polytracker.taint_dag¶
taint_dag classes¶
TDBitmapSection¶
- class polytracker.taint_dag.TDBitmapSection(mem, hdr)¶
Bases:
object
Represents a bitmap section encoded by BitmapSectionBase.
The only configuration currently supported is to have the BucketType template parameter of BitmapSectionBase as uint64_t. It also requires the endianess to not change as the implementation does not handle endianess in any specific way.
- __init__(mem, hdr)¶
- enumerate_set_bits()¶
Enumerates all bits that are set
The index of each bit that is set will be yielded.
TDControlFlowLogSection¶
- class polytracker.taint_dag.TDControlFlowLogSection(mem, hdr)¶
Bases:
object
TDAG Control flow log section
Interprets the control flow log section in a TDAG file. Enables enumeration/random access of items
- ENTER_FUNCTION = 0¶
- LEAVE_FUNCTION = 1¶
- TAINTED_CONTROL_FLOW = 2¶
- __init__(mem, hdr)¶
- function_id_mapping(id_to_name_array)¶
This method stores an array used to translate from function id to symbolic names
TDEnterFunctionEvent¶
- class polytracker.taint_dag.TDEnterFunctionEvent(callstack)¶
Bases:
object
Emitted whenever execution enters a function. The callstack member is the callstack right before entering the function, having the function just entered as the last member of the callstack.
- __init__(callstack)¶
Callstack after entering function
TDEvent¶
- class polytracker.taint_dag.TDEvent¶
Bases:
Structure
- class Kind(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶
Bases:
Enum
- ENTRY = 0¶
- EXIT = 1¶
- classmethod __contains__(member)¶
Return True if member is a member of this enum raises TypeError if member is not an enum member
note: in 3.12 TypeError will no longer be raised, and True will also be returned if member is the value of a member in this enum
- classmethod __getitem__(name)¶
Return the member matching name.
- classmethod __iter__()¶
Return members in definition order.
- classmethod __len__()¶
Return the number of members (no aliases)
- __init__(*args, **kwargs)¶
- fnidx¶
Structure/Union member
- kind¶
Structure/Union member
TDEventsSection¶
TDFDHeader¶
TDFile¶
TDFileMeta¶
- class polytracker.taint_dag.TDFileMeta¶
Bases:
Structure
TDAG File metadata.
File header describing the overall layout of the TDAG file. Corresponds to OutputFile::FileMeta in outputfile.h
- __init__(*args, **kwargs)¶
- magic¶
Structure/Union member
- section_count¶
Structure/Union member
- tdag¶
Structure/Union member
TDFnHeader¶
TDFunctionsSection¶
TDInfo¶
- class polytracker.taint_dag.TDInfo(argument_parser: ArgumentParser)¶
Bases:
Command
- __init__(argument_parser: ArgumentParser)¶
- extension_types: Optional[List[Type[CommandExtension]]] = None¶
An auto-populated list of eny extensions to this command.
- extensions: List[CommandExtension]¶
- parent: Optional['Plugin']¶
The parent of this plugin, if it is a sub-plugin.
- parent_parsers: Tuple[ArgumentParser, ...] = ()¶
An optional sequence of parent argument parsers from which to parse options.
- run(args)¶
Callback for when the command is run.
- Parameters:
args – The result of parsing the commandline arguments set up by
Command.__init_arguments__()
.
- subcommand_types: Optional[List[Type[Subcommand]]] = None¶
An auto-populated list of subcommands of this command.
- subcommands: List[Subcommand]¶
TDLabelSection¶
TDLeaveFunctionEvent¶
- class polytracker.taint_dag.TDLeaveFunctionEvent(callstack)¶
Bases:
object
Emitted whenever execution leaves a function. The callstack member is the callstack right before leaving the function, having the function about to leave as the last member of the callstack.
- __init__(callstack)¶
Callstack before leaving function
TDNode¶
TDProgramTrace¶
- class polytracker.taint_dag.TDProgramTrace(file: BinaryIO)¶
Bases:
ProgramTrace
- access_sequence() Iterator[TaintAccess] ¶
Yields the taint accesses in this trace, in order.
- property basic_blocks: Iterable[BasicBlock]¶
The static basic blocks operated on by the trace.
- property cfg: DiGraph[BasicBlock]¶
The static control flow graph associated with this trace.
- cfg_roots() Iterable[BasicBlock] ¶
- property entrypoint: Optional[FunctionInvocation]¶
Returns the entrypoint to this trace (i.e., its first
FunctionInvocation
, typicallymain
).
- file_offset(node: TaintForestNode) ByteOffset ¶
The file offset associated with a taint forest node
- function_trace() Iterator[FunctionEntry] ¶
Iterates over all of the
FunctionEntry
events in this trace.This is equivalent to:
iter(event for event in self if isinstance(event, FunctionEntry))
- get_event(uid: int) TraceEvent ¶
Gets a trace event by its ID.
- get_function(name: str) Function ¶
Looks up a function by its name.
- Raises:
KeyError – if a function of that name was not executed in the trace
- has_function(name: str) bool ¶
Returns whether a function of the given name was executed in this trace.
- input_properties(source: Input) InputProperties ¶
- static load(tdpath: Union[str, Path]) TDProgramTrace ¶
loads a trace from a .tdag file emitted by an instrumented binary
- next_function_entry(after: Optional[FunctionEntry] = None) Optional[FunctionEntry] ¶
Returns the next function entry, or None if none exists
- property output_taints: Iterator[TDTaintOutput]¶
Iterates over all of the outputs written in the trace
- property taint_forest: TaintForest¶
The taint forest associated with this trace.
- taints(nodes: Iterable[TaintForestNode]) Taints ¶
TDRangeNode¶
TDSectionMeta¶
- class polytracker.taint_dag.TDSectionMeta¶
Bases:
Structure
TDAG Section metadata.
Section header describing a particular section in the TDAG file. Corresponds to OutputFile::SectionMeta in outputfile.h
- __init__(*args, **kwargs)¶
- align¶
Structure/Union member
- offset¶
Structure/Union member
- size¶
Structure/Union member
- tag¶
Structure/Union member
TDSink¶
TDSinkSection¶
TDSourceIndexSection¶
- class polytracker.taint_dag.TDSourceIndexSection(mem, hdr)¶
Bases:
TDBitmapSection
Represents the source index section.
It is a bitmap of all labels that are source taints.
- __init__(mem, hdr)¶
- enumerate_set_bits()¶
Enumerates all bits that are set
The index of each bit that is set will be yielded.
TDSourceNode¶
TDSourceSection¶
TDStringSection¶
TDTaintForest¶
- class polytracker.taint_dag.TDTaintForest(trace: TDProgramTrace)¶
Bases:
TaintForest
- __init__(trace: TDProgramTrace) None ¶
- create_node(label: int) TDTaintForestNode ¶
- get_node(label: int, source: Optional[Input] = None) TDTaintForestNode ¶
- nodes() Iterator[TDTaintForestNode] ¶
Iterates over the nodes in order of decreasing label
- to_graph() DAG[TaintForestNode] ¶
TDTaintForestNode¶
- class polytracker.taint_dag.TDTaintForestNode(forest: TDTaintForest, label: int, source: Optional[Input], affected_control_flow: bool = False, parent_labels: Optional[Tuple[int, int]] = None)¶
Bases:
TaintForestNode
- __init__(forest: TDTaintForest, label: int, source: Optional[Input], affected_control_flow: bool = False, parent_labels: Optional[Tuple[int, int]] = None)¶
- property parent_one: Optional[TDTaintForestNode]¶
- property parent_two: Optional[TDTaintForestNode]¶
TDTaintOutput¶
TDTaintedControlFlowEvent¶
- class polytracker.taint_dag.TDTaintedControlFlowEvent(callstack, label)¶
Bases:
object
Emitted whenever a control flow change is influenced by tainted data. The label that influenced the control flow is available in the label member. Current callstack (including the function the control flow happened in) is available in the callstack member.
- __init__(callstack, label)¶