vuzzer

Open source

:pointright: VUzzer 64-bit is available at: https://github.com/vusec/vuzzer64 ========== VUzzer =========== About ------ This Project depen…

386 stars0 likes0 views

Website GitHub

About

:pointright: VUzzer 64-bit is available at: https://github.com/vusec/vuzzer64 ========== VUzzer =========== About ------ This Project depen…

:point_right: VUzzer 64-bit is available at:

https://github.com/vusec/vuzzer64

VUzzer

About

This Project depends heavily on a modeified version of DataTracker, which in turn depends on LibDFT pintool. It has some extra tags added in libdft. DataTracker original repo https://github.com/m000/dtracker.

Running the VUzzer:

Please see wikiHOWTO.md for a step-by-step procedure to run the VUzzer. This file also contains explanation for most of the options.

:point_right: NOTE: VUzzer's taintflow analysis does not work on binaries compiled with sanitizers pass (e.g. address sanitizer). Therefore, do not involve VUzzer in an experiment where sanitizer enabled binaries are used.

Requirements

DataTracker runs on 32bit Linux systems. This limitation is imposed by the current version of libdft. However, the methods of both software are not platform-specific. So, in principle, they can be ported on any platform supported by Intel Pin. The requirements for running DataTracker are:

A C++11 compiler and unix build utilities (e.g. GNU Make).
A recent (>=2.13) version of Intel Pin. The framework must be present in directory pin inside the VUzzer top directory. A simple way to do so is to create a symbolic link pointing to your pin directory.

bash

$ cd vuzzer
$ ln -s /path-to-pin-home pin

A suitable version of the [modified libdft][libdft-mod] - typically the latest available. This must be placed in directory support/libdft.
Python 2.7 for converting raw provenance to [PROV][prov] format in [Turtle][turtle] syntax.
EWAGBoolArray: https://github.com/lemire/EWAHBoolArray/ - To install it in your system just copy headers file(https://github.com/lemire/EWAHBoolArray/tree/master/headers) in /usr/include folder.
BitMagic: http://bmagic.sourceforge.net/ - To install it in your system do sudo apt-get install bmagic
BitVector module for python.

We have tested VUzzer by running in on VirtualBox, with Ubuntu 14.04 LTS (32-bit), Linux 3.16.0.32 image. It should be noted that with kernel 4.x.y, Pin (2.13) gets panic. We recommend setting up the same environment to use VUzzer. This limitation will be addressed in the future release of VUzzer with 64-bit support.

Installation

First do cd vuzzer and then

bash

export PIN_ROOT=$(pwd)/pin

If initially libdft has been made then go to support/libdft/src and do make clean Again in the parent folder execute following

make support-libdft

make

make -f mymakefile

If all above steps were successfull, obj-ia32/dtracker.so and obj-i32/bbcounts2.so will be created. This is Pin tool containing all the instrumentation required to perform taintflow and basic block level tracing.

Changing the tags

Currently there are 4 custom tags

libdft_tag_set_fdoff
libdft_tag_bitset
libdft_tag_ewah
libdft_tag_bvector

Default tag is

…

./pin/pin.sh -follow_execv -t ./obj-ia32/dtracker.so -filename --


Compulsory Knob:

* ``-filename ``

*** Note: Please ensure that you supply the name of file of which you want to know the taint information. Otherwise there would be no taint propogation. ***

The command runs the program under Pin
In addition to the standard Pin knobs, DataTracker additionally supports these tool-specific knobs:

* ```-stdin [1|0]```: Turns tracking of data read from the standard input on or off. Default if off.
* ```-stdout [1|0]```: Turns logging of provenance of data written to standard output on or off. Default if on.
* ```-stderr [1|0]```: Turns logging of provenance of data written to standard error on or off. Default if off.
* ```-maxoff integer_val```: Puts the limit on the size of the taint offsets of cmp instruction. Default is 4.
* ```-maxlea integer_val```: Puts the limit on the size of the taint offsets of lea instruction. Default is 4.

Note that launching large programs using the method above takes a lot of time. For such programs, it is suggested to first launch the program and then attach DataTracker to the running process like this:

./pin/pin.sh -follow_execv -pid -t ./obj-ia32/dtracker.so


The raw provenance generated by DataTracker is contained in file ``rawprov.out``. Any additional debugging information are written in file ``pintool.log``.

CMP Output Format (cmp.out)
---------------------------
cmp.out will contain all those compare instructions whose operand is tainted by some offset of file. 
All instructions will be represented by a row containing 13 space separated values as below:

Bit-operation cmp-type ins-address dest[0] dest[1] dest[2] dest[3] src[0] src[1] src[2] src[3] dest_val src_val

```8 reg reg 0x08048532 {0} {} {} {} {2} {} {} {} Z a```

[pin]: http://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool
[pin-dl]: http://software.intel.com/en-us/articles/pintool-downloads
[pin-makefile]: http://software.intel.com/sites/landingpage/pintool/docs/62732/Pin/html/index.html#MAKEFILES
[libdft]: http://www.cs.columbia.edu/~vpk/research/libdft/
[libdft-mod]: https://git.cs.vu.nl/r.vermeulen/libdft
[vu-cs]: http://www.cs.vu.nl/en/
[turtle]: http://www.w3.org/TeamSubmission/turtle/
[prov]: http://www.w3.org/TR/2013/NOTE-prov-overview-20130430/
[provconvert]: https://github.com/lucmoreau/ProvToolbox/wiki/provconvert
[provtoolbox]: https://github.com/lucmoreau/ProvToolbox/wiki/ProvToolbox-Home
[ipaw14-demo]: https://www.youtube.com/watch?v=BD0h6M5mVoo
[vu-dare]: http://dare.ubvu.vu.nl/
[dtracker-dare]: http://dare.ubvu.vu.nl/handle/1871/51386