Contents Menu Expand Light mode Dark mode Auto light/dark, in light mode Auto light/dark, in dark mode Skip to content
Penguin Docs
Penguin Docs

Documentation

  • Penguin: Configuration Based Rehosting
  • Installation
  • Learn more about Penguin
  • Penguin Development Guide
  • Example: Local kernel development
  • Local Plugins
  • Penguin Playbook
  • Penguin Plugins
  • Portal
  • Plugins
  • Penguin Configuration
  • Scripting Plugins in Penguin
  • Singularity
  • Syscalls Plugin System
  • Uprobes Plugin System
  • Example Rehosting Workflow

Packages

  • penguin package
    • penguin.penguin_config package
      • penguin.penguin_config.versions package
        • penguin.penguin_config.versions.v2 module
      • penguin.penguin_config.gen_docs module
      • penguin.penguin_config.structure module
    • penguin.abi_info module
    • penguin.analyses module
    • penguin.arch module
    • penguin.common module
    • penguin.config_patchers module
    • penguin.defaults module
    • penguin.gen_config module
    • penguin.gen_image module
    • penguin.genetic module
    • penguin.graph_search module
    • penguin.graphs module
    • penguin.llm module
    • penguin.manager module
    • penguin.patch_minimizer module
    • penguin.patch_search module
    • penguin.penguin_prep module
    • penguin.penguin_run module
    • penguin.plugin_manager module
    • penguin.q_config module
    • penguin.search_utils module
    • penguin.static_analyses module
    • penguin.utils module
  • pengutils package
    • pengutils.events package
      • pengutils.events.base module
      • pengutils.events.types module
    • pengutils.utils package
      • pengutils.utils.cli_breakpoint module
      • pengutils.utils.cli_db module
      • pengutils.utils.cli_guest_cmd module
      • pengutils.utils.cli_pengutils module
      • pengutils.utils.cli_plugins module
      • pengutils.utils.util_base module
      • pengutils.utils.util_events module
  • pyplugins package
    • pyplugins.actuation package
      • pyplugins.actuation.fetch_web module
      • pyplugins.actuation.nmap module
      • pyplugins.actuation.vpn module
    • pyplugins.analysis package
      • pyplugins.analysis.env module
      • pyplugins.analysis.ficd module
      • pyplugins.analysis.health module
      • pyplugins.analysis.hooklogger module
      • pyplugins.analysis.indiv_debug module
      • pyplugins.analysis.interfaces module
      • pyplugins.analysis.netbinds module
      • pyplugins.analysis.repl module
    • pyplugins.apis package
      • pyplugins.apis.events module
      • pyplugins.apis.execs module
      • pyplugins.apis.fs module
      • pyplugins.apis.kffi module
      • pyplugins.apis.mem module
      • pyplugins.apis.net module
      • pyplugins.apis.osi module
      • pyplugins.apis.portalcall module
      • pyplugins.apis.send_hypercall module
      • pyplugins.apis.signals module
      • pyplugins.apis.static_fs module
      • pyplugins.apis.symbols module
      • pyplugins.apis.syscalls module
      • pyplugins.apis.unwind module
      • pyplugins.apis.uprobes module
    • pyplugins.compat package
      • pyplugins.compat.coverage module
    • pyplugins.core package
      • pyplugins.core.core module
      • pyplugins.core.igloodriver module
      • pyplugins.core.live_image module
    • pyplugins.hyper package
      • pyplugins.hyper.bash_command module
      • pyplugins.hyper.canary module
      • pyplugins.hyper.consts module
      • pyplugins.hyper.portal module
      • pyplugins.hyper.shell module
      • pyplugins.hyper.uboot module
    • pyplugins.interventions package
      • pyplugins.interventions.hyperfile module
      • pyplugins.interventions.kernelversion module
      • pyplugins.interventions.kmods module
      • pyplugins.interventions.lifeguard module
      • pyplugins.interventions.mount module
      • pyplugins.interventions.nvram2 module
      • pyplugins.interventions.pseudofiles module
      • pyplugins.interventions.remotectrl module
      • pyplugins.interventions.symex module
    • pyplugins.loggers package
      • pyplugins.loggers.db module
      • pyplugins.loggers.exec_logger module
      • pyplugins.loggers.rw_logger module
      • pyplugins.loggers.syscalls_logger module
    • pyplugins.wrappers package
      • pyplugins.wrappers.generic module
      • pyplugins.wrappers.osi_wrap module
      • pyplugins.wrappers.ptregs_wrap module
Back to top

penguin.graph_search module¶

class penguin.graph_search.GlobalState(proj_dir, output_dir, base_config)[source]¶

Bases: object

class penguin.graph_search.Worker(global_state, config_manager, proj_dir, run_base, max_iters, run_index, timeout, active_worker_count, verbose=False, thread_id=None, logger=None)[source]¶

Bases: object

static analyze_failures(run_dir, node, n_config_tests, logger=None)[source]¶

After we run a configuration, do our post-run analysis of failures. Run each PyPlugin that has a PenguinAnalysis implemented. Have each identify failures.

Staticmethod with logger arg so we can call from other search algos too. Maybe worth refactoring into manager or something more generic?

find_best_score(run_dir, run_idx, n_config_tests, is_exclusive)[source]¶

Look acrous our n_config_tests runs. Calculate the maximal score for each score type our various metrics. Note n_config_tests is 1 for now. Later we might increase depending on expected non-determinism.

find_mitigations_f(failure, config)[source]¶
Parameters:
  • failure (Failure)

  • config (Configuration)

Return type:

List[Mitigation]

find_new_configs_f(failure, mitigation, parent_config)[source]¶

Given a failure and mitigation, find new configurations to explore

Parameters:
  • failure (Failure)

  • mitigation (Mitigation)

  • parent_config (Configuration)

Return type:

List[Configuration]

run()[source]¶
run_config_f(config)[source]¶

Run a given configuration, collect details of it’s failures and calculate score

Parameters:

config (Configuration)

Return type:

Tuple[List[Failure], float]

penguin.graph_search.add_init_options_to_graph(config_manager, proj_dir, base_config)[source]¶

A config needs to have an [‘env’][‘igloo_init’] in order to do anything useful. We might have a single option already set or we might have multiple options stored proj_dir/static/InitFinder.yaml (based on static analysis).

If we have no value set and no potential values, we raise an error.

Otherwise we’ll create a fake failure for “init” and a mitigation node to add each of the init options. Then we’ll create configs with each init and add the necessary graph edges. This means we’ll start our search with multiple configuration options (nodes) to explore.

If an igloo_init is set in the initial config, we’ll assume that’s right and leave it alone.

penguin.graph_search.graph_search(proj_dir, initial_config, output_dir, timeout, max_iters=1000, nthreads=1, init=None, verbose=False)[source]¶

Main entrypoint. Given an initial config and directory run our graph search.

penguin.graph_search.main()[source]¶
penguin.graph_search.report_best_results(best_idx, best_output, output_dir)[source]¶
Next
penguin.graphs module
Previous
penguin.genetic module
Copyright ©
Made with Sphinx and @pradyunsg's Furo
On this page
  • penguin.graph_search module
    • GlobalState
    • Worker
      • analyze_failures()
      • find_best_score()
      • find_mitigations_f()
      • find_new_configs_f()
      • run()
      • run_config_f()
    • add_init_options_to_graph()
    • graph_search()
    • main()
    • report_best_results()