<div dir="ltr"><div>sorry, i take the wrong version of my test file...<br></div>i am going to upload the right one.<br></div><div class="gmail_extra"><br><div class="gmail_quote">2015-04-13 10:05 GMT-04:00 xiaojuan Li <span dir="ltr"><<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div><div>yeah,i did not get seg fault when i reproduce the tainted instructions tutorial.<br></div><span class="">Thanks for your patience very much!<br></span></div>your guys' work is great! do not say sorry.<br><br></div>my command line is:(in /qemu/arm-softmmu directory)./qemu-system-arm -m 2G -replay ime4-13 -M android_arm -kernel /dev/null -android -panda "stringsearch:name=1;tstringsearch;tainted_instr";<br></div>the content of 1_search_strings.txt is: "cipher";<br></div>here is my .rr file:<br><a href="http://pan.baidu.com/s/1gdCfTSn" target="_blank">http://pan.baidu.com/s/1gdCfTSn</a> <br></div>(sorry for taking so long time to upload .rr)<br><br></div>Thanks again!<br><div><div><div><div><div><br></div></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-04-13 8:58 GMT-04:00 Leek, Timothy - 0559 - MITLL <span dir="ltr"><<a href="mailto:tleek@ll.mit.edu" target="_blank">tleek@ll.mit.edu</a>></span>:<div><div class="h5"><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div style="direction:ltr;font-family:Tahoma;color:#000000;font-size:10pt">Uninit taint plugin *should* display at the end of the run. That is not an error. It is just a message. You aren't getting a seg fault when you reproduce the tainted instructions
tutorial, though. Right? <br>
<br>
I don't know what's wrong with your android run. We could try to reproduce and debug. Can you give us your replay? Package it up with scripts/rrpack.py. Stick the .rr file somewhere we can get it. And give us your complete command line. And the string
search file. <br>
<br>
That said -- we are fairly swamped right now. So might take a bit. Sorry!<br>
<br>
Cheers.<br>
<br>
Tim<br>
<br>
<div style="font-family:Times New Roman;color:#000000;font-size:16px">
<hr>
<div style="direction:ltr"><font color="#000000" face="Tahoma" size="2"><b>From:</b> xiaojuan Li [<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>]<br>
<b>Sent:</b> Monday, April 13, 2015 8:27 AM<br>
<b>To:</b> Leek, Timothy - 0559 - MITLL; <a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a>; Brendan Dolan-Gavitt<div><div><br>
<b>Subject:</b> Re: [panda-users] taint segmentation fault<br>
</div></div></font><br>
</div><div><div>
<div></div>
<div>
<div dir="ltr">
<div>
<div>
<div>let me describe how can i get my test snp:<br>
</div>
first i boot android emulator,begin_record, do some operations in emulator,end_record. then i use it to replay to taint the data i input before.<br>
</div>
(by the way, though i can get the result of the tutorial,it shows "uninit taint plugin" end of the result).<br>
</div>
Thanks!<br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">2015-04-13 8:14 GMT-04:00 xiaojuan Li <span dir="ltr"><<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div>Thanks first. <br>
</div>
I tried it before and can get the result described in the tutorial,but when turn to my snp, it still shows "segfault".<br>
<br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">2015-04-13 7:26 GMT-04:00 Leek, Timothy - 0559 - MITLL <span dir="ltr">
<<a href="mailto:tleek@ll.mit.edu" target="_blank">tleek@ll.mit.edu</a>></span>:
<div>
<div><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>
<div>Maybe try git pull. Then make distclean in qemu dir. Then make. Then try the tutorial. Should work. </div>
<span>
<div>
<div>--</div>
<div>Tim Leek</div>
<div>Technical Staff</div>
<div>Cyber System Assessments</div>
<div>MIT Lincoln Laboratory</div>
<div><a href="tel:781-981-2975" value="+17819812975" target="_blank">781-981-2975</a></div>
<div><br>
</div>
</div>
</span></div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;border-bottom:medium none;border-left:medium none;padding-bottom:0in;padding-left:0in;padding-right:0in;border-top:#b5c4df 1pt solid;border-right:medium none;padding-top:3pt">
<span style="font-weight:bold">From: </span>xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Sunday, April 12, 2015 at 11:41 PM<br>
<span style="font-weight:bold">To: </span>Brendan Dolan-Gavitt <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>, "<a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a>" <<a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a>>
<div>
<div><br>
<span style="font-weight:bold">Subject: </span>Re: [panda-users] taint segmentation fault<br>
</div>
</div>
</div>
<div>
<div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">yeah.i fail to taint both in using sshkeygen and my test snp.
<div>here is the result of following the steps in the tutorial:<br>
<div><img src="cid:ii_i8fbyz2t0_14cb0dd5dd523760" height="447" width="472"></div>
<div>Thanks!<br>
<br>
</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">2015-04-13 11:34 GMT+08:00 Brendan Dolan-Gavitt <span dir="ltr">
<<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Are you able to follow the steps in the tutorial (using the sshkeygen<br>
replay)? Or does that fail as well?<br>
<span><font color="#888888"><br>
-Brendan<br>
</font></span>
<div>
<div><br>
On Sun, Apr 12, 2015 at 11:27 PM, xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>> wrote:<br>
> thanks first. i cannot either.<br>
> just segfault while tainting.<br>
><br>
><br>
> 2015-04-13 4:52 GMT+08:00 Leek, Timothy - 0559 - MITLL <<a href="mailto:tleek@ll.mit.edu" target="_blank">tleek@ll.mit.edu</a>>:<br>
>><br>
>> Also, just a check. Are you able to reproduce the results here?<br>
>><br>
>> <a href="https://github.com/moyix/panda/blob/master/docs/tainted_instructions.md" target="_blank">
https://github.com/moyix/panda/blob/master/docs/tainted_instructions.md</a><br>
>><br>
>> --<br>
>> Tim Leek<br>
>> Technical Staff<br>
>> Cyber System Assessments<br>
>> MIT Lincoln Laboratory<br>
>> <a href="tel:781-981-2975" value="+17819812975" target="_blank">781-981-2975</a><br>
>><br>
>><br>
>> From: Brendan Dolan-Gavitt <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>><br>
>> Date: Sunday, April 12, 2015 at 4:04 PM<br>
>><br>
>> To: xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>> Cc: "<a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a>" <<a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a>><br>
>> Subject: Re: [panda-users] taint segmentation fault<br>
>><br>
>> A few things:<br>
>><br>
>> 1. Did you make sure to do a make clean and then re-run build.sh after<br>
>> updating? I got a segfault just after taint was turned on as well until I<br>
>> did a make clean and re-ran build.sh.<br>
>> 2. Are you running this on a 64-bit system? What kernel version?<br>
>><br>
>> -Brendan<br>
>><br>
>> On Sun, Apr 12, 2015 at 9:16 AM, xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>> wrote:<br>
>>><br>
>>> any suggestions? about segmentation fault?<br>
>>> and after my test,I make sure it is not caused by insufficient memory.<br>
>>> Thanks a lot!<br>
>>><br>
>>> 2015-04-11 11:59 GMT+08:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>><br>
>>>> excuse me:<br>
>>>> I try to fix the segmentation error:<br>
</div>
</div>
<span>>>>> and find this piece of code:<br>
>>>><br>
</span><span>>>>> do you mean that it doesn't support so large byte?or it doesn't support<br>
>>>> for android arm?<br>
>>>> in the doc I noticed that network tainting is not supported for arm<br>
>>>> architecture,and the string I tainted was something may go through the<br>
>>>> network.<br>
>>>><br>
>>>> Thanks!<br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>> 2015-04-09 21:30 GMT+08:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>>><br>
>>>>> Now that the panda <a href="http://taint.md" target="_blank">taint.md</a> is not fresh,can you guys give me some<br>
>>>>> help?<br>
>>>>> I use the replay plugin,here is my command and the result.<br>
>>>>><br>
>>>>><br>
>>>>><br>
>>>>><br>
>>>>><br>
</span><span>>>>>> the content of pk_search_strings.txt is :"sdt"<br>
>>>>><br>
>>>>> I am confused here:in the paper— Repeatable reverse with panda:<br>
>>>>> :<br>
</span><span>>>>>> it is clear that:if I use the stringsearch and taint plugin,when it<br>
>>>>> matches, the taint label will be put and then taint action will start.but<br>
>>>>> when I use it, it seems wrong(the picture showed before):no taint action<br>
>>>>> execute,and i am confused about the tstringsearch's result.<br>
>>>>> how can i use it to analysis?<br>
>>>>> Thanks a lot!<br>
>>>>><br>
>>>>><br>
>>>>> 2015-04-08 10:14 GMT+08:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>>>><br>
>>>>>> I get the replay file by running runandroid script. and i use<br>
>>>>>> qemu-system-arm command just to do some replay work.<br>
>>>>>> I may not understand you at all in this emal.do you mean that i should<br>
>>>>>> gdb the original program rather than the record file?<br>
>>>>>> Thansk<br>
>>>>>><br>
>>>>>> 2015-04-08 9:52 GMT+08:00 Brendan Dolan-Gavitt <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>>>>><br>
>>>>>>> Hmm. gdb should normally stop when you get a segfault.<br>
>>>>>>><br>
>>>>>>> Are you by any chance running PANDA using the runandroid script? If<br>
>>>>>>> so, you will need to instead invoke PANDA manually, i.e.:<br>
>>>>>>><br>
>>>>>>> gdb --args arm-softmmu/qemu-system-arm [...]<br>
>>>>>>><br>
>>>>>>> And then once it crashes, type "bt" at the gdb prompt to get a<br>
>>>>>>> backtrace.<br>
>>>>>>><br>
>>>>>>> -Brendan<br>
>>>>>>><br>
>>>>>>> On Tue, Apr 7, 2015 at 9:47 PM, xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>>>>> wrote:<br>
>>>>>>>><br>
>>>>>>>> when gdb,it shows:<br>
</span><span>>>>>>>>> and then i see the log:it shows segfault:<br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>><br>
</span>
<div>
<div>>>>>>>>> 2015-04-08 9:03 GMT+08:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>>>>>>><br>
>>>>>>>>> maybe i am wrong.<br>
>>>>>>>>> i use the command<br>
>>>>>>>>> line:"taint2:label_mode=binary,query_outgoing_network=1"and I found that<br>
>>>>>>>>> when i use taint2, after it loads panda_taint2.so,it<br>
>>>>>>>>> shows:"taint2:instructed not to inline taint ops .success".<br>
>>>>>>>>><br>
>>>>>>>>> 2015-04-08 8:54 GMT+08:00 xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>>:<br>
>>>>>>>>>><br>
>>>>>>>>>> ok.<br>
>>>>>>>>>> 1.I want to use taint plugin to get information about some<br>
>>>>>>>>>> functions(of course, it is closed-source),so I think I can stringsearch<br>
>>>>>>>>>> potential data and then taint them and next I can locate the functions which<br>
>>>>>>>>>> solves these data.<br>
>>>>>>>>>><br>
>>>>>>>>>> 2.the command line I used is :<br>
>>>>>>>>>> stringsearch:name=***;taint2:tainted_instructions=1.<br>
>>>>>>>>>><br>
>>>>>>>>>> thanks<br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>> 2015-04-08 8:40 GMT+08:00 Brendan Dolan-Gavitt<br>
>>>>>>>>>> <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>>>>>>>>><br>
>>>>>>>>>>> Could you provide:<br>
>>>>>>>>>>><br>
>>>>>>>>>>> 1. What information you're trying to get<br>
>>>>>>>>>>> 2. The command line you're using to run PANDA with the taint2<br>
>>>>>>>>>>> plugin<br>
>>>>>>>>>>><br>
>>>>>>>>>>> ?<br>
>>>>>>>>>>><br>
>>>>>>>>>>> Right now I believe taint2 does not produce very much output by<br>
>>>>>>>>>>> default. Instead you use the -pandalog <filename> command line option, and<br>
>>>>>>>>>>> taint2 will write its results there in pandalog format; you can then read<br>
>>>>>>>>>>> them using pandalog_reader (see panda/pandalog_reader.c for details on that<br>
>>>>>>>>>>> tool).<br>
>>>>>>>>>>><br>
>>>>>>>>>>> -Brendan<br>
>>>>>>>>>>><br>
>>>>>>>>>>> On Tue, Apr 7, 2015 at 8:32 PM, xiaojuan Li<br>
>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>> wrote:<br>
>>>>>>>>>>>><br>
>>>>>>>>>>>> when I tried taint2,it showed the same error with taint1, the<br>
>>>>>>>>>>>> olny difference is that taint2 has no segfault error,just uninit taint<br>
>>>>>>>>>>>> plugin.<br>
>>>>>>>>>>>><br>
>>>>>>>>>>>> 2015-04-08 8:28 GMT+08:00 Brendan Dolan-Gavitt<br>
>>>>>>>>>>>> <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>>:<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> Could you be a little more descriptive about how it failed?<br>
>>>>>>>>>>>>> Segfault? Error message? Incorrect output?<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> -Brendan<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> On Tue, Apr 7, 2015 at 8:27 PM, xiaojuan Li<br>
>>>>>>>>>>>>> <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>> wrote:<br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>> i tried taint2 too,it failed.<br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>> 2015-04-07 5:20 GMT+08:00 Leek, Timothy - 0559 - MITLL<br>
>>>>>>>>>>>>>> <<a href="mailto:tleek@ll.mit.edu" target="_blank">tleek@ll.mit.edu</a>>:<br>
>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>> Also note that the “taint” plugin is somewhat defunct.<br>
>>>>>>>>>>>>>>> “taint2” is the one we are actively using and developing.<br>
>>>>>>>>>>>>>>> --<br>
>>>>>>>>>>>>>>> Tim Leek<br>
>>>>>>>>>>>>>>> Technical Staff<br>
>>>>>>>>>>>>>>> Cyber System Assessments<br>
>>>>>>>>>>>>>>> MIT Lincoln Laboratory<br>
>>>>>>>>>>>>>>> <a href="tel:781-981-2975" value="+17819812975" target="_blank">781-981-2975</a><br>
>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>> From: Brendan Dolan-Gavitt <<a href="mailto:brendandg@gatech.edu" target="_blank">brendandg@gatech.edu</a>><br>
>>>>>>>>>>>>>>> Date: Monday, April 6, 2015 at 5:18 PM<br>
>>>>>>>>>>>>>>> To: xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>>>>>>>>>>>>> Cc: "<a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a>" <<a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a>><br>
>>>>>>>>>>>>>>> Subject: Re: [panda-users] taint segmentation fault<br>
>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>> Could you run that under gdb and provide us with a backtrace<br>
>>>>>>>>>>>>>>> when it crashes?<br>
>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>> -Brendan<br>
>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>> On Sunday, April 5, 2015, xiaojuan Li <<a href="mailto:xiaotan6666@gmail.com" target="_blank">xiaotan6666@gmail.com</a>><br>
>>>>>>>>>>>>>>> wrote:<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> Hi,<br>
>>>>>>>>>>>>>>>> excuse me,i have a question about taint<br>
>>>>>>>>>>>>>>>> plugin:(stringsearch:name=***;taint:tainted_instructions=1)<br>
>>>>>>>>>>>>>>>> when I started it showed success:<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
</div>
</div>
<span>>>>>>>>>>>>>>>>> but when it finished search,it showd "uninit taint plugin<br>
>>>>>>>>>>>>>>>> segementation fault"<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
</span>
<div>
<div>>>>>>>>>>>>>>>>> how can I fix it?<br>
>>>>>>>>>>>>>>>> Thanks a lot!<br>
>>>>>>>>>>>>>>>> --<br>
>>>>>>>>>>>>>>>> wait and hope~~<br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>> --<br>
>>>>>>>>>>>>>> wait and hope~~<br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>> _______________________________________________<br>
>>>>>>>>>>>>>> panda-users mailing list<br>
>>>>>>>>>>>>>> <a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a><br>
>>>>>>>>>>>>>> <a href="http://mailman.mit.edu/mailman/listinfo/panda-users" target="_blank">
http://mailman.mit.edu/mailman/listinfo/panda-users</a><br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>><br>
>>>>>>>>>>>><br>
>>>>>>>>>>>><br>
>>>>>>>>>>>> --<br>
>>>>>>>>>>>> wait and hope~~<br>
>>>>>>>>>>><br>
>>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>> --<br>
>>>>>>>>>> wait and hope~~<br>
>>>>>>>>><br>
>>>>>>>>><br>
>>>>>>>>><br>
>>>>>>>>><br>
>>>>>>>>> --<br>
>>>>>>>>> wait and hope~~<br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>> --<br>
>>>>>>>> wait and hope~~<br>
>>>>>>><br>
>>>>>>><br>
>>>>>><br>
>>>>>><br>
>>>>>><br>
>>>>>> --<br>
>>>>>> wait and hope~~<br>
>>>>><br>
>>>>><br>
>>>>><br>
>>>>><br>
>>>>> --<br>
>>>>> wait and hope~~<br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>> --<br>
>>>> wait and hope~~<br>
>>><br>
>>><br>
>>><br>
>>><br>
>>> --<br>
>>> wait and hope~~<br>
>><br>
>><br>
><br>
><br>
><br>
> --<br>
> wait and hope~~<br>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div>
<div dir="ltr">wait and hope~~</div>
</div>
</div>
</div>
</div>
</div>
</div>
</span></div>
</blockquote>
</div>
</div>
</div>
<span><font color="#888888"><br>
<br clear="all">
<br>
-- <br>
<div>
<div dir="ltr">wait and hope~~</div>
</div>
</font></span></div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<div>
<div dir="ltr">wait and hope~~</div>
</div>
</div>
</div>
</div></div></div>
</div>
</div>
</blockquote></div></div></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><br>-- <br><div><div dir="ltr">wait and hope~~</div></div>
</font></span></div>
</blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr">wait and hope~~</div></div>
</div>