From 706718ca2e7ef0becb32fc4548fadeb19a0f6212 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Tue, 18 Feb 2020 14:52:28 +0100 Subject: cmplog routines llvm pass --- llvm_mode/cmplog-routines-pass.cc | 325 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 325 insertions(+) create mode 100644 llvm_mode/cmplog-routines-pass.cc (limited to 'llvm_mode/cmplog-routines-pass.cc') diff --git a/llvm_mode/cmplog-routines-pass.cc b/llvm_mode/cmplog-routines-pass.cc new file mode 100644 index 00000000..309ea65e --- /dev/null +++ b/llvm_mode/cmplog-routines-pass.cc @@ -0,0 +1,325 @@ +/* + * Copyright 2016 laf-intel + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include +#include + +#include +#include +#include +#include +#include "llvm/Config/llvm-config.h" + +#include "llvm/ADT/Statistic.h" +#include "llvm/IR/IRBuilder.h" +#include "llvm/IR/LegacyPassManager.h" +#include "llvm/IR/Module.h" +#include "llvm/Support/Debug.h" +#include "llvm/Support/raw_ostream.h" +#include "llvm/Transforms/IPO/PassManagerBuilder.h" +#include "llvm/Transforms/Utils/BasicBlockUtils.h" +#include "llvm/Pass.h" +#include "llvm/Analysis/ValueTracking.h" + +#if LLVM_VERSION_MAJOR > 3 || \ + (LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR > 4) +#include "llvm/IR/Verifier.h" +#include "llvm/IR/DebugInfo.h" +#else +#include "llvm/Analysis/Verifier.h" +#include "llvm/DebugInfo.h" +#define nullptr 0 +#endif + +#include + +using namespace llvm; + +namespace { + +class CmpLogRoutines : public ModulePass { + + public: + static char ID; + CmpLogRoutines() : ModulePass(ID) { + + char *instWhiteListFilename = getenv("AFL_LLVM_WHITELIST"); + if (instWhiteListFilename) { + + std::string line; + std::ifstream fileStream; + fileStream.open(instWhiteListFilename); + if (!fileStream) report_fatal_error("Unable to open AFL_LLVM_WHITELIST"); + getline(fileStream, line); + while (fileStream) { + + myWhitelist.push_back(line); + getline(fileStream, line); + + } + + } + + } + + bool runOnModule(Module &M) override; + +#if LLVM_VERSION_MAJOR < 4 + const char *getPassName() const override { + +#else + StringRef getPassName() const override { + +#endif + return "cmplog routines"; + + } + + protected: + std::list myWhitelist; + + private: + bool hookRtns(Module &M); + +}; + +} // namespace + +char CmpLogRoutines::ID = 0; + +bool CmpLogRoutines::hookRtns(Module &M) { + + std::vector calls; + LLVMContext & C = M.getContext(); + + Type * VoidTy = Type::getVoidTy(C); + PointerType * VoidPtrTy = PointerType::get(VoidTy, 0); + +#if LLVM_VERSION_MAJOR < 9 + Constant * +#else + FunctionCallee +#endif + c = M.getOrInsertFunction("__cmplog_rtn_hook", VoidTy, VoidPtrTy, VoidPtrTy +#if LLVM_VERSION_MAJOR < 5 + , + NULL +#endif + ); +#if LLVM_VERSION_MAJOR < 9 + Function *cmplogHookFn = cast(c); +#else + FunctionCallee cmplogHookFn = c; +#endif + + /* iterate over all functions, bbs and instruction and add suitable calls */ + for (auto &F : M) { + + for (auto &BB : F) { + + if (!myWhitelist.empty()) { + + BasicBlock::iterator IP = BB.getFirstInsertionPt(); + + bool instrumentBlock = false; + + /* Get the current location using debug information. + * For now, just instrument the block if we are not able + * to determine our location. */ + DebugLoc Loc = IP->getDebugLoc(); +#if LLVM_VERSION_MAJOR >= 4 || \ + (LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR >= 7) + if (Loc) { + + DILocation *cDILoc = dyn_cast(Loc.getAsMDNode()); + + unsigned int instLine = cDILoc->getLine(); + StringRef instFilename = cDILoc->getFilename(); + + if (instFilename.str().empty()) { + + /* If the original location is empty, try using the inlined location + */ + DILocation *oDILoc = cDILoc->getInlinedAt(); + if (oDILoc) { + + instFilename = oDILoc->getFilename(); + instLine = oDILoc->getLine(); + + } + + } + + (void)instLine; + + /* Continue only if we know where we actually are */ + if (!instFilename.str().empty()) { + + for (std::list::iterator it = myWhitelist.begin(); + it != myWhitelist.end(); ++it) { + + /* We don't check for filename equality here because + * filenames might actually be full paths. Instead we + * check that the actual filename ends in the filename + * specified in the list. */ + if (instFilename.str().length() >= it->length()) { + + if (instFilename.str().compare( + instFilename.str().length() - it->length(), + it->length(), *it) == 0) { + + instrumentBlock = true; + break; + + } + + } + + } + + } + + } + +#else + if (!Loc.isUnknown()) { + + DILocation cDILoc(Loc.getAsMDNode(C)); + + unsigned int instLine = cDILoc.getLineNumber(); + StringRef instFilename = cDILoc.getFilename(); + + (void)instLine; + + /* Continue only if we know where we actually are */ + if (!instFilename.str().empty()) { + + for (std::list::iterator it = myWhitelist.begin(); + it != myWhitelist.end(); ++it) { + + /* We don't check for filename equality here because + * filenames might actually be full paths. Instead we + * check that the actual filename ends in the filename + * specified in the list. */ + if (instFilename.str().length() >= it->length()) { + + if (instFilename.str().compare( + instFilename.str().length() - it->length(), + it->length(), *it) == 0) { + + instrumentBlock = true; + break; + + } + + } + + } + + } + + } + +#endif + + /* Either we couldn't figure out our location or the location is + * not whitelisted, so we skip instrumentation. */ + if (!instrumentBlock) continue; + + } + + for (auto &IN : BB) { + + CallInst *callInst = nullptr; + + if ((callInst = dyn_cast(&IN))) { + + Function *Callee = callInst->getCalledFunction(); + if (!Callee) continue; + if (callInst->getCallingConv() != llvm::CallingConv::C) continue; + + FunctionType *FT = Callee->getFunctionType(); + + bool isPtrRtn = + FT->getNumParams() >= 2 && !FT->getReturnType()->isVoidTy() && + FT->getParamType(0) == FT->getParamType(1) && + FT->getParamType(0)->isPointerTy(); + + if (!isPtrRtn) + continue; + + calls.push_back(callInst); + + } + + } + + } + + } + + if (!calls.size()) return false; + errs() << "Hooking " << calls.size() << " calls with pointers as arguments\n"; + + for (auto &callInst : calls) { + + Value *v1P = callInst->getArgOperand(0), + *v2P = callInst->getArgOperand(1); + + BasicBlock *bb = callInst->getParent(); + BasicBlock::iterator IP = bb->getFirstInsertionPt(); + IRBuilder<> IRB(&*IP); + + std::vector args; + args.push_back(v1P); + args.push_back(v2P); + + IRB.CreateCall(cmplogHookFn, args, "tmp"); + + errs() << callInst->getCalledFunction()->getName() << "\n"; + + } + + return true; + +} + +bool CmpLogRoutines::runOnModule(Module &M) { + + if (getenv("AFL_QUIET") == NULL) + llvm::errs() << "Running cmplog-routines-pass by andreafioraldi@gmail.com\n"; + hookRtns(M); + verifyModule(M); + + return true; + +} + +static void registerCmpLogRoutinesPass(const PassManagerBuilder &, + legacy::PassManagerBase &PM) { + + auto p = new CmpLogRoutines(); + PM.add(p); + +} + +static RegisterStandardPasses RegisterCmpLogRoutinesPass( + PassManagerBuilder::EP_OptimizerLast, registerCmpLogRoutinesPass); + +static RegisterStandardPasses RegisterCmpLogRoutinesPass0( + PassManagerBuilder::EP_EnabledOnOptLevel0, registerCmpLogRoutinesPass); + -- cgit 1.4.1 From a83691d6626a4a3b4881534d5680153a5df2e951 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Tue, 18 Feb 2020 15:27:35 +0100 Subject: fix insertion of __cmplog_rtn_hook --- llvm_mode/afl-clang-fast.c | 2 ++ llvm_mode/cmplog-routines-pass.cc | 7 +++---- 2 files changed, 5 insertions(+), 4 deletions(-) (limited to 'llvm_mode/cmplog-routines-pass.cc') diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index d9e2cd95..6e277c7e 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -208,6 +208,8 @@ static void edit_params(u32 argc, char** argv) { cc_params[cc_par_cnt++] = "-Xclang"; cc_params[cc_par_cnt++] = alloc_printf("%s/cmplog-routines-pass.so", obj_path); + + cc_params[cc_par_cnt++] = "-fno-inline"; } else { diff --git a/llvm_mode/cmplog-routines-pass.cc b/llvm_mode/cmplog-routines-pass.cc index 309ea65e..7e3acae2 100644 --- a/llvm_mode/cmplog-routines-pass.cc +++ b/llvm_mode/cmplog-routines-pass.cc @@ -280,9 +280,8 @@ bool CmpLogRoutines::hookRtns(Module &M) { Value *v1P = callInst->getArgOperand(0), *v2P = callInst->getArgOperand(1); - BasicBlock *bb = callInst->getParent(); - BasicBlock::iterator IP = bb->getFirstInsertionPt(); - IRBuilder<> IRB(&*IP); + IRBuilder<> IRB(callInst->getParent()); + IRB.SetInsertPoint(callInst); std::vector args; args.push_back(v1P); @@ -290,7 +289,7 @@ bool CmpLogRoutines::hookRtns(Module &M) { IRB.CreateCall(cmplogHookFn, args, "tmp"); - errs() << callInst->getCalledFunction()->getName() << "\n"; + // errs() << callInst->getCalledFunction()->getName() << "\n"; } -- cgit 1.4.1 From 2a549d548a8f277a25a115694485f051f7e586b5 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Tue, 18 Feb 2020 17:45:57 +0100 Subject: fuzzer wotking with rtn cmplog --- llvm_mode/afl-llvm-cmplog-rt.o.c | 6 +++ llvm_mode/cmplog-routines-pass.cc | 29 ++++++++------- src/afl-fuzz-redqueen.c | 77 ++++++++++++++++++++++++--------------- 3 files changed, 69 insertions(+), 43 deletions(-) (limited to 'llvm_mode/cmplog-routines-pass.cc') diff --git a/llvm_mode/afl-llvm-cmplog-rt.o.c b/llvm_mode/afl-llvm-cmplog-rt.o.c index 65d1d9d5..3d9cfca1 100644 --- a/llvm_mode/afl-llvm-cmplog-rt.o.c +++ b/llvm_mode/afl-llvm-cmplog-rt.o.c @@ -322,6 +322,8 @@ void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) { uintptr_t k = (uintptr_t)__builtin_return_address(0); k = (k >> 4) ^ (k << 8); k &= CMP_MAP_W - 1; + + __afl_cmp_map->headers[k].type = CMP_TYPE_INS; u32 hits = __afl_cmp_map->headers[k].hits; __afl_cmp_map->headers[k].hits = hits + 1; @@ -344,6 +346,8 @@ void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) { uintptr_t k = (uintptr_t)__builtin_return_address(0); k = (k >> 4) ^ (k << 8); k &= CMP_MAP_W - 1; + + __afl_cmp_map->headers[k].type = CMP_TYPE_INS; u32 hits = __afl_cmp_map->headers[k].hits; __afl_cmp_map->headers[k].hits = hits + 1; @@ -363,6 +367,8 @@ void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) { uintptr_t k = (uintptr_t)__builtin_return_address(0); k = (k >> 4) ^ (k << 8); k &= CMP_MAP_W - 1; + + __afl_cmp_map->headers[k].type = CMP_TYPE_INS; u32 hits = __afl_cmp_map->headers[k].hits; __afl_cmp_map->headers[k].hits = hits + 1; diff --git a/llvm_mode/cmplog-routines-pass.cc b/llvm_mode/cmplog-routines-pass.cc index 7e3acae2..e7125f9f 100644 --- a/llvm_mode/cmplog-routines-pass.cc +++ b/llvm_mode/cmplog-routines-pass.cc @@ -1,18 +1,19 @@ /* - * Copyright 2016 laf-intel - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ + american fuzzy lop++ - LLVM CmpLog instrumentation + -------------------------------------------------- + + Written by Andrea Fioraldi + + Copyright 2015, 2016 Google Inc. All rights reserved. + Copyright 2019-2020 AFLplusplus Project. All rights reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at: + + http://www.apache.org/licenses/LICENSE-2.0 + +*/ #include #include diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c index f070c196..b09a977f 100644 --- a/src/afl-fuzz-redqueen.c +++ b/src/afl-fuzz-redqueen.c @@ -207,7 +207,7 @@ checksum_fail: ///// Input to State replacement -u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) { +u8 its_fuzz(u8* buf, u32 len, u8* status) { u64 orig_hit_cnt, new_hit_cnt; @@ -217,18 +217,11 @@ u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) { new_hit_cnt = queued_paths + unique_crashes; - if (unlikely(new_hit_cnt != orig_hit_cnt)) { - + if (unlikely(new_hit_cnt != orig_hit_cnt)) *status = 1; - - } else { - - if (size >= MIN_AUTO_EXTRA && size <= MAX_AUTO_EXTRA) - maybe_add_auto(&buf[idx], size); + else *status = 2; - } - return 0; } @@ -254,7 +247,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, if (its_len >= 8 && *buf_64 == pattern && *o_buf_64 == pattern) { *buf_64 = repl; - if (unlikely(its_fuzz(idx, 8, buf, len, status))) return 1; + if (unlikely(its_fuzz(buf, len, status))) return 1; *buf_64 = pattern; } @@ -272,7 +265,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, if (its_len >= 4 && *buf_32 == (u32)pattern && *o_buf_32 == (u32)pattern) { *buf_32 = (u32)repl; - if (unlikely(its_fuzz(idx, 4, buf, len, status))) return 1; + if (unlikely(its_fuzz(buf, len, status))) return 1; *buf_32 = pattern; } @@ -290,7 +283,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, if (its_len >= 2 && *buf_16 == (u16)pattern && *o_buf_16 == (u16)pattern) { *buf_16 = (u16)repl; - if (unlikely(its_fuzz(idx, 2, buf, len, status))) return 1; + if (unlikely(its_fuzz(buf, len, status))) return 1; *buf_16 = (u16)pattern; } @@ -308,7 +301,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, if (its_len >= 2 && *buf_8 == (u8)pattern && *o_buf_8 == (u8)pattern) { *buf_8 = (u8)repl; - if (unlikely(its_fuzz(idx, 1, buf, len, status))) + if (unlikely(its_fuzz(buf, len, status))) return 1; *buf_16 = (u16)pattern; @@ -423,7 +416,26 @@ u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { u8 rtn_extend_encoding(struct cmp_header* h, u8* pattern, u8* repl, u32 idx, u8* orig_buf, u8* buf, u32 len, u8* status) { - *status = 2; + u32 i; + u32 its_len = MIN(32, len - idx); + + u8 save[32]; + memcpy(save, &buf[idx], its_len); + + *status = 0; + + for (i = 0; i < its_len; ++i) { + + if (pattern[idx + i] != orig_buf[idx + i] || *status == 1) + break; + + buf[idx +i] = repl[idx + i]; + if (unlikely(its_fuzz(buf, len, status))) return 1; + + } + + memcpy(&buf[idx], save, i); + return 0; } @@ -444,9 +456,9 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { struct cmpfn_operands* o = &((struct cmpfn_operands*)cmp_map->log[key])[i]; // opt not in the paper - //for (j = 0; j < i; ++j) - // if (cmp_map->log[key][j].v0 == o->v0 && cmp_map->log[key][i].v1 == o->v1) - // goto cmp_fuzz_next_iter; + for (j = 0; j < i; ++j) + if (!memcmp(&((struct cmpfn_operands*)cmp_map->log[key])[j], o, sizeof(struct cmpfn_operands))) + goto rtn_fuzz_next_iter; for (idx = 0; idx < len && fails < 8; ++idx) { @@ -476,7 +488,7 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { } - cmp_fuzz_next_iter: + rtn_fuzz_next_iter: stage_cur++; } @@ -491,6 +503,7 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len, u32 exec_cksum) { + u8 r = 1; its_argv = argv; if (unlikely(colorization(buf, len, exec_cksum))) return 1; @@ -513,31 +526,37 @@ u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len, for (k = 0; k < CMP_MAP_W; ++k) { if (!cmp_map->headers[k].hits) continue; - if (cmp_map->headers[k].hits > CMP_MAP_H) - stage_max += CMP_MAP_H; + if (cmp_map->headers[k].type == CMP_TYPE_INS) + stage_max += MIN(cmp_map->headers[k].hits, CMP_MAP_H); else - stage_max += cmp_map->headers[k].hits; + stage_max += MIN(cmp_map->headers[k].hits, CMP_MAP_RTN_H); } - + for (k = 0; k < CMP_MAP_W; ++k) { if (!cmp_map->headers[k].hits) continue; - if (cmp_map->headers[k].type == CMP_TYPE_INS) - cmp_fuzz(k, orig_buf, buf, len); - else - rtn_fuzz(k, orig_buf, buf, len); + if (cmp_map->headers[k].type == CMP_TYPE_INS) { + if (unlikely(cmp_fuzz(k, orig_buf, buf, len))) + goto exit_its; + } else { + if (unlikely(rtn_fuzz(k, orig_buf, buf, len))) + goto exit_its; + } } - memcpy(orig_buf, buf, len); + r = 0; +exit_its: + memcpy(orig_buf, buf, len); + new_hit_cnt = queued_paths + unique_crashes; stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt; stage_cycles[STAGE_ITS] += total_execs - orig_execs; - return 0; + return r; } -- cgit 1.4.1