TaintDroid剖析之Native方法級汙點跟蹤分析

#ifdef WITH_TAINT_TRACKING

    // Copy args to another array, to ensure correct taint propagation in case args change

    int nArgs = method->insSize * 2 + 1;

    u4* oldArgs = (u4*)malloc(sizeof(u4)*nArgs);

    memcpy(oldArgs, args, sizeof(u4)*nArgs);

#endif /*WITH_TAINT_TRACKING*/

#ifdef WITH_TAINT_TRACKING

    dvmTaintPropJniMethod(oldArgs, pResult, method);

    free(oldArgs);

#endif /*WITH_TAINT_TRACKING*/

    const DexProto* proto = &method->prototype;

    DexParameterIterator pIterator;

    int nParams = dexProtoGetParameterCount(proto);

    int pStart = (dvmIsStaticMethod(method)?0:1); /* index where params start */

    /* Consider 3 arguments. [x] indicates return taint index

     * 0 1 2 [3] 4 5 6

     */

    int nArgs = method->insSize;

    u4* rtaint = (u4*) &args[nArgs]; /* The return taint value */

    int tStart = nArgs+1; /* index of args[] where taint values start */

    int tEnd   = nArgs*2; /* index of args[] where taint values end */

    u4            tag = TAINT_CLEAR;

    int i;

    for (i = tStart; i <= tEnd; i++) {

              tag |= args[i];

    }

    /* If not static, pull any taint from the “this” object */

    if (!dvmIsStaticMethod(method)) {

              tag |= getObjectTaint((Object*)args[0], method->clazz->descriptor);

    }

    /* Union taint from Objects we care about */

    dexParameterIteratorInit(&pIterator, proto);

    for (i=pStart; ; i++) {

              const char* desc = dexParameterIteratorNextDescriptor(&pIterator);

              if (desc == NULL) {

                  break;

              }          

              if (desc[0] == `[` || desc[0] == `L`] { 

                  tag |= getObjectTaint((Object*) args[i], desc); //當前只支援array和string物件的汙點獲取！

              }

              if (desc[0] == `J` || desc[0] == `D`) {

                  /* wide argument, increment index one more */

                  i++;

              }

    }

    /* Look at the taint policy profiles (may have return taint) */

    tag |= propMethodProfile(args, method);

    /* Update return taint according to the return type */

    if (tag) {

              const char* desc = dexProtoGetReturnType(proto);

              setReturnTaint(tag, rtaint, pResult, desc);

    }

typedef enum {

    kTaintProfileUnknown = 0,

    kTaintProfileClass,

    kTaintProfileParam,

    kTaintProfileReturn

} TaintProfileEntryType;

typedef struct {

    const char* from;  //格式大概為：[class/param/argX/return].[xxx].[xxx]

    const char* to;

} TaintProfileEntry;

#define TAINT_PROFILE_TABLE_SIZE 8 /* per class */

#define TAINT_POLICY_TABLE_SIZE 32 /* number of classes */

typedef struct {

    const char* methodName;

    const TaintProfileEntry* entries;

} TaintProfile;

typedef struct {

    const char* classDescriptor;

    const TaintProfile* profiles;

    HashTable* methodTable; /* created on startup */

} TaintPolicy;

#ifdef WITH_TAINT_TRACKING

    dvmTaintPropJniStartup();

#endif

/* Code called from dvmJniStartup()

 * Initializes the gPolicyTable for fast lookup of taint policy

 * profiles for methods.

 */

void dvmTaintPropJniStartup()

{

    TaintPolicy* policy;

    u4 hash;

    /* Create the policy table (perfect size) */

    gPolicyTable = dvmHashTableCreate(

                  dvmHashSize(TAINT_POLICY_TABLE_SIZE),    

                  freeTaintPolicy);

    for (policy = gDvmJniTaintPolicy; policy->classDescriptor != NULL; policy++) {

              const TaintProfile *profile;

              /* Create the method table for this class */

              policy->methodTable = dvmHashTableCreate(

                            TAINT_PROFILE_TABLE_SIZE, freeTaintProfile);

              /* Add all of the methods */

              for (profile = &policy->profiles[0]; profile->methodName != NULL; profile++) {

                  hash = dvmComputeUtf8Hash(profile->methodName);

                  dvmHashTableLookup(policy->methodTable, hash,(void *) profile,

                                hashcmpTaintProfile, true); //最後一個參數列示在hash表中找不到目標item時，是否將這個item新增到hash表中。

              }

              /* Add this class to gPolicyTable */

              hash = dvmComputeUtf8Hash(policy->classDescriptor);

              dvmHashTableLookup(gPolicyTable, hash, policy,

                            hashcmpTaintPolicy, true);

    }

#ifdef TAINT_JNI_LOG

    /* JNI logging for debugging purposes */

    gJniLogSeen = dvmHashTableCreate(dvmHashSize(50), free);

#endif

}

TaintPolicy gDvmJniTaintPolicy[] = {

    {“Llibcore/icu/NativeConverter;”, libcore_icu_NativeConverter_methods, NULL},

    {“Lfoo/bar/name2;”, foo_bar_name2_methods, NULL},

    {NULL, NULL, NULL}

};

/*

entry = entry->from

*/

u4 getEntryTaint(const char* entry, const u4* args, const Method* method)

{

    u4 tag = TAINT_CLEAR;

    char *pos;

    /* Determine split point if any */

    pos = index((char *) entry, `.`); //這裡涉及到entry的命名方式

    switch (getEntryType(entry)) {

              case kTaintProfileClass:  //如果是類的話就獲取該類由entry指定的filed的tag

                  if (dvmIsStaticMethod(method)) {

                            tag = getFieldEntryTaint(pos+1, method->clazz, NULL);

                  } else {

                            tag = getFieldEntryTaint(pos+1, method->clazz, (Object*)args[0]);

                  }

                  break;

              case kTaintProfileParam:

                  tag = getParamEntryTaint(entry, args, method);

                  break;

              default:

                  ALOGW(“TaintPolicy: Invalid from type: [%s]”, entry);

    }

    return tag;

}

其命名有三種方式：

1) class.field1[.field2[…]]。class只能用於第一個引數arg0，即this或靜態方法的當前class;

2) param.num[.field1[.field2[…]]]。Num表示引數的序列號，另外如果某變數的tag並不是儲存在棧幀中與引數相鄰的tag中，就可能繼續新增欄位名；

3) return。 Ununsed。

u4 getFieldEntryTaint(const char* entry, ClassObject* clazz, Object* obj)

{

    u4 tag = TAINT_CLEAR;

    FieldRef fRef;

    fRef = getFieldFromEntry(entry, clazz, obj);  //此時的entry已經去掉了’class.’ ,‘argX.’, ‘return.’ 字首

    if (fRef.field != NULL) {

              tag = getTaintFromField(fRef.field, fRef.obj);

    }

    return tag;

}

/* 這是一個封裝結構體，在處理巢狀的例項域entry的時候會用到*/

typedef struct {

    Field *field;

    Object *obj;

} FieldRef;

u4 getTaintFromField(Field* field, Object* obj)

{

    u4 tag = TAINT_CLEAR;

    if (dvmIsStaticField(field)) {

                            StaticField* sfield = (StaticField*) field;

                            tag = dvmGetStaticFieldTaint(sfield);

    } else {

              InstField* ifield = (InstField*) field;

              if (field->signature[0] == `J` || field->signature[0] == `D`) {

                  tag = dvmGetFieldTaintWide(obj, ifield->byteOffset);

              } else {

                  tag = dvmGetFieldTaint(obj, ifield->byteOffset);

              }

    }

    return tag;

}

/* Returns a taint if the profile policy indicates propagation

 * to the return

 */

u4 propMethodProfile(const u4* args, const Method* method)

{

    u4 rtaint = TAINT_CLEAR;

    TaintProfile* profile = NULL;

    const TaintProfileEntry* entry = NULL;

    profile = getPolicyProfile(method);  //根據method結構體獲取該方法對應的TaintProfile結構體(此函式很耗時)

    if (profile == NULL) {

              return rtaint; //若為空，表示當前profile連結串列中沒有此方法，那麼就直接返回空tag

    }

    //LOGD(“TaintPolicy: applying policy for %s.%s”,

    //                  method->clazz->descriptor, method->name);

    /* Cycle through the profile entries */

    for (entry = &profile->entries[0]; entry->from != NULL; entry++) {

              u4 tag = TAINT_CLEAR;

              tag = getEntryTaint(entry->from, args, method);

              if (tag) {

                  //LOGD(“TaintPolicy: tag = %d %s -> %s”,

                  //                  tag, entry->from, entry->to);

                  rtaint |= addEntryTaint(tag, entry->to, args, method);

              }

    }

    return rtaint;

}