microwalk-project / microwalk Goto Github PK

View Code? Open in Web Editor NEW

59.0 59.0 9.0 895 KB

A microarchitectural leakage detection framework using dynamic instrumentation.

License: MIT License

C++ 7.17% C 4.85% C# 69.94% Python 0.11% Makefile 0.27% Shell 1.02% JavaScript 15.85% Dockerfile 0.79%

crypto dynamic-instrumentation side-channel-attacks

microwalk's People

Contributors

Stargazers

Watchers

Forkers

chubbymaggie etkraw amattoo mfkiwl isnavarr dmnkschndr paetscan chihiro-lee easywalk-ci-project

microwalk's Issues

reproducing results for "crypto-js" library

Hi,

I want to reproduce results for crypto-js library but I couldn't figure out the right configuration used in the paper.
In the develop branch, there is no index.js given, so I tried testing the master branch. I get the following error:

Failed to instrument ;(function (root, factory) {
..............
<content of crypto-js.js here.>
..............
analysis exception!!!
TypeError: ExprGen[$param.type] is not a function
    at generateFunctionParams (/mw/jalangi2/node_modules/esotope/esotope.js:684:45)
    at generateFunctionBody (/mw/jalangi2/node_modules/esotope/esotope.js:705:9)
    at Object.generateFunctionExpression [as FunctionExpression] (/mw/jalangi2/node_modules/esotope/esotope.js:1180:13)
    at Object.generateCallExpression [as CallExpression] (/mw/jalangi2/node_modules/esotope/esotope.js:1004:35)
    at Object.generateProperty [as Property] (/mw/jalangi2/node_modules/esotope/esotope.js:1261:39)
    at Object.generateObjectExpression [as ObjectExpression] (/mw/jalangi2/node_modules/esotope/esotope.js:1281:38)
    at Object.generateCallExpression [as CallExpression] (/mw/jalangi2/node_modules/esotope/esotope.js:1004:35)
    at Object.generateCallExpression [as CallExpression] (/mw/jalangi2/node_modules/esotope/esotope.js:1004:35)
    at Object.generateCallExpression [as CallExpression] (/mw/jalangi2/node_modules/esotope/esotope.js:1004:35)
    at Object.generateCallExpression [as CallExpression] (/mw/jalangi2/node_modules/esotope/esotope.js:1004:35)

The content of the target-example.js is the following. I wanted to keep it simple to make sure the problem is not in my code.

  // Executes the given testcase.
  // Parameters:
  // - testcaseBuffer: Buffer object containing the bytes read from the testcase file.
  function processTestcase(testcaseBuffer)
  {
        var testcase = testcaseBuffer.toString();
        /* TODO */
  }
  module.exports = { processTestcase };

Add support for pretty print using MAP file

Allow to convert instruction addresses into text from by reading from a pre-generated MAP file:

0x18000357

becomes

target.dll:func1+57

Load existing test cases

Add module for loading existing test cases from a specified directory.

Passthrough module for preprocessing

Add a passthrough module for the preprocessor stage; this way, raw trace generation can be separated from the computationally expensive tasks.

Add more leakage measures

Min entropy
Guessing entropy
Min guessing entropy

Load existing preprocessed trace files

Add module to load preprocessed trace files for new analysis.

"Empty call stack" warning for PinNotifyTestcaseStart return

At begin of each trace, the ret of the PinNotifyTestcaseStart function is recorded:

[    0] StackWrite: <wrapper:PinNotifyTestcaseStart+4>, [$+008000AC]
[    1] StackRead: <wrapper:PinNotifyTestcaseStart+7>, [$+008000AC]
[    2] StackRead: <wrapper:PinNotifyTestcaseStart+E>, [$+008000B8]
[    3] Return: <wrapper:PinNotifyTestcaseStart+E> -> <wrapper:TraceFunc+14A>
[    4] StackRead: <wrapper:TraceFunc+14A>, [$+00800350]
[    5] Call: <wrapper:TraceFunc+151> -> <wrapper:_Z9RunTargetP8_IO_FILE+0>
[    6]   StackWrite: <wrapper:_Z9RunTargetP8_IO_FILE+8>, [$+00800098]
...

This leads to warnings during analysis.

The same is true for the call to PinNotifyTestcaseEnd in the very end.

Usage question: a small test with Botan results in a lot of warnings

In https://github.com/lieser/botan/tree/pl/test-microwalk I'm currently trying to setup a small test Microwalk CI for Botan.

I however get a lot of warnings (https://github.com/lieser/botan/actions/runs/4701855851/jobs/8338408892).

A few trace messages similar to:

[dbug] [trace:pin] Pin tool log: Error: Cannot resolve image of basic block 7fa6a0631220 (instrumenting as 'interesting')

A lot of warnings similar to:

[warn] [preprocess:prefix] Free of address 00005629e46ad420 does not correspond to any heap allocation, skipping

A massive amount of message similar to

[warn] [preprocess:0] Could not resolve target of memory access 00007fa6a100af38 -> [00005629e46a4a88] (read), skipping
[warn] [preprocess:0] Could not resolve target of memory access 00007fa6a0f0070e -> [00005629e4697170] (write), skipping

For a pretty small test the complete log is over 1.000.000 lines long, which does not seem normal to me.

Would be nice if you can give me a hint on what is going wrong. Let me know if I should open an issue in the main repository for this usage question.

(Note: this was split from microwalk-project/microwalk-pin-action#1)

Test pipeline performance

Extensive performance profiling of the trace preprocessor is needed. This is usually the main bottleneck.

Full Windows & Linux build compatibility

Build script for Windows
Build script for Linux
Make Pin tool and wrappers Linux compatible

Load existing raw trace files

Add module to load raw trace files for preprocessing (e.g., when tracing on a different system than the one Microwalk is running on).

Bugs in RandomTestcaseGenerator

In RandomTestcaseGenerator, the _knownTestcases field is not filled. Also it might be desirable to add a warning if the testcase count gets too near to log(testcase length).