Download as PDF, PPTX
Uploaded byAntonio Costa aka Cooler_
Static analysis for beginners
This document discusses static analysis for beginners. It describes how to use techniques like deterministic finite automata (DFA) and parsing tools like Flex and Bison to detect issues in source code. It provides an example of using the Re2c tool to generate a lexer for rule-based detection. The document also introduces heap detective, a tool that maps heap memory usage in programs to find issues like memory leaks. Overall, it offers an overview of static analysis concepts and tools while showcasing examples from open source projects.
More Related Content
Similar to Static analysis for beginners
Static analysis for beginners
- 1. Static Analysis for beginners Howyou can find dragons
- 2. whoamy ● Just another Programmer ● SecurityEngineer ● Ten years experience ● About me: Github.com/CoolerVoid Twitter: @Cooler_freenode Contact: coolerlair@gmail.com
- 3.
- 4.
- 6. Linux/Git creation ● Version control ● ManualCodereview ● New tools for static analysis in Kernel or drivers to make auto patch etc...
- 7. The root ofstudy
- 8. The root ofstudy ● The Dragon Book ● Flex ● Bison ● AST ● Trees ● Tokenizer
- 9. Security focus ● Find Pitfalls ● Fixeach point ● Mitigate ● Sometimes its hard… ● Education ???
- 10. Security focus ● Find Pitfalls ● Fixeach point ● Mitigate ● Sometimes its hard… ● Education ???
- 11. Security focus ● Find Pitfalls ● Fixeach point ● Mitigate ● Sometimes its hard… ● Education ???
- 12.
- 13. File system Pitfalls ● Filesystem problems ● Call Open() but not call close() ● Load config file, but don’t have lock… ● Don’t check permissions to open file ● Don’t check existence of file ● Race condition (TOCTOU) ● Mistake in permissions
- 14. Pitfall example 1 ● Filesystem problems ● Call Open() but not call close() ● Load config file, but don’t have lock… ● Don’t check permissions to open file ● Don’t check existence of file ● Race condition (TOCTOU) ● Mistake in permissions
- 15. Pitfall example 1 ● Thiscode example is noncompliant because the file opened by the call to fopen() is not closed before function func() returns:
- 16. Pitfall example 1 ● Thiscode example is right way, because open and close file:
- 17. Detection ● Do you rememberthe dragon book ? ● You can use DFA(Deterministic Finite Automaton) to solve this with rank points. ● You can tokenize each word and save in nodes, you can load data structure and walk to collect each rule, the data structure you can use Tree, AST, graph(this is common but more complex). ● You can use Flex+Bison to generate input extractor and parser… ● You can use regex(regular expression), but don’t have a good performance! Its not better path! ● Relax here! have other paths to following…
- 18. Detection ● Do you rememberthe dragon book ? ● You can use DFA(Deterministic Finite Automaton) to solve this with rank points. ● You can tokenize each word ans save in nodes, you can load data structure and walk to collect each rule, the data structure you can use Tree, AST, graph(this is common but more complex). ● You can use Flex+Bison to generate input extractor and parse rules… ● You can use regex(regular expression), but don’t have a good performance! Its not better path! ● Relax here! have other paths to following…
- 19. Detection Ex 1 ● ItsOK my choice is use Re2c to solve the problem! ● Re2c is a free and open-source lexer generator for C, C++ and Go. It compiles regular expressions to determinisitic finite automata and encodes the automata in the form of a program in the target language. ● The main advantages of re2c are speed of the generated code and a flexible user interface that allows one to adapt the generated lexer to a particular environment and input model. ● Re2c supports fast and lightweight submatch extraction with either POSIX or leftmost greedy semantics.
- 20. Detection Ex 1 ● github.com/CoolerVoid/heap_detective/tree/master/doc/PoC1 ● doc/PoC1/rule.c ● Ruleto generate ● Need Re2c tool ● Need GCC
- 21. Detection Ex 1 ● github.com/CoolerVoid/heap_detective/tree/master/doc/PoC1 ● doc/PoC1/gen_re2.c ● Ruleto generate ● Need Re2c tool ● Need GCC
- 22.
- 23.
- 24. Detection Ex 1 ● github.com/CoolerVoid/heap_detective/tree/master/doc/PoC1/test.sh ● Noteneed re2c and gcc! (apt-get install re2c gcc)
- 25. Detection Ex 1 Thelogic its simple !
- 26. Detection Ex 1 ● github.com/CoolerVoid/heap_detective/tree/master/doc/PoC1/test.sh ● Noteneed re2c and gcc! (apt-get install re2c gcc)
- 27. Detection ● Do you rememberthe dragon book ? ● You can use DFA(Deterministic Finite Automaton) to solve this with rank points. ● You can tokenize each word ans save in nodes, you can load data structure and walk to collect each rule, the data structure you can use Tree, AST, graph(this is common but more complex). ● You can use Flex+Bison to generate input extractor and parse rules… ● You can use regex(regular expression), but don’t have a good performance! Its not better path! ● Relax here! have other paths to following…
- 28. ● Do you rememberthe dragon book ? ● You can use DFA(Deterministic Finite Automaton) to solve this with rank points. ● You can tokenize each word ans save in nodes, you can load data structure and walk to collect each rule, the data structure you can use Tree, AST, graph(this is common but more complex). ● You can use Flex+Bison to generate input extractor and parse rules… ● You can use regex(regular expression), but don’t have a good performance! Its not better path! ● Relax here! have other paths to following… Detection
- 29. Heap detective ● All languagesuses heap memory ● In C its commom when you use functions like malloc(), calloc(), realloc(), strdup() etc… ● In C++ its common when you use “new”. ● Heap use can have a lot pitfalls if you not follow good practices. ● Memory leak, double free, use after free, wild pointer, heap overflow, crash(DoS) other pitfalls… ● Some languages like Java have garbage collector to clean the heap memory to manage this, but if programmer don’t know good practices the problem with memory leak or crash can be found.
- 30. Heap detective ● How youcan map heap memory use ?
- 31. Heap detective ● How youcan map heap memory usage in static analysis ? ● Use my Tool heap detective ● https://github.com/CoolerVoid/heap_detective
- 32. Heap detective ● How youcan map heap memory use ? ● List the functions that use heap memory ● List functions to liberate heap
- 33.
- 34.
- 35.
- 36.
- 37.
- 38. Cool stuff ● My Treelibrary in C ● Ice n-ary tree based on glib tree functions ● https://github.com/CoolerVoid/icenarytree
- 39. Other projects ● Code walk,code search, regex with rule based… ● github.com/CoolerVoid/codewarrior ● github.com/CoolerVoid/codecat ● https://semgrep.dev (very cool)
- 40.
- 41. Thank you! Credits: CoolerVoid Contact:coolerlair@gmail.com