From 7b6d51a9d0775466ac3de6156180062edd1e3d9d Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Fri, 19 Jul 2019 17:47:53 +0200 Subject: libcompcov for QEMU --- qemu_mode/libcompcov/libcompcov.so.c | 307 +++++++++++++++++++++++++++++++++++ 1 file changed, 307 insertions(+) create mode 100644 qemu_mode/libcompcov/libcompcov.so.c (limited to 'qemu_mode/libcompcov/libcompcov.so.c') diff --git a/qemu_mode/libcompcov/libcompcov.so.c b/qemu_mode/libcompcov/libcompcov.so.c new file mode 100644 index 00000000..3f6a1d0e --- /dev/null +++ b/qemu_mode/libcompcov/libcompcov.so.c @@ -0,0 +1,307 @@ +/* + + american fuzzy lop++ - strcmp() / memcmp() CompareCoverage library + ------------------------------------------------------------------ + + Written and maintained by Andrea Fioraldi + + Copyright 2019 Andrea Fioraldi. All rights reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at: + + http://www.apache.org/licenses/LICENSE-2.0 + + This Linux-only companion library allows you to instrument strcmp(), + memcmp(), and related functions to get compare coverage. + See README.compcov for more info. + + */ + +#include +#include +#include +#include +#include + +#include "../../types.h" +#include "../../config.h" + +#include "pmparser.h" + +#ifndef __linux__ +# error "Sorry, this library is Linux-specific for now!" +#endif /* !__linux__ */ + +/* Change this value to tune the compare coverage */ + +#define MAX_CMP_LENGTH 32 + +static u8 __compcov_loaded; + +static void *__compcov_code_start, + *__compcov_code_end; + +static u8 *__compcov_afl_map; + + +static size_t __strlen2(const char *s1, const char *s2, size_t max_length) { + // from https://github.com/googleprojectzero/CompareCoverage + + size_t len = 0; + for (; len < max_length && s1[len] != '\0' && s2[len] != '\0'; len++) { } + return len; +} + +/* Identify the binary boundaries in the memory mapping */ + +static void __compcov_load(void) { + + __compcov_loaded = 1; + + char *id_str = getenv(SHM_ENV_VAR); + int shm_id; + + if (id_str) { + + shm_id = atoi(id_str); + __compcov_afl_map = shmat(shm_id, NULL, 0); + + if (__compcov_afl_map == (void*)-1) exit(1); + } else { + + __compcov_afl_map = calloc(1, MAP_SIZE); + } + + if (getenv("AFL_INST_LIBS")) { + + __compcov_code_start = (void*)0; + __compcov_code_end = (void*)-1; + return; + } + + char* bin_name = getenv("AFL_COMPCOV_BINNAME"); + + procmaps_iterator* maps = pmparser_parse(-1); + procmaps_struct* maps_tmp = NULL; + + while ((maps_tmp = pmparser_next(maps)) != NULL) { + + /* If AFL_COMPCOV_BINNAME is not set pick the first executable segment */ + if (!bin_name || strstr(maps_tmp->pathname, bin_name) != NULL) { + + if (maps_tmp->is_x) { + if (!__compcov_code_start) + __compcov_code_start = maps_tmp->addr_start; + if (!__compcov_code_end) + __compcov_code_end = maps_tmp->addr_end; + } + } + } + + pmparser_free(maps); +} + + +static void __compcov_trace(u64 cur_loc, const u8* v0, const u8* v1, size_t n) { + + size_t i; + + for (i = 0; i < n && v0[i] == v1[i]; ++i) { + + __compcov_afl_map[cur_loc +i]++; + } +} + +/* Check an address against the list of read-only mappings. */ + +static u8 __compcov_is_in_bound(const void* ptr) { + + return ptr >= __compcov_code_start && ptr < __compcov_code_end; +} + + +/* Replacements for strcmp(), memcmp(), and so on. Note that these will be used + only if the target is compiled with -fno-builtins and linked dynamically. */ + +#undef strcmp + +int strcmp(const char* str1, const char* str2) { + + void* retaddr = __builtin_return_address(0); + + if (__compcov_is_in_bound(retaddr)) { + + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); + + if (n <= MAX_CMP_LENGTH) { + + u64 cur_loc = (u64)retaddr; + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 1; + + __compcov_trace(cur_loc, str1, str2, n); + } + } + + while (1) { + + unsigned char c1 = *str1, c2 = *str2; + + if (c1 != c2) return (c1 > c2) ? 1 : -1; + if (!c1) return 0; + str1++; str2++; + + } + +} + + +#undef strncmp + +int strncmp(const char* str1, const char* str2, size_t len) { + + void* retaddr = __builtin_return_address(0); + + if (__compcov_is_in_bound(retaddr)) { + + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); + n = MIN(n, len); + + if (n <= MAX_CMP_LENGTH) { + + u64 cur_loc = (u64)retaddr; + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 1; + + __compcov_trace(cur_loc, str1, str2, n); + } + } + + while (len--) { + + unsigned char c1 = *str1, c2 = *str2; + + if (!c1) return 0; + if (c1 != c2) return (c1 > c2) ? 1 : -1; + str1++; str2++; + + } + + return 0; + +} + + +#undef strcasecmp + +int strcasecmp(const char* str1, const char* str2) { + + void* retaddr = __builtin_return_address(0); + + if (__compcov_is_in_bound(retaddr)) { + /* Fallback to strcmp, maybe improve in future */ + + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); + + if (n <= MAX_CMP_LENGTH) { + + u64 cur_loc = (u64)retaddr; + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 1; + + __compcov_trace(cur_loc, str1, str2, n); + } + } + + while (1) { + + unsigned char c1 = tolower(*str1), c2 = tolower(*str2); + + if (c1 != c2) return (c1 > c2) ? 1 : -1; + if (!c1) return 0; + str1++; str2++; + + } + +} + + +#undef strncasecmp + +int strncasecmp(const char* str1, const char* str2, size_t len) { + + void* retaddr = __builtin_return_address(0); + + if (__compcov_is_in_bound(retaddr)) { + /* Fallback to strncmp, maybe improve in future */ + + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); + n = MIN(n, len); + + if (n <= MAX_CMP_LENGTH) { + + u64 cur_loc = (u64)retaddr; + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 1; + + __compcov_trace(cur_loc, str1, str2, n); + } + } + + while (len--) { + + unsigned char c1 = tolower(*str1), c2 = tolower(*str2); + + if (!c1) return 0; + if (c1 != c2) return (c1 > c2) ? 1 : -1; + str1++; str2++; + + } + + return 0; + +} + + +#undef memcmp + +int memcmp(const void* mem1, const void* mem2, size_t len) { + + void* retaddr = __builtin_return_address(0); + + if (__compcov_is_in_bound(retaddr)) { + + size_t n = len; + + if (n <= MAX_CMP_LENGTH) { + + u64 cur_loc = (u64)retaddr; + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 1; + + __compcov_trace(cur_loc, mem1, mem2, n); + } + } + + while (len--) { + + unsigned char c1 = *(const char*)mem1, c2 = *(const char*)mem2; + if (c1 != c2) return (c1 > c2) ? 1 : -1; + mem1++; mem2++; + + } + + return 0; + +} + +/* Init code to open init the library. */ + +__attribute__((constructor)) void __compcov_init(void) { + + __compcov_load(); +} + + -- cgit 1.4.1 From c7887abb64669573cf4b3fba6d438eb7ebcfc1fc Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sat, 20 Jul 2019 13:12:19 +0200 Subject: added test and debug --- qemu_mode/libcompcov/Makefile | 7 ++-- qemu_mode/libcompcov/compcovtest.cc | 63 ++++++++++++++++++++++++++++++++++++ qemu_mode/libcompcov/libcompcov.so.c | 11 +++++++ 3 files changed, 79 insertions(+), 2 deletions(-) create mode 100644 qemu_mode/libcompcov/compcovtest.cc (limited to 'qemu_mode/libcompcov/libcompcov.so.c') diff --git a/qemu_mode/libcompcov/Makefile b/qemu_mode/libcompcov/Makefile index 02266bd2..2336ec59 100644 --- a/qemu_mode/libcompcov/Makefile +++ b/qemu_mode/libcompcov/Makefile @@ -21,7 +21,7 @@ VERSION = $(shell grep '^\#define VERSION ' ../config.h | cut -d '"' -f2) CFLAGS ?= -O3 -funroll-loops CFLAGS += -Wall -Wno-unused-result -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -all: libcompcov.so +all: libcompcov.so compcovtest libcompcov.so: libcompcov.so.c ../../config.h $(CC) $(CFLAGS) -shared -fPIC $< -o $@ $(LDFLAGS) @@ -30,7 +30,10 @@ libcompcov.so: libcompcov.so.c ../../config.h clean: rm -f *.o *.so *~ a.out core core.[1-9][0-9]* - rm -f libcompcov.so + rm -f libcompcov.so compcovtest + +compcovtest: compcovtest.cc + $(CXX) $< -o $@ install: all install -m 755 libcompcov.so $${DESTDIR}$(HELPER_PATH) diff --git a/qemu_mode/libcompcov/compcovtest.cc b/qemu_mode/libcompcov/compcovtest.cc new file mode 100644 index 00000000..fd1fda00 --- /dev/null +++ b/qemu_mode/libcompcov/compcovtest.cc @@ -0,0 +1,63 @@ +///////////////////////////////////////////////////////////////////////// +// +// Author: Mateusz Jurczyk (mjurczyk@google.com) +// +// Copyright 2019 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// + +// solution: echo -ne 'The quick brown fox jumps over the lazy dog\xbe\xba\xfe\xca\xbe\xba\xfe\xca\xde\xc0\xad\xde\xef\xbe' | ./compcovtest + +#include +#include +#include +#include + +int main() { + char buffer[44] = { /* zero padding */ }; + fread(buffer, 1, sizeof(buffer) - 1, stdin); + + if (memcmp(&buffer[0], "The quick brown fox ", 20) != 0 || + strncmp(&buffer[20], "jumps over ", 11) != 0 || + strcmp(&buffer[31], "the lazy dog") != 0) { + return 1; + } + + uint64_t x = 0; + fread(&x, sizeof(x), 1, stdin); + if (x != 0xCAFEBABECAFEBABE) { + return 2; + } + + uint32_t y = 0; + fread(&y, sizeof(y), 1, stdin); + if (y != 0xDEADC0DE) { + return 3; + } + + uint16_t z = 0; + fread(&z, sizeof(z), 1, stdin); + + switch (z) { + case 0xBEEF: + break; + + default: + return 4; + } + + printf("Puzzle solved, congrats!\n"); + abort(); + return 0; +} diff --git a/qemu_mode/libcompcov/libcompcov.so.c b/qemu_mode/libcompcov/libcompcov.so.c index 3f6a1d0e..52143c1f 100644 --- a/qemu_mode/libcompcov/libcompcov.so.c +++ b/qemu_mode/libcompcov/libcompcov.so.c @@ -45,6 +45,8 @@ static void *__compcov_code_start, static u8 *__compcov_afl_map; +static int debug_fd = -1; + static size_t __strlen2(const char *s1, const char *s2, size_t max_length) { // from https://github.com/googleprojectzero/CompareCoverage @@ -108,6 +110,12 @@ static void __compcov_trace(u64 cur_loc, const u8* v0, const u8* v1, size_t n) { size_t i; + if (debug_fd != 1) { + char debugbuf[4096]; + snprintf(debugbuf, sizeof(debugbuf), "0x%llx %s %s %lu\n", cur_loc, v0 == NULL ? "(null)" : (char*)v0, v1 == NULL ? "(null)" : (char*)v1, n); + write(debug_fd, debugbuf, strlen(debugbuf)); + } + for (i = 0; i < n && v0[i] == v1[i]; ++i) { __compcov_afl_map[cur_loc +i]++; @@ -301,6 +309,9 @@ int memcmp(const void* mem1, const void* mem2, size_t len) { __attribute__((constructor)) void __compcov_init(void) { + if (getenv("AFL_QEMU_COMPCOV_DEBUG") != NULL) + debug_fd = open("compcov.debug", O_WRONLY | O_CREAT | O_TRUNC | O_SYNC, 0644); + __compcov_load(); } -- cgit 1.4.1 From 253056b932c0ee8d53b47e6c4dd1239a5d8da1a0 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sat, 20 Jul 2019 14:08:45 +0200 Subject: more speed to libcompcov using real libc functions --- qemu_mode/libcompcov/Makefile | 1 + qemu_mode/libcompcov/libcompcov.so.c | 77 +++++++++--------------------------- 2 files changed, 20 insertions(+), 58 deletions(-) (limited to 'qemu_mode/libcompcov/libcompcov.so.c') diff --git a/qemu_mode/libcompcov/Makefile b/qemu_mode/libcompcov/Makefile index 02266bd2..5f4a33c6 100644 --- a/qemu_mode/libcompcov/Makefile +++ b/qemu_mode/libcompcov/Makefile @@ -20,6 +20,7 @@ VERSION = $(shell grep '^\#define VERSION ' ../config.h | cut -d '"' -f2) CFLAGS ?= -O3 -funroll-loops CFLAGS += -Wall -Wno-unused-result -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign +LDFLAGS += -ldl all: libcompcov.so diff --git a/qemu_mode/libcompcov/libcompcov.so.c b/qemu_mode/libcompcov/libcompcov.so.c index 3f6a1d0e..19eb821e 100644 --- a/qemu_mode/libcompcov/libcompcov.so.c +++ b/qemu_mode/libcompcov/libcompcov.so.c @@ -19,6 +19,8 @@ */ +#define _GNU_SOURCE +#include #include #include #include @@ -38,13 +40,17 @@ #define MAX_CMP_LENGTH 32 -static u8 __compcov_loaded; - static void *__compcov_code_start, *__compcov_code_end; static u8 *__compcov_afl_map; +static int (*__libc_strcmp)(const char*, const char*); +static int (*__libc_strncmp)(const char*, const char*, size_t); +static int (*__libc_strcasecmp)(const char*, const char*); +static int (*__libc_strncasecmp)(const char*, const char*, size_t); +static int (*__libc_memcmp)(const void*, const void*, size_t); + static size_t __strlen2(const char *s1, const char *s2, size_t max_length) { // from https://github.com/googleprojectzero/CompareCoverage @@ -57,8 +63,12 @@ static size_t __strlen2(const char *s1, const char *s2, size_t max_length) { /* Identify the binary boundaries in the memory mapping */ static void __compcov_load(void) { - - __compcov_loaded = 1; + + __libc_strcmp = dlsym(RTLD_NEXT, "strcmp"); + __libc_strncmp = dlsym(RTLD_NEXT, "strncmp"); + __libc_strcasecmp = dlsym(RTLD_NEXT, "strcasecmp"); + __libc_strncasecmp = dlsym(RTLD_NEXT, "strncasecmp"); + __libc_memcmp = dlsym(RTLD_NEXT, "memcmp"); char *id_str = getenv(SHM_ENV_VAR); int shm_id; @@ -145,16 +155,7 @@ int strcmp(const char* str1, const char* str2) { } } - while (1) { - - unsigned char c1 = *str1, c2 = *str2; - - if (c1 != c2) return (c1 > c2) ? 1 : -1; - if (!c1) return 0; - str1++; str2++; - - } - + return __libc_strcmp(str1, str2); } @@ -179,18 +180,7 @@ int strncmp(const char* str1, const char* str2, size_t len) { } } - while (len--) { - - unsigned char c1 = *str1, c2 = *str2; - - if (!c1) return 0; - if (c1 != c2) return (c1 > c2) ? 1 : -1; - str1++; str2++; - - } - - return 0; - + return __libc_strncmp(str1, str2, len); } @@ -215,16 +205,7 @@ int strcasecmp(const char* str1, const char* str2) { } } - while (1) { - - unsigned char c1 = tolower(*str1), c2 = tolower(*str2); - - if (c1 != c2) return (c1 > c2) ? 1 : -1; - if (!c1) return 0; - str1++; str2++; - - } - + return __libc_strcasecmp(str1, str2); } @@ -250,18 +231,7 @@ int strncasecmp(const char* str1, const char* str2, size_t len) { } } - while (len--) { - - unsigned char c1 = tolower(*str1), c2 = tolower(*str2); - - if (!c1) return 0; - if (c1 != c2) return (c1 > c2) ? 1 : -1; - str1++; str2++; - - } - - return 0; - + return __libc_strncasecmp(str1, str2, len); } @@ -285,16 +255,7 @@ int memcmp(const void* mem1, const void* mem2, size_t len) { } } - while (len--) { - - unsigned char c1 = *(const char*)mem1, c2 = *(const char*)mem2; - if (c1 != c2) return (c1 > c2) ? 1 : -1; - mem1++; mem2++; - - } - - return 0; - + return __libc_memcmp(mem1, mem2, len); } /* Init code to open init the library. */ -- cgit 1.4.1