Temu Traces
Divya
I am working with temu in Ubuntu 9.04. I used a redhat image as guest
OS.
We are working on project which detects buffer overflow through temu
traces ..
When we are using load_plugin "tracecap/tracecap.so" to load plugin.
But after the traces, the instructions decoded is showing as 0 and my
trace file is empty.
But taint_sendkey seems to be working with the C program.For instance,
i used vul.c which takes an integer.
taint_sendkey 5 1000 will send the input to the program..But on
trace_stop, trace file is not written(its created)..
I tried all of these :
1) changed the settings in main.ini file and made all options as Yes.
2) used enable_emulation
3) made sure that process is running..
Please let me know if anyone has any ideas.
Thanks
Divya
Stephen McCamant
D> Hey all,
D> I am working with temu in Ubuntu 9.04. I used a redhat image as
D> guest OS. We are working on project which detects buffer overflow
D> through temu traces ..
D> When we are using load_plugin "tracecap/tracecap.so" to load
D> plugin. But after the traces, the instructions decoded is showing
D> as 0 and my trace file is empty.
D> But taint_sendkey seems to be working with the C program.For
D> instance, i used vul.c which takes an integer.
D> taint_sendkey 5 1000 will send the input to the program..But on
D> trace_stop, trace file is not written(its created)..
D> I tried all of these :
D> 1) changed the settings in main.ini file and made all options as
D> Yes.
Checking the options in the main.ini file is definitely a good idea,
but note that "yes" is not the setting for each option that maximizes
the chances of seeing output. For instance setting
trace_only_after_first_taint to "no" is what should give you more
traced instructions.
D> 2) used enable_emulation
D> 3) made sure that process is running..
D> Please let me know if anyone has any ideas.
Hmm. From that description I didn't notice anything obvious that
you're forgetting; 1-3 are all good things to check. I think it might
be helpful if you could send a complete transcript of the commands you
typed and the results you get at the TEMU monitor. Another useful
datapoint in narrowing down where the problem is would be to see
whether TEMU ever printed the "Time of first tainted data:" message.
Also, it sounds like the example you're trying here is similar to the
example in the TEMU manual, but not exactly the same. If you try to
reproduce the example from the manual exactly, does it work? If so,
you may be able to better understand what's going wrong by comparing
your example to the one in the manual.
Hope this helps,
-- Stephen
Divya
Thanks !!
I got it .. i was not using the same plugin (tracecap.so) in the
start.sh file ..
But , i have one more problem now
I am running a redhat temu image where i write a buffer overflow
vulnerable program
I need to tell the user , where the bufferoverflow is happening ,
which function is causing , which line its happening.
I get a binary dump file from temu .. I use a trace reader software to
generate assembly instructions and analyze those instructions to find
out where the buffer overflow is happening ..
But the problem is that i need to get the name of function which is
causing buffer overflow.
For instance , i am using gets which is causing this... but all i get
from assembly level trace is the address of gets ..
Is there any instruction in qemu to map address to library function in
the temu image.. i,e I want to find the address mappings in the vul.c
in temu image from qemu...
Everything i import from temu will be binary instructions .. thats
another problem ..
I want to find the mapping of addresses programatically since i am
writing c code to analyze the buffer overflow from the trace.
Any inputs will be helpful
Thanks
Divya
On Oct 16, 4:15 am, Stephen McCamant <s...@CS.Berkeley.EDU> wrote:
Juan Caballero
Tracecap produces a functions file that can be used to map instruction to functions.
If you trace a program and generate trace "x.trace", you should have a file "x.trace.functions" in the same directory.
You can use trace_reader to get the function information like follows:
"trace_reader -fmap x.trace.functions -trace x.trace -flog x.flog > x.disas"
This produces two outputs:
1) in the x.disas file, the name of the known exported functions is inlined after a call or a ret
2) The x.flog file tells you when each function was called and returned, altogether with the module and function name
Note that only functions exported by name/ordinal will have a meaningful name. For other functions you'll get something like "user32.dll::sub_7E4254C9", which means the the function entry point is 0x7E4254C9 but the name is unknown.
Hope that helps,
Juan
K V Divya
Thanks a lot for reply ..
I am generating x.trace.functions file . But it is empty.
I am using tracecap.so plugin .. I have attached my .ini file.
Please let me know if i have to change anything to yes here ?
Thnaks
Divya
K V Divya
But , No luck .. I used the ini file you sent and my trace file is also empty .. !!
Not sure if there is something else missing ..
Hi,
I have attached my main.ini file. In my temu file functions is generating.
If problem in main.ini - you can fix it.
but I think that the problem in another.
2010/10/29 K V Divya <kvd...@gmail.com>
--
Best Regards,
Alexandr N. Bazhanyuk
UKRAINE
Phone: +38-096-789-65-17
mail: virv...@gmail.com
ICQ: 472244882
Skype: virvdova
Stephen McCamant
KVD> thanks a lot !!
KVD> But , No luck .. I used the ini file you sent and my trace file
KVD> is also empty .. !!
KVD> Not sure if there is something else missing ..
I'm not too familiar with all of this code, but my recollection was
that we only generated the function_map data structure (and thus the
.functions file) based on messages from the (Windows) guest driver,
whereas Divya's guest system is running (RedHat) Linux.
If you have a copy of the Linux executable accessible outside the
virtual machine, you can map potentially map addresses to function
names and/or line numbers based using a library like the GNU Binutils
that parses executable structure. For an unstripped binary or one with
debugging information, you can use the Binutils "addr2line" utility to
test getting function names or line numbers respectively; if that's
doing what you want you can then look at the source of the addr2line
program to see how that's implemented using the BFD library. The
closest Linux equivalent to what we do on Windows would be to use the
dynamic symbols of ".so" libraries; you can list these with "nm -D",
which is also part of the Binutils, though I don't think addr2line
queries them.
-- Stephen
K V Divya
Thanks !!
nm and addr2line utilities will give us the required output .. But in temu image
We are running a redhat temu image which was given by our prof :)..
What ever file we try to export from image where the vulnerable program is running through qemu will be in binary format ..
And we do not want to just see the memory dump.We want to export it during run time programtically..
Any suggestions for this qould be appreciated ...
Thanks
Divya
Bazhanyk Alex
I wrote that I taint file.
I have two partitions in my guest OS: disk C,D
D - FAT32!
1) mount disk D in my linux file system:
mount -o loop,offset=32256 winxp2.img test
2) copy file in this image (I don't touched this file until start
program's that will handle it,otherwise it will cached)
$cp 0914.txt test
3) start temu
$ sudo ./tracecap/temu -m 256 -net nic,vlan=0 -net tap,vlan=0,script=/
etc/qemu-ifup -monitor stdio -hda ../../qemu_images/winxp/winxp.img -
hdb ../../qemu_images/winxp/winxp2.img
Could not open '/dev/kqemu' - QEMU acceleration layer not activated:
No such file or directory
QEMU 0.9.1 monitor - type 'help' for more information
(qemu) enable_emulation
You have to load a plugin before switching to emulated mode!
4) load plugin
(qemu) load_plugin tracecap/tracecap.so
general/trace_only_after_first_taint is enabled.
general/log_external_calls is disabled.
general/write_ops_at_insn_end is enabled.
general/save_state_at_trace_stop is disabled.
tracing/tracing_table_lookup is enabled.
tracing/tracing_tainted_only is disabled.
tracing/tracing_single_thread_only is disabled.
tracing/tracing_kernel is disabled.
tracing/tracing_kernel_tainted is disabled.
tracing/tracing_kernel_partial is disabled.
network/ignore_dns is disabled.
Enabled: 0x00 Proto: 0x00 Sport: 0 Dport: 0 Src: 0.0.0.0 Dst: 0.0.0.0
Loading plugin options from: SRC_PATH/tracecap/ini/hook_plugin.ini
Loading plugins from: SRC_PATH/shared/hooks/hook_plugins
Cannot determine file system type
Cannot determine file system type
Cannot determine file system type
tracecap/tracecap.so is loaded successfully!
(qemu) enable_emulation
Emulation is now enabled
(qemu) taint_file "0914.txt" 1 6543
Tainting disk 1 file 0914.txt
4fe8:512[6543] 4fe9:512[6543] 4fea:512[6543] 4feb:512[6543] 4fec:
512[6543] 4fed:512[6543] 4fee:512[6543] 4fef:512[6543] 4ff0:512[6543]
4ff1:512[6543] 4ff2:512[6543] 4ff3:512[6543] 4ff4:512[6543]
4ff5:512[6543] 4ff6:512[6543] 4ff7:512[6543] 4ff8:512[6543]
4ff9:512[6543]
4ffa:512[6543] 4ffb:512[6543] 4ffc:512[6543] 4ffd:512[6543] 4ffe:
512[6543] 4fff:512[6543] 5000:512[6543] 5001:512[6543] 5002:512[6543]
5003:512[6543] 5004:512[6543] 5005:512[6543] 5006:512[6543]
Tainted file 0914.txt
(qemu) tracebyname "notepad.exe" /tmp/trace_off_2
Waiting for process notepad.exe to start
(Start notepad.exe)
PID: 824 CR3: 0x02b62000
(qemu) Time of first tainted data: 1288638979.718363
(qemu) trace_stop
Stop tracing process 824
Number of instructions decoded: 136746300
Number of operands decoded: 323719221
Number of instructions written to trace: 118158023
Number of tainted instructions written to trace: 59297252
Processing time: 1495.93 U: 1490.86 S: 5.07232
Generating file: /home/drake/bitblaze/traces/trace_off_3.functions
(qemu) disable_emulation
Emulation is now disabled
(qemu) unload_plugin
tracecap/tracecap.so is unloaded!
(qemu)
On 30 окт, 12:16, K V Divya <kvdi...@gmail.com> wrote:
> Hi Stephen,
>
> Thanks !!
> nm and addr2line utilities will give us the required output .. But in temu
> image
>
> We are running a redhat temu image which was given by our prof :)..
> What ever file we try to export from image where the vulnerable program is
> running through qemu will be in binary format ..
> And we do not want to just see the memory dump.We want to export it during
> run time programtically..
> Any suggestions for this qould be appreciated ...
>
> Thanks
> Divya
>
MCher
roddam bramhini
i am launching temu in ubuntu 10.04
whenever i am giving a command
(qemu) trace "/tmp/foo.trace"
i am getting this error
Unknown command: trace
can anyone help,
Thanks in advance
Bramhini Roddam
Stephen McCamant
RB> hi everyone..
RB> i am launching temu in ubuntu 10.04
RB> whenever i am giving a command
RB> (qemu) trace "/tmp/foo.trace"
RB> i am getting this error
RB> Unknown command: trace
RB> can anyone help,
RB> Thanks in advance
RB> Bramhini Roddam
I think there's a pretty simple answer to your problem, and perhaps
some one else on the list will feel like answering it directly. What
I'd like to do instead is to suggest a debugging process that might
help you come to an answer yourself:
1) Make a list of all the commands you are giving to TEMU, in
sequence, when you get the error message quoted above.
2) Make a list of all the commands that are given to TEMU in the
tutorial example in the manual, up to the successful "trace"
command:
http://bitblaze.cs.berkeley.edu/release/temu-1.0/howto.html#htoc5
3) Compare the two lists. Are there some commands that are present on
one list, but not on the other? Are any of the commands in a
different order, or are they given different numbers of arguments?
Each such difference is a possible cause of the failure.