<div dir="ltr">Ah, yes. This sounds right.<div><br></div><div>I had also observed the delayed update of kernel data structures. This happens when a new process starts. Most of the OsiProc fields were correct at the callback time, but the process name was still that of the parent process.</div><div><br></div><div>For my plugin, I opted to mark the new process as "fresh" and update the name next time I see the process.</div><div><br></div><div>Thanks!</div><div><br></div><div>M.</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-07-17 19:34 GMT+02:00 Brendan Dolan-Gavitt <span dir="ltr"><<a href="mailto:brendandg@nyu.edu" target="_blank">brendandg@nyu.edu</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I *think* the reasoning was that right when PGD_CHANGED happens the<br>
data structures that track the current process may be in transition,<br>
and so it might not be reliable to get the current process. But I<br>
don't know if this was actually tested. According to git-blame, Tim is<br>
the one to ask, so hopefully he'll weigh in.<br>
<br>
It should also be easy enough to test this hypothesis by switching it<br>
to PGD_CHANGED on a few test cases an seeing if the results match up.<br>
If we can get away with only invoking on PGD change that would<br>
definitely be an improvement.<br>
<br>
-Brendan<br>
<div><div class="h5"><br>
On Sun, Jul 17, 2016 at 1:20 PM, Manolis Stamatogiannakis<br>
<<a href="mailto:mstamat@gmail.com">mstamat@gmail.com</a>> wrote:<br>
> Hello,<br>
><br>
> I was going through the file_taint plugin code and was wondering about the<br>
> osi_foo() callback.<br>
> <a href="https://github.com/moyix/panda/blob/master/qemu/panda_plugins/file_taint/file_taint.cpp#L386" rel="noreferrer" target="_blank">https://github.com/moyix/panda/blob/master/qemu/panda_plugins/file_taint/file_taint.cpp#L386</a><br>
><br>
> Is there any reason that the function is hooked as a<br>
> PANDA_CB_BEFORE_BLOCK_EXEC callback rather than PANDA_CB_VMI_PGD_CHANGED<br>
> callback?<br>
><br>
> For linux it seems to me that PANDA_CB_VMI_PGD_CHANGED would yield<br>
> equivalent results at only a tiny fraction of the invocations.<br>
><br>
> Same should be true for windows as far as I can tell.<br>
><br>
> Thanks,<br>
> M.<br>
><br>
</div></div>> _______________________________________________<br>
> panda-users mailing list<br>
> <a href="mailto:panda-users@mit.edu">panda-users@mit.edu</a><br>
> <a href="http://mailman.mit.edu/mailman/listinfo/panda-users" rel="noreferrer" target="_blank">http://mailman.mit.edu/mailman/listinfo/panda-users</a><br>
><br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
--<br>
Brendan Dolan-Gavitt<br>
Assistant Professor, Department of Computer Science and Engineering<br>
NYU Tandon School of Engineering<br>
</font></span></blockquote></div><br></div>