[panda-users] when is on_branch2 called?

[Manolis Stamatogiannakis]

I'm working on a plugin similar to the tainted_branch plugin.

I have registered an on_branch2 callback, but I get many printouts where
the address provided to the callback doesn't seem to be tainted. E.g.:

0xc1138fd3:4:{ }{ }{ }{ }:0
     ^     ^       ^      ^
    pc     sz    taint    num_tainted


sz is as provided by the callback. num_tainted is computed same as in
tainted_branch.

Why is this happening? Shouldn't by definition have some taint returned for
the address?

I could be missing some semantics here, but even tainted_branch seems to
use num_tainted to avoid what it looks like a "false positive" callback.

M.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.mit.edu/pipermail/panda-users/attachments/20180207/3d544c1a/attachment.html