{"record":{"id":"2159049801558848","repo":"NationalSecurityAgency/ghidra","slug":"cannot-make-taint-concrete-215904","errorCode":null,"errorMessage":"Cannot make Taint concrete","messagePattern":"Cannot make Taint concrete","errorType":"exception","errorClass":"ConcretionError","httpStatus":null,"severity":"error","filePath":"Ghidra/Debug/TaintAnalysis/src/main/java/ghidra/pcode/emu/taint/state/TaintPcodeExecutorStatePiece.java","lineNumber":81,"sourceCode":"\t * Create the taint piece\n\t * \n\t * @param language the language of the emulator\n\t * @param addressArithmetic the address arithmetic, likely taken from the concrete piece\n\t * @param cb callbacks to receive emulation events\n\t */\n\tpublic TaintPcodeExecutorStatePiece(Language language,\n\t\t\tPcodeArithmetic<byte[]> addressArithmetic, PcodeStateCallbacks cb) {\n\t\tsuper(language, addressArithmetic, TaintPcodeArithmetic.forLanguage(language), cb);\n\t}\n\n\t@Override\n\tpublic TaintPcodeExecutorStatePiece fork(PcodeStateCallbacks cb) {\n\t\tthrow new UnsupportedOperationException();\n\t}\n\n\t@Override\n\tpublic MemBuffer getConcreteBuffer(Address address, Purpose purpose) {\n\t\tthrow new ConcretionError(\"Cannot make Taint concrete\", purpose);\n\t}\n\n\t/**\n\t * {@inheritDoc}\n\t * \n\t * <p>\n\t * Here, we just follow the pattern: delegate to the space map.\n\t */\n\t@Override\n\tprotected TaintSpace getForSpace(AddressSpace space, boolean toWrite) {\n\t\tif (toWrite) {\n\t\t\treturn spaceMap.computeIfAbsent(space, s -> new TaintSpace(space, this));\n\t\t}\n\t\treturn spaceMap.get(space);\n\t}\n\n\t/**\n\t * {@inheritDoc}","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Debug/TaintAnalysis/src/main/java/ghidra/pcode/emu/taint/state/TaintPcodeExecutorStatePiece.java#L63-L99","documentation":"TaintPcodeExecutorStatePiece only tracks taint labels, not concrete bytes. getConcreteBuffer would need real bytes, so it throws ConcretionError to redirect concretization to the paired concrete state piece. As with toConcrete, taint here is auxiliary and cannot satisfy a concrete read on its own.","triggerScenarios":"Requesting a concrete MemBuffer from a taint state piece - e.g. an executor path that demands a concrete buffer for an address, or user code calling getConcreteBuffer on the taint piece directly.","commonSituations":"Using a taint-only state without a concrete partner; an instruction/emulator path (address resolution, concrete branch) that requires a concrete buffer; user analysis calling getConcreteBuffer on taint.","solutions":["Pair the taint state piece with a concrete state piece (composite/paired state) so concrete reads route to the concrete piece.","Route concrete reads explicitly through the concrete piece rather than the taint piece.","Avoid forcing concrete reads in taint-only analysis."],"exampleFix":"// before (taint-only state)\nMemBuffer b = taintPiece.getConcreteBuffer(addr, Purpose.OTHER); // throws\n// after (route through the paired concrete piece)\nMemBuffer b = concretePiece.getConcreteBuffer(addr, Purpose.OTHER);","handlingStrategy":"fallback","validationCode":"// Use a composite state; route concrete reads to the concrete piece.\nif (statePiece instanceof TaintPcodeExecutorStatePiece) {\n    return concretePiece.getConcreteBuffer(address, purpose);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return statePiece.getConcreteBuffer(address, purpose);\n} catch (ConcretionError e) {\n    return concretePiece.getConcreteBuffer(address, purpose);\n}","preventionTips":["Pair the taint state piece with a concrete state piece in a composite state.","Route concrete reads explicitly to the concrete piece."],"tags":["pcode","emulation","taint","concretization","state"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}