temu问题之xp sp3 下不生成trace文件

原创

upkevin 2012-03-02 11:05:34 博主文章分类：BAP研究 ©著作权

©著作权归作者所有：来自51CTO博客作者upkevin的原创作品，如需转载，请与作者联系，否则将追究法律责任

1、安装完TEMU，在xp sp3下无法生成trace文件，百思不得其解。google一下。

Stop tracing process 864
Number of instructions decoded: 1064541
Number of operands decoded: 2518508
Number of instructions written to trace: 0
Number of tainted instructions written to trace: 0
Processing time: 26.0416 U: 0 S: 26.0416
Generating file: cmd.exe.functions

2、据google你人所答， temu1.0不支持对xp sp3版本，需要在temu根目录taint_check.c文件中，查找到taint_patch()函数，在if(cpu_single_env_eip != 0xbf8a4bde && cpu_single_env->eip)后添加sp3的检查特征值，0xbf848d65 and 0xbf848d1c,OK!!

下面成功输出结果。

(qemu) trace_stop

Stop tracing process 488

Number of instructions decoded: 52271

Number of operands decoded: 128452

Number of instructions written to trace: 52225

Number of tainted instructions written to trace: 54

Processing time: 14.3609 U: 14.3609 S: 0

Generating file: /tmp/488.trace.functions