Class TaintFileReadsLinuxAmd64SyscallLibrary

java.lang.Object

ghidra.pcode.exec.DefaultPcodeUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.exec.AnnotatedPcodeUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.sys.AnnotatedEmuSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.unix.AbstractEmuUnixSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.linux.AbstractEmuLinuxSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.linux.EmuLinuxAmd64SyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.taint.lib.TaintFileReadsLinuxAmd64SyscallLibrary

All Implemented Interfaces:

EmuSyscallLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>, PcodeUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

public class TaintFileReadsLinuxAmd64SyscallLibrary
extends EmuLinuxAmd64SyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

A library for performing Taint Analysis on a Linux-amd64 program that reads from tainted files

This library is not currently accessible from the UI. It can be used with scripts by overriding a taint emulator's userop library factory method.

TODO: A means of adding and configuring userop libraries in the UI.

TODO: Example scripts.

Nested Class Summary

Nested classes/interfaces inherited from class AbstractEmuUnixSyscallUseropLibrary

AbstractEmuUnixSyscallUseropLibrary.Errno, AbstractEmuUnixSyscallUseropLibrary.UnixStructuredPart

Nested classes/interfaces inherited from class AnnotatedEmuSyscallUseropLibrary

AnnotatedEmuSyscallUseropLibrary.EmuSyscall, AnnotatedEmuSyscallUseropLibrary.StructuredPart

Nested classes/interfaces inherited from class AnnotatedPcodeUseropLibrary

AnnotatedPcodeUseropLibrary.AnnotatedPcodeUseropDefinition<T>, AnnotatedPcodeUseropLibrary.FixedArgsAnnotatedPcodeUseropDefinition<T>, AnnotatedPcodeUseropLibrary.OpExecutor, AnnotatedPcodeUseropLibrary.OpInput, AnnotatedPcodeUseropLibrary.OpLibrary, AnnotatedPcodeUseropLibrary.OpOp, AnnotatedPcodeUseropLibrary.OpOutput, AnnotatedPcodeUseropLibrary.OpState, AnnotatedPcodeUseropLibrary.PcodeUserop, AnnotatedPcodeUseropLibrary.VariadicAnnotatedPcodeUseropDefinition<T>

Nested classes/interfaces inherited from interface EmuSyscallLibrary

EmuSyscallLibrary.EmuSyscallDefinition<T>

Nested classes/interfaces inherited from interface PcodeUseropLibrary

PcodeUseropLibrary.EmptyPcodeUseropLibrary, PcodeUseropLibrary.PcodeUseropDefinition<T>, PcodeUseropLibrary.PcodeUseropSymbolMap

Field Summary

Fields inherited from class EmuLinuxAmd64SyscallUseropLibrary

clib64

Fields inherited from class AbstractEmuLinuxSyscallUseropLibrary

ERRNOS, O_APPEND, O_CREAT, O_MASK_RDWR, O_RDONLY, O_RDWR, O_TRUNC, O_WRONLY

Fields inherited from class AbstractEmuUnixSyscallUseropLibrary

closedFds, descriptors, fs, intSize, user

Fields inherited from class AnnotatedEmuSyscallUseropLibrary

additionalArchives, CACHE_BY_CLASS, cSpec, dtMachineWord, machine, program, SYSCALL_SPACE_NAME, syscallMap

Fields inherited from class DefaultPcodeUseropLibrary

ops

Fields inherited from interface EmuSyscallLibrary

FALLBACK_EMU_SYSCALL, SYSCALL_CONVENTION_NAME

Fields inherited from interface PcodeUseropLibrary

NIL, SYMBOL_CACHE

Constructor Summary

Constructors

Constructor	Description
TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine, EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs, Program program)
TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine, EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs, Program program, EmuUnixUser user)

Method Summary

Modifier and Type	Method	Description
org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>	unix_read(PcodeExecutorState<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> state, org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> fd, org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> bufPtr, org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> count)

Methods inherited from class EmuLinuxAmd64SyscallUseropLibrary

disposeAdditionalArchives, getAdditionalArchives, syscall

Methods inherited from class AbstractEmuLinuxSyscallUseropLibrary

convertFlags, getErrno

Methods inherited from class AbstractEmuUnixSyscallUseropLibrary

abstract_unix_read, claimFd, createHandle, findFd, lowestFd, newStructuredPart, putDescriptor, releaseFd, unix_close, unix_exit, unix_group_exit, unix_open, unix_read, unix_write

Methods inherited from class AnnotatedEmuSyscallUseropLibrary

getSyscalls, mapAndBindSyscalls, mapAndBindSyscalls, newBoundSyscall

Methods inherited from class AnnotatedPcodeUseropLibrary

getMethodLookup, getOperandType

Methods inherited from class DefaultPcodeUseropLibrary

getUserops, putOp

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface EmuSyscallLibrary

emu_rt_syscall, emu_syscall

Methods inherited from interface PcodeUseropLibrary

compose, compose, getSymbols, getUserops

Constructor Details

TaintFileReadsLinuxAmd64SyscallLibrary

public TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine,
 EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs,
 Program program,
 EmuUnixUser user)

TaintFileReadsLinuxAmd64SyscallLibrary

public TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine,
 EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs,
 Program program)

Method Details

unix_read

public org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> unix_read(PcodeExecutorState<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> state,
 org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> fd,
 org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> bufPtr,
 org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> count)