augure 0.2.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +29 -4
- data/README.md +7 -4
- data/lib/augure/facts.rb +16 -1
- data/lib/augure/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: a789ddf9e30394c583979b786270f9c5523a6aa559eeb26d744e4076c4f7448e
|
|
4
|
+
data.tar.gz: c725354af8ac4b3b30c648e98611425eaa9365dd981fd09bf6078219bec0210c
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: edc2f71a9f272fa9385c9bd0e16acb798c2860c9eb0bbfabf0475112d854a73c9ed97309d48a2d828dc06dfe8dd637d1665a062109d980fca7746953e6247c93
|
|
7
|
+
data.tar.gz: bfa1a02a06249670a7dca49a61cc07f61ac26c4660d2d87fb6867c3370aa117c47c843e83a4841ecb1b7c9dbe421a6ccda5f57751e93ff77dbba0ee3f52e560b
|
data/CHANGELOG.md
CHANGED
|
@@ -5,7 +5,32 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
-
## [
|
|
8
|
+
## [0.3.1] - 2026-11-02
|
|
9
|
+
|
|
10
|
+
### Fixed
|
|
11
|
+
|
|
12
|
+
- The fact-atom grammar rejects empty string atoms (`allocator("")`): the empty
|
|
13
|
+
atom parsed, carried no observation, and every rule of the predicate silently
|
|
14
|
+
never fired (measured: the suggest step's empty allocator tilted a decision).
|
|
15
|
+
Loud `MalformedFact` with the line number at parse and at `add`.
|
|
16
|
+
|
|
17
|
+
## [0.3.0] - 2026-10-30
|
|
18
|
+
|
|
19
|
+
- The profiler emits the vuln facts the binary itself carries: the
|
|
20
|
+
static frame read is the evidence, so an unsafe call site feeding an
|
|
21
|
+
rbp-frame buffer becomes `vuln("sof")` with `vuln_function` and
|
|
22
|
+
`sink` facts, and a printf-family format argument living on the
|
|
23
|
+
stack becomes `vuln("fmtstr")` + `fmtstr_read`. The operator's
|
|
24
|
+
suggest stays for the knowledge no ELF can show (a lib-side overflow,
|
|
25
|
+
a heap class, a filter).
|
|
26
|
+
- The sized-copy family (read, fgets, memcpy, memmove, strncpy) gets a
|
|
27
|
+
boundedness guard: when the length argument is an immediate at most
|
|
28
|
+
as large as the room between the buffer and the return slot, the
|
|
29
|
+
call is a bounded copy, not the overflow - the scan moves on. The
|
|
30
|
+
length register is per-sink (rdx, rsi for fgets). Sites without an
|
|
31
|
+
rbp-frame buffer (a global, a pointer arg) no longer stop the scan:
|
|
32
|
+
a later site may carry the overflow.
|
|
33
|
+
- augure-profiler 0.0.3.
|
|
9
34
|
|
|
10
35
|
## [0.2.0] - 2026-10-29
|
|
11
36
|
|
|
@@ -16,9 +41,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
16
41
|
- The ret2csu_v2 pack's build layout now teaches the WIN call measured
|
|
17
42
|
end to end on the corpus binary: the csu pair populates rsi/rdx (the
|
|
18
43
|
newer gcc flavor truncates edi, rdi never rides the csu), the mov
|
|
19
|
-
block's mandatory call lands on
|
|
20
|
-
cell (a no-op call preserving every argument register), the
|
|
21
|
-
seven-slot junk slide absorbs the loop epilogue, then pop_rdi
|
|
44
|
+
block's mandatory call lands on the `fini` stub through the .dynamic
|
|
45
|
+
DT_FINI cell (a no-op call preserving every argument register), the
|
|
46
|
+
seven-slot junk slide absorbs the loop epilogue, then `pop_rdi`
|
|
22
47
|
carries the full 64-bit first argument. The canonical puts leak
|
|
23
48
|
stays documented as the reference variant.
|
|
24
49
|
- Profiler: `pop rsi; pop r15; ret` joins the gadget vocabulary (the
|
data/README.md
CHANGED
|
@@ -11,10 +11,13 @@
|
|
|
11
11
|
---
|
|
12
12
|
|
|
13
13
|
[](https://github.com/log0u7/augure/actions/workflows/ci.yml)
|
|
14
|
+
[](LICENSE)
|
|
15
|
+
[](https://www.ruby-lang.org/)
|
|
14
16
|
[](https://rubygems.org/gems/augure)
|
|
15
|
-
[](https://www.ruby-lang.org/)
|
|
16
|
-
[](LICENSE)
|
|
17
17
|
[](packs/)
|
|
18
|
+
[](https://metasm.cr0.org/)
|
|
19
|
+
[](https://github.com/Z3Prover/z3)
|
|
20
|
+
[](https://modelcontextprotocol.io)
|
|
18
21
|
|
|
19
22
|
Every exploitation framework answers *"how do I run this technique?"*.
|
|
20
23
|
**Augure answers the question nobody automates: *"which technique should run,
|
|
@@ -53,8 +56,8 @@ augure analyze examples/ret2win.facts # your first decision
|
|
|
53
56
|
```
|
|
54
57
|
|
|
55
58
|
(The `examples/` ship in the gem; in a repo checkout the same paths work
|
|
56
|
-
from the repo root.
|
|
57
|
-
|
|
59
|
+
from the repo root. augure-profiler installs the same way and turns a
|
|
60
|
+
real binary into the facts file.)
|
|
58
61
|
|
|
59
62
|
Profile a real binary into facts, then decide on them:
|
|
60
63
|
|
data/lib/augure/facts.rb
CHANGED
|
@@ -125,6 +125,15 @@ module Augure
|
|
|
125
125
|
|
|
126
126
|
raise MalformedFact, "#{name}: fact atoms may not contain quotes, backslashes, parens or newlines"
|
|
127
127
|
end
|
|
128
|
+
# the empty atom: a fact like allocator("") carries no observation -
|
|
129
|
+
# it parses, then every rule of the predicate silently never fires
|
|
130
|
+
# (measured: the suggest step's empty allocator tilted a decision).
|
|
131
|
+
# Loud failure instead of silent void.
|
|
132
|
+
args.each do |arg|
|
|
133
|
+
next unless arg.is_a?(String) && arg.empty?
|
|
134
|
+
|
|
135
|
+
raise MalformedFact, "#{name}: fact atoms may not be empty strings"
|
|
136
|
+
end
|
|
128
137
|
(@rels[name] ||= []) << args
|
|
129
138
|
self
|
|
130
139
|
end
|
|
@@ -163,7 +172,13 @@ module Augure
|
|
|
163
172
|
if arg.match?(/\A-?\d+\z/)
|
|
164
173
|
arg.to_i
|
|
165
174
|
elsif arg.match?(/\A"[^"\\()]*"\z/)
|
|
166
|
-
arg[1..-2]
|
|
175
|
+
inner = arg[1..-2]
|
|
176
|
+
if inner.empty?
|
|
177
|
+
raise MalformedFact,
|
|
178
|
+
"line #{lineno}: #{name} arg #{i + 1} may not be an empty string"
|
|
179
|
+
end
|
|
180
|
+
|
|
181
|
+
inner
|
|
167
182
|
else
|
|
168
183
|
raise MalformedFact,
|
|
169
184
|
"line #{lineno}: #{name} arg #{i + 1} is not a quoted string atom or integer"
|
data/lib/augure/version.rb
CHANGED