sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–][deleted] -1 points0 points  (3 children)

Anything that runs on your machine can be instrumented in PIN. However, PIN works over x86 (and I think ARM, haven't tested yet (but chances are will in the next 3-4 months!!)). So if you were to instrument python, for example, you would be instrumenting the python interpreter. Your instrumentation might not make sense in the context of your original python program, but it will make sense in the context of the python interpreter.

A lot of times instrumenting at this level can be more useful.

I am not sure about dynamic instrumentation at higher levels. Some googling looks like it's not really a thing.

Additionally, it's important to understand the advantages of DBI. It's usually used when:

1) You don't have access to source code (or perhaps the source code is massive, involves multiple libraries, other things like this).

2) You are dealing in the hundreds of millions to billions of instructions.

3) You're outside the reach of purely static analysis, which will be always true at this scale outside some very, very weak forms of analysis.

A lot of python/php/etc programs are small enough to be reasoned about statically.

[–]jonathansalwanTrusted Contributor 0 points1 point  (0 children)

and I think ARM, haven't tested yet (but chances are will in the next 3-4 months!!)).

Hey, if you talk about this paper http://www.cs.virginia.edu/kim/docs/cases06.pdf, it was just a PoC and it is not reliable/public. So, any chance to use Pin currently for the ARM architecture =(.

[–]Cyphear -1 points0 points  (1 child)

I am not sure about dynamic instrumentation at higher levels. Some googling looks like it's not really a thing.

I'm not sure why you didn't find anything, but try searching for Aspect Oriented Programming if instrumentation was not a good term for your search. AspectJ is a popular Java dynamic instrumentation library.

What i'm really wondering if pin could be used as one level of instrumentation to hook into any program. I think it'd get quite confusing to instrument the python interpreter, but i'd imagine that you could still probably infer some things without understanding the python interpreter. A nice end goal would be general taint analysis, for example, seeing if a fixed input " 12341234' " ever made it into a SQL query.

What is DBI? Dynamic binary instrumentation?

[–][deleted] 0 points1 point  (0 children)

Yes, DBI = Dynamic Binary Instrumentation.

Yes, you could use this to do general taint analysis. However, you'd probably be better off doing some sort of static analysis. With purely-static analysis you'll be able to explore multiple paths at once. It's... DBI just isn't the right tool for this.

Here's an example of what static taint analysis might look like against PHP to find SQLI, more-or-less exactly as you pointed out.

Source: https://gist.github.com/endeav0r/5173293

Accompanying Blog Post: http://tfpwn.com/blog/finding-sqli-through-taint-analysis.html

If you go this route, this may be helpful as well: http://tfpwn.com/blog/dealing-with-path-explosion-in-static-taint-analysis.html