moyix

  400f70:       48 8d a4 24 68 ff ff    lea    -0x98(%rsp),%rsp
  400f77:       ff 
  400f78:       48 89 14 24             mov    %rdx,(%rsp)
  400f7c:       48 89 4c 24 08          mov    %rcx,0x8(%rsp)
  400f81:       48 89 44 24 10          mov    %rax,0x10(%rsp)
  400f86:       48 c7 c1 aa 30 00 00    mov    $0x30aa,%rcx
  400f8d:       e8 0e 02 00 00          callq  4011a0 <__afl_maybe_log>
  400f92:       48 8b 44 24 10          mov    0x10(%rsp),%rax
  400f97:       48 8b 4c 24 08          mov    0x8(%rsp),%rcx
  400f9c:       48 8b 14 24             mov    (%rsp),%rdx

moyix

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

#ifndef __AFL_LOOP 
#define __AFL_LOOP(n) ({ static int __i; !(__i++); }) 
#endif 

static unsigned char lava_val[4];

moyix

0000000: 4156 414c 0000 0000 0200 0000 7212 8357  AVAL........r..W
0000010: 6c69 6768 7400 0000 0000 0000 0000 0000  light...........
0000020: 0200 0000 4a78 de11 706c 616e 636b 0000  ....Jx..planck..
0000030: 0000 0000 0000 0000 0100 0000 c308 d440  ...............@

moyix

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

#ifndef __AFL_LOOP 
#define __AFL_LOOP(n) ({ static int __i; !(__i++); }) 
#endif 

static unsigned char lava_val[4];

moyix

#!/bin/bash

cd "$1"/toy/
klee --simplify-sym-indices --write-cvcs --write-cov --output-module --disable-inlining --optimize --use-forked-solver --use-cex-cache --libc=uclibc --posix-runtime --allow-external-sym-calls --only-output-states-covering-new --max-sym-array-size=4096 --max-instruction-time=30. --max-time=18000. --watchdog --max-memory-inhibit=false --max-static-fork-pct=1 --max-static-solve-pct=1 --max-static-cpfork-pct=1 --switch-type=internal --randomize-fork --search=random-path --search=nurs:covnew --use-batching-search --batch-instructions=10000 ./toy.bc A --sym-files 1 128 --sym-stdout

moyix

graph nsa {
node1 [label="BUSURPER-3101-805.exe"];
node2 [label="BBALL_DA28F-2131.exe"];
node234 [label="pd_create_ruleset-2100"];
node4 [label="SecondDate-3021.exe"];
node5 [label="BUSURPER-3001-705.exe"];
node6 [label="IvlMiniProg-3100"];
node264 [label="SecondDateLP-3020"];
node8 [label="profilerIpv4-2200"];
node11 [label="pd_miniprog-2100"];

moyix

-rw-rw----  0 user   user      150 Dec 31  1969 trickortreat/pitchimpair/uji.kyoyo-u.ac.jp___133.3.5.33/jackladder
-rw-rw-rw-  0 user   user      180 Dec 31  1969 trickortreat/pitchimpair/win.hallym.ac.kr___210.115.225.17/orangutan
-rw-rw-rw-  0 user   user      183 Dec 31  1969 trickortreat/intonation/mailhub.minaffet.gov.rw___62.56.174.152/orangutan
-rw-rw-rw-  0 user   user      174 Dec 31  1969 trickortreat/pitchimpair/nodep.sun-ip.or.jp___150.27.1.2/incision
-rw-rw----  0 user   user      157 Dec 31  1969 trickortreat/pitchimpair/utc-web.utc21.co.kr___211.40.103.194/dewdrop
drwxrwxr-x  0 user   user        0 Dec 31  1969 trickortreat/pitchimpair/mail.btbu.edu.cn___211.82.112.23/
-rw-rw----  0 user   user      175 Dec 31  1969 trickortreat/pitchimpair/ns.hufs.ac.kr___203.253.64.1/orangutan
drwxrwxr-x  0 user   user        0 Dec 31  1969 trickortreat/intonation/nd11mx1-a-fixed.sancharnet.in___61.0.0.46/
-rw-rw-rw-  0 user   user      181 Dec 31  1969 trickortreat/pitchimpair/ganeran.sarenet.es___194.30.32.

moyix

=========== ./BANANAGLEE/BANANAUSURPER/BG2200_UPGRADE/UPGRADE/BUSURPER-2211-611.exe ===========
00000000 l    df *ABS*	00000000 upgrade_pix.c
00000000 l    df *ABS*	00000000 change_page_permission.c
00000000 l    df *ABS*	00000000 osVersionChecking.c
=========== ./BANANAGLEE/BANANAUSURPER/BG2200_UPGRADE/UPGRADE/BUSURPER-2211-614.exe ===========
00000000 l    df *ABS*	00000000 upgrade_pix.c
00000000 l    df *ABS*	00000000 change_page_permission.c
00000000 l    df *ABS*	00000000 osVersionChecking.c
=========== ./BANANAGLEE/BANANAUSURPER/BG2200_UPGRADE/UPGRADE/BUSURPER-2211-622.exe ===========
00000000 l    df *ABS*	00000000 upgrade_pix.c

moyix

# We're going to do a simple demo of using PANDA to do a dynamic taint
# analysis of a program that parses a file. The program we're using is
# the "who" utility, which parses a binary log file (utmp).
# This assumes that you've got a build of PANDA:
ls ~/git/panda/build/i386-softmmu/qemu-system-i386
# To start off, we'll create a recording of running who. We can do this
# using PANDA's run_debian.py script, which will automatically download a
# 32-bit Linux image and run a command in it. It will even copy in any
# files needed for you.
~/git/panda/panda/scripts/run_debian.py who /var/run/utmp 

moyix

all: quiz

quiz.o: quiz.asm
	nasm -f elf64 $< -o $@

quiz: quiz.o
	ld -Tdata=0x8000000000 $< -o $@