Not writing tainted data in trace

70 views

Skip to first unread message

Roi Mallo

unread,

Feb 27, 2013, 10:07:29 AM2/27/13

to bitblaz...@googlegroups.com

Hi,

I've modified the tracecap source to hook

kernel functions as global hooks and then

taint the data in the hook.

The hooks added to commands.c are:

// ioctl communication interface

hookapi_hook_function_byname(

"ntdll.dll",

"ZwOpenFile",

1 /* global */,

NtOpenFile_call,

0 /* no opaque */,

0 /* no opaque */

);

hookapi_hook_function_byname(

"ntoskrnl.exe",

"NtDeviceIoControlFile",

1 /* global */,

iopxxxcontrolfile_call,

0 /* no opaque */,

0 /* no opaque */

);

In iopxxxcontrolfile_call I hook data in the stack:

hook_taint_record_t tr;

tr.source = TAINT_SOURCE_API_DEVICE_IO_CONTROL;

tr.origin = DEVICE_IO_CONTROL_ORIGIN;

tr.offset = 0;

taint_mem((uint32_t)(esp+24), 4, (void *)&tr);

Then loading this plugin into temu, I get the following

output:

(qemu) load_plugin my_tracecap/tracecap.so

general/trace_only_after_first_taint is enabled.
general/log_external_calls is disabled.
general/write_ops_at_insn_end is disabled.
general/save_state_at_trace_stop is disabled.
tracing/tracing_table_lookup is enabled.
tracing/tracing_tainted_only is disabled.
tracing/tracing_kernel is enabled.
tracing/tracing_kernel_tainted is enabled.
tracing/tracing_kernel_partial is enabled.
network/ignore_dns is disabled.
Enabled: 0x00 Proto: 0x00 Sport: 0 Dport: 0 Src: 0.0.0.0 Dst: 0.0.0.0
Loading plugin options from: /etc/bitblaze/tracecap/hook_plugin.ini
Loading plugins from: /fill/in/path/to/temu/shared/hooks/hook_plugins
Hooking ntdll.dll::ZwOpenFile @ 0x7c91d580
Hooking ntoskrnl.exe::NtDeviceIoControlFile @ 0x8058efad
Cannot determine file system type
Cannot determine file system type
Cannot determine file system type
my_tracecap/tracecap.so is loaded successfully!

(qemu) enable_emulation

Emulation is now enabled

(qemu) tracebyname IOCTLClass.exe ioctl.trace

Waiting for process IOCTLClass.exe to start

(qemu)

PID: 1836 CR3: 0x06ba2000
Tracing IOCTLClass.exe
[*] In NtOpenFile_call
[+] Device name: \Device\aswSP
[*] In NtOpenFile_ret
[+] FileHandle: 0x000007e8
[*] In iopxxxcontrolfile_call
[*] FileHandle: 0x000007e8
[*] IoControlCode: 0xb2d6016c
[*] Tainting memory: 0xfb5a7d50 (0xb2d6016c)
Time of first tainted data: 1361877930.994695

(qemu) trace_stop

Stop tracing process 1836
Number of instructions decoded: 10447165
Number of operands decoded: 25926834
Number of instructions written to trace: 21253
Number of tainted instructions written to trace: 0
Processing time: 67.3282 U: 67.2082 S: 0.120007
Generating file: ioctl.trace.functions

As you can see, the data is tainted and is being accessed

by the application, but the instructions are not written in the

trace log.

Some help/wrong?

Thanks.

Roi Mallo

unread,

Apr 1, 2013, 9:36:30 AM4/1/13

to bitblaz...@googlegroups.com

Hi again,

nobody?

I dont understand cause taint_mem fails, seems the rigth routine to doing that.