Package ghidra.pcode.emu.taint.lib

Class TaintFileReadsLinuxAmd64SyscallLibrary

java.lang.Object

ghidra.pcode.exec.AnnotatedPcodeUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.sys.AnnotatedEmuSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.unix.AbstractEmuUnixSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.linux.AbstractEmuLinuxSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.linux.EmuLinuxAmd64SyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.taint.lib.TaintFileReadsLinuxAmd64SyscallLibrary

All Implemented Interfaces:

EmuSyscallLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>, PcodeUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

public class TaintFileReadsLinuxAmd64SyscallLibrary
extends EmuLinuxAmd64SyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

A library for performing Taint Analysis on a Linux-amd64 program that reads from tainted files

This library is not currently accessible from the UI. It can be used with scripts by overriding a taint emulator's userop library factory method.

TODO: A means of adding and configuring userop libraries in the UI.

TODO: Example scripts.

Nested Class Summary

Nested classes/interfaces inherited from class ghidra.pcode.emu.unix.AbstractEmuUnixSyscallUseropLibrary

AbstractEmuUnixSyscallUseropLibrary.Errno, AbstractEmuUnixSyscallUseropLibrary.UnixStructuredPart

Nested classes/interfaces inherited from class ghidra.pcode.emu.sys.AnnotatedEmuSyscallUseropLibrary

AnnotatedEmuSyscallUseropLibrary.EmuSyscall, AnnotatedEmuSyscallUseropLibrary.StructuredPart

Nested classes/interfaces inherited from class ghidra.pcode.exec.AnnotatedPcodeUseropLibrary

AnnotatedPcodeUseropLibrary.AnnotatedPcodeUseropDefinition<T>, AnnotatedPcodeUseropLibrary.FixedArgsAnnotatedPcodeUseropDefinition<T>, AnnotatedPcodeUseropLibrary.OpExecutor, AnnotatedPcodeUseropLibrary.OpLibrary, AnnotatedPcodeUseropLibrary.OpOutput, AnnotatedPcodeUseropLibrary.OpState, AnnotatedPcodeUseropLibrary.PcodeUserop, AnnotatedPcodeUseropLibrary.VariadicAnnotatedPcodeUseropDefinition<T>

Nested classes/interfaces inherited from interface ghidra.pcode.emu.sys.EmuSyscallLibrary

EmuSyscallLibrary.EmuSyscallDefinition<T>, EmuSyscallLibrary.SyscallPcodeUseropDefinition<T>

Nested classes/interfaces inherited from interface ghidra.pcode.exec.PcodeUseropLibrary

PcodeUseropLibrary.EmptyPcodeUseropLibrary, PcodeUseropLibrary.PcodeUseropDefinition<T>

Field Summary

Fields inherited from class ghidra.pcode.emu.linux.EmuLinuxAmd64SyscallUseropLibrary

clib64, regRAX

Fields inherited from class ghidra.pcode.emu.linux.AbstractEmuLinuxSyscallUseropLibrary

ERRNOS, O_APPEND, O_CREAT, O_MASK_RDWR, O_RDONLY, O_RDWR, O_TRUNC, O_WRONLY

Fields inherited from class ghidra.pcode.emu.unix.AbstractEmuUnixSyscallUseropLibrary

closedFds, descriptors, fs, intSize, user

Fields inherited from class ghidra.pcode.emu.sys.AnnotatedEmuSyscallUseropLibrary

additionalArchives, CACHE_BY_CLASS, cSpec, dtMachineWord, machine, program, SYSCALL_SPACE_NAME, syscallMap

Fields inherited from class ghidra.pcode.exec.AnnotatedPcodeUseropLibrary

ops

Fields inherited from interface ghidra.pcode.emu.sys.EmuSyscallLibrary

SYSCALL_CONVENTION_NAME

Fields inherited from interface ghidra.pcode.exec.PcodeUseropLibrary

NIL

Constructor Summary

Constructors

Constructor	Description
TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine, EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs, Program program)
TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine, EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs, Program program, EmuUnixUser user)

Method Summary

Modifier and Type	Method	Description
org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>	unix_read(PcodeExecutorState<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> state, org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> fd, org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> bufPtr, org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> count)	The UNIX read system call

Methods inherited from class ghidra.pcode.emu.linux.EmuLinuxAmd64SyscallUseropLibrary

disposeAdditionalArchives, getAdditionalArchives, readSyscallNumber, returnErrno

Methods inherited from class ghidra.pcode.emu.linux.AbstractEmuLinuxSyscallUseropLibrary

convertFlags, getErrno

Methods inherited from class ghidra.pcode.emu.unix.AbstractEmuUnixSyscallUseropLibrary

claimFd, createHandle, findFd, handleError, lowestFd, newStructuredPart, putDescriptor, releaseFd, unix_close, unix_exit, unix_group_exit, unix_open, unix_write

Methods inherited from class ghidra.pcode.emu.sys.AnnotatedEmuSyscallUseropLibrary

getSyscalls, getSyscallUserop, mapAndBindSyscalls, mapAndBindSyscalls, newBoundSyscall

Methods inherited from class ghidra.pcode.exec.AnnotatedPcodeUseropLibrary

getMethodLookup, getOperandType, getUserops

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface ghidra.pcode.emu.sys.EmuSyscallLibrary

syscall

Methods inherited from interface ghidra.pcode.exec.PcodeUseropLibrary

compose, getSymbols, getUserops

Constructor Details

TaintFileReadsLinuxAmd64SyscallLibrary

public TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine,
 EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs,
 Program program,
 EmuUnixUser user)

TaintFileReadsLinuxAmd64SyscallLibrary

public TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine,
 EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs,
 Program program)

Method Details

unix_read

public org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> unix_read(PcodeExecutorState<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> state,
 org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> fd,
 org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> bufPtr,
 org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> count)

Description copied from class: AbstractEmuUnixSyscallUseropLibrary

The UNIX read system call

Overrides:

unix_read in class AbstractEmuUnixSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

Parameters:

state - to receive the thread's state

fd - the file descriptor

bufPtr - the pointer to the buffer to receive the data

count - the number of bytes to read

Returns:

the number of bytes successfully read