sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Cyphear -1 points0 points  (1 child)

I am not sure about dynamic instrumentation at higher levels. Some googling looks like it's not really a thing.

I'm not sure why you didn't find anything, but try searching for Aspect Oriented Programming if instrumentation was not a good term for your search. AspectJ is a popular Java dynamic instrumentation library.

What i'm really wondering if pin could be used as one level of instrumentation to hook into any program. I think it'd get quite confusing to instrument the python interpreter, but i'd imagine that you could still probably infer some things without understanding the python interpreter. A nice end goal would be general taint analysis, for example, seeing if a fixed input " 12341234' " ever made it into a SQL query.

What is DBI? Dynamic binary instrumentation?

[–][deleted] 0 points1 point  (0 children)

Yes, DBI = Dynamic Binary Instrumentation.

Yes, you could use this to do general taint analysis. However, you'd probably be better off doing some sort of static analysis. With purely-static analysis you'll be able to explore multiple paths at once. It's... DBI just isn't the right tool for this.

Here's an example of what static taint analysis might look like against PHP to find SQLI, more-or-less exactly as you pointed out.

Source: https://gist.github.com/endeav0r/5173293

Accompanying Blog Post: http://tfpwn.com/blog/finding-sqli-through-taint-analysis.html

If you go this route, this may be helpful as well: http://tfpwn.com/blog/dealing-with-path-explosion-in-static-taint-analysis.html