Taint-based Dynamic Analysis (CoC Research Day 2009)
1 like966 views
This document discusses taint-based dynamic analysis and leak detection. It provides an overview of how taint analysis works by assigning taint marks to tracked values, propagating those marks as values are operated on, and checking the taint marks to detect issues. It then discusses applications of taint analysis like attack prevention, information flow monitoring, testing, and detecting memory errors and leaks. Finally, it dives deeper into how leak detection specifically tracks pointers to allocated memory and reports errors if a pointer's taint mark reaches zero but the memory has not been freed.
![addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy](https://image.slidesharecdn.com/coc-researchday-130605203706-phpapp02/85/Taint-based-Dynamic-Analysis-CoC-Research-Day-2009-16-320.jpg)
![addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy](https://image.slidesharecdn.com/coc-researchday-130605203706-phpapp02/85/Taint-based-Dynamic-Analysis-CoC-Research-Day-2009-17-320.jpg)
![addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy; fixing them is not](https://image.slidesharecdn.com/coc-researchday-130605203706-phpapp02/85/Taint-based-Dynamic-Analysis-CoC-Research-Day-2009-18-320.jpg)
![addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy](https://image.slidesharecdn.com/coc-researchday-130605203706-phpapp02/85/Taint-based-Dynamic-Analysis-CoC-Research-Day-2009-26-320.jpg)
![46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
delHtab() {
15. int i;
16. HASHPTR hptr , zapptr;
17. for(i = 0; i < 3001; i++) {
18. hptr = hashtab[i];
19. if(hptr != (HASHPTR) NULL) {
20. zapptr = hptr ;
21. while(hptr->hnext != (HASHPTR) NULL) {
22.! ! hptr = hptr->hnext;
23.! ! free(zapptr);
24.! ! zapptr = hptr ;
25.! ! }
26.! ! free(hptr);
27.! }
28. }!
29. free(hashtab);
30. return;
}
Detecting leaks is easy](https://image.slidesharecdn.com/coc-researchday-130605203706-phpapp02/85/Taint-based-Dynamic-Analysis-CoC-Research-Day-2009-27-320.jpg)
![46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
Detecting leaks is easy; fixing them is, too
delHtab() {
15. int i;
16. HASHPTR hptr , zapptr;
17. for(i = 0; i < 3001; i++) {
18. hptr = hashtab[i];
19. if(hptr != (HASHPTR) NULL) {
20. zapptr = hptr ;
21. while(hptr->hnext != (HASHPTR) NULL) {
22.! ! hptr = hptr->hnext;
23.! ! free(zapptr);
24.! ! zapptr = hptr ;
25.! ! }
26.! ! free(hptr);
27.! }
28. }!
29. free(hashtab);
30. return;
}](https://image.slidesharecdn.com/coc-researchday-130605203706-phpapp02/85/Taint-based-Dynamic-Analysis-CoC-Research-Day-2009-28-320.jpg)
![46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
Detecting leaks is easy; fixing them is, too
delHtab() {
15. int i;
16. HASHPTR hptr , zapptr;
17. for(i = 0; i < 3001; i++) {
18. hptr = hashtab[i];
19. if(hptr != (HASHPTR) NULL) {
20. zapptr = hptr ;
21. while(hptr->hnext != (HASHPTR) NULL) {
22.! ! hptr = hptr->hnext;
23.! ! free(zapptr);
24.! ! zapptr = hptr ;
25.! ! }
26.! ! free(hptr);
27.! }
28. }!
29. free(hashtab);
30. return;
}
free(hptr->hname)](https://image.slidesharecdn.com/coc-researchday-130605203706-phpapp02/85/Taint-based-Dynamic-Analysis-CoC-Research-Day-2009-29-320.jpg)
Taint-based Dynamic Analysis (CoC Research Day 2009)
- 1. Taint-based Dynamic Analysis CoC Research Day - 9/25/2009 Designed at Apple in California; assembled at GeorgiaTech
- 3. Dynamic Tainting Overview 1 Assign taint marks C A B Z
- 4. Dynamic Tainting Overview 1 Assign taint marks C A B 312 Z
- 5. Dynamic Tainting Overview 1 Assign taint marks 2 Propagate taint marks C A B 312 Z
- 6. Dynamic Tainting Overview 1 Assign taint marks 2 Propagate taint marks C A B 312 Z
- 7. Dynamic Tainting Overview 1 Assign taint marks 3 Check taint marks 2 Propagate taint marks C A B 312 Z
- 8. Dynamic Tainting Overview 1 Assign taint marks 3 Check taint marks 2 Propagate taint marks C A B 312 Z C A B 312 Z 3
- 9. Dynamic Tainting Applications Attack detection / prevention Information policy enforcement Testing Memory errors Data lifetime
- 10. Dynamic Tainting Applications Attack detection / prevention Prevent stack smashing, SQL injection, buffer overruns, etc. Attack detection / prevention Information policy enforcement Testing Memory errors Data lifetime
- 11. Dynamic Tainting Applications Information policy enforcement ensure classified information does not leave the system Attack detection / prevention Information policy enforcement Testing Memory errors Data lifetime
- 12. Dynamic Tainting Applications Testing Coverage metrics, test data generation heuristic, etc. ✔/✘ Attack detection / prevention Information policy enforcement Testing Memory errors Data lifetime
- 13. Dynamic Tainting Applications Attack detection / prevention Information policy enforcement Testing Data lifetime track how long sensitive data remains in an application Memory errors Data lifetime
- 14. Dynamic Tainting Applications Attack detection / prevention Information policy enforcement Testing Memory errors Detect illegal memory access, leak detection, etc. Memory errors Data lifetime
- 15. Dynamic Tainting Applications Attack detection / prevention Information policy enforcement Testing Memory errors Detect illegal memory access, leak detection, etc.leak detection Memory errors Data lifetime
- 16. addhash(char hname[]) { 35. int i; 36. HASHPTR hptr; 37. unsigned int hsum = 0; 38. for(i = 0 ; i < strlen(hname) ; i++) { 39. sum += (unsigned int) hname[i]; 40. } 41. hsum %= 3001; 42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) { 43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX)); 44. hptr->hnext = (HASHPTR) NULL; 45. hptr->hnum = ++netctr; 46. hptr->hname = (char *) malloc((strlen(hname) + 1) * ! ! ! ! ! ! ! ! ! ! sizeof(char)); 47. sprintf(hptr->hname , "%s" , hname); 48. return(1); 49. } else { ! ... 67. } } Detecting leaks is easy
- 17. addhash(char hname[]) { 35. int i; 36. HASHPTR hptr; 37. unsigned int hsum = 0; 38. for(i = 0 ; i < strlen(hname) ; i++) { 39. sum += (unsigned int) hname[i]; 40. } 41. hsum %= 3001; 42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) { 43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX)); 44. hptr->hnext = (HASHPTR) NULL; 45. hptr->hnum = ++netctr; 46. hptr->hname = (char *) malloc((strlen(hname) + 1) * ! ! ! ! ! ! ! ! ! ! sizeof(char)); 47. sprintf(hptr->hname , "%s" , hname); 48. return(1); 49. } else { ! ... 67. } } Detecting leaks is easy
- 18. addhash(char hname[]) { 35. int i; 36. HASHPTR hptr; 37. unsigned int hsum = 0; 38. for(i = 0 ; i < strlen(hname) ; i++) { 39. sum += (unsigned int) hname[i]; 40. } 41. hsum %= 3001; 42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) { 43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX)); 44. hptr->hnext = (HASHPTR) NULL; 45. hptr->hnum = ++netctr; 46. hptr->hname = (char *) malloc((strlen(hname) + 1) * ! ! ! ! ! ! ! ! ! ! sizeof(char)); 47. sprintf(hptr->hname , "%s" , hname); 48. return(1); 49. } else { ! ... 67. } } Detecting leaks is easy; fixing them is not
- 19. Discover where the last pointer to un-freed memory is lost Leak Detection Overview
- 20. Assign taint marks Propagate taint marks Check taint marks ptr1 = malloc(...) ➔ ptr1 ptr2 = calloc(...) ➔ ptr2 ptr3 = ptr1 ➔ ptr3 , ptr1 ptr1 = NULL ➔ ptr1 , ptr3 ptr4 = ptr2 + 1 ➔ ptr4 , ptr2 Report error if taint mark’s count is zero and memory has not been freed. 1 1 1 Discover where the last pointer to un-freed memory is lost Leak Detection Overview
- 21. Assign taint marks Propagate taint marks Check taint marks ptr1 = malloc(...) ➔ ptr1 ptr2 = calloc(...) ➔ ptr2 ptr3 = ptr1 ➔ ptr3 , ptr1 ptr1 = NULL ➔ ptr1 , ptr3 ptr4 = ptr2 + 1 ➔ ptr4 , ptr2 Report error if taint mark’s count is zero and memory has not been freed. 1 1 1 Discover where the last pointer to un-freed memory is lost Leak Detection Overview # of pointers tainted with this color
- 22. Assign taint marks Propagate taint marks Check taint marks ptr1 = malloc(...) ➔ ptr1 ptr2 = calloc(...) ➔ ptr2 ptr3 = ptr1 ➔ ptr3 , ptr1 ptr1 = NULL ➔ ptr1 , ptr3 ptr4 = ptr2 + 1 ➔ ptr4 , ptr2 Report error if taint mark’s count is zero and memory has not been freed. 1 1 1 Discover where the last pointer to un-freed memory is lost Leak Detection Overview
- 23. Assign taint marks Propagate taint marks Check taint marks ptr1 = malloc(...) ➔ ptr1 ptr2 = calloc(...) ➔ ptr2 ptr3 = ptr1 ➔ ptr3 , ptr1 ptr1 = NULL ➔ ptr1 , ptr3 ptr4 = ptr2 + 1 ➔ ptr4 , ptr2 Report error if taint mark’s count is zero and memory has not been freed. 2 1 1 1 1 2 2 2 1 1 2 2 Discover where the last pointer to un-freed memory is lost Leak Detection Overview
- 24. Assign taint marks Propagate taint marks Check taint marks ptr1 = malloc(...) ➔ ptr1 ptr2 = calloc(...) ➔ ptr2 ptr3 = ptr1 ➔ ptr3 , ptr1 ptr1 = NULL ➔ ptr1 , ptr3 ptr4 = ptr2 + 1 ➔ ptr4 , ptr2 Report error if taint mark’s count is zero and memory has not been freed. 2 1 1 1 1 2 2 2 1 1 2 2 In general propagation follows standard pointer arithmetic rules Discover where the last pointer to un-freed memory is lost Leak Detection Overview
- 25. Assign taint marks Propagate taint marks Check taint marks ptr1 = malloc(...) ➔ ptr1 ptr2 = calloc(...) ➔ ptr2 ptr3 = ptr1 ➔ ptr3 , ptr1 ptr1 = NULL ➔ ptr1 , ptr3 ptr4 = ptr2 + 1 ➔ ptr4 , ptr2 Report error if taint mark’s count is zero and memory has not been freed. 2 3 1 1 1 1 2 2 2 1 1 2 2 In general propagation follows standard pointer arithmetic rules Discover where the last pointer to un-freed memory is lost Leak Detection Overview
- 26. addhash(char hname[]) { 35. int i; 36. HASHPTR hptr; 37. unsigned int hsum = 0; 38. for(i = 0 ; i < strlen(hname) ; i++) { 39. sum += (unsigned int) hname[i]; 40. } 41. hsum %= 3001; 42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) { 43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX)); 44. hptr->hnext = (HASHPTR) NULL; 45. hptr->hnum = ++netctr; 46. hptr->hname = (char *) malloc((strlen(hname) + 1) * ! ! ! ! ! ! ! ! ! ! sizeof(char)); 47. sprintf(hptr->hname , "%s" , hname); 48. return(1); 49. } else { ! ... 67. } } Detecting leaks is easy
- 27. 46. hptr->hname = (char *) malloc((strlen(hname) + 1) * ! ! ! ! ! ! ! ! ! ! sizeof(char)); delHtab() { 15. int i; 16. HASHPTR hptr , zapptr; 17. for(i = 0; i < 3001; i++) { 18. hptr = hashtab[i]; 19. if(hptr != (HASHPTR) NULL) { 20. zapptr = hptr ; 21. while(hptr->hnext != (HASHPTR) NULL) { 22.! ! hptr = hptr->hnext; 23.! ! free(zapptr); 24.! ! zapptr = hptr ; 25.! ! } 26.! ! free(hptr); 27.! } 28. }! 29. free(hashtab); 30. return; } Detecting leaks is easy
- 28. 46. hptr->hname = (char *) malloc((strlen(hname) + 1) * ! ! ! ! ! ! ! ! ! ! sizeof(char)); Detecting leaks is easy; fixing them is, too delHtab() { 15. int i; 16. HASHPTR hptr , zapptr; 17. for(i = 0; i < 3001; i++) { 18. hptr = hashtab[i]; 19. if(hptr != (HASHPTR) NULL) { 20. zapptr = hptr ; 21. while(hptr->hnext != (HASHPTR) NULL) { 22.! ! hptr = hptr->hnext; 23.! ! free(zapptr); 24.! ! zapptr = hptr ; 25.! ! } 26.! ! free(hptr); 27.! } 28. }! 29. free(hashtab); 30. return; }
- 29. 46. hptr->hname = (char *) malloc((strlen(hname) + 1) * ! ! ! ! ! ! ! ! ! ! sizeof(char)); Detecting leaks is easy; fixing them is, too delHtab() { 15. int i; 16. HASHPTR hptr , zapptr; 17. for(i = 0; i < 3001; i++) { 18. hptr = hashtab[i]; 19. if(hptr != (HASHPTR) NULL) { 20. zapptr = hptr ; 21. while(hptr->hnext != (HASHPTR) NULL) { 22.! ! hptr = hptr->hnext; 23.! ! free(zapptr); 24.! ! zapptr = hptr ; 25.! ! } 26.! ! free(hptr); 27.! } 28. }! 29. free(hashtab); 30. return; } free(hptr->hname)
- 31. Leakpoint implementation Pointer to memory area 0x1C93AC0 (16 bytes) allocated: at malloc by addhash (hash.c:50) by parser (parser.c:210) by readcell (parser.c:34) by main (main.c:98) was leaked: at free by delHtab (hash.c:28) by grdcell(grdcell.c:354) by main (main.c:227)
- 32. Leakpoint implementation Pointer to memory area 0x1C93AC0 (16 bytes) allocated: at malloc by addhash (hash.c:50) by parser (parser.c:210) by readcell (parser.c:34) by main (main.c:98) was leaked: at free by delHtab (hash.c:28) by grdcell(grdcell.c:354) by main (main.c:227)
- 33. Leakpoint implementation Pointer to memory area 0x1C93AC0 (16 bytes) allocated: at malloc by addhash (hash.c:50) by parser (parser.c:210) by readcell (parser.c:34) by main (main.c:98) was leaked: at free by delHtab (hash.c:28) by grdcell(grdcell.c:354) by main (main.c:227)
- 34. Evaluation
- 36. Evaluation Transmission Locations identified by Leakpoint correspond to where the leaks were fixed by developers.
- 37. Evaluation Transmission Also found thousands of leaks in the SPEC INT benchmarks Locations identified by Leakpoint correspond to where the leaks were fixed by developers.
- 38. static void processCompletedTasks(tr_web *web) { ... task->done_func(web->session, ..., task->done_func_user_data); ... evbuffer_free(task->response); tr_free(task->url); tr_free(task); ... } static void invokeRequest(void * vreq) { ... hash = tr_new0(uint8_t, SHA_DIGEST_LENGTH); memcpy(hash, req->torrent_hash, SHA_DIGEST_LENGTH); tr_webRun(req->session, req->url, req->done_func, hash); ... } static void onStoppedResponse(tr_session *session, ..., void *torrent_hash) { dbgmsg(NULL, "got a response ... message"); // tr_free(torrent_hash); onReqDone(session); }
- 39. Overhead Powerful but expensive 50 - 100x overheads are common • Execution time is completely automated • Developers have to think less
- 40. Questions?