<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>I believe this is the expected behavior. Try running with qemu-system-i386 instead of qemu-system-x86_64.</p>
<p> </p>
<p>Mark</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="width: 98%; display: inline-block;">
<div id="divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size: 11pt;"><b>From:</b> panda-users-bounces@mit.edu <panda-users-bounces@mit.edu> on behalf of Vikas Puri <vpurinet@gmail.com><br>
<b>Sent:</b> Thursday, December 20, 2018 9:18 AM<br>
<b>To:</b> Brendan Dolan-Gavitt<br>
<b>Cc:</b> panda-users@mit.edu<br>
<b>Subject:</b> EXT :Re: [panda-users] Question about file_taint</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div>
<div>
<div>Hi Brendan,<br>
<br>
</div>
Sorry for the late reply. Here is the information that you requested. I appreciate your help.
<br>
</div>
<br>
</div>
<b>Guest OS</b>:<br>
<ul>
<li>ubuntu 4.4.0-31-generic i686</li></ul>
<p><b>Host OS:</b></p>
<ul>
<li>Ubuntu 4.4.0-31-generic x86_64 x86_64 <br>
</li></ul>
<p><b>Command Executed on Host</b>:</p>
<ul>
<li>$PANDA_PATH/x86_64-softmmu/qemu-system-x86_64 -replay append_file_3 -os linux-32-ubuntu:4.4.0-131-generic -panda osi -m 4096 -panda osi_linux:kconf_group=ubuntu:4.4.0-131-generic:32 -panda file_taint:filename=test.txt</li></ul>
<p><b>Error reported on Host:</b></p>
<p style="margin-left: 40px;">PANDA[core]:os_familyno=2 bits=32 os_details=ubuntu:4.4.0-131-generic<br>
PANDA[osi_linux]:adding argument kconf_group=ubuntu:4.4.0-131-generic:32.<br>
PANDA[file_taint]:adding argument filename=test.txt.<br>
PANDA[core]:initializing osi<br>
Looking for kconffile in /home/hackuser5/panda/panda/build/x86_64-softmmu/panda/plugins/osi_linux/kernelinfo.conf<br>
OSI grabbing Linux introspection backend.<br>
Linux OSI, using group ubuntu:4.4.0-131-generic:32 from /home/hackuser5/panda/panda/build/x86_64-softmmu/panda/plugins/osi_linux/kernelinfo.conf.<br>
PANDA[core]:loading required plugin osi_linux<br>
PANDA[core]:initializing osi_linux<br>
PANDA[osi_linux]:W> kernelinfo bytes [76-79] not read<br>
PANDA[osi_linux]:W> kernelinfo bytes [92-95] not read<br>
PANDA[core]:/home/hackuser5/panda/panda/build/x86_64-softmmu/panda/plugins/panda_osi_linux.so already loaded<br>
PANDA[core]:initializing file_taint<br>
PANDA[core]:loading required plugin syscalls2<br>
PANDA[core]:initializing syscalls2<br>
PANDA[syscalls2]:using profile for linux x86 32-bit<br>
PANDA[core]:loading required plugin osi<br>
PANDA[core]:/home/hackuser5/panda/panda/build/x86_64-softmmu/panda/plugins/panda_osi.so already loaded<br>
PANDA[core]:loading required plugin taint2<br>
PANDA[core]:initializing taint2<br>
PANDA[taint2]:propagation via pointer dereference ENABLED<br>
PANDA[taint2]:taint operations inlining DISABLED<br>
PANDA[taint2]:llvm optimizations DISABLED<br>
PANDA[taint2]:taint debugging DISABLED<br>
PANDA[taint2]:detaint if control bits 0 DISABLED<br>
PANDA[taint2]:maximum taint compute number (0=unlimited) 0<br>
PANDA[taint2]:maximum taintset cardinality (0=unlimited) 0<br>
PANDA[core]:loading required plugin callstack_instr<br>
PANDA[core]:initializing callstack_instr<br>
<b>ERROR: Linux is only supported on x86 (32-bit)</b><br>
FAIL: Unable to load plugin `/home/hackuser5/panda/panda/build/x86_64-softmmu/panda/plugins/panda_file_taint.so'<br>
</p>
<p>-Vikas<br>
</p>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Dec 18, 2018 at 7:11 PM Brendan Dolan-Gavitt <<a href="mailto:brendandg@nyu.edu">brendandg@nyu.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">
<div dir="ltr">You should be able to compile *and* run syscalls2 on a 64 bit host as long as the guest virtual machine is 32-bit. In particular, we have tested Ubuntu 16.04 64-bit hosts pretty extensively with file_taint: they work fine. What's the actual error
you're getting?</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Dec 18, 2018 at 9:59 PM Vikas Puri <<a href="mailto:vpurinet@gmail.com" target="_blank">vpurinet@gmail.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">
<div dir="ltr">Hi Brendan,
<div><br>
</div>
<div>Thanks for your reply. As you indicate, I can compile syscalls2 on a 64-bit host. However, I cannot execute it and the plugins that it's a dependency for (like file_taint) on a 64 bit host. On a 32-bit host, I have issues with taint2 since it requires
LLVM support. </div>
<div><br>
</div>
<div>My question is simply on what host platforms can I execute file_taint and related taint plugins? </div>
<div><br>
</div>
<div>Thanks for your help. </div>
<div><br>
</div>
<div>Regards,</div>
<div><br>
</div>
<div>-Vikas</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Dec 18, 2018 at 5:00 PM Brendan Dolan-Gavitt <<a href="mailto:brendandg@nyu.edu" target="_blank">brendandg@nyu.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">
<div>
<div dir="auto">For (2), syscalls2 only supports analyzing 32 bit guests, but it should compile on a 64-bit host operating system just fine (this is the configuration we use normally). Could you post the error you’re getting when trying to compile it?</div>
</div>
<div><br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Dec 18, 2018 at 3:58 PM Vikas Puri <<a href="mailto:vpurinet@gmail.com" target="_blank">vpurinet@gmail.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">
<div dir="ltr">
<div dir="ltr">Hello,
<div><br>
</div>
<div>I am attempting to use the file_taint plugin. However, I am running into a few problems (listed below). I am attempting to run this on a ubuntu 16.04 host and guest:</div>
<div>
<ol>
<li><span style="color: rgb(0, 0, 0); font-family: Calibri; font-size: 11pt;">"file_taint" depends on the taint2 plugin. Taint2 requires LLVM. LLVM support requires a 64-bit host OS. </span></li><li><span style="color: rgb(0, 0, 0); font-family: Calibri; font-size: 11pt;">file_taint also requires the syscalls2 plugin. Syscalls2 seems to be supported for the ARM and i386 CPU families. It does not appear to be supported on x86_64 platforms. I get an
error when executing this on a x86_64 Ubuntu 16.04 host. </span></li><li><span style="color: rgb(0, 0, 0); font-family: Calibri; font-size: 11pt;">Given the constraints of items 1 and 2, I cannot identify a host OS that I can use to build and execute file_taint.</span></li></ol>
<div><font color="#000000" face="Calibri"><span style="font-size: 14.66px;">Any suggestions that you can provide would be greatly appreciated.</span></font></div>
</div>
<div><font color="#000000" face="Calibri"><span style="font-size: 14.66px;"><br>
</span></font></div>
<div><font color="#000000" face="Calibri"><span style="font-size: 14.66px;">Sincerely,</span></font></div>
<div><font color="#000000" face="Calibri"><span style="font-size: 14.66px;"><br>
</span></font></div>
<div><font color="#000000" face="Calibri"><span style="font-size: 14.66px;">-Vikas</span></font></div>
</div>
</div>
_______________________________________________<br>
panda-users mailing list<br>
<a href="mailto:panda-users@mit.edu" target="_blank">panda-users@mit.edu</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.mit.edu_mailman_listinfo_panda-2Dusers&d=DwICAg&c=slrrB7dE8n7gBJbeO0g-IQ&r=A4wu5Zmpus3hDmokNWeJTO0SLjrxguzCAxn30Hc-o48&m=wlCAgCNUC_P-8nSM_ArRoZfarTg_fpwoE8E2IZBYXRo&s=eFlh9e8xVYsffx6nie7-Pk--u9ykujp3zQd5zejToFw&e=" target="_blank" rel="noreferrer">https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.mit.edu_mailman_listinfo_panda-2Dusers&d=DwICAg&c=slrrB7dE8n7gBJbeO0g-IQ&r=A4wu5Zmpus3hDmokNWeJTO0SLjrxguzCAxn30Hc-o48&m=wlCAgCNUC_P-8nSM_ArRoZfarTg_fpwoE8E2IZBYXRo&s=eFlh9e8xVYsffx6nie7-Pk--u9ykujp3zQd5zejToFw&e=</a><br>
</blockquote>
</div>
</div>
-- <br>
<div class="gmail-m_7166642241583901992gmail-m_-5741346633710983508gmail-m_-6290489791961989465gmail-m_2779151574711275485gmail_signature" dir="ltr">
Brendan Dolan-Gavitt<br>
Assistant Professor, Department of Computer Science and Engineering<br>
NYU Tandon School of Engineering</div>
</blockquote>
</div>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail-m_7166642241583901992gmail-m_-5741346633710983508gmail_signature" dir="ltr">
Brendan Dolan-Gavitt<br>
Assistant Professor, Department of Computer Science and Engineering<br>
NYU Tandon School of Engineering</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>