KRFAnalysis icon indicating copy to clipboard operation
KRFAnalysis copied to clipboard

Reverse taint analysis module

Open hmwildermuth opened this issue 6 years ago • 0 comments

Adds an LLVM pass to do the 'reverse taint analysis' that allows tracing back along the call stack in order to detect what functions could have been the fault that crashed the program.

The pass has the same basic algorithm as #13 but acts on IR and uses symbol names instead of addresses. It has the benefit of knowing exactly how many parameters each function should have, something binary ninja struggles with.

Requires debug info in the IR.

Still has some todos before its ready:

  • JSON output
  • Integration into the pipeline so that gdb output can easily be passed to it.

hmwildermuth avatar Jul 29 '19 20:07 hmwildermuth