slicer.py

The slicer script make use of REVEN data tainting capabilities to display a list of instructions that manipulate tainted data.

It uses reven.Project.taint method to retrieve the list of execution Point which deal with tainted data and print them.

#!/usr/bin/env python2

import reven
import argparse

def parse_args():
    parser = argparse.ArgumentParser(description='Create a sliced trace based on some register taint propagation.')
    parser.add_argument('--host', metavar='host', dest='host', help='the reven host', default="localhost")
    parser.add_argument('--port', metavar='port', dest='port', type=int, help='the reven server port', default=13370)
    parser.add_argument('-r', metavar='run', dest='run', help='the reven execution run name', default='Execution run')
    parser.add_argument('-s', metavar='sequence', dest='sequence', type=int, help='the reven execution sequence', default=0)
    parser.add_argument('-i', metavar='instruction', dest='instruction', type=int, help='the reven execution instruction', default=0)
    parser.add_argument('-b', dest='backward', action='store_true', help='taint in backward direction')

    parser.add_argument(metavar='registers', dest='registers', help='name of the registers to taint', nargs='+')

    args = parser.parse_args()

    return args

if __name__ == '__main__':

    # Parse the input arguments
    args = parse_args()

    # Connect to the reven project
    p = reven.Project(args.host, args.port)

    # Get the target trace
    t = p.trace(args.run)

    # Get the taint range start point
    start_point = t.point(args.sequence, args.instruction)

    # Get the taint range end point
    if args.backward:
        # Get the first trace point
        stop_point = t.point(0)
    else:
        # Get the last trace point
        stop_point = t.point(t.sequence_count-1)
        last_instruction = len(stop_point.basic_block) -1
        stop_point = t.point(t.sequence_count-1, last_instruction)


    # Get the initially tainted registers (assume its a 4byte register).
    syms = [ reven.SymbolicRegister(r, 4) for r in args.registers ]

    # Propagate the taint, timeout after 5s
    result = p.taint(start_point, stop_point, syms, 5000)

    # Display the sliced trace
    for r in sorted(result.keys()):
        print "%d_%d - %-32s %s" % (r.sequence_index, r.instruction_index, r.symbol, r.instruction)