{"action":"closed","issue":{"url":"https://api.github.com/repos/JonathanSalwan/Triton/issues/208","labels_url":"https://api.github.com/repos/JonathanSalwan/Triton/issues/208/labels{/name}","comments_url":"https://api.github.com/repos/JonathanSalwan/Triton/issues/208/comments","events_url":"https://api.github.com/repos/JonathanSalwan/Triton/issues/208/events","html_url":"https://github.com/JonathanSalwan/Triton/issues/208","id":116880199,"number":208,"title":"Issues with tainted instructions","user":{"login":"0ca","id":5008707,"avatar_url":"https://avatars.githubusercontent.com/u/5008707?v=3","gravatar_id":"","url":"https://api.github.com/users/0ca","html_url":"https://github.com/0ca","followers_url":"https://api.github.com/users/0ca/followers","following_url":"https://api.github.com/users/0ca/following{/other_user}","gists_url":"https://api.github.com/users/0ca/gists{/gist_id}","starred_url":"https://api.github.com/users/0ca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0ca/subscriptions","organizations_url":"https://api.github.com/users/0ca/orgs","repos_url":"https://api.github.com/users/0ca/repos","events_url":"https://api.github.com/users/0ca/events{/privacy}","received_events_url":"https://api.github.com/users/0ca/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/JonathanSalwan/Triton/labels/Bug","name":"Bug","color":"fc2929"},{"url":"https://api.github.com/repos/JonathanSalwan/Triton/labels/Taint%20Engines","name":"Taint Engines","color":"bfdadc"}],"state":"closed","locked":false,"assignee":{"login":"JonathanSalwan","id":991046,"avatar_url":"https://avatars.githubusercontent.com/u/991046?v=3","gravatar_id":"","url":"https://api.github.com/users/JonathanSalwan","html_url":"https://github.com/JonathanSalwan","followers_url":"https://api.github.com/users/JonathanSalwan/followers","following_url":"https://api.github.com/users/JonathanSalwan/following{/other_user}","gists_url":"https://api.github.com/users/JonathanSalwan/gists{/gist_id}","starred_url":"https://api.github.com/users/JonathanSalwan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JonathanSalwan/subscriptions","organizations_url":"https://api.github.com/users/JonathanSalwan/orgs","repos_url":"https://api.github.com/users/JonathanSalwan/repos","events_url":"https://api.github.com/users/JonathanSalwan/events{/privacy}","received_events_url":"https://api.github.com/users/JonathanSalwan/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/JonathanSalwan/Triton/milestones/3","html_url":"https://github.com/JonathanSalwan/Triton/milestones/v0.2","labels_url":"https://api.github.com/repos/JonathanSalwan/Triton/milestones/3/labels","id":1087872,"number":3,"title":"v0.2","description":"The v0.2 version","creator":{"login":"JonathanSalwan","id":991046,"avatar_url":"https://avatars.githubusercontent.com/u/991046?v=3","gravatar_id":"","url":"https://api.github.com/users/JonathanSalwan","html_url":"https://github.com/JonathanSalwan","followers_url":"https://api.github.com/users/JonathanSalwan/followers","following_url":"https://api.github.com/users/JonathanSalwan/following{/other_user}","gists_url":"https://api.github.com/users/JonathanSalwan/gists{/gist_id}","starred_url":"https://api.github.com/users/JonathanSalwan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JonathanSalwan/subscriptions","organizations_url":"https://api.github.com/users/JonathanSalwan/orgs","repos_url":"https://api.github.com/users/JonathanSalwan/repos","events_url":"https://api.github.com/users/JonathanSalwan/events{/privacy}","received_events_url":"https://api.github.com/users/JonathanSalwan/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":75,"state":"open","created_at":"2015-04-28T17:14:11Z","updated_at":"2015-11-14T16:17:44Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-11-14T00:19:24Z","updated_at":"2015-11-14T16:17:44Z","closed_at":"2015-11-14T16:17:44Z","body":"HI,\r\n\r\nI was testing the tainting engine with this code I saw in the examples:\r\n```\r\nfrom triton import *\r\n\r\nGREEN = \"\\033[92m\"\r\nENDC  = \"\\033[0m\"\r\n\r\ndef cafter(instruction):\r\n    print '%#x: %s' %(instruction.getAddress(), instruction.getDisassembly())\r\n    for se in instruction.getSymbolicExpressions():\r\n        if se.isTainted() == True:\r\n            print '\\t -> #%d = %s%s%s %s' %(se.getId(), GREEN, se.getAst(), ENDC, (('; ' + se.getComment()) if se.getComment() is not None else ''))\r\n        else:\r\n            print '\\t -> #%d = %s %s' %(se.getId(), se.getAst(), (('; ' + se.getComment()) if se.getComment() is not None else ''))\r\n    print\r\n\r\ndef mainAnalysis(threadId):\r\n    print \"Main\"\r\n    rdi = getRegValue(IDREF.REG.RDI) # argc\r\n    rsi = getRegValue(IDREF.REG.RSI) # argv\r\n    while rdi != 1: #Arg0 not tainted\r\n        argv = getMemValue(rsi + ((rdi-1) * 8), 8)\r\n        offset = 0\r\n        while getMemValue(argv + offset, 1) != 0x00:\r\n            print \"Tainting %c\" % getMemValue(argv + offset, 1)\r\n            taintMem(argv + offset)\r\n            offset += 1\r\n        print '[+] %03d bytes tainted from the argv[%d] (%#x) pointer' %(offset, rdi-1, argv)\r\n        rdi -= 1\r\n    return\r\n\r\n\r\nif __name__ == '__main__':\r\n    # Start the symbolic analysis from the 'check' function\r\n    startAnalysisFromSymbol('main')\r\n    addCallback(mainAnalysis,   IDREF.CALLBACK.ROUTINE_ENTRY, \"main\")\r\n    addCallback(cafter, IDREF.CALLBACK.AFTER)\r\n    # Run the instrumentation - Never returns\r\n    runProgram()\r\n```\r\nBut when I execute it with the following command:\r\n`./triton examples/taint_runtime_memory.py ./samples/code_coverage/test_atoi 22`\r\nI see something unexpected:\r\n![tainted](https://cloud.githubusercontent.com/assets/5008707/11160666/b98e21b8-8a21-11e5-8648-807c71690d2f.png)\r\n\r\nThe reference `#353` is tainted, but the reference `#360`, that is extracting a byte from `#353`, it's not tainted.\r\n\r\nIs this correct? or is it a bug?\r\n\r\nThank you!"}}