| Copyright | (c) 2026 Jared Tobin |
|---|---|
| License | MIT |
| Maintainer | Jared Tobin <jared@ppad.tech> |
| Safe Haskell | None |
| Language | Haskell2010 |
Vestigia.Trace
Description
A run's leakage, read from what memcheck reported. An error
whose undefined value was created by a client request descends
from a byte the harness marked secret, so it is a site where the
execution depended on the secret: a branch (control), an
address computed from it (address), an integer division's
operand (operand, from vestigia's patched memcheck), or a
system call handed it (syscall). Every other uninitialised read
is kept apart as unrelated, and memory errors as faults:
neither says anything about the secret. Leak reports say nothing
about the execution and are dropped.
memcheck sees the path a run took, so runs of one harness on several secrets are read together: a site is one instruction and class however many runs reached it, with the runs that did. Where a run's objects are known, a site is named by its address in its object, so runs that loaded an object apart still agree on it.
Synopsis
- data Class
- data Taint = Taint {}
- data Located = Located {}
- data Site = Site {}
- data Trace = Trace {}
- trace :: [Taint] -> Trace
- sitesIn :: [Text] -> Trace -> Trace
- readObjects :: Text -> Either String [(Integer, Text)]
- resolveObjects :: [(Integer, Text)] -> IO [(Integer, Text)]
- traceJson :: Text -> Trace -> Value
- traceSummary :: Trace -> Text
Documentation
How an execution depended on a secret at a site.
One run under memcheck: its name, what memcheck reported, where the harness's loader put each object (its load bias and path, as the harness reported them; none for a report made elsewhere), and the harness's exit status, where known.
Constructors
| Taint | |
A frame, with its address in its object where its run's objects say.
One instruction that depended on a secret: where, as the first run to reach it saw it; how many times, over every run; the runs that reached it, as indices into the runs; and every stack that did.
Constructors
| Site | |
Runs' sites, in the order first reported, and what memcheck reported that says nothing about the secret, each with the index of the run that reported it.
Constructors
| Trace | |
trace :: [Taint] -> Trace Source #
The runs' leakage. Sites are one per instruction and class: memcheck reports one context per distinct stack, and the instruction is what depended on the secret, whatever called it and in whichever run.
sitesIn :: [Text] -> Trace -> Trace Source #
Only the sites in objects whose path contains one of the given texts, as a differential run keeps its origins; every site when none is given.
readObjects :: Text -> Either String [(Integer, Text)] Source #
The objects file the harness's first mark writes: a load bias (hex) and a path per line.
>>>readObjects "7f0000 /lib/libc.so.6\n400000 /bin/harness\n"Right [(8323072,"/lib/libc.so.6"),(4194304,"/bin/harness")]
resolveObjects :: [(Integer, Text)] -> IO [(Integer, Text)] Source #
A frame's address in its object, where the harness reported the object: by its path, else by its file name. | A run's objects, each path resolved to the file it names, as memcheck names a frame's object: a loader reaches a library by the link its soname names, memcheck by the file the link leads to. A path that names nothing here, as in a report made elsewhere, is kept as reported.
traceSummary :: Trace -> Text Source #
One line per site, for a reader at a terminal: with how many runs reached it, where there were several.