pag

25 ms·

1.
by pag 3y ago
I implemented something like this! The Dr. Lojekyll [1] datalog system was built around the idea of inputs as receiving messages over time, and publishing outputs (also as messages) or responding to queries (using materialized views). It wo
2.
by pag 4y ago
These are great questions! We think our approaches are complimentary. We think that CIR, or ClangIR, can be a codegen target from a combination of our high-level IR and our medium-level IR dialects. Our understanding of ClangIR is that it h
3.
by pag 5y ago
Can you explain how your offering compares with open-source alternatives, such as KLEE [1] and DeepState [2]? P.S. your logo is surprisingly similar to that of ForAllSecure [3], which also provides a symbolic execution engine called Mayhem
4.
by pag 5y ago
DeepState [1] is a tool that lets you write Google Test-style unit tests, as well as property tests, in either C or C++, and plug in fuzzers and symbolic executors. That is, DeepState bridges this gap between fuzz testing and property testi
5.
by pag 6y ago
It sounds like what you want is Mishegos [1], described here [2]. In fact, this work shows that Capstone performs rather poorly compared to more permissively licensed open-source competitors such as Intel XED and Zydis. Really, if your focu
6.
by pag 7y ago
And lets not forget that Rust's borrow checker is implemented with Datalog [1]. [1] https://smallcultfollowing.com/babysteps/blog/2018/04/27/an-...
7.
by pag 7y ago
Datalog also comes up in cluster management / provisioning. For example: Differential Datalog [1]. [1] https://github.com/vmware/differential-datalog
8.
by pag 7y ago
Datalog and variants of it come up a bunch in program analysis and software security. For example, GitHub/Microsoft acquired a company, Semmle [1], that has an object-oriented query language that compiles down into Datalog, and can be
9.
by pag 7y ago
If you can modify the kernel, you could modify binfmt_elf.c in the case of the Linux kernel, and log out the load address to dmesg or something like that. Another alternative, which I believe are both options available with PIN and DynamoRI
10.
by pag 7y ago
If you're inside the process, as the LD_PRELOAD interceptor mentioned in the article is, then in theory you could try to get the address of the binary's main function or some other symbol that you expect to be exported, and scan d
11.
by pag 7y ago
This is a really cool SQLite wrapper. One of these things this wrapper lets you do is bind C++ functions/lambdas to ones in SQLite. You can use that functionality in things like SQLite expression indexes, or for customizing a full-text
12.
by pag 7y ago
Hopefully we'll have a Dockerfile soon that gets things all set up :-D
13.
by pag 7y ago
Nope :-P
14.
by pag 7y ago
By the way, did you know that DeepState is actually pure C, and that all the C++ is just window dressing on top? This means that you could feasibly integrate components of it in Ada, or call to those components in Ada, assuming that you hav
15.
by pag 7y ago
There are a number of lifters. The McSema repo has a table detailing the features of most of them. Glad that DeepState had an impact on you :-D We continue to evolve DeepState, both in the direction of better fuzzing, and better test case r
16.
by pag 7y ago
We at Trail of Bits are also working on "klee-native," a port of KLEE using Remill to dynamically lift and emulate binaries. This project is very early on, though.
17.
by pag 8y ago
I found an old paper I wrote about my first DBT, and it has a nice figure about how I implemented indirect branch resolution: https://imgur.com/a/dCpY7V2 . Feel free to ping me at pag on the Empire Hacking slack if you
18.
by pag 8y ago
Take a look at the various block chaining approaches of dynamic binary translators (DynamoRIO, PIN, etc.). There is a lot of work done in this space.
19.
by pag 8y ago
DeepState provides a Google Test-compatible interface to writing C++ unit tests; however, underneath it all, it is really a C unit testing framework. That is the reason for some of the strange naming of functions like DeepState_Int: these a
20.
by pag 8y ago
I think you could produce much better machine code by "templatizing" the stack allocations into function-specific pattern variables, passed to a single alloca-like function which uses the template to figure out how much stack spac
21.
by pag 8y ago
One unusual thing is that, at least for the curl example binary, the pre-built installable version is an x86 one and not an x86-64 one. From briefly looking at the assembly, it seems like each variable or stack object has metadata associate
22.
by pag 8y ago
The Remill [1] machine code to LLVM bitcode binary translator lifts procedural code into an SSA form (LLVM's) and abstracts over the modelled program's memory using small step semantics that also benefits from SSA form. The way it
23.
by pag 8y ago
Check out DeepState! https://github.com/trailofbits/deepstate
24.
by pag 8y ago
The Solidity language is deceptively low level, which partially stems from implementation details related to how the solc compiler chooses to implement language features. Developers coming to Solidity from a language like Javascript or Pyth
25.
by pag 8y ago
If you're an everyday C/C++ programmer and can't imagine how Angr could fit into your workflow, then check out DeepState ( https://github.com/trailofbits/deepstate ). It is a Google Test-compatible unit te
26.
by pag 9y ago
I created a linux kernel dynamic binary translator [1] (think of it as being like an in-situ vmware esxi) using C++. The key was to not use anything that touches floating point. Mostly what I wanted was templates, atomics, and a few other n
27.
by pag 9y ago
McSema developer here. We have a few success stories with it, including lifting, instrumenting, and recompiling Apache web server. It has also been used for symbolic execution of various programs. We at Trail of Bits are working on version
28.
A walk down memory lane(blog.trailofbits.com)
53 points by pag 9y ago|2 comments
29.
by pag 10y ago
I'm really happy with how the Canadian Revenue Agency handles things. You file online, there's plenty of free services to do your taxes. They support auto-fill where the CRA can send them the tax info it already knows about you (e
30.
by pag 10y ago
Given enough googly eyes, all bugs are hilarious.

More ›