A taint tracer written via Immunity's plugin system. Taint is tracked on registers and memory locations. Currently, ~40 commonly used instructions are implemented. To track taint, following rules are utilized to determine propagation:
- If data is copied from a tainted source to an untainted destination, taint the destination.
- If data is copied from an untainted source to a tainted destination, clear the destination.
- If data is copied from a memory location through a tainted register, taint the destination.
- If data is copied from a tainted memory location through an untainted register, taint the destination.
- If data is copied from a untainted memory location through an untainted register, clear the destination.
- If the destination is set to a constant value, clear the destination.
Copy taint.py and the taint directory into Immunity Debugger's PyCommands directory.
For help, run the command without any arguments.