Taint Analysis
Taint Analysis
Contents Pin Tool Introduction Instrumentation granularity Trace instrumentation Example >Other important features Dynamic Taint Analysis Introduction > Classify of taint analysis Taint procedure Taint analysis for security 2
Contents 2 • Pin Tool ➢ Introduction ➢ Instrumentation granularity ➢ Trace instrumentation ➢ Example ➢ Other important features • Dynamic Taint Analysis ➢ Introduction ➢ Classify of taint analysis ➢ Taint procedure ➢ Taint analysis for security
Pin tools 3
Pin tools 3
Instrumentation A technique that inserts code into a program to collect run- time information Program analysis:performance profiling,error detection,capture replay Architectural study:processor and cache simulation,trace collection Source-Code Instrumentation Static Binary Instrumentation Dynamic Binary Instrumentation Instrumentcode just before itruns (Just In Time-JIT) No need to recompile or re-link Discover code at runtime Handle dynamically-generated code-Attach to running processes 4
Instrumentation • A technique that inserts code into a program to collect runtime information ➢ Program analysis : performance profiling, error detection, capture & replay ➢ Architectural study : processor and cache simulation, trace collection • Source-Code Instrumentation • Static Binary Instrumentation • Dynamic Binary Instrumentation ➢ Instrument code just before it runs ( Just In Time - JIT) ✓ No need to recompile or re-link ✓ Discover code at runtime ✓ Handle dynamically-generated code -Attach to running processes 4
Pin Instrumentation Capability Use Pin APIs to write PinTools that: Replace application functions with your own Call the original application function from within your replacementfunction Fully examine any application instruction,and insert a call to your instrumenting function to be executed whenever that instruction executes Pass parameters to your instrumenting function from a large set of supported parameters Register values(including IP),Register values by reference(for modification) Memory addresses read/written by the instruction Full register context Track function calls including syscalls and examine/change arguments Track application threads ·Interceptsignals .Instrumenta process tree 5 .Many other capabilities
Pin Instrumentation Capability Use Pin APIs to write PinTools that: • Replace application functions with your own ➢ Call the original application function from within your replacement function • Fully examine any application instruction, and insert a call to your instrumenting function to be executed whenever that instruction executes ➢ Pass parameters to your instrumenting function from a large set of supported parameters ✓ Register values (including IP), Register values by reference (for modification) ✓ Memory addresses read/written by the instruction ✓ Full register context ✓ …… • Track function calls including syscalls and examine/change arguments • Track application threads • Intercept signals • Instrument a process tree • Many other capabilities... 5