def test_taint_union_register_memory(self):
"""Check tainting union register U memory."""
setArchitecture(ARCH.X86_64)
self.assertFalse(isRegisterTainted(REG.RAX))
taintRegister(REG.RAX)
self.assertTrue(isRegisterTainted(REG.RAX))
taintUnionRegisterMemory(REG.RAX, MemoryAccess(0x2000, 4))
self.assertTrue(isRegisterTainted(REG.RAX))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
untaintRegister(REG.RAX)
self.assertFalse(isRegisterTainted(REG.RAX))
taintUnionRegisterMemory(REG.RAX, MemoryAccess(0x2000, 4))
self.assertFalse(isRegisterTainted(REG.RAX))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
# !T U T
untaintRegister(REG.RAX)
taintMemory(MemoryAccess(0x2000, 4))
taintUnionRegisterMemory(REG.RAX, MemoryAccess(0x2000, 4))
self.assertTrue(isRegisterTainted(REG.RAX))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
# T U T
taintRegister(REG.RAX)
taintMemory(MemoryAccess(0x2000, 4))
taintUnionRegisterMemory(REG.RAX, MemoryAccess(0x2000, 4))
self.assertTrue(isRegisterTainted(REG.RAX))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
def test_taint_union_register_memory(self):
"""Check tainting union register U memory."""
setArchitecture(ARCH.X86_64)
self.assertFalse(isRegisterTainted(REG.RAX))
taintRegister(REG.RAX)
self.assertTrue(isRegisterTainted(REG.RAX))
taintUnionRegisterMemory(REG.RAX, MemoryAccess(0x2000, 4))
self.assertTrue(isRegisterTainted(REG.RAX))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
untaintRegister(REG.RAX)
self.assertFalse(isRegisterTainted(REG.RAX))
taintUnionRegisterMemory(REG.RAX, MemoryAccess(0x2000, 4))
self.assertFalse(isRegisterTainted(REG.RAX))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
# !T U T
untaintRegister(REG.RAX)
taintMemory(MemoryAccess(0x2000, 4))
taintUnionRegisterMemory(REG.RAX, MemoryAccess(0x2000, 4))
self.assertTrue(isRegisterTainted(REG.RAX))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
# T U T
taintRegister(REG.RAX)
taintMemory(MemoryAccess(0x2000, 4))
taintUnionRegisterMemory(REG.RAX, MemoryAccess(0x2000, 4))
self.assertTrue(isRegisterTainted(REG.RAX))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
def test_taint_assignement_memory_memory(self):
"""Check tainting assignment memory <- memory."""
setArchitecture(ARCH.X86_64)
taintMemory(MemoryAccess(0x2000, 1))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
taintAssignmentMemoryMemory(MemoryAccess(0x1000, 1),
MemoryAccess(0x2000, 1))
self.assertTrue(isMemoryTainted(MemoryAccess(0x1000, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
taintAssignmentMemoryMemory(MemoryAccess(0x1000, 1),
MemoryAccess(0x3000, 1))
taintAssignmentMemoryMemory(MemoryAccess(0x2000, 1),
MemoryAccess(0x3000, 1))
self.assertFalse(isMemoryTainted(MemoryAccess(0x1000, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 1)))
taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
taintAssignmentMemoryMemory(MemoryAccess(0x2001, 2),
MemoryAccess(0x3000, 1))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
def test_taint_union_memory_immediate(self):
"""Check tainting union memory U immediate."""
setArchitecture(ARCH.X86_64)
taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
taintUnionMemoryImmediate(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
untaintMemory(MemoryAccess(0x2000, 4))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
def test_taint_union_memory_immediate(self):
"""Check tainting union memory U immediate."""
setArchitecture(ARCH.X86_64)
taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
taintUnionMemoryImmediate(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
untaintMemory(MemoryAccess(0x2000, 4))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
def test_taint_union_memory_register(self):
"""Check tainting union memory U register."""
setArchitecture(ARCH.X86_64)
taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
taintUnionMemoryRegister(MemoryAccess(0x2000, 4), REG.RAX)
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isRegisterTainted(REG.RAX))
untaintMemory(MemoryAccess(0x2000, 4))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isRegisterTainted(REG.RAX))
taintUnionMemoryRegister(MemoryAccess(0x2000, 4), REG.RAX)
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isRegisterTainted(REG.RAX))
taintRegister(REG.RAX)
taintUnionMemoryRegister(MemoryAccess(0x2000, 4), REG.RAX)
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertTrue(isRegisterTainted(REG.RAX))
def test_taint_union_memory_register(self):
"""Check tainting union memory U register."""
setArchitecture(ARCH.X86_64)
taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
taintUnionMemoryRegister(MemoryAccess(0x2000, 4), REG.RAX)
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isRegisterTainted(REG.RAX))
untaintMemory(MemoryAccess(0x2000, 4))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isRegisterTainted(REG.RAX))
taintUnionMemoryRegister(MemoryAccess(0x2000, 4), REG.RAX)
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isRegisterTainted(REG.RAX))
taintRegister(REG.RAX)
taintUnionMemoryRegister(MemoryAccess(0x2000, 4), REG.RAX)
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertTrue(isRegisterTainted(REG.RAX))
def test_taint_assignement_memory_memory(self):
"""Check tainting assignment memory <- memory."""
setArchitecture(ARCH.X86_64)
taintMemory(MemoryAccess(0x2000, 1))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
taintAssignmentMemoryMemory(MemoryAccess(0x1000, 1), MemoryAccess(0x2000, 1))
self.assertTrue(isMemoryTainted(MemoryAccess(0x1000, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
taintAssignmentMemoryMemory(MemoryAccess(0x1000, 1), MemoryAccess(0x3000, 1))
taintAssignmentMemoryMemory(MemoryAccess(0x2000, 1), MemoryAccess(0x3000, 1))
self.assertFalse(isMemoryTainted(MemoryAccess(0x1000, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 1)))
taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
taintAssignmentMemoryMemory(MemoryAccess(0x2001, 2), MemoryAccess(0x3000, 1))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
def test_taint_assignement_register_memory(self):
"""Check tainting assignment register <- memory."""
setArchitecture(ARCH.X86_64)
self.assertFalse(isRegisterTainted(REG.RAX))
taintRegister(REG.RAX)
self.assertTrue(isRegisterTainted(REG.RAX))
taintAssignmentRegisterMemory(REG.RAX, MemoryAccess(0x2000, 8))
self.assertFalse(isRegisterTainted(REG.RAX))
taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 8)))
taintAssignmentRegisterMemory(REG.RAX, MemoryAccess(0x2000, 8))
self.assertTrue(isRegisterTainted(REG.RAX))
taintAssignmentRegisterMemory(REG.RAX, MemoryAccess(0x3000, 8))
self.assertFalse(isRegisterTainted(REG.RAX))
def test_taint_assignement_register_memory(self):
"""Check tainting assignment register <- memory."""
setArchitecture(ARCH.X86_64)
self.assertFalse(isRegisterTainted(REG.RAX))
taintRegister(REG.RAX)
self.assertTrue(isRegisterTainted(REG.RAX))
taintAssignmentRegisterMemory(REG.RAX, MemoryAccess(0x2000, 8))
self.assertFalse(isRegisterTainted(REG.RAX))
taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 8)))
taintAssignmentRegisterMemory(REG.RAX, MemoryAccess(0x2000, 8))
self.assertTrue(isRegisterTainted(REG.RAX))
taintAssignmentRegisterMemory(REG.RAX, MemoryAccess(0x3000, 8))
self.assertFalse(isRegisterTainted(REG.RAX))
def test_taint_assignement_memory_immediate(self):
"""Check tainting assignment memory <- immediate."""
setArchitecture(ARCH.X86_64)
taintMemory(0x1000)
self.assertTrue(isMemoryTainted(0x1000))
taintAssignmentMemoryImmediate(MemoryAccess(0x1000, 1))
self.assertFalse(isMemoryTainted(0x1000))
taintMemory(0x1000)
self.assertTrue(isMemoryTainted(0x1000))
taintAssignmentMemoryImmediate(MemoryAccess(0x0fff, 2))
self.assertFalse(isMemoryTainted(0x1000))
taintMemory(0x1000)
self.assertTrue(isMemoryTainted(0x1000))
taintAssignmentMemoryImmediate(MemoryAccess(0x0ffe, 2))
self.assertTrue(isMemoryTainted(0x1000))
taintMemory(MemoryAccess(0x1000, 4))
self.assertTrue(isMemoryTainted(0x1000))
self.assertTrue(isMemoryTainted(0x1001))
self.assertTrue(isMemoryTainted(0x1002))
self.assertTrue(isMemoryTainted(0x1003))
self.assertFalse(isMemoryTainted(0x1004))
taintAssignmentMemoryImmediate(MemoryAccess(0x1001, 1))
self.assertTrue(isMemoryTainted(0x1000))
self.assertFalse(isMemoryTainted(0x1001))
self.assertTrue(isMemoryTainted(0x1002))
self.assertTrue(isMemoryTainted(0x1003))
taintAssignmentMemoryImmediate(MemoryAccess(0x1000, 4))
self.assertFalse(isMemoryTainted(0x1000))
self.assertFalse(isMemoryTainted(0x1001))
self.assertFalse(isMemoryTainted(0x1002))
self.assertFalse(isMemoryTainted(0x1003))
def test_taint_memory(self):
"""Check tainting memory."""
setArchitecture(ARCH.X86_64)
self.assertFalse(isMemoryTainted(0x1000))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
taintMemory(0x1000)
taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(0x1000))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 2)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2002, 2)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2003, 2)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x1fff, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertFalse(isMemoryTainted(0x1001))
self.assertFalse(isMemoryTainted(0x0fff))
untaintMemory(0x1000)
untaintMemory(MemoryAccess(0x2000, 4))
self.assertFalse(isMemoryTainted(0x1000))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 2)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2002, 2)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2003, 2)))
def test_taint_assignement_memory_register(self):
"""Check tainting assignment memory <- register."""
setArchitecture(ARCH.X86_64)
taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 8)))
taintAssignmentMemoryRegister(MemoryAccess(0x2002, 2), REG.AX)
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2005, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2006, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2007, 1)))
taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 8)))
taintAssignmentMemoryRegister(MemoryAccess(0x1fff, 8), REG.RAX)
self.assertFalse(isMemoryTainted(MemoryAccess(0x1fff, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2005, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2006, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2007, 1)))
def test_taint_assignement_memory_immediate(self):
"""Check tainting assignment memory <- immediate."""
setArchitecture(ARCH.X86_64)
taintMemory(0x1000)
self.assertTrue(isMemoryTainted(0x1000))
taintAssignmentMemoryImmediate(MemoryAccess(0x1000, 1))
self.assertFalse(isMemoryTainted(0x1000))
taintMemory(0x1000)
self.assertTrue(isMemoryTainted(0x1000))
taintAssignmentMemoryImmediate(MemoryAccess(0x0fff, 2))
self.assertFalse(isMemoryTainted(0x1000))
taintMemory(0x1000)
self.assertTrue(isMemoryTainted(0x1000))
taintAssignmentMemoryImmediate(MemoryAccess(0x0ffe, 2))
self.assertTrue(isMemoryTainted(0x1000))
taintMemory(MemoryAccess(0x1000, 4))
self.assertTrue(isMemoryTainted(0x1000))
self.assertTrue(isMemoryTainted(0x1001))
self.assertTrue(isMemoryTainted(0x1002))
self.assertTrue(isMemoryTainted(0x1003))
self.assertFalse(isMemoryTainted(0x1004))
taintAssignmentMemoryImmediate(MemoryAccess(0x1001, 1))
self.assertTrue(isMemoryTainted(0x1000))
self.assertFalse(isMemoryTainted(0x1001))
self.assertTrue(isMemoryTainted(0x1002))
self.assertTrue(isMemoryTainted(0x1003))
taintAssignmentMemoryImmediate(MemoryAccess(0x1000, 4))
self.assertFalse(isMemoryTainted(0x1000))
self.assertFalse(isMemoryTainted(0x1001))
self.assertFalse(isMemoryTainted(0x1002))
self.assertFalse(isMemoryTainted(0x1003))
def test_taint_memory(self):
"""Check tainting memory."""
setArchitecture(ARCH.X86_64)
self.assertFalse(isMemoryTainted(0x1000))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
taintMemory(0x1000)
taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(0x1000))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 2)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2002, 2)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2003, 2)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x1fff, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertFalse(isMemoryTainted(0x1001))
self.assertFalse(isMemoryTainted(0x0fff))
untaintMemory(0x1000)
untaintMemory(MemoryAccess(0x2000, 4))
self.assertFalse(isMemoryTainted(0x1000))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 2)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2002, 2)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2003, 2)))
def test_taint_assignement_memory_register(self):
"""Check tainting assignment memory <- register."""
setArchitecture(ARCH.X86_64)
taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 8)))
taintAssignmentMemoryRegister(MemoryAccess(0x2002, 2), REG.AX)
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2005, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2006, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2007, 1)))
taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 8)))
taintAssignmentMemoryRegister(MemoryAccess(0x1fff, 8), REG.RAX)
self.assertFalse(isMemoryTainted(MemoryAccess(0x1fff, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2005, 1)))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2006, 1)))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2007, 1)))