Triaging Crashed With Backward Taint Analysis For Arm Architecture
summary
A set of tools is developed for crash analysis on Linux ARM: ARM-Tracer is a ptrace-based DBI that records execution until a crash, handling ARM/thumb interworking, breakpoints, thread interference and atomic instruction sequences; ARM-Analyzer is a C# GUI that performs backward taint analysis on trace logs to identify input-influenced registers and memory. Traces average ~7 million instructions (~1 GB, ~25 minutes) and the analyzer finds taint chains and flagged two exploitable Polaris Office crashes within ~15 seconds in fast mode.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:42Example
- 3:41VDT
- 6:17DBI
- 8:30Instruction Tracing
- 9:55Instruction States
- 10:35Program Counter
- 10:56Interference
- 12:14Start tracing
- 12:55Condition flags
- 14:26Analyzer
- 15:05Results
- 16:18Experiment
- 17:52Demo
- 23:01Outro
related talks
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
28mPostmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts
02h 00mAdvanced Debug and Trace Tools for RISC-V Architectures
16mHardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
50mHardware Assisted Tracing on ARM with CoreSight and OpenCSD
26mNinja: Towards Transparent Tracing and Debugging on ARM
46mTools and Techniques to Debug an Embedded Linux System
42mIdentifying Safety Weaknesses and Fault Propagation in the Linux Kernel