Obvious false positive detected by Flowtracker / Analysing non targeted functions about flowtracker HOT 10 OPEN

Hi Diego, Thank you for your quick answer. Here is an example of source file containing two functions where we are analyzing only one of them (compConstant4() as designated in the xml file) and the corresponding output. You can notice that the output (subgraphASCIILines1.txt for example) is showing that there is a bug in lines 22 and 23 which belong to the function additional_function() while in the xml we just mentioned the function compConstant4(). PS: We are using other constant-time checking tools as binsec/rel, ctgrind and dudect. In the same category as FlowTracker, we are exploring ct-verif. Do you have any suggestions in the same category as FlowTracker? Best regards, Olivier Adjonyo. From: Diego F. Aranha ***@***.***> Date: Thursday, 22 February 2024 at 10:48 AM To: dfaranha/FlowTracker ***@***.***> Cc: Koffi Adjonyo ***@***.***>, Author ***@***.***> Subject: Re: [dfaranha/FlowTracker] Obvious false positive detected by Flowtracker / Analysing non targeted functions (Issue #1) You don't often get email from ***@***.*** Learn why this is important<https://protect.checkpoint.com/v2/___https://aka.ms/LearnAboutSenderIdentification___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86ODkzMGFiYjIwNmQ4OWZmYTRhM2MyODg3NDE5MTFkZWE6NjplYWQxOjFhNTU1ODRhMTZjYmFjNjg5NDk1ZThmODVjMGRhZDU5OWMwM2Q0OWJhZWZkZDNkODUzZDMxNjU5ZGNhZTQxZWE6aDpU> Hi Oliver, It's a relatively common problem with FlowTracker, and information flow analysis in general. We point it out in the original paper as an important limitation. I'm actually surprised they it still works, given that is not maintained for several years! The latter sounds like a bug. Do you have a minimal example to share? PS: there are better tools these days that supersede FlowTracker. Have you tried them? — Reply to this email directly, view it on GitHub<https://protect.checkpoint.com/v2/___https://github.com/dfaranha/FlowTracker/issues/1%23issuecomment-1958810356___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86ODkzMGFiYjIwNmQ4OWZmYTRhM2MyODg3NDE5MTFkZWE6Njo4ZGIzOjQzMjJmMzBlODYzMjA4ZTQ1MGUxZTljMWE2OGQzNWVhMTNlZmEwMmRhNjgwMDJjNDQzYzJlNjNjZTAwY2Q5ZWM6aDpU>, or unsubscribe<https://protect.checkpoint.com/v2/___https://github.com/notifications/unsubscribe-auth/A6WWBXB3AVCI3BK24FYT3MLYU3SYZAVCNFSM6AAAAABDUKNM5KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNJYHAYTAMZVGY___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86ODkzMGFiYjIwNmQ4OWZmYTRhM2MyODg3NDE5MTFkZWE6Njo4ZjNiOmFjODVkNmFjZDk4NTZjZWU0NjRhYzQ0ZWVhZGRiNTE2NTA3YjFkNDA2YzE2YTMyMDMzYjU0ODA5YmVhNzFkNDA6aDpU>. You are receiving this because you authored the thread.Message ID: ***@***.***> #include <stdio.h> int compConstant4 (char *pw, char *in) { int i; int isEqual = 1; int mock = 0; for (i=0; i<7; i++) { if (pw[i]!=in[i]) { isEqual = 0; }else { mock = 0; } } return isEqual; } int addtional_function(const unsigned char *modDePass, const unsigned char *password){ for(int i=0;i<10;i++){ if (modDePass[i] != password[i]){ return 1; } } return 0; } Vulnerability from ' line 6 to line 11 ' Line 11 Vulnerability from ' line 6 to line 22 ' Line 22 Line 23 Vulnerability from ' line 6 to line 23 ' Line 23 Line 22 Line 23 Vulnerability from ' line 6 to line 23 ' Line 23 Line 22 Line 23

Thanks kindly for the survey! The xml file is in the attachment of the previous mail (xml_example_2.xml). Bellow are the commands lines: - compilation: clang -emit-llvm -c -g example_2_c.c -o example_2.bc opt -instnamer -mem2reg example_2.bc > example_2.rbc -execution: opt -basicaa -load AliasSets.so -load DepGraph.so -load bSSA2.so -bssa2 -xmlfile xml_example_2.xml example_2.rbc 2> output_exampler2.out Olivier Adjonyo From: Diego F. Aranha ***@***.***> Date: Thursday, 22 February 2024 at 2:20 PM To: dfaranha/FlowTracker ***@***.***> Cc: Koffi Adjonyo ***@***.***>, Author ***@***.***> Subject: Re: [dfaranha/FlowTracker] Obvious false positive detected by Flowtracker / Analysing non targeted functions (Issue #1) You don't often get email from ***@***.*** Learn why this is important<https://protect.checkpoint.com/v2/___https://aka.ms/LearnAboutSenderIdentification___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86NjQ5MjM2YTk1YmQ5MTlhNzQwNDhhM2U4NGI2NmQ1MTA6NjphNjViOjM0MDU3ZDU4MmU1ODE3NjgwOGYwMGM2MmRkZjA5OGI0Mzk0YmUwMWVhMDFlZDkzNTBmMDhiNTA5OWMyN2Y4YjQ6aDpU> Hi Oliver, Can you past the XML file too and command-line steps? I want to try reproducing the same thing you're seeing in your end. This survey maps many other tools: https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9833713<https://protect.checkpoint.com/v2/___https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9833713___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86NjQ5MjM2YTk1YmQ5MTlhNzQwNDhhM2U4NGI2NmQ1MTA6NjowMzMyOjVmMzMzN2M4MzkyNzkwNDc0YTcwMDJjNTRmOGZjOWU2NDg3ZTU2YzQwYTZmZTE0Y2ZjZmU5MWFkMzY0N2I2NTQ6aDpU> — Reply to this email directly, view it on GitHub<https://protect.checkpoint.com/v2/___https://github.com/dfaranha/FlowTracker/issues/1%23issuecomment-1959131042___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86NjQ5MjM2YTk1YmQ5MTlhNzQwNDhhM2U4NGI2NmQ1MTA6NjowMTE2OjBlNDdlNGE5MTY0ZjkwMDQ4MzIxOGQ0Y2I5OGJlNjAxYTI4YjljY2NiZDFlMmM5YmE1MjFlMzFkMjQ2MjIyOTA6aDpU>, or unsubscribe<https://protect.checkpoint.com/v2/___https://github.com/notifications/unsubscribe-auth/A6WWBXCQR7MJVVNH42IUQDLYU4LWRAVCNFSM6AAAAABDUKNM5KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNJZGEZTCMBUGI___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86NjQ5MjM2YTk1YmQ5MTlhNzQwNDhhM2U4NGI2NmQ1MTA6NjplMzIxOmQ2NTJlZDY4MTQyMmUyZDI4YjUxNzE2ZTM3NjU0NDlhYWNjYzYxMTY2YzVlYmY1Njk5ODJjYjgwOGFiOWFhOWQ6aDpU>. You are receiving this because you authored the thread.Message ID: ***@***.***>

Ah! Sorry for that Diego; please find it attached here. thanks 😊 Olivier Adjonyo From: Diego F. Aranha ***@***.***> Date: Thursday, 22 February 2024 at 5:46 PM To: dfaranha/FlowTracker ***@***.***> Cc: Koffi Adjonyo ***@***.***>, Author ***@***.***> Subject: Re: [dfaranha/FlowTracker] Obvious false positive detected by Flowtracker / Analysing non targeted functions (Issue #1) You don't often get email from ***@***.*** Learn why this is important<https://protect.checkpoint.com/v2/___https://aka.ms/LearnAboutSenderIdentification___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86NmUwZGE1ZGM4ZjNhMWRlNjNhNjNkYjczNWEwMjYxZDk6NjplZGVmOmRmNGYxOTAxZDQ3MGFiNjgwODQ3MTUxODNkMTU0NTMxZGUwMjVmZDMxYjJjNjc5MWU2ZGQ3MTNhNWRlZjhhYmM6aDpU> I think the XML is garbled because of the email interface, or at least I can't find it anywhere. — Reply to this email directly, view it on GitHub<https://protect.checkpoint.com/v2/___https://github.com/dfaranha/FlowTracker/issues/1%23issuecomment-1959483106___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86NmUwZGE1ZGM4ZjNhMWRlNjNhNjNkYjczNWEwMjYxZDk6NjowMDcyOjg2OTdjNmI2OTEwNjk0ZWQ3ZDI0YjNmZTlmYzg2ZDg1NzY5ZWMzMjg2MDhjZDkxMTEzNGQ3NWNhZDhkZTE5NTE6aDpU>, or unsubscribe<https://protect.checkpoint.com/v2/___https://github.com/notifications/unsubscribe-auth/A6WWBXH5257LPJ54ODSNBHDYU5DZVAVCNFSM6AAAAABDUKNM5KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNJZGQ4DGMJQGY___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86NmUwZGE1ZGM4ZjNhMWRlNjNhNjNkYjczNWEwMjYxZDk6Njo5MWY0OjNmYWI0NDEzOTY4ZGM2YzhmMzhhZDA5NTE5NDM2OWVkZThmNDlkMzAzOTQ5NzMzNjZiZmEyODJhNGVhZTU2MWY6aDpU>. You are receiving this because you authored the thread.Message ID: ***@***.***>

<functions> <sources> <function> <name>compConstant4</name> <return>false</return> <public> <parameter>in</parameter> </public> <secret> <parameter>pw</parameter> <!--Secret key--> </secret> </function> </sources> </functions> Hello Diego, Thanks for your reply. Please find above our .xml file. With this approach, Flowtracker is detecting leaks in the additional function even though we are not mentioning it in the xml file. Do you think this normal? Adding a main function in the .c file like follow, makes Flowtracker detects only the targeted function: int main(){ char pw[10] = "olivier"; char in[10] = "gilbert"; compConstant4 (pw, in); return 0; Any thought about this? From: Diego F. Aranha ***@***.***> Date: Friday, 23 February 2024 at 12:17 AM To: dfaranha/FlowTracker ***@***.***> Cc: Koffi Adjonyo ***@***.***>, Author ***@***.***> Subject: Re: [dfaranha/FlowTracker] Obvious false positive detected by Flowtracker / Analysing non targeted functions (Issue #1) You don't often get email from ***@***.*** Learn why this is important<https://protect.checkpoint.com/v2/___https://aka.ms/LearnAboutSenderIdentification___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86MTRhMWJiMmRmNTE0Mzg1YTIwNmVjZTNmY2IwNjc1MTA6NjpmMDM0OjZkZTg1MDFkN2Y5YzM1ZjdlZGI0YmI4YzlkZDhlZmU1OWRlZTcwNGQyYjI1ZWM3YTU2MDg0MzExMWRjOTY2MGI6aDpU> I wrote a tentative XML file here and it looks like FlowTracker is heavily confused about the lines of code when trying to reconstruct the subgraphs. I don't remember this being much of an issue in the original paper, but that was several years ago. We used FlowTracker again with multiple implementations in this paper<https://protect.checkpoint.com/v2/___https://dfaranha.github.io/files/wticg17.pdf___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86MTRhMWJiMmRmNTE0Mzg1YTIwNmVjZTNmY2IwNjc1MTA6Njo4NTFmOjU1ODkxZWVlNmIxNWUzZDVkMDJhYjEzYzg3MGRiNDg1MmJiYjRiYzcxODU3NzExNTE5NTNlZWZhNjlmZDQ1YmY6aDpU> with code+results available at this repository<https://protect.checkpoint.com/v2/___https://github.com/arthurlopes/ctbench___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86MTRhMWJiMmRmNTE0Mzg1YTIwNmVjZTNmY2IwNjc1MTA6NjplY2UxOmE5ZGY5NWUyNGJlMGU4MDQ2NmIyNmNmYTdhMDg3YTJjODA3ZmQ3MzEzYjJkMWNiM2YyNWI0NDEwZGM4NWM4MDg6aDpU>. I tried a few experiments to understand what FlowTracker is doing: * Adding the additional function to the XML file with public parameters had the same result as without the function, so I believe FlowTracker is not detecting false positives there, but just having trouble pointing out the leaky lines numbers. * Adding the additional function to the XML file with a private parameter increased the number of vulnerable subgraphs, which indicated that FlowTracker was now finding issues in the additional function as well, exactly as expected. * Marking the additional function as static reduced the confusion, both in terms of the generated subgraphs and lines of code. From the above and the issue with false positives, I can say that a modern build of FlowTracker is more useful at plainly detecting the presence of leakage (or the lack thereof) than assisting the programmer with locating the exact sources. In any case, it's not software that is currently maintained and depends on very old LLVM, so better alternatives clearly exist. You can also try to write to my co-author Fernando Quintao at ***@***.******@***.***> to inquire about follow-up work. I clearly remember him mentioning a reimplementation of FlowTracker in Java that perhaps is still maintained. For reference, here is one of the XML files I used. <functions> <sources> <function> <name>compConstant4</name> <return>false</return> <public> <parameter>in</parameter> </public> <secret> <parameter>pw</parameter> </secret> </function> <function> <name>addtional_function</name> <return>false</return> <public> <parameter>modDePass</parameter> </public> <secret> <parameter>password</parameter> </secret> </function> </sources> </functions> — Reply to this email directly, view it on GitHub<https://protect.checkpoint.com/v2/___https://github.com/dfaranha/FlowTracker/issues/1%23issuecomment-1960221767___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86MTRhMWJiMmRmNTE0Mzg1YTIwNmVjZTNmY2IwNjc1MTA6NjozMWY4OmFjODE4ZTFhMmIzYWM4Y2JkMmNiYTdjMDcxNDIxYTQ1MTY4ODZkZDdkZThjYzYzZDcwMDEyMjgxNWVhMGY2YTg6aDpU>, or unsubscribe<https://protect.checkpoint.com/v2/___https://github.com/notifications/unsubscribe-auth/A6WWBXFVSQ6AESK3TNFT5C3YU6RFVAVCNFSM6AAAAABDUKNM5KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNRQGIZDCNZWG4___.bWVjMTp0ZWNobm9sb2d5aW5ub3ZhdGlvbmluc3RpdHV0ZTpjOm86MTRhMWJiMmRmNTE0Mzg1YTIwNmVjZTNmY2IwNjc1MTA6Njo5OGNhOjc3OTljNmZiMzdlMGYwMjQzMWI3MzM1ZGYzMzNiMDg4OTIzYzQ0ZGJlYzZmNDM4Y2QwMTM1MjFkZWQ1MDQ5NDc6aDpU>. You are receiving this because you authored the thread.Message ID: ***@***.***>