Class TaintFileReadsLinuxAmd64SyscallLibrary

java.lang.Object

ghidra.pcode.exec.AnnotatedPcodeUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.sys.AnnotatedEmuSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.unix.AbstractEmuUnixSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.linux.AbstractEmuLinuxSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.linux.EmuLinuxAmd64SyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

ghidra.pcode.emu.taint.lib.TaintFileReadsLinuxAmd64SyscallLibrary

All Implemented Interfaces:

EmuSyscallLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>, PcodeUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

public class TaintFileReadsLinuxAmd64SyscallLibrary
extends EmuLinuxAmd64SyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

A library for performing Taint Analysis on a Linux-amd64 program that reads from tainted files

This library is not currently accessible from the UI. It can be used with scripts by overriding a taint emulator's userop library factory method.

TODO: A means of adding and configuring userop libraries in the UI.

TODO: Example scripts.

Nested Class Summary

Nested classes/interfaces inherited from class AbstractEmuUnixSyscallUseropLibrary

AbstractEmuUnixSyscallUseropLibrary.Errno, AbstractEmuUnixSyscallUseropLibrary.UnixStructuredPart

Nested classes/interfaces inherited from class AnnotatedEmuSyscallUseropLibrary

AnnotatedEmuSyscallUseropLibrary.EmuSyscall, AnnotatedEmuSyscallUseropLibrary.StructuredPart

Nested classes/interfaces inherited from class AnnotatedPcodeUseropLibrary

AnnotatedPcodeUseropLibrary.AnnotatedPcodeUseropDefinition<T>, AnnotatedPcodeUseropLibrary.FixedArgsAnnotatedPcodeUseropDefinition<T>, AnnotatedPcodeUseropLibrary.OpExecutor, AnnotatedPcodeUseropLibrary.OpLibrary, AnnotatedPcodeUseropLibrary.OpOutput, AnnotatedPcodeUseropLibrary.OpState, AnnotatedPcodeUseropLibrary.PcodeUserop, AnnotatedPcodeUseropLibrary.VariadicAnnotatedPcodeUseropDefinition<T>

Nested classes/interfaces inherited from interface EmuSyscallLibrary

EmuSyscallLibrary.EmuSyscallDefinition<T>, EmuSyscallLibrary.SyscallPcodeUseropDefinition<T>

Nested classes/interfaces inherited from interface PcodeUseropLibrary

PcodeUseropLibrary.EmptyPcodeUseropLibrary, PcodeUseropLibrary.PcodeUseropDefinition<T>

Field Summary

Fields inherited from class EmuLinuxAmd64SyscallUseropLibrary

clib64, regRAX

Fields inherited from class AbstractEmuLinuxSyscallUseropLibrary

ERRNOS, O_APPEND, O_CREAT, O_MASK_RDWR, O_RDONLY, O_RDWR, O_TRUNC, O_WRONLY

Fields inherited from class AbstractEmuUnixSyscallUseropLibrary

closedFds, descriptors, fs, intSize, user

Fields inherited from class AnnotatedEmuSyscallUseropLibrary

additionalArchives, CACHE_BY_CLASS, cSpec, dtMachineWord, machine, program, SYSCALL_SPACE_NAME, syscallMap

Fields inherited from class AnnotatedPcodeUseropLibrary

ops

Fields inherited from interface EmuSyscallLibrary

SYSCALL_CONVENTION_NAME

Fields inherited from interface PcodeUseropLibrary

NIL

Constructor Summary

Constructors

Constructor	Description
TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine, EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs, Program program)
TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine, EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs, Program program, EmuUnixUser user)

Method Summary

Modifier and Type	Method	Description
org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>	unix_read(PcodeExecutorState<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> state, org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> fd, org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> bufPtr, org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> count)	The UNIX read system call

Methods inherited from class EmuLinuxAmd64SyscallUseropLibrary

disposeAdditionalArchives, getAdditionalArchives, readSyscallNumber, returnErrno

Methods inherited from class AbstractEmuLinuxSyscallUseropLibrary

convertFlags, getErrno

Methods inherited from class AbstractEmuUnixSyscallUseropLibrary

claimFd, createHandle, findFd, handleError, lowestFd, newStructuredPart, putDescriptor, releaseFd, unix_close, unix_exit, unix_group_exit, unix_open, unix_write

Methods inherited from class AnnotatedEmuSyscallUseropLibrary

getSyscalls, getSyscallUserop, mapAndBindSyscalls, mapAndBindSyscalls, newBoundSyscall

Methods inherited from class AnnotatedPcodeUseropLibrary

getMethodLookup, getOperandType, getUserops

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface EmuSyscallLibrary

syscall

Methods inherited from interface PcodeUseropLibrary

compose, getSymbols, getUserops

Constructor Details

TaintFileReadsLinuxAmd64SyscallLibrary

public TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine,
 EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs,
 Program program,
 EmuUnixUser user)

TaintFileReadsLinuxAmd64SyscallLibrary

public TaintFileReadsLinuxAmd64SyscallLibrary(PcodeMachine<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> machine,
 EmuUnixFileSystem<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> fs,
 Program program)

Method Details

unix_read

public org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> unix_read(PcodeExecutorState<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>> state,
 org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> fd,
 org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> bufPtr,
 org.apache.commons.lang3.tuple.Pair<byte[],TaintVec> count)

Description copied from class: AbstractEmuUnixSyscallUseropLibrary

The UNIX read system call

Overrides:

unix_read in class AbstractEmuUnixSyscallUseropLibrary<org.apache.commons.lang3.tuple.Pair<byte[],TaintVec>>

Parameters:

state - to receive the thread's state

fd - the file descriptor

bufPtr - the pointer to the buffer to receive the data

count - the number of bytes to read

Returns:

the number of bytes successfully read