Re: PAPER: Dynamic Data Flow Analysis via Virtual Code Integration (aka The SpiderPig case)

[nnp <version5 () gmail com>]

Hey,

I've got a few questions regarding your approach.

1) In section 4.4 you discuss predicting data propogation and you use
the term 'symbolic execution'. Does this mean you treat all input as
symbolic? e.g. everything from a recv() call is marked as 'tainted'

2) If the answer to the previous question is 'yes'; how do you deal
with symbolic read/writes using your O_in/O_out register mechanism? I
can't see this working for memory, as the size of those sets becomes
potentially unbounded (well, bounded by the amount of usable memory)
e.g how do you describe the memory written to by **mov dword ptr
[eax], ebx** if eax is symbolic and dependent on user input? A more
tangible situation might be the case where a child object is created,
then written to memory at a symbolic offset and then later read again.

3) What DynamoRIO plugin are you comparing your code to?

Cheers, and good work,
nnp

On Mon, May 18, 2009 at 1:32 PM, Piotr Bania <bania.piotr () gmail com> wrote:
> SpiderPig is a project created for performing and visualizing data flow
> analysis of a selected binary program. SpiderPig was created in the purpose
> of providing a tool which would be able to help vulnerability and security
> researchers with tracing and analyzing any necessary data and it's further
> propagation. Such tasks are very often crucial in the vulnerability
> discovering/identifying process and typically require a lot of time
> consuming manual work. Following paper discusses methods and techniques
> implemented in SpiderPig in order to perform semi-automatic data flow
> analysis.
>
> Paper is available here:
> http://piotrbania.com/all/spiderpig/pbania-spiderpig2008.pdf
>
>
> Simple video demo and some other things available on project website:
> http://piotrbania.com/all/spiderpig/
>
>
> best regards,
> Piotr Bania
>
> --
> --------------------------------------------------------------------
> Piotr Bania - <bania.piotr () gmail com> - 0xCD, 0x19
> Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
> http://www.piotrbania.com  - Key ID: 0xBE43AC33
> --------------------------------------------------------------------
>
>               - "The more I learn about men, the more I love dogs."
>
>
> P.S Did ya know adult pigs can run at speeds of up to 11 miles an hour?
>
> _______________________________________________
> Dailydave mailing list
> Dailydave () lists immunitysec com
> http://lists.immunitysec.com/mailman/listinfo/dailydave



-- 
http://www.unprotectedhex.com
http://www.smashthestack.org
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave