812337331 : 72a7562e<br>
>>>> >> >> >>>> >> b6cb2a2a<br>
>>>> >> >> >>>> >> 0d36c000<br>
>>>> >> >> >>>> >> tstringsearch: thestring = [passwordisqemu]<br>
>>>> >> >> >>>> >> tstringsearch: 70 61 73 73 77 6f 72 64 69 73 71 65 6d 75<br>
>>>> >> >> >>>> >> tstringsearch: string in memory @ 0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ****************************************************************************<br>
>>>> >> >> >>>> >> applying taint labels to search string of length 14 @<br>
>>>> >> >> >>>> >> p=0xa70d6212<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> ******************************************************************************<br>
>>>> >> >> >>>> >> api414-4-20: 859399601 ( 11.00%) instrs. 658.13 sec.<br>
>>>> >> >> >>>> >> 3.27<br>
>>>> >> >> >>>> >> GB<br>
>>>> >> >> >>>> >> ram.<br>
>>>> >> >> >>>> >> api414-4-20: 937474512 ( 12.00%) instrs. 1017.48 sec.<br>
>>>> >> >> >>>> >> 4.70<br>
>>>> >> >> >>>> >> GB<br>
>>>> >> >> >>>> >> ram.<br>
>>>> >> >> >>>> >> api414-4-20: 1015597970 ( 13.00%) instrs. 1265.76 sec.<br>
>>>> >> >> >>>> >> 5.58<br>
>>>> >> >> >>>> >> GB<br>
>>>> >> >> >>>> >> ram.<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> My command line to replay was:<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> arm-softmmu/qemu-system-arm -m 512 -replay api414-4-20 -M<br>
>>>> >> >> >>>> >> android_arm<br>
>>>> >> >> >>>> >> -cpu cortex-a9 -android -kernel /dev/null -pandalog<br>
>>>> >> >> >>>> >> api.log<br>
>>>> >> >> >>>> >> -panda<br>
>>>> >> >> >>>> >> 'stringsearch:name=api;tstringsearch;tainted_instr'<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> From the screenshot you posted earlier, it looks like<br>
>>>> >> >> >>>> >> yours had<br>
>>>> >> >> >>>> >> already failed by this point. If you are still getting a<br>
>>>> >> >> >>>> >> segfault<br>
>>>> >> >> >>>> >> with<br>
>>>> >> >> >>>> >> this replay, could you post:<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> 1. The full command line you are using (as text, not a<br>
>>>> >> >> >>>> >> screenshot)<br>
>>>> >> >> >>>> >> 2. The full output from PANDA up to the point where the<br>
>>>> >> >> >>>> >> segfault<br>
>>>> >> >> >>>> >> happens (as text, not a screenshot)<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> -Brendan<br>
>>>> >> >> >>>> >><br>
>>>> >> >> >>>> >> On Mon, Apr 20, 2015 at 7:57 PM, xiaojuan Li<br>
>>>> >> >> >>>> >> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> >> wrote:<br>
>>>> >> >> >>>> >> > i know you are busy.<br>
>>>> >> >> >>>> >> > I just get stuck in this taint step but have no idea no<br>
>>>> >> >> >>>> >> > fix<br>
>>>> >> >> >>>> >> > it...(use<br>
>>>> >> >> >>>> >> > core<br>
>>>> >> >> >>>> >> > dump to find where it segfault )<br>
>>>> >> >> >>>> >> > here is the 512M version:<br>
>>>> >> >> >>>> >> > <a href="http://pan.baidu.com/s/1mgopzIg" target="_blank">http://pan.baidu.com/s/1mgopzIg</a><br>
>>>> >> >> >>>> >> > the content of search string .txt is "passwordisqemu"<br>
>>>> >> >> >>>> >> > thanks!<br>
>>>> >> >> >>>> >> ><br>
>>>> >> >> >>>> >> > 2015-04-20 11:32 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> >> > <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> ><br>
>>>> >> >> >>>> >> >> I will try to reproduce from those instructions in the<br>
>>>> >> >> >>>> >> >> next<br>
>>>> >> >> >>>> >> >> couple<br>
>>>> >> >> >>>> >> >> days.<br>
>>>> >> >> >>>> >> >> Sorry for the delay! Did you post the .rr of the<br>
>>>> >> >> >>>> >> >> recording<br>
>>>> >> >> >>>> >> >> with<br>
>>>> >> >> >>>> >> >> 512M<br>
>>>> >> >> >>>> >> >> somewhere? I only saw the 2G one.<br>
>>>> >> >> >>>> >> >><br>
>>>> >> >> >>>> >> >> Thanks,<br>
>>>> >> >> >>>> >> >> Brendan<br>
>>>> >> >> >>>> >> >><br>
>>>> >> >> >>>> >> >> On Mon, Apr 20, 2015 at 8:07 AM, xiaojuan Li<br>
>>>> >> >> >>>> >> >> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> >> >> wrote:<br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>> about the taint segfault, if you cannot download that<br>
>>>> >> >> >>>> >> >>> .rr i<br>
>>>> >> >> >>>> >> >>> upload<br>
>>>> >> >> >>>> >> >>> before, you can follow the step to reproduce:<br>
>>>> >> >> >>>> >> >>> 1)use android studio to create avd, choose api21<br>
>>>> >> >> >>>> >> >>> target<br>
>>>> >> >> >>>> >> >>> android<br>
>>>> >> >> >>>> >> >>> 5.0.1<br>
>>>> >> >> >>>> >> >>> use<br>
>>>> >> >> >>>> >> >>> the default size;you can get the<br>
>>>> >> >> >>>> >> >>> cache-img,sdcard.img,data.img<br>
>>>> >> >> >>>> >> >>> and<br>
>>>> >> >> >>>> >> >>> system.img and then copy kernel-qemu & rmdisk.img from<br>
>>>> >> >> >>>> >> >>> sdk/systemimg;<br>
>>>> >> >> >>>> >> >>> 2)use pandaCovert.py to convert them and get the<br>
>>>> >> >> >>>> >> >>> (cache,data,system)-pandroid.qcow2 as well as kernel<br>
>>>> >> >> >>>> >> >>> and<br>
>>>> >> >> >>>> >> >>> initramfs;<br>
>>>> >> >> >>>> >> >>> 3)use runpandroid.py(-m 512) to boot emulator;telnet<br>
>>>> >> >> >>>> >> >>> and<br>
>>>> >> >> >>>> >> >>> begin_record<br>
>>>> >> >> >>>> >> >>> 4)run an app and input a string : end_record;<br>
>>>> >> >> >>>> >> >>> 5)use qemu-system-arm to replay(-m 512) with the panda<br>
>>>> >> >> >>>> >> >>> plugins:stringsearch,tstringsearch;tainted_instr.(the<br>
>>>> >> >> >>>> >> >>> search<br>
>>>> >> >> >>>> >> >>> string<br>
>>>> >> >> >>>> >> >>> .txt is<br>
>>>> >> >> >>>> >> >>> the string you input)<br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>> do you guys get the segfault ?<br>
>>>> >> >> >>>> >> >>> how can i fix it?<br>
>>>> >> >> >>>> >> >>> Thanks a lot!<br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>> 2015-04-20 17:51 GMT+08:00 xiaojuan Li<br>
>>>> >> >> >>>> >> >>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>> excuse me, i have noticed that the ida_taint<br>
>>>> >> >> >>>> >> >>>> plugin:"win7<br>
>>>> >> >> >>>> >> >>>> only<br>
>>>> >> >> >>>> >> >>>> but<br>
>>>> >> >> >>>> >> >>>> othre<br>
>>>> >> >> >>>> >> >>>> os could be easily added".<br>
>>>> >> >> >>>> >> >>>> i have installed ida pro in my<br>
>>>> >> >> >>>> >> >>>> system(debian),modified the<br>
>>>> >> >> >>>> >> >>>> ida_taint.bat<br>
>>>> >> >> >>>> >> >>>> with my ida path,when i use it :./ida_taint.bat<br>
>>>> >> >> >>>> >> >>>> name.json<br>
>>>> >> >> >>>> >> >>>> qemu-system-arm<br>
>>>> >> >> >>>> >> >>>> it failed. it seems not available in linux, is it?<br>
>>>> >> >> >>>> >> >>>> Thanks a lot!<br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>> 2015-04-10 21:24 GMT-04:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>> <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>>> Once you have used PANDA's taint system to identify<br>
>>>> >> >> >>>> >> >>>>> the<br>
>>>> >> >> >>>> >> >>>>> portions of<br>
>>>> >> >> >>>> >> >>>>> the<br>
>>>> >> >> >>>> >> >>>>> code that process the data you're interested in, you<br>
>>>> >> >> >>>> >> >>>>> will<br>
>>>> >> >> >>>> >> >>>>> still<br>
>>>> >> >> >>>> >> >>>>> have<br>
>>>> >> >> >>>> >> >>>>> to<br>
>>>> >> >> >>>> >> >>>>> analyze that code do understand how it works. One<br>
>>>> >> >> >>>> >> >>>>> way to<br>
>>>> >> >> >>>> >> >>>>> do<br>
>>>> >> >> >>>> >> >>>>> that<br>
>>>> >> >> >>>> >> >>>>> might be to<br>
>>>> >> >> >>>> >> >>>>> use the scissors plugin to extract out the portion<br>
>>>> >> >> >>>> >> >>>>> of the<br>
>>>> >> >> >>>> >> >>>>> trace<br>
>>>> >> >> >>>> >> >>>>> that<br>
>>>> >> >> >>>> >> >>>>> contains the code you're interested in, and then<br>
>>>> >> >> >>>> >> >>>>> replay<br>
>>>> >> >> >>>> >> >>>>> it<br>
>>>> >> >> >>>> >> >>>>> with<br>
>>>> >> >> >>>> >> >>>>> QEMU's "-d<br>
>>>> >> >> >>>> >> >>>>> in_asm -D asmlog.txt" options to get the disassembly<br>
>>>> >> >> >>>> >> >>>>> for<br>
>>>> >> >> >>>> >> >>>>> that<br>
>>>> >> >> >>>> >> >>>>> code.<br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>>> Alternatively, you could take a memory snapshot at<br>
>>>> >> >> >>>> >> >>>>> some<br>
>>>> >> >> >>>> >> >>>>> point<br>
>>>> >> >> >>>> >> >>>>> when<br>
>>>> >> >> >>>> >> >>>>> the<br>
>>>> >> >> >>>> >> >>>>> code you want to analyze is in memory (using<br>
>>>> >> >> >>>> >> >>>>> something<br>
>>>> >> >> >>>> >> >>>>> like<br>
>>>> >> >> >>>> >> >>>>> the<br>
>>>> >> >> >>>> >> >>>>> pmemsave<br>
>>>> >> >> >>>> >> >>>>> plugin in PANDA), then use Volatility to analyze<br>
>>>> >> >> >>>> >> >>>>> that<br>
>>>> >> >> >>>> >> >>>>> memory<br>
>>>> >> >> >>>> >> >>>>> image<br>
>>>> >> >> >>>> >> >>>>> to<br>
>>>> >> >> >>>> >> >>>>> extract out the binary, which you could look at in<br>
>>>> >> >> >>>> >> >>>>> IDA or<br>
>>>> >> >> >>>> >> >>>>> something<br>
>>>> >> >> >>>> >> >>>>> similar.<br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>>> Basically – disassemble the code that handles the<br>
>>>> >> >> >>>> >> >>>>> data<br>
>>>> >> >> >>>> >> >>>>> you're<br>
>>>> >> >> >>>> >> >>>>> interested in and find out how it works. Exactly<br>
>>>> >> >> >>>> >> >>>>> what<br>
>>>> >> >> >>>> >> >>>>> that<br>
>>>> >> >> >>>> >> >>>>> means<br>
>>>> >> >> >>>> >> >>>>> will depend<br>
>>>> >> >> >>>> >> >>>>> on what you're hoping to accomplish.<br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>>> On Fri, Apr 10, 2015 at 9:07 PM, xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> >> >>>>> wrote:<br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>> Hi,<br>
>>>> >> >> >>>> >> >>>>>> Thanks for your job first.<br>
>>>> >> >> >>>> >> >>>>>> I am a little confused about the result of the<br>
>>>> >> >> >>>> >> >>>>>> tainted.how<br>
>>>> >> >> >>>> >> >>>>>> can<br>
>>>> >> >> >>>> >> >>>>>> I<br>
>>>> >> >> >>>> >> >>>>>> get<br>
>>>> >> >> >>>> >> >>>>>> enough information about the processing code from<br>
>>>> >> >> >>>> >> >>>>>> the<br>
>>>> >> >> >>>> >> >>>>>> binary?<br>
>>>> >> >> >>>> >> >>>>>> use<br>
>>>> >> >> >>>> >> >>>>>> the gdb?<br>
>>>> >> >> >>>> >> >>>>>> Thanks!<br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>> 2015-04-10 12:05 GMT+08:00 xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >>>> >> >>>>>>><br>
>>>> >> >> >>>> >> >>>>>>> Thanks for your guys great work!<br>
>>>> >> >> >>>> >> >>>>>>> and I will try.<br>
>>>> >> >> >>>> >> >>>>>>><br>
>>>> >> >> >>>> >> >>>>>>> 2015-04-10 11:42 GMT+08:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>>>>> <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> Hi,<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> Tim has just updated the tainted_instructions<br>
>>>> >> >> >>>> >> >>>>>>>> tutorial<br>
>>>> >> >> >>>> >> >>>>>>>> so<br>
>>>> >> >> >>>> >> >>>>>>>> that it<br>
>>>> >> >> >>>> >> >>>>>>>> reflects how things work now. Could you look<br>
>>>> >> >> >>>> >> >>>>>>>> through<br>
>>>> >> >> >>>> >> >>>>>>>> that<br>
>>>> >> >> >>>> >> >>>>>>>> tutorial and see<br>
>>>> >> >> >>>> >> >>>>>>>> if it helps with your problem?<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> <a href="https://github.com/moyix/panda/blob/master/docs/tainted_instructions.md" target="_blank">https://github.com/moyix/panda/blob/master/docs/tainted_instructions.md</a><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> Note that you will probably need to do a "git<br>
>>>> >> >> >>>> >> >>>>>>>> pull"<br>
>>>> >> >> >>>> >> >>>>>>>> and<br>
>>>> >> >> >>>> >> >>>>>>>> rebuild<br>
>>>> >> >> >>>> >> >>>>>>>> (make clean ; ./build.sh) in order to make sure<br>
>>>> >> >> >>>> >> >>>>>>>> everything<br>
>>>> >> >> >>>> >> >>>>>>>> works<br>
>>>> >> >> >>>> >> >>>>>>>> as it says<br>
>>>> >> >> >>>> >> >>>>>>>> in the tutorial.<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>> On Thu, Apr 9, 2015 at 9:30 AM, xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> >> >>>>>>>> wrote:<br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>> Now that the panda <a href="http://taint.md" target="_blank">taint.md</a> is not fresh,can you<br>
>>>> >> >> >>>> >> >>>>>>>>> guys<br>
>>>> >> >> >>>> >> >>>>>>>>> give<br>
>>>> >> >> >>>> >> >>>>>>>>> me<br>
>>>> >> >> >>>> >> >>>>>>>>> some<br>
>>>> >> >> >>>> >> >>>>>>>>> help?<br>
>>>> >> >> >>>> >> >>>>>>>>> I use the replay plugin,here is my command and<br>
>>>> >> >> >>>> >> >>>>>>>>> the<br>
>>>> >> >> >>>> >> >>>>>>>>> result.<br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>> the content of pk_search_strings.txt is :"sdt"<br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>> I am confused here:in the paper— Repeatable<br>
>>>> >> >> >>>> >> >>>>>>>>> reverse<br>
>>>> >> >> >>>> >> >>>>>>>>> with<br>
>>>> >> >> >>>> >> >>>>>>>>> panda:<br>
>>>> >> >> >>>> >> >>>>>>>>> :<br>
>>>> >> >> >>>> >> >>>>>>>>> it is clear that:if I use the stringsearch and<br>
>>>> >> >> >>>> >> >>>>>>>>> taint<br>
>>>> >> >> >>>> >> >>>>>>>>> plugin,when<br>
>>>> >> >> >>>> >> >>>>>>>>> it<br>
>>>> >> >> >>>> >> >>>>>>>>> matches, the taint label will be put and then<br>
>>>> >> >> >>>> >> >>>>>>>>> taint<br>
>>>> >> >> >>>> >> >>>>>>>>> action<br>
>>>> >> >> >>>> >> >>>>>>>>> will<br>
>>>> >> >> >>>> >> >>>>>>>>> start.but<br>
>>>> >> >> >>>> >> >>>>>>>>> when I use it, it seems wrong(the picture showed<br>
>>>> >> >> >>>> >> >>>>>>>>> before):no<br>
>>>> >> >> >>>> >> >>>>>>>>> taint action<br>
>>>> >> >> >>>> >> >>>>>>>>> execute,and i am confused about the<br>
>>>> >> >> >>>> >> >>>>>>>>> tstringsearch's<br>
>>>> >> >> >>>> >> >>>>>>>>> result.<br>
>>>> >> >> >>>> >> >>>>>>>>> how can i use it to analysis?<br>
>>>> >> >> >>>> >> >>>>>>>>> Thanks a lot!<br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>> 2015-04-08 10:14 GMT+08:00 xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>> I get the replay file by running runandroid<br>
>>>> >> >> >>>> >> >>>>>>>>>> script.<br>
>>>> >> >> >>>> >> >>>>>>>>>> and<br>
>>>> >> >> >>>> >> >>>>>>>>>> i<br>
>>>> >> >> >>>> >> >>>>>>>>>> use<br>
>>>> >> >> >>>> >> >>>>>>>>>> qemu-system-arm command just to do some replay<br>
>>>> >> >> >>>> >> >>>>>>>>>> work.<br>
>>>> >> >> >>>> >> >>>>>>>>>> I may not understand you at all in this emal.do<br>
>>>> >> >> >>>> >> >>>>>>>>>> you<br>
>>>> >> >> >>>> >> >>>>>>>>>> mean<br>
>>>> >> >> >>>> >> >>>>>>>>>> that i<br>
>>>> >> >> >>>> >> >>>>>>>>>> should gdb the original program rather than the<br>
>>>> >> >> >>>> >> >>>>>>>>>> record<br>
>>>> >> >> >>>> >> >>>>>>>>>> file?<br>
>>>> >> >> >>>> >> >>>>>>>>>> Thansk<br>
>>>> >> >> >>>> >> >>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>> 2015-04-08 9:52 GMT+08:00 Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>>>>>>>> <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> Hmm. gdb should normally stop when you get a<br>
>>>> >> >> >>>> >> >>>>>>>>>>> segfault.<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> Are you by any chance running PANDA using the<br>
>>>> >> >> >>>> >> >>>>>>>>>>> runandroid<br>
>>>> >> >> >>>> >> >>>>>>>>>>> script?<br>
>>>> >> >> >>>> >> >>>>>>>>>>> If so, you will need to instead invoke PANDA<br>
>>>> >> >> >>>> >> >>>>>>>>>>> manually,<br>
>>>> >> >> >>>> >> >>>>>>>>>>> i.e.:<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> gdb --args arm-softmmu/qemu-system-arm [...]<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> And then once it crashes, type "bt" at the gdb<br>
>>>> >> >> >>>> >> >>>>>>>>>>> prompt<br>
>>>> >> >> >>>> >> >>>>>>>>>>> to<br>
>>>> >> >> >>>> >> >>>>>>>>>>> get a<br>
>>>> >> >> >>>> >> >>>>>>>>>>> backtrace.<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>> On Tue, Apr 7, 2015 at 9:47 PM, xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>> wrote:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>> when gdb,it shows:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>> and then i see the log:it shows segfault:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>> 2015-04-08 9:03 GMT+08:00 xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> maybe i am wrong.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> i use the command<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> line:"taint2:label_mode=binary,query_outgoing_network=1"and<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> I found that<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> when i use taint2, after it loads<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> panda_taint2.so,it<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> shows:"taint2:instructed not to inline taint<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> ops<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> .success".<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> 2015-04-08 8:54 GMT+08:00 xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> ok.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> 1.I want to use taint plugin to get<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> information<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> about<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> some<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> functions(of course, it is<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> closed-source),so I<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> think I<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> can<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> stringsearch<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> potential data and then taint them and next<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> I<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> can<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> locate<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> the functions which<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> solves these data.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> 2.the command line I used is :<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> stringsearch:name=***;taint2:tainted_instructions=1.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> thanks<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> 2015-04-08 8:40 GMT+08:00 Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> Could you provide:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> 1. What information you're trying to get<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> 2. The command line you're using to run<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> PANDA<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> with<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> the<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> taint2<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> plugin<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> ?<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> Right now I believe taint2 does not<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> produce<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> very<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> much<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> output<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> by default. Instead you use the -pandalog<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> <filename><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> command line option,<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> and taint2 will write its results there in<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> pandalog<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> format; you can then<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> read them using pandalog_reader (see<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> panda/pandalog_reader.c for details on<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> that tool).<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> On Tue, Apr 7, 2015 at 8:32 PM, xiaojuan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>> wrote:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> when I tried taint2,it showed the same<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> error<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> with<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> taint1,<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> the olny difference is that taint2 has no<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> segfault<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> error,just uninit taint<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> plugin.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> 2015-04-08 8:28 GMT+08:00 Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> Could you be a little more descriptive<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> about<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> how<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> it<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> failed?<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> Segfault? Error message? Incorrect<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> output?<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> On Tue, Apr 7, 2015 at 8:27 PM, xiaojuan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>> wrote:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> i tried taint2 too,it failed.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> 2015-04-07 5:20 GMT+08:00 Leek, Timothy<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> -<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> 0559<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> -<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> MITLL<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> <<a href="mailto:tleek@ll.mit.edu" target="_blank">tleek@ll.mit.edu</a>>:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Also note that the “taint” plugin is<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> somewhat<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> defunct.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> “taint2” is the one we are actively<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> using<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> and<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> developing.<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Tim Leek<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Technical Staff<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Cyber System Assessments<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> MIT Lincoln Laboratory<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> <a href="tel:781-981-2975" value="+17819812975" target="_blank">781-981-2975</a><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> From: Brendan Dolan-Gavitt<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Date: Monday, April 6, 2015 at 5:18 PM<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> To: xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Cc: "<a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a>"<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> <<a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Subject: Re: [panda-users] taint<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> segmentation<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> fault<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> Could you run that under gdb and<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> provide us<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> with<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> a<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> backtrace when it crashes?<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> -Brendan<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> On Sunday, April 5, 2015, xiaojuan Li<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>> wrote:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> Hi,<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> excuse me,i have a question about<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> taint<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> plugin:(stringsearch:name=***;taint:tainted_instructions=1)<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> when I started it showed success:<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> but when it finished search,it showd<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> "uninit<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> taint<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> plugin segementation fault"<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> how can I fix it?<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> Thanks a lot!<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> _______________________________________________<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> panda-users mailing list<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> <a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>> <a href="http://mailman.mit.edu/mailman/listinfo/panda-users" target="_blank">http://mailman.mit.edu/mailman/listinfo/panda-users</a><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>>><br>
>>>> >> >> >>>> >> >>>>>>><br>
>>>> >> >> >>>> >> >>>>>>><br>
>>>> >> >> >>>> >> >>>>>>><br>
>>>> >> >> >>>> >> >>>>>>> --<br>
>>>> >> >> >>>> >> >>>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>><br>
>>>> >> >> >>>> >> >>>>>> --<br>
>>>> >> >> >>>> >> >>>>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>>><br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>><br>
>>>> >> >> >>>> >> >>>> --<br>
>>>> >> >> >>>> >> >>>> wait and hope~~<br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>><br>
>>>> >> >> >>>> >> >>> --<br>
>>>> >> >> >>>> >> >>> wait and hope~~<br>
>>>> >> >> >>>> >> >><br>
>>>> >> >> >>>> >> >><br>
>>>> >> >> >>>> >> ><br>
>>>> >> >> >>>> >> ><br>
>>>> >> >> >>>> >> ><br>
>>>> >> >> >>>> >> > --<br>
>>>> >> >> >>>> >> > wait and hope~~<br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> ><br>
>>>> >> >> >>>> > --<br>
>>>> >> >> >>>> > wait and hope~~<br>
>>>> >> >> >>><br>
>>>> >> >> >>><br>
>>>> >> >> >>><br>
>>>> >> >> >>><br>
>>>> >> >> >>> --<br>
>>>> >> >> >>> wait and hope~~<br>
>>>> >> >> >><br>
>>>> >> >> >><br>
>>>> >> >> >><br>
>>>> >> >> >><br>
>>>> >> >> >> --<br>
>>>> >> >> >> wait and hope~~<br>
>>>> >> >> ><br>
>>>> >> >> ><br>
>>>> >> >> ><br>
>>>> >> >> ><br>
>>>> >> >> > --<br>
>>>> >> >> > wait and hope~~<br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> ><br>
>>>> >> > --<br>
>>>> >> > wait and hope~~<br>
>>>> ><br>
>>>> ><br>
>>>> ><br>
>>>> ><br>
>>>> > --<br>
>>>> > wait and hope~~<br>
>>><br>
>>><br>
>>><br>
>>><br>
>>> --<br>
>>> wait and hope~~<br>
>><br>
>><br>
>><br>
>><br>
>> --<br>
>> wait and hope~~<br>
>><br>
>> _______________________________________________<br>
>> panda-users mailing list<br>
>> <a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a><br>
>> <a href="http://mailman.mit.edu/mailman/listinfo/panda-users" target="_blank">http://mailman.mit.edu/mailman/listinfo/panda-users</a><br>
>><br>
><br>
><br>
><br>
> --<br>
> wait and hope~~<br>
><br>
> _______________________________________________<br>
> panda-users mailing list<br>
> <a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a><br>
> <a href="http://mailman.mit.edu/mailman/listinfo/panda-users" target="_blank">http://mailman.mit.edu/mailman/listinfo/panda-users</a><br>
><span class="HOEnZb"><font color="#888888"><br>
</font></span></div></div></blockquote></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><br>-- <br><div><div dir="ltr">wait and hope~~</div></div>
</font></span></div>
</blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr">wait and hope~~</div></div>
</div>