The goal of this transformation is to disrupt analysis tools that
make use of dynamic taint analysis.
Diversity
We use two basic ways to copy a variable using control-, rather than data-flow:
- counting up to the value of the variable, and
- copying it bit by bit, tested in an if-statement.
Usage
If you want to copy using signals you must first generate the signal handlers using the InitImplicitFlow transformation.Options
Option | Arguments | Description |
---|---|---|
--Transform | AntiTaintAnalysis | Transform the code by inserting implicit flow such that dynamic taint analysis becomes less precise. |
--AntiTaintAnalysisKinds | argv, sysCalls, vars, * | Comma-separated list of the kinds of anti-taint analysis transformations to employ. Default=none.
|
--AntiTaintAnalysisSysCalls | getpid, scanf, * | Comma-separated list of the system calls whose output should be passed through implicit flow. Only two calls are currently implemented. Default=all system calls.
|
--AntiTaintAnalysisImplicitFlow | single, compose, select, majority, repeat, until | S-expression of the implicit flow combiners to use. Default=none.
|
Examples
The code to copy argc using bit-by-bit copy and signals would look something like this:
argc_origPtr13 = (unsigned char *)(& argc); argc_copyPtr15 = (unsigned char *)(& argc_copy14); size_iter16 = 0; while (size_iter16 < 4) { TempVar = 0; signal(31, handler); BitVar = 0; while (BitVar < 8) { if ((*argc_origPtr13 >> BitVar) & 1) { raise(31); } BitVar ++; } signal(31, (void (*)(void *sig ))1); *argc_copyPtr15 = TempVar; argc_origPtr13 ++; argc_copyPtr15 ++; size_iter16 ++; }with this signal handler and these global variables:
unsigned char TempVar; int BitVar; void handler(int sig ) { TempVar |= 1 << BitVar; }
Issues
Currently, we can only un-taint a few variables:
- argc and argv in main,
- the output values of a few system and library calls: getpid and scanf,
- the virtual PC in a virtualized function (using the --VirtualizeImplicitFlowVPC option).
- The function handler to a jitted function (using the --JitImplicitFlow option).