<div dir="ltr">OK, I see what's going on. It looks like you are running a 32-bit guest under qemu-system-x86_64. I think this should work (i.e., that assertion in file_taint is wrong), but it is not as well-tested, which may be why it's disabled.<div><br></div><div>Your second attempt, replaying a recording made under qemu-system-x86_64 using qemu-system-i386, won't work – the two machine definitions are incompatible.</div><div><br></div><div>What should work is to boot the VM and create the recording under qemu-system-i386, then replay it under qemu-system-i386 as well.</div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Dec 20, 2018 at 12:04 PM Vikas Puri <<a href="mailto:vpurinet@gmail.com">vpurinet@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div><div>Hi Mark,<br><br></div>I get a different error when I attempt to run with qemu-system-i386. This is shown below:<br><br><div style="margin-left:40px">$PANDA_PATH/i386-softmmu/qemu-system-i386 -replay append_file_3 -os linux-32-ubuntu:4.4.0-131-generic -panda osi -m 4096 -panda osi_linux:kconf_group=ubuntu:4.4.0-131-generic:32 -panda file_taint:filename=test.txt<br>PANDA[core]:os_familyno=2 bits=32 os_details=ubuntu:4.4.0-131-generic<br>PANDA[osi_linux]:adding argument kconf_group=ubuntu:4.4.0-131-generic:32.<br>PANDA[file_taint]:adding argument filename=test.txt.<br>PANDA[core]:initializing osi<br>Looking for kconffile in /home/hackuser5/panda/panda/build/i386-softmmu/panda/plugins/osi_linux/kernelinfo.conf<br>OSI grabbing Linux introspection backend.<br>Linux OSI, using group ubuntu:4.4.0-131-generic:32 from /home/hackuser5/panda/panda/build/i386-softmmu/panda/plugins/osi_linux/kernelinfo.conf.<br>PANDA[core]:loading required plugin osi_linux<br>PANDA[core]:initializing osi_linux<br>PANDA[osi_linux]:W> kernelinfo bytes [76-79] not read<br>PANDA[osi_linux]:W> kernelinfo bytes [92-95] not read<br>PANDA[core]:/home/hackuser5/panda/panda/build/i386-softmmu/panda/plugins/panda_osi_linux.so already loaded<br>PANDA[core]:initializing file_taint<br>PANDA[core]:loading required plugin syscalls2<br>PANDA[core]:initializing syscalls2<br>PANDA[syscalls2]:using profile for linux x86 32-bit<br>PANDA[core]:loading required plugin osi<br>PANDA[core]:/home/hackuser5/panda/panda/build/i386-softmmu/panda/plugins/panda_osi.so already loaded<br>PANDA[core]:loading required plugin taint2<br>PANDA[core]:initializing taint2<br>PANDA[taint2]:propagation via pointer dereference ENABLED<br>PANDA[taint2]:taint operations inlining DISABLED<br>PANDA[taint2]:llvm optimizations DISABLED<br>PANDA[taint2]:taint debugging DISABLED<br>PANDA[taint2]:detaint if control bits 0 DISABLED<br>PANDA[taint2]:maximum taint compute number (0=unlimited) 0<br>PANDA[taint2]:maximum taintset cardinality (0=unlimited) 0<br>PANDA[core]:loading required plugin callstack_instr<br>PANDA[core]:initializing callstack_instr<br>PANDA[core]:loading required plugin osi_linux<br>PANDA[core]:/home/hackuser5/panda/panda/build/i386-softmmu/panda/plugins/panda_osi_linux.so already loaded<br>loading snapshot<br><b>qemu-system-i386: Missing section footer for cpu</b><br>Failed to load vmstate<br>Failed to start replay<br><br></div></div>-Vikas<br></div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Dec 20, 2018 at 8:34 AM Mankins, Mark A [US] (MS) <<a href="mailto:mark.mankins@ngc.com" target="_blank">mark.mankins@ngc.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr" style="font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255);font-family:Calibri,Arial,Helvetica,sans-serif">
<p>I believe this is the expected behavior. Try running with qemu-system-i386 instead of qemu-system-x86_64.</p>
<p> </p>
<p>Mark</p>
<div style="color:rgb(33,33,33)">
<hr style="width:98%;display:inline-block">
<div id="gmail-m_7811210436381441676gmail-m_6871187686345147799divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> <a href="mailto:panda-users-bounces@mit.edu" target="_blank">panda-users-bounces@mit.edu</a> <<a href="mailto:panda-users-bounces@mit.edu" target="_blank">panda-users-bounces@mit.edu</a>> on behalf of Vikas Puri <<a href="mailto:vpurinet@gmail.com" target="_blank">vpurinet@gmail.com</a>><br>
<b>Sent:</b> Thursday, December 20, 2018 9:18 AM<br>
<b>To:</b> Brendan Dolan-Gavitt<br>
<b>Cc:</b> <a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a><br>
<b>Subject:</b> EXT :Re: [panda-users] Question about file_taint</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div>
<div>
<div>Hi Brendan,<br>
<br>
</div>
Sorry for the late reply. Here is the information that you requested. I appreciate your help.
<br>
</div>
<br>
</div>
<b>Guest OS</b>:<br>
<ul>
<li>ubuntu 4.4.0-31-generic i686</li></ul>
<p><b>Host OS:</b></p>
<ul>
<li>Ubuntu 4.4.0-31-generic x86_64 x86_64 <br>
</li></ul>
<p><b>Command Executed on Host</b>:</p>
<ul>
<li>$PANDA_PATH/x86_64-softmmu/qemu-system-x86_64 -replay append_file_3 -os linux-32-ubuntu:4.4.0-131-generic -panda osi -m 4096 -panda osi_linux:kconf_group=ubuntu:4.4.0-131-generic:32 -panda file_taint:filename=test.txt</li></ul>
<p><b>Error reported on Host:</b></p>
<p style="margin-left:40px">PANDA[core]:os_familyno=2 bits=32 os_details=ubuntu:4.4.0-131-generic<br>
PANDA[osi_linux]:adding argument kconf_group=ubuntu:4.4.0-131-generic:32.<br>
PANDA[file_taint]:adding argument filename=test.txt.<br>
PANDA[core]:initializing osi<br>
Looking for kconffile in /home/hackuser5/panda/panda/build/x86_64-softmmu/panda/plugins/osi_linux/kernelinfo.conf<br>
OSI grabbing Linux introspection backend.<br>
Linux OSI, using group ubuntu:4.4.0-131-generic:32 from /home/hackuser5/panda/panda/build/x86_64-softmmu/panda/plugins/osi_linux/kernelinfo.conf.<br>
PANDA[core]:loading required plugin osi_linux<br>
PANDA[core]:initializing osi_linux<br>
PANDA[osi_linux]:W> kernelinfo bytes [76-79] not read<br>
PANDA[osi_linux]:W> kernelinfo bytes [92-95] not read<br>
PANDA[core]:/home/hackuser5/panda/panda/build/x86_64-softmmu/panda/plugins/panda_osi_linux.so already loaded<br>
PANDA[core]:initializing file_taint<br>
PANDA[core]:loading required plugin syscalls2<br>
PANDA[core]:initializing syscalls2<br>
PANDA[syscalls2]:using profile for linux x86 32-bit<br>
PANDA[core]:loading required plugin osi<br>
PANDA[core]:/home/hackuser5/panda/panda/build/x86_64-softmmu/panda/plugins/panda_osi.so already loaded<br>
PANDA[core]:loading required plugin taint2<br>
PANDA[core]:initializing taint2<br>
PANDA[taint2]:propagation via pointer dereference ENABLED<br>
PANDA[taint2]:taint operations inlining DISABLED<br>
PANDA[taint2]:llvm optimizations DISABLED<br>
PANDA[taint2]:taint debugging DISABLED<br>
PANDA[taint2]:detaint if control bits 0 DISABLED<br>
PANDA[taint2]:maximum taint compute number (0=unlimited) 0<br>
PANDA[taint2]:maximum taintset cardinality (0=unlimited) 0<br>
PANDA[core]:loading required plugin callstack_instr<br>
PANDA[core]:initializing callstack_instr<br>
<b>ERROR: Linux is only supported on x86 (32-bit)</b><br>
FAIL: Unable to load plugin `/home/hackuser5/panda/panda/build/x86_64-softmmu/panda/plugins/panda_file_taint.so'<br>
</p>
<p>-Vikas<br>
</p>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Dec 18, 2018 at 7:11 PM Brendan Dolan-Gavitt <<a href="mailto:brendandg@nyu.edu" target="_blank">brendandg@nyu.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left:1px solid rgb(204,204,204)">
<div dir="ltr">You should be able to compile *and* run syscalls2 on a 64 bit host as long as the guest virtual machine is 32-bit. In particular, we have tested Ubuntu 16.04 64-bit hosts pretty extensively with file_taint: they work fine. What's the actual error
you're getting?</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Dec 18, 2018 at 9:59 PM Vikas Puri <<a href="mailto:vpurinet@gmail.com" target="_blank">vpurinet@gmail.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left:1px solid rgb(204,204,204)">
<div dir="ltr">Hi Brendan,
<div><br>
</div>
<div>Thanks for your reply. As you indicate, I can compile syscalls2 on a 64-bit host. However, I cannot execute it and the plugins that it's a dependency for (like file_taint) on a 64 bit host. On a 32-bit host, I have issues with taint2 since it requires
LLVM support. </div>
<div><br>
</div>
<div>My question is simply on what host platforms can I execute file_taint and related taint plugins? </div>
<div><br>
</div>
<div>Thanks for your help. </div>
<div><br>
</div>
<div>Regards,</div>
<div><br>
</div>
<div>-Vikas</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Dec 18, 2018 at 5:00 PM Brendan Dolan-Gavitt <<a href="mailto:brendandg@nyu.edu" target="_blank">brendandg@nyu.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left:1px solid rgb(204,204,204)">
<div>
<div dir="auto">For (2), syscalls2 only supports analyzing 32 bit guests, but it should compile on a 64-bit host operating system just fine (this is the configuration we use normally). Could you post the error you’re getting when trying to compile it?</div>
</div>
<div><br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Dec 18, 2018 at 3:58 PM Vikas Puri <<a href="mailto:vpurinet@gmail.com" target="_blank">vpurinet@gmail.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left:1px solid rgb(204,204,204)">
<div dir="ltr">
<div dir="ltr">Hello,
<div><br>
</div>
<div>I am attempting to use the file_taint plugin. However, I am running into a few problems (listed below). I am attempting to run this on a ubuntu 16.04 host and guest:</div>
<div>
<ol>
<li><span style="color:rgb(0,0,0);font-family:Calibri;font-size:11pt">"file_taint" depends on the taint2 plugin. Taint2 requires LLVM. LLVM support requires a 64-bit host OS. </span></li><li><span style="color:rgb(0,0,0);font-family:Calibri;font-size:11pt">file_taint also requires the syscalls2 plugin. Syscalls2 seems to be supported for the ARM and i386 CPU families. It does not appear to be supported on x86_64 platforms. I get an
error when executing this on a x86_64 Ubuntu 16.04 host. </span></li><li><span style="color:rgb(0,0,0);font-family:Calibri;font-size:11pt">Given the constraints of items 1 and 2, I cannot identify a host OS that I can use to build and execute file_taint.</span></li></ol>
<div><font face="Calibri" color="#000000"><span style="font-size:14.66px">Any suggestions that you can provide would be greatly appreciated.</span></font></div>
</div>
<div><font face="Calibri" color="#000000"><span style="font-size:14.66px"><br>
</span></font></div>
<div><font face="Calibri" color="#000000"><span style="font-size:14.66px">Sincerely,</span></font></div>
<div><font face="Calibri" color="#000000"><span style="font-size:14.66px"><br>
</span></font></div>
<div><font face="Calibri" color="#000000"><span style="font-size:14.66px">-Vikas</span></font></div>
</div>
</div>
_______________________________________________<br>
panda-users mailing list<br>
<a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.mit.edu_mailman_listinfo_panda-2Dusers&d=DwICAg&c=slrrB7dE8n7gBJbeO0g-IQ&r=A4wu5Zmpus3hDmokNWeJTO0SLjrxguzCAxn30Hc-o48&m=wlCAgCNUC_P-8nSM_ArRoZfarTg_fpwoE8E2IZBYXRo&s=eFlh9e8xVYsffx6nie7-Pk--u9ykujp3zQd5zejToFw&e=" rel="noreferrer" target="_blank">https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.mit.edu_mailman_listinfo_panda-2Dusers&d=DwICAg&c=slrrB7dE8n7gBJbeO0g-IQ&r=A4wu5Zmpus3hDmokNWeJTO0SLjrxguzCAxn30Hc-o48&m=wlCAgCNUC_P-8nSM_ArRoZfarTg_fpwoE8E2IZBYXRo&s=eFlh9e8xVYsffx6nie7-Pk--u9ykujp3zQd5zejToFw&e=</a><br>
</blockquote>
</div>
</div>
-- <br>
<div class="gmail-m_7811210436381441676gmail-m_6871187686345147799gmail-m_7166642241583901992gmail-m_-5741346633710983508gmail-m_-6290489791961989465gmail-m_2779151574711275485gmail_signature" dir="ltr">
Brendan Dolan-Gavitt<br>
Assistant Professor, Department of Computer Science and Engineering<br>
NYU Tandon School of Engineering</div>
</blockquote>
</div>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail-m_7811210436381441676gmail-m_6871187686345147799gmail-m_7166642241583901992gmail-m_-5741346633710983508gmail_signature" dir="ltr">
Brendan Dolan-Gavitt<br>
Assistant Professor, Department of Computer Science and Engineering<br>
NYU Tandon School of Engineering</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote></div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">Brendan Dolan-Gavitt<br>Assistant Professor, Department of Computer Science and Engineering<br>NYU Tandon School of Engineering</div>