added gcc_plugin

1 files changed, 372 insertions, 0 deletions

diff --git a/gcc_plugin/afl-gcc-pass.so.cc b/gcc_plugin/afl-gcc-pass.so.cc
new file mode 100644
index 00000000..8d1888ef
--- /dev/null
+++ b/gcc_plugin/afl-gcc-pass.so.cc
@@ -0,0 +1,372 @@
+//
+// There are two TODOs in this file:
+//   - dont instrument blocks that are uninterested
+//   - implement whitelist feature
+//
+
+/*
+   american fuzzy lop - GCC instrumentation pass
+   ---------------------------------------------
+
+   Written by Austin Seipp <aseipp@pobox.com> with bits from
+              Emese Revfy <re.emese@gmail.com>
+
+   Updated by Thorsten Schulz <thorsten.schulz@uni-rostock.de>
+
+   GCC integration design is based on the LLVM design, which comes
+   from Laszlo Szekeres. Some of the boilerplate code below for
+   afl_pass to adapt to different GCC versions was taken from Emese
+   Revfy's Size Overflow plugin for GCC, licensed under the GPLv2/v3.
+
+   (NOTE: this plugin code is under GPLv3, in order to comply with the
+   GCC runtime library exception, which states that you may distribute
+   "Target Code" from the compiler under a license of your choice, as
+   long as the "Compilation Process" is "Eligible", and contains no
+   GPL-incompatible software in GCC "during the process of
+   transforming high level code to target code". In this case, the
+   plugin will be used to generate "Target Code" during the
+   "Compilation Process", and thus it must be GPLv3 to be "eligible".)
+
+   Copyright (C) 2015 Austin Seipp
+
+   This program is free software: you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+ */
+
+//#define BUILD_INLINE_INST
+
+#include "../config.h"
+#include "../debug.h"
+
+/* clear helper AFL types pulls in, which intervene with gcc-plugin geaders from GCC-8 */
+#ifdef likely
+#undef likely
+#endif
+#ifdef unlikely
+#undef unlikely
+#endif
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <gcc-plugin.h>
+#include <plugin-version.h>
+#include <diagnostic.h>
+#include <tree.h>
+#include <tree-ssa.h>
+#include <tree-pass.h>
+#include <tree-ssa-alias.h>
+#include <basic-block.h>
+#include <gimple-expr.h>
+#include <gimple.h>
+#include <gimple-iterator.h>
+#include <version.h>
+#include <toplev.h>
+#include <intl.h>
+#include <context.h>
+#include <stringpool.h>
+#include <cgraph.h>
+#include <cfgloop.h>
+
+/* -------------------------------------------------------------------------- */
+/* -- AFL instrumentation pass ---------------------------------------------- */
+
+static int be_quiet = 0;
+static unsigned int inst_ratio = 100;
+static bool inst_ext = true; /* I reckon inline is broken / unfunctional */
+
+
+static unsigned int ext_call_instrument(function *fun) {
+	/* Instrument all the things! */
+	basic_block bb;
+	unsigned finst_blocks = 0;
+	unsigned fcnt_blocks = 0;
+
+	FOR_ALL_BB_FN(bb, fun) {
+		gimple_seq fcall;
+		gimple_seq seq = NULL;
+		gimple_stmt_iterator bentry;
+
+		if (!fcnt_blocks++) continue; /* skip block 0 */
+		
+		// TODO: if the predecessor does not have to destinations
+		// then skip this block :TODO
+
+		/* Bail on this block if we trip the specified ratio */
+		if (R(100) >= inst_ratio) continue;
+
+		/* Make up cur_loc */
+
+		unsigned int rand_loc = R(MAP_SIZE);
+		tree cur_loc = build_int_cst(uint64_type_node, rand_loc);
+
+		/* Update bitmap via external call */
+		/* to quote:
+		 * /+ Trace a basic block with some ID +/
+		 * void __afl_trace(u16 x);
+		 */
+
+		tree fntype = build_function_type_list(
+			void_type_node,   /* return */
+			uint16_type_node, /* args */
+			NULL_TREE);       /* done */
+		tree fndecl = build_fn_decl("__afl_trace", fntype);
+		TREE_STATIC(fndecl)     = 1; /* Defined elsewhere */
+		TREE_PUBLIC(fndecl)     = 1; /* Public */
+		DECL_EXTERNAL(fndecl)   = 1; /* External linkage */
+		DECL_ARTIFICIAL(fndecl) = 1; /* Injected by compiler */
+
+		fcall = gimple_build_call(fndecl, 1, cur_loc);  /* generate the function _call_ to above built reference, with *1* parameter -> the random const for the location */
+		gimple_seq_add_stmt(&seq, fcall); /* and insert into a sequence */
+
+		/* Done - grab the entry to the block and insert sequence */
+		bentry = gsi_start_bb(bb);
+		gsi_insert_seq_before(&bentry, seq, GSI_SAME_STMT);
+
+		finst_blocks++;
+	}
+	fcnt_blocks--; /* discard the first in the count */
+
+	/* Say something nice. */
+	if (!be_quiet) {
+		if (!finst_blocks)
+			WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST ),
+					function_name(fun));
+		else if (finst_blocks < fcnt_blocks)
+			OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST ),
+					finst_blocks, fcnt_blocks,
+					function_name(fun));
+		else
+			OKF(G_("Instrumented %2u locations in " cBRI "%s" cRST ),
+					finst_blocks,
+					function_name(fun));
+	}
+
+	return 0;
+}
+
+static unsigned int inline_instrument(function *fun) {
+#ifdef BUILD_INLINE_INST   /* ifdef inline away, so I don't have to refactor it */
+	/* Instrument all the things! */
+	basic_block bb;
+	unsigned finst_blocks = 0;
+	unsigned fcnt_blocks = 0;
+
+	/* Set up global type declarations */
+	tree map_type = build_pointer_type(unsigned_char_type_node);
+	tree map_ptr_g = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier_with_length("__afl_area_ptr",14), map_type);
+	TREE_USED(map_ptr_g) = 1;
+	TREE_STATIC(map_ptr_g) = 1; /* Defined elsewhere */
+	DECL_EXTERNAL(map_ptr_g) = 1; /* External linkage */
+	DECL_PRESERVE_P(map_ptr_g) = 1;
+	DECL_ARTIFICIAL(map_ptr_g) = 1;
+	rest_of_decl_compilation(map_ptr_g, 1, 0);
+
+	tree prev_loc_g = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier_with_length("__afl_prev_loc",14), uint16_type_node);
+	TREE_USED(prev_loc_g) = 1;
+	TREE_STATIC(prev_loc_g) = 1; /* Defined elsewhere */
+	DECL_EXTERNAL(prev_loc_g) = 1; /* External linkage */
+	DECL_PRESERVE_P(prev_loc_g) = 1;
+	DECL_ARTIFICIAL(prev_loc_g) = 1;
+	rest_of_decl_compilation(prev_loc_g, 1, 0);
+
+	FOR_ALL_BB_FN(bb, fun) {
+		gimple *g;
+		gimple_seq seq = NULL;
+		gimple_stmt_iterator bentry;
+
+		if (!fcnt_blocks++) continue; /* skip block 0 */
+
+		/* Bail on this block if we trip the specified ratio */
+		if (R(100) >= inst_ratio) continue;
+
+		/* Make up cur_loc */
+
+		unsigned int rand_loc = R(MAP_SIZE);
+		tree cur_loc = build_int_cst(uint64_type_node, rand_loc);
+
+		/* Load prev_loc, xor with cur_loc */
+
+		tree area_off = create_tmp_var(uint64_type_node, "area_off");
+		g = gimple_build_assign(area_off, BIT_XOR_EXPR, prev_loc_g, cur_loc);
+		gimple_seq_add_stmt(&seq, g); // area_off = prev_loc ^ cur_loc
+
+		/* Update bitmap */
+
+//		tree zero = build_int_cst(unsigned_char_type_node, 0);
+		tree one = build_int_cst(unsigned_char_type_node, 1);
+
+		tree tmp1 = create_tmp_var(map_type, "tmp1");
+		g = gimple_build_assign(tmp1, PLUS_EXPR, map_ptr_g, area_off);
+		gimple_seq_add_stmt(&seq, g); // tmp1 = __afl_area_ptr + area_off
+		SAYF(G_("%d,"), fcnt_blocks);
+
+		tree tmp2 = create_tmp_var(unsigned_char_type_node, "tmp2");
+		//tree tmp1_ptr = build_simple_mem_ref_loc(UNKNOWN_LOCATION, tmp1);
+		g = gimple_build_assign(tmp2, INDIRECT_REF, tmp1);
+		gimple_seq_add_stmt(&seq, g); // tmp2 = *tmp1
+
+		tree tmp3 = create_tmp_var(unsigned_char_type_node, "tmp3");
+		g = gimple_build_assign(tmp3, PLUS_EXPR, tmp2, one);
+		gimple_seq_add_stmt(&seq, g); // tmp3 = tmp2 + 1
+
+//		tree tmp4 = create_tmp_var(map_type, "tmp4");
+//		g = gimple_build_assign(tmp4, PLUS_EXPR, map_ptr_g, area_off);
+//		gimple_seq_add_stmt(&seq, g); // tmp4 = __afl_area_ptr + area_off
+
+//		tree deref2 = build2(MEM_REF, map_type, tmp4, zero);
+		tree deref2 = build4(ARRAY_REF, map_type, map_ptr_g, area_off, NULL, NULL);
+		g = gimple_build_assign(deref2, MODIFY_EXPR, tmp3);
+		gimple_seq_add_stmt(&seq, g); // *tmp4 = tmp3
+		SAYF(G_("+%d,"), fcnt_blocks);
+
+		/* Set prev_loc to cur_loc >> 1 */
+
+		tree shifted_loc = build_int_cst(TREE_TYPE(prev_loc_g), rand_loc >> 1);
+		g = gimple_build_assign(prev_loc_g, MODIFY_EXPR, shifted_loc);
+		gimple_seq_add_stmt(&seq, g); // __afl_pred_loc = cur_loc >> 1
+
+		/* Done - grab the entry to the block and insert sequence */
+
+		bentry = gsi_start_bb(bb);
+		gsi_insert_seq_before(&bentry, seq, GSI_SAME_STMT);
+
+		inst_blocks++;
+		finst_blocks++;
+	}
+
+	/* Say something nice. */
+	if (!be_quiet) {
+		if (!finst_blocks)
+			WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST ),
+					function_name(fun));
+		else if (finst_blocks < fcnt_blocks)
+			OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST ),
+					finst_blocks, fcnt_blocks,
+					function_name(fun));
+		else
+			OKF(G_("Instrumented   %2u   locations in " cBRI "%s" cRST ),
+					finst_blocks,
+					function_name(fun));
+	}
+
+#endif
+	return 0;
+}
+
+/* -------------------------------------------------------------------------- */
+/* -- Boilerplate and initialization ---------------------------------------- */
+
+static const struct pass_data afl_pass_data = {
+
+                .type                   = GIMPLE_PASS,
+                .name                   = "afl-inst",
+                .optinfo_flags          = OPTGROUP_NONE,
+
+                .tv_id                  = TV_NONE,
+                .properties_required    = 0,
+                .properties_provided    = 0,
+                .properties_destroyed   = 0,
+                .todo_flags_start       = 0,
+                // NOTE(aseipp): it's very, very important to include
+                // at least 'TODO_update_ssa' here so that GCC will
+                // properly update the resulting SSA form, e.g., to
+                // include new PHI nodes for newly added symbols or
+                // names. Do not remove this. Do not taunt Happy Fun
+                // Ball.
+                .todo_flags_finish      = TODO_update_ssa | TODO_verify_il | TODO_cleanup_cfg,
+};
+
+namespace {
+
+class afl_pass : public gimple_opt_pass {
+private:
+	bool do_ext_call;
+
+public:
+	afl_pass(bool ext_call, gcc::context *g) : gimple_opt_pass(afl_pass_data, g), do_ext_call(ext_call) {}
+
+	virtual unsigned int execute(function *fun) {
+		// TODO: implement whitelist feature here :TODO
+		return do_ext_call ? ext_call_instrument(fun) : inline_instrument(fun);
+	}
+}; /* class afl_pass */
+
+}  /* anon namespace */
+
+static struct opt_pass *make_afl_pass(bool ext_call, gcc::context *ctxt) {
+	return new afl_pass(ext_call, ctxt);
+}
+
+/* -------------------------------------------------------------------------- */
+/* -- Initialization -------------------------------------------------------- */
+
+int plugin_is_GPL_compatible = 1;
+
+static struct plugin_info afl_plugin_info = {
+  .version = "20181200",
+  .help    = "AFL gcc plugin\n",
+};
+
+int plugin_init(struct plugin_name_args *plugin_info,
+                struct plugin_gcc_version *version) {
+
+	struct register_pass_info afl_pass_info;
+	struct timeval tv;
+	struct timezone tz;
+	u32 rand_seed;
+
+	/* Setup random() so we get Actually Random(TM) outputs from R() */
+	gettimeofday(&tv, &tz);
+	rand_seed = tv.tv_sec ^ tv.tv_usec ^ getpid();
+	srandom(rand_seed);
+
+	/* Pass information */
+	afl_pass_info.pass = make_afl_pass(inst_ext, g);
+	afl_pass_info.reference_pass_name = "ssa";
+	afl_pass_info.ref_pass_instance_number = 1;
+	afl_pass_info.pos_op = PASS_POS_INSERT_AFTER;
+
+	if (!plugin_default_version_check(version, &gcc_version)) {
+		FATAL(G_("Incompatible gcc/plugin versions!"));
+	}
+
+	/* Show a banner */
+	if (isatty(2) && !getenv("AFL_QUIET")) {
+		SAYF(G_(cCYA "afl-gcc-pass" cRST " initial version 1.94 by <aseipp@pobox.com>, updated to " cBRI VERSION cRST " by <thorsten.schulz@uni-rostock.de>\n"));
+	} else
+		be_quiet = 1;
+
+	/* Decide instrumentation ratio */
+	char* inst_ratio_str = getenv("AFL_INST_RATIO");
+
+	if (inst_ratio_str) {
+		if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || !inst_ratio || inst_ratio > 100)
+			FATAL(G_("Bad value of AFL_INST_RATIO (must be between 1 and 100)"));
+		else {
+			if (!be_quiet)
+				ACTF(G_("%s instrumentation at ratio of %u%% in %s mode."),
+					inst_ext ? G_("Call-based") : G_("Inline"),
+					inst_ratio,
+					getenv("AFL_HARDEN") ? G_("hardened") : G_("non-hardened"));
+		}
+	}
+
+	/* Go go gadget */
+	register_callback(plugin_info->base_name, PLUGIN_INFO, NULL, &afl_plugin_info);
+	register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &afl_pass_info);
+	return 0;
+}