<div dir="ltr">Cool, thanks! <br></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Jun 21, 2018 at 10:50 AM Brendan Dolan-Gavitt <<a href="mailto:brendandg@nyu.edu">brendandg@nyu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Yes; have a look at the "osi" plugin, which provides an API for<br>
getting information about the current process, its libraries, etc. An<br>
example use of the API can be found in the "asidstory" and "osi_test"<br>
plugins.<br>
<br>
On Wed, Jun 20, 2018 at 10:04 PM, shuai xi <<a href="mailto:ahahanamea@gmail.com" target="_blank">ahahanamea@gmail.com</a>> wrote:<br>
> Thank you for answering my question. You say that there is a way to<br>
> enabling and disabling the taint system so that it's only active when the<br>
> process you want is running. So, is there some ways to know what the current<br>
> process's name or pid when replaying logs. I need some information like that<br>
> to decide the place where the taint analysis should be enabled or not. Can I<br>
> get this information from panda2 or qemu APIs?<br>
><br>
> On Thu, Jun 21, 2018 at 9:09 AM shuai xi <<a href="mailto:ahahanamea@gmail.com" target="_blank">ahahanamea@gmail.com</a>> wrote:<br>
>><br>
>> Cool, thanks!<br>
>><br>
>> On Wed, Jun 20, 2018 at 11:22 PM Manolis Stamatogiannakis<br>
>> <<a href="mailto:mstamat@gmail.com" target="_blank">mstamat@gmail.com</a>> wrote:<br>
>>><br>
>>> Given the opportunity, a small update on my work on turning taint<br>
>>> analysis on/off.<br>
>>><br>
>>> Plan A was to switch between LLVM/TCG when taint analysis is on/off.<br>
>>> There are some waning comments in PANDA code that this should not work<br>
>>> because of a bug in the LLVM pass registration code. But before reaching<br>
>>> that point, I believe I've hit a different bug. The bug seems to be<br>
>>> allocation-related and I haven't been able to resolve it for some time now.<br>
>>><br>
>>> So I'll probably switch to plan B, which is to stay in LLVM mode after<br>
>>> taint analysis has been enabled and only switch off taint propagation when<br>
>>> it is not needed.<br>
>>><br>
>>> I'll try to send a PR with what I've done in the following days. In the<br>
>>> meantime, my working branch is here:<br>
>>> <a href="https://github.com/m000/panda/tree/taint2-wip" rel="noreferrer" target="_blank">https://github.com/m000/panda/tree/taint2-wip</a><br>
>>><br>
>>> M.<br>
>>><br>
>>><br>
>>> Στις Τετ, 20 Ιουν 2018 στις 5:03 μ.μ., ο/η Brendan Dolan-Gavitt<br>
>>> <<a href="mailto:brendandg@nyu.edu" target="_blank">brendandg@nyu.edu</a>> έγραψε:<br>
>>>><br>
>>>> There is no way to record just a single process. However, if the<br>
>>>> recording is too large you can use the "scissors" plugin to chop it<br>
>>>> down to just the part you care about. Also, I think Manolis<br>
>>>> Stamatogiannakis has done some work on selectively enabling and<br>
>>>> disabling the taint system so that it's only active when the process<br>
>>>> you want is running, but I don't know if that work is publicly<br>
>>>> available yet.<br>
>>>><br>
>>>> -Brendan<br>
>>>><br>
>>>> On Wed, Jun 20, 2018 at 3:39 AM, shuai xi <<a href="mailto:ahahanamea@gmail.com" target="_blank">ahahanamea@gmail.com</a>> wrote:<br>
>>>> > hello developer, i want to use panda2 plugins like 'taint2' to<br>
>>>> > analysis a<br>
>>>> > program. But the 'record' function records whole system. i want to<br>
>>>> > just<br>
>>>> > focus on this program's process and use the process's virtual address<br>
>>>> > to<br>
>>>> > taint a buffer of memory. Dose panda2 provide this functionality?<br>
>>>> ><br>
>>>> > _______________________________________________<br>
>>>> > panda-users mailing list<br>
>>>> > <a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a><br>
>>>> > <a href="http://mailman.mit.edu/mailman/listinfo/panda-users" rel="noreferrer" target="_blank">http://mailman.mit.edu/mailman/listinfo/panda-users</a><br>
>>>> ><br>
>>>><br>
>>>><br>
>>>><br>
>>>> --<br>
>>>> Brendan Dolan-Gavitt<br>
>>>> Assistant Professor, Department of Computer Science and Engineering<br>
>>>> NYU Tandon School of Engineering<br>
>>>> _______________________________________________<br>
>>>> panda-users mailing list<br>
>>>> <a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a><br>
>>>> <a href="http://mailman.mit.edu/mailman/listinfo/panda-users" rel="noreferrer" target="_blank">http://mailman.mit.edu/mailman/listinfo/panda-users</a><br>
<br>
<br>
<br>
-- <br>
Brendan Dolan-Gavitt<br>
Assistant Professor, Department of Computer Science and Engineering<br>
NYU Tandon School of Engineering<br>
</blockquote></div>