Taosc

Taosc is an automated makeshift patcher for binary programs.

Installation

Taosc depends on AFL++, Dyninst, E9Patch, GNU Findutils, FUZZOLIC, Valgrind and POSIX utilities. Shell scripts in this project are not fully POSIX-compliant (patches welcomed) and have only been tested with GNU Bash. To build and install taosc to $prefix (default to /usr/local), you need install(1p) and a compiler for C++23 and Zig 0.16:

make -j$(nproc) PREFIX=$prefix install

Usage

taosc-fix TIMEOUT WORKDIR PROOFS_OF_CONCEPT EXECUTABLE ARG...

Fix EXECUTABLE, which crashes for PoC(s) in the PROOFS_OF_CONCEPT directory when it is run with ARG(s), where @@ is the placeholder for input files.

Processes taking more than TIMEOUT seconds to terminate are treated the same as crashes.

Files in WORKDIR are overwritten without any warning. A successful invocation of taosc should create the following files.

• patch-location: address of the patch location
• patch-destination: address of the instruction the patch jumps to
• PROG.patched, where PROG is the basename of EXECUTABLE: patched program expecting the mentioned environment variables

Depending on the content of the file patch-format, additional output may be expected as follows.

• Single CWE-*: PROG.brpatched and PROG.brpatched.json for BinRadar
• ERM generic: newline-separated list of predicates
• ERM CWE-805: predicates, PROG.brpatched and PROG.brpatched.json

Copying

Taosc is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.