From d16585ec1f91e8c1a24856fc2007991ddacb956f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20=C3=96sterlund?= Date: Tue, 14 Jul 2020 15:35:13 +0200 Subject: [PATCH] Initial commit --- BUILD_TARGET.md | 77 + Cargo.lock | 783 +++ Cargo.toml | 8 + Dockerfile | 31 + LICENSE | 201 + README.md | 105 +- angora.env | 2 + build/build.sh | 38 + build/build_diff_tool.sh | 2 + build/install_llvm.sh | 19 + build/install_pin_mode.sh | 12 + build/install_rust.sh | 18 + build/install_tools.sh | 12 + common/Cargo.toml | 11 + common/src/cond_stmt_base.rs | 83 + common/src/config.rs | 45 + common/src/defs.rs | 105 + common/src/lib.rs | 14 + common/src/log_data.rs | 20 + common/src/shm.rs | 113 + common/src/tag.rs | 19 + docs/build_target.md | 127 + docs/configuration.md | 6 + docs/coverage.md | 31 + docs/environment_variables.md | 18 + docs/example.md | 109 + docs/exploitation.md | 13 + docs/lava-who-fix.md | 86 + docs/lava.md | 108 + docs/overview.md | 43 + docs/pin_mode.md | 35 + docs/running.md | 35 + docs/troubleshoot.md | 22 + docs/ui.md | 74 + docs/usage.md | 30 + fuzzer/Cargo.toml | 39 + fuzzer/src/bin/fuzzer.rs | 119 + fuzzer/src/bin/parse_track_file.rs | 50 + fuzzer/src/bin/speed_test.rs | 46 + fuzzer/src/bind_cpu.rs | 105 + fuzzer/src/branches.rs | 237 + fuzzer/src/check_dep.rs | 89 + fuzzer/src/command.rs | 215 + fuzzer/src/cond_stmt/cond_state.rs | 135 + fuzzer/src/cond_stmt/cond_stmt.rs | 127 + fuzzer/src/cond_stmt/mod.rs | 11 + fuzzer/src/cond_stmt/output.rs | 186 + fuzzer/src/cond_stmt/shm_conds.rs | 72 + fuzzer/src/depot/depot.rs | 177 + fuzzer/src/depot/depot_dir.rs | 33 + fuzzer/src/depot/dump.rs | 45 + fuzzer/src/depot/file.rs | 39 + fuzzer/src/depot/mod.rs | 9 + fuzzer/src/depot/qpriority.rs | 87 + fuzzer/src/depot/sync.rs | 123 + fuzzer/src/directed.rs | 44 + fuzzer/src/dyncfg/cfg.rs | 311 + fuzzer/src/dyncfg/fparse.rs | 45 + fuzzer/src/dyncfg/fparser.rs | 75 + fuzzer/src/dyncfg/mod.rs | 10 + fuzzer/src/executor/executor.rs | 516 ++ fuzzer/src/executor/forksrv.rs | 179 + fuzzer/src/executor/limit.rs | 73 + fuzzer/src/executor/mod.rs | 8 + fuzzer/src/executor/pipe_fd.rs | 38 + fuzzer/src/executor/status_type.rs | 8 + fuzzer/src/fuzz_loop.rs | 149 + fuzzer/src/fuzz_main.rs | 272 + fuzzer/src/fuzz_type.rs | 29 + fuzzer/src/lib.rs | 38 + fuzzer/src/mut_input/mod.rs | 8 + fuzzer/src/mut_input/mut_input.rs | 233 + fuzzer/src/mut_input/offsets.rs | 208 + fuzzer/src/mut_input/rw.rs | 145 + fuzzer/src/mut_input/serialize.rs | 59 + fuzzer/src/search/Readme.md | 2 + fuzzer/src/search/afl.rs | 287 + fuzzer/src/search/cbh.rs | 47 + fuzzer/src/search/cmpfn.rs | 82 + fuzzer/src/search/det.rs | 29 + fuzzer/src/search/exploit.rs | 50 + fuzzer/src/search/gd.rs | 360 + fuzzer/src/search/grad.rs | 86 + fuzzer/src/search/handler.rs | 97 + fuzzer/src/search/interesting_val.rs | 79 + fuzzer/src/search/len.rs | 71 + fuzzer/src/search/mb.rs | 36 + fuzzer/src/search/method.rs | 17 + fuzzer/src/search/mod.rs | 47 + fuzzer/src/search/one_byte.rs | 48 + fuzzer/src/search/random.rs | 24 + fuzzer/src/stats/bunny.rs | 36 + fuzzer/src/stats/chart.rs | 184 + fuzzer/src/stats/entry.rs | 142 + fuzzer/src/stats/format.rs | 25 + fuzzer/src/stats/fuzz.rs | 79 + fuzzer/src/stats/local.rs | 50 + fuzzer/src/stats/mod.rs | 17 + fuzzer/src/stats/search.rs | 106 + fuzzer/src/stats/show.rs | 39 + fuzzer/src/stats/state.rs | 76 + fuzzer/src/tmpfs.rs | 45 + fuzzer/src/track/filter.rs | 119 + fuzzer/src/track/fparser.rs | 103 + fuzzer/src/track/load_pin_data.rs | 71 + fuzzer/src/track/mod.rs | 5 + llvm-diff-parmesan/CMakeLists.txt | 46 + llvm-diff-parmesan/DiffConsumer.cpp | 286 + llvm-diff-parmesan/DiffConsumer.h | 99 + llvm-diff-parmesan/DiffLog.cpp | 50 + llvm-diff-parmesan/DiffLog.h | 83 + llvm-diff-parmesan/DifferenceEngine.cpp | 747 ++ llvm-diff-parmesan/DifferenceEngine.h | 89 + llvm-diff-parmesan/build/CMakeCache.txt | 518 ++ .../CMakeFiles/3.16.5/CMakeASMCompiler.cmake | 18 + .../CMakeFiles/3.16.5/CMakeCCompiler.cmake | 76 + .../CMakeFiles/3.16.5/CMakeCXXCompiler.cmake | 88 + .../3.16.5/CMakeDetermineCompilerABI_C.bin | Bin 0 -> 16440 bytes .../3.16.5/CMakeDetermineCompilerABI_CXX.bin | Bin 0 -> 16456 bytes .../build/CMakeFiles/3.16.5/CMakeSystem.cmake | 15 + .../3.16.5/CompilerIdC/CMakeCCompilerId.c | 671 ++ .../build/CMakeFiles/3.16.5/CompilerIdC/a.out | Bin 0 -> 16600 bytes .../CompilerIdCXX/CMakeCXXCompilerId.cpp | 660 ++ .../CMakeFiles/3.16.5/CompilerIdCXX/a.out | Bin 0 -> 16608 bytes .../CMakeDirectoryInformation.cmake | 16 + .../build/CMakeFiles/CMakeRuleHashes.txt | 3 + .../build/CMakeFiles/Makefile.cmake | 148 + llvm-diff-parmesan/build/CMakeFiles/Makefile2 | 276 + .../build/CMakeFiles/TargetDirectories.txt | 29 + .../build/CMakeFiles/cmake.check_cache | 1 + .../intrinsics_gen.dir/DependInfo.cmake | 11 + .../CMakeFiles/intrinsics_gen.dir/build.make | 72 + .../intrinsics_gen.dir/cmake_clean.cmake | 5 + .../intrinsics_gen.dir/progress.make | 1 + .../llvm-diff-parmesan.dir/CXX.includecache | 142 + .../llvm-diff-parmesan.dir/DependInfo.cmake | 25 + .../llvm-diff-parmesan.dir/DiffConsumer.cpp.o | Bin 0 -> 465032 bytes .../llvm-diff-parmesan.dir/DiffLog.cpp.o | Bin 0 -> 35272 bytes .../DifferenceEngine.cpp.o | Bin 0 -> 641168 bytes .../llvm-diff-parmesan.dir/build.make | 155 + .../llvm-diff-parmesan.dir/cmake_clean.cmake | 13 + .../llvm-diff-parmesan.dir/depend.internal | 25 + .../llvm-diff-parmesan.dir/depend.make | 25 + .../llvm-diff-parmesan.dir/flags.make | 10 + .../llvm-diff-parmesan.dir/link.txt | 1 + .../llvm-diff-parmesan.dir/llvm-diff.cpp.o | Bin 0 -> 264136 bytes .../llvm-diff-parmesan.dir/progress.make | 6 + .../build/CMakeFiles/progress.marks | 1 + llvm-diff-parmesan/build/Makefile | 374 + llvm-diff-parmesan/build/cmake_install.cmake | 54 + .../CMakeDirectoryInformation.cmake | 16 + .../CollabFuzzIDAssignerConfig-noconfig.cmake | 20 + .../CollabFuzzIDAssignerConfig.cmake | 101 + .../CMakeFiles/progress.marks | 1 + .../build/id-assigner-pass/Makefile | 184 + .../id-assigner-pass/cmake_install.cmake | 65 + .../CMakeDirectoryInformation.cmake | 16 + .../include/CMakeFiles/progress.marks | 1 + .../build/id-assigner-pass/include/Makefile | 184 + .../include/cmake_install.cmake | 43 + .../CMakeDirectoryInformation.cmake | 16 + .../LLVMIDAssigner.dir/CXX.includecache | 56 + .../LLVMIDAssigner.dir/DependInfo.cmake | 26 + .../LLVMIDAssigner.dir/IDAssigner.cpp.o | Bin 0 -> 774448 bytes .../CMakeFiles/LLVMIDAssigner.dir/build.make | 109 + .../LLVMIDAssigner.dir/cmake_clean.cmake | 10 + .../LLVMIDAssigner.dir/depend.internal | 6 + .../CMakeFiles/LLVMIDAssigner.dir/depend.make | 6 + .../CMakeFiles/LLVMIDAssigner.dir/flags.make | 10 + .../CMakeFiles/LLVMIDAssigner.dir/link.txt | 1 + .../LLVMIDAssigner.dir/progress.make | 3 + .../DependInfo.cmake | 11 + .../build.make | 76 + .../cmake_clean.cmake | 8 + .../progress.make | 1 + .../DependInfo.cmake | 11 + .../install-LLVMIDAssigner.dir/build.make | 76 + .../cmake_clean.cmake | 8 + .../install-LLVMIDAssigner.dir/progress.make | 1 + .../src/CMakeFiles/progress.marks | 1 + .../id-assigner-pass/src/LLVMIDAssigner.so | Bin 0 -> 4582136 bytes .../build/id-assigner-pass/src/Makefile | 262 + .../id-assigner-pass/src/cmake_install.cmake | 49 + llvm-diff-parmesan/build/llvm-diff-parmesan | Bin 0 -> 2193160 bytes llvm-diff-parmesan/build/targets.json | 4 + .../id-assigner-pass/.clang-format | 2 + .../id-assigner-pass/.clang-tidy | 17 + .../id-assigner-pass/.gitignore | 17 + .../id-assigner-pass/CMakeLists.txt | 34 + .../id-assigner-pass/bitbucket-pipelines.yml | 24 + .../id-assigner-pass/include/CMakeLists.txt | 21 + .../include/collabfuzz/IDAssigner.h | 46 + .../id-assigner-pass/src/CMakeLists.txt | 11 + .../id-assigner-pass/src/IDAssigner.cpp | 287 + .../id-assigner-pass/test/CMakeLists.txt | 17 + .../id-assigner-pass/test/lit.cfg.in | 17 + .../id-assigner-pass/test/src/hello.ll | 106 + .../id-assigner-pass/test/src/hello_debug.ll | 145 + llvm-diff-parmesan/llvm-diff.cpp | 133 + llvm_mode/CMakeLists.txt | 26 + llvm_mode/compiler/CMakeLists.txt | 8 + llvm_mode/compiler/angora_clang.c | 461 ++ llvm_mode/dfsan_rt/CMakeLists.txt | 58 + llvm_mode/dfsan_rt/abilibstdc++.txt | 3850 +++++++++++ llvm_mode/dfsan_rt/build_lib.py | 101 + llvm_mode/dfsan_rt/cmake/AddCompilerRT.cmake | 548 ++ llvm_mode/dfsan_rt/cmake/BuiltinTests.cmake | 98 + .../dfsan_rt/cmake/CompilerRTCompile.cmake | 143 + .../cmake/CompilerRTDarwinUtils.cmake | 438 ++ llvm_mode/dfsan_rt/cmake/CompilerRTLink.cmake | 16 + .../dfsan_rt/cmake/CompilerRTUtils.cmake | 307 + .../dfsan_rt/cmake/HandleCompilerRT.cmake | 21 + llvm_mode/dfsan_rt/cmake/SanitizerUtils.cmake | 94 + llvm_mode/dfsan_rt/common_interface_defs.h | 189 + llvm_mode/dfsan_rt/dfsan/.clang-format | 1 + llvm_mode/dfsan_rt/dfsan/CMakeLists.txt | 60 + llvm_mode/dfsan_rt/dfsan/dfsan.cc | 251 + llvm_mode/dfsan_rt/dfsan/dfsan.cc.bak | 475 ++ llvm_mode/dfsan_rt/dfsan/dfsan.h | 67 + llvm_mode/dfsan_rt/dfsan/dfsan.syms.extra | 3 + llvm_mode/dfsan_rt/dfsan/dfsan_custom.cc | 1192 ++++ llvm_mode/dfsan_rt/dfsan/dfsan_flags.inc | 32 + .../dfsan_rt/dfsan/dfsan_interceptors.cc | 46 + llvm_mode/dfsan_rt/dfsan/dfsan_platform.h | 119 + llvm_mode/dfsan_rt/dfsan/done_abilist.txt | 369 + .../dfsan/libc_ubuntu1404_abilist.txt | 3433 ++++++++++ .../dfsan_rt/dfsan/scripts/build-libc-list.py | 96 + .../dfsan/scripts/check_custom_wrappers.sh | 54 + llvm_mode/dfsan_rt/dfsan_interface.h | 122 + llvm_mode/dfsan_rt/interception/.clang-format | 1 + .../dfsan_rt/interception/CMakeLists.txt | 23 + .../dfsan_rt/interception/interception.h | 263 + .../interception/interception_linux.cc | 37 + .../interception/interception_linux.h | 47 + .../dfsan_rt/interception/interception_mac.cc | 20 + .../dfsan_rt/interception/interception_mac.h | 28 + .../dfsan_rt/interception/interception_win.cc | 1000 +++ .../dfsan_rt/interception/interception_win.h | 84 + .../dfsan_rt/libclang_rt.dfsan-x86_64.a.syms | 44 + .../dfsan_rt/sanitizer_common/.clang-format | 1 + .../dfsan_rt/sanitizer_common/.clang-tidy | 12 + .../dfsan_rt/sanitizer_common/CMakeLists.txt | 189 + .../dfsan_rt/sanitizer_common/assembly.h | 169 + .../sanitizer_common/sanitizer_addrhashmap.h | 342 + .../sanitizer_common/sanitizer_allocator.cc | 224 + .../sanitizer_common/sanitizer_allocator.h | 57 + .../sanitizer_allocator_bytemap.h | 103 + .../sanitizer_allocator_combined.h | 212 + .../sanitizer_allocator_interface.h | 46 + .../sanitizer_allocator_internal.h | 68 + .../sanitizer_allocator_local_cache.h | 249 + .../sanitizer_allocator_primary32.h | 306 + .../sanitizer_allocator_primary64.h | 507 ++ .../sanitizer_allocator_secondary.h | 275 + .../sanitizer_allocator_size_class_map.h | 217 + .../sanitizer_allocator_stats.h | 107 + .../dfsan_rt/sanitizer_common/sanitizer_asm.h | 58 + .../sanitizer_common/sanitizer_atomic.h | 82 + .../sanitizer_common/sanitizer_atomic_clang.h | 100 + .../sanitizer_atomic_clang_other.h | 97 + .../sanitizer_atomic_clang_x86.h | 116 + .../sanitizer_common/sanitizer_atomic_msvc.h | 266 + .../sanitizer_common/sanitizer_bitvector.h | 351 + .../sanitizer_common/sanitizer_bvgraph.h | 165 + .../sanitizer_common/sanitizer_common.cc | 498 ++ .../sanitizer_common/sanitizer_common.h | 852 +++ .../sanitizer_common_interceptors.inc | 6077 +++++++++++++++++ .../sanitizer_common_interceptors_format.inc | 560 ++ .../sanitizer_common_interceptors_ioctl.inc | 604 ++ .../sanitizer_common_libcdep.cc | 179 + .../sanitizer_common_nolibc.cc | 32 + .../sanitizer_common_syscalls.inc | 2888 ++++++++ .../sanitizer_coverage_libcdep.cc | 1045 +++ .../sanitizer_coverage_mapping_libcdep.cc | 122 + .../sanitizer_deadlock_detector.h | 416 ++ .../sanitizer_deadlock_detector1.cc | 195 + .../sanitizer_deadlock_detector2.cc | 428 ++ .../sanitizer_deadlock_detector_interface.h | 93 + .../sanitizer_common/sanitizer_flag_parser.cc | 171 + .../sanitizer_common/sanitizer_flag_parser.h | 122 + .../sanitizer_common/sanitizer_flags.cc | 130 + .../sanitizer_common/sanitizer_flags.h | 62 + .../sanitizer_common/sanitizer_flags.inc | 229 + .../sanitizer_common/sanitizer_freebsd.h | 137 + .../sanitizer_interface_internal.h | 65 + .../sanitizer_internal_defs.h | 344 + .../sanitizer_common/sanitizer_lfstack.h | 73 + .../sanitizer_common/sanitizer_libc.cc | 293 + .../sanitizer_common/sanitizer_libc.h | 89 + .../sanitizer_common/sanitizer_libignore.cc | 102 + .../sanitizer_common/sanitizer_libignore.h | 83 + .../sanitizer_common/sanitizer_linux.cc | 1401 ++++ .../sanitizer_common/sanitizer_linux.h | 94 + .../sanitizer_linux_libcdep.cc | 556 ++ .../sanitizer_common/sanitizer_linux_mips64.S | 23 + .../sanitizer_common/sanitizer_linux_s390.cc | 191 + .../sanitizer_common/sanitizer_linux_x86_64.S | 25 + .../sanitizer_common/sanitizer_list.h | 156 + .../sanitizer_common/sanitizer_mac.cc | 798 +++ .../dfsan_rt/sanitizer_common/sanitizer_mac.h | 59 + .../sanitizer_common/sanitizer_malloc_mac.inc | 329 + .../sanitizer_common/sanitizer_mutex.h | 219 + .../sanitizer_persistent_allocator.cc | 19 + .../sanitizer_persistent_allocator.h | 72 + .../sanitizer_placement_new.h | 25 + .../sanitizer_common/sanitizer_platform.h | 256 + .../sanitizer_platform_interceptors.h | 315 + .../sanitizer_platform_limits_linux.cc | 107 + .../sanitizer_platform_limits_posix.cc | 1286 ++++ .../sanitizer_platform_limits_posix.h | 1407 ++++ .../sanitizer_common/sanitizer_posix.cc | 363 + .../sanitizer_common/sanitizer_posix.h | 92 + .../sanitizer_posix_libcdep.cc | 419 ++ .../sanitizer_common/sanitizer_printf.cc | 334 + .../sanitizer_common/sanitizer_procmaps.h | 98 + .../sanitizer_procmaps_common.cc | 175 + .../sanitizer_procmaps_freebsd.cc | 88 + .../sanitizer_procmaps_linux.cc | 90 + .../sanitizer_procmaps_mac.cc | 184 + .../sanitizer_common/sanitizer_quarantine.h | 187 + .../sanitizer_report_decorator.h | 47 + .../sanitizer_common/sanitizer_stackdepot.cc | 163 + .../sanitizer_common/sanitizer_stackdepot.h | 72 + .../sanitizer_stackdepotbase.h | 178 + .../sanitizer_common/sanitizer_stacktrace.cc | 132 + .../sanitizer_common/sanitizer_stacktrace.h | 141 + .../sanitizer_stacktrace_libcdep.cc | 120 + .../sanitizer_stacktrace_printer.cc | 173 + .../sanitizer_stacktrace_printer.h | 71 + .../sanitizer_common/sanitizer_stoptheworld.h | 69 + .../sanitizer_stoptheworld_linux_libcdep.cc | 533 ++ .../sanitizer_suppressions.cc | 168 + .../sanitizer_common/sanitizer_suppressions.h | 57 + .../sanitizer_common/sanitizer_symbolizer.cc | 114 + .../sanitizer_common/sanitizer_symbolizer.h | 186 + .../sanitizer_symbolizer_internal.h | 151 + .../sanitizer_symbolizer_libbacktrace.cc | 209 + .../sanitizer_symbolizer_libbacktrace.h | 50 + .../sanitizer_symbolizer_libcdep.cc | 428 ++ .../sanitizer_symbolizer_mac.cc | 169 + .../sanitizer_symbolizer_mac.h | 48 + .../sanitizer_symbolizer_posix_libcdep.cc | 503 ++ .../sanitizer_symbolizer_win.cc | 288 + .../sanitizer_syscall_generic.inc | 34 + .../sanitizer_syscall_linux_aarch64.inc | 138 + .../sanitizer_syscall_linux_x86_64.inc | 91 + .../sanitizer_common/sanitizer_termination.cc | 86 + .../sanitizer_thread_registry.cc | 303 + .../sanitizer_thread_registry.h | 148 + .../sanitizer_tls_get_addr.cc | 146 + .../sanitizer_common/sanitizer_tls_get_addr.h | 61 + .../sanitizer_unwind_linux_libcdep.cc | 168 + .../sanitizer_common/sanitizer_win.cc | 932 +++ .../sanitizer_common/scripts/check_lint.sh | 136 + .../sanitizer_common/scripts/cpplint.py | 4024 +++++++++++ .../scripts/gen_dynamic_list.py | 112 + .../sanitizer_common/scripts/litlint.py | 72 + .../sanitizer_common/scripts/litlint_test.py | 23 + .../sanitizer_common/scripts/sancov.py | 246 + .../symbolizer/sanitizer_symbolize.cc | 72 + .../symbolizer/sanitizer_wrappers.cc | 175 + .../symbolizer/scripts/build_symbolizer.sh | 187 + .../symbolizer/scripts/global_symbols.txt | 136 + llvm_mode/external_lib/CMakeLists.txt | 11 + llvm_mode/external_lib/io_func.c | 583 ++ llvm_mode/external_lib/stdalloc.c | 142 + llvm_mode/external_lib/zlib_abilist.txt | 194 + llvm_mode/external_lib/zlib_func.c | 18 + llvm_mode/include/abilist.h | 60 + llvm_mode/include/alloc_inl.h | 572 ++ llvm_mode/include/debug.h | 250 + llvm_mode/include/defs.h | 82 + llvm_mode/include/version.h | 47 + llvm_mode/libcxx/CMakeLists.txt | 6 + llvm_mode/libcxx/build_fast/lib/libc++.a | Bin 0 -> 7354422 bytes llvm_mode/libcxx/build_fast/lib/libc++abi.a | Bin 0 -> 1114338 bytes llvm_mode/libcxx/build_track/lib/libc++.a | Bin 0 -> 19336664 bytes llvm_mode/libcxx/build_track/lib/libc++abi.a | Bin 0 -> 2951462 bytes llvm_mode/libcxx/compile.sh | 74 + llvm_mode/llvm_diff_parmesan/CMakeLists.txt | 26 + llvm_mode/llvm_diff_parmesan/DiffConsumer.cpp | 286 + llvm_mode/llvm_diff_parmesan/DiffConsumer.h | 99 + llvm_mode/llvm_diff_parmesan/DiffLog.cpp | 50 + llvm_mode/llvm_diff_parmesan/DiffLog.h | 83 + .../llvm_diff_parmesan/DifferenceEngine.cpp | 747 ++ .../llvm_diff_parmesan/DifferenceEngine.h | 89 + llvm_mode/llvm_diff_parmesan/llvm-diff.cpp | 133 + llvm_mode/pass/AngoraPass.cc | 989 +++ llvm_mode/pass/CMakeLists.txt | 55 + llvm_mode/pass/DFSanPass.cc | 1932 ++++++ llvm_mode/pass/UnfoldBranchPass.cc | 136 + llvm_mode/pass/id-assigner-pass/.clang-format | 2 + llvm_mode/pass/id-assigner-pass/.clang-tidy | 17 + llvm_mode/pass/id-assigner-pass/.gitignore | 17 + .../pass/id-assigner-pass/CMakeLists.txt | 32 + .../id-assigner-pass/bitbucket-pipelines.yml | 24 + .../id-assigner-pass/include/CMakeLists.txt | 21 + .../include/collabfuzz/IDAssigner.h | 46 + .../pass/id-assigner-pass/src/CMakeLists.txt | 16 + .../pass/id-assigner-pass/src/IDAssigner.cpp | 287 + .../pass/id-assigner-pass/test/CMakeLists.txt | 17 + .../pass/id-assigner-pass/test/lit.cfg.in | 17 + .../pass/id-assigner-pass/test/src/hello.ll | 106 + .../id-assigner-pass/test/src/hello_debug.ll | 145 + llvm_mode/rules/CMakeLists.txt | 2 + llvm_mode/rules/angora_abilist.txt | 222 + llvm_mode/rules/exploitation_list.txt | 40 + misc/paper.png | Bin 0 -> 455933 bytes misc/screenshot.png | Bin 0 -> 791461 bytes pin_mode/Makefile | 27 + pin_mode/cond_stmt.h | 36 + pin_mode/logger.h | 135 + pin_mode/makefile.rules | 95 + pin_mode/pin_stub.c | 19 + pin_mode/pin_track.cpp | 211 + pin_mode/run_pin.sh | 7 + runtime/Cargo.toml | 18 + runtime/include/ffds.h | 22 + runtime/include/heapmap.h | 17 + runtime/include/len_label.h | 15 + runtime/include/log_collect.h | 17 + runtime/include/tag_set.h | 27 + runtime/src/ffds.rs | 47 + runtime/src/heapmap.rs | 72 + runtime/src/len_label.rs | 123 + runtime/src/lib.rs | 15 + runtime/src/logger.rs | 114 + runtime/src/tag_set.rs | 835 +++ runtime/src/tag_set_wrap.rs | 125 + runtime/src/track.rs | 321 + runtime_fast/Cargo.toml | 19 + runtime_fast/build.rs | 7 + runtime_fast/src/context.c | 13 + runtime_fast/src/context.rs | 29 + runtime_fast/src/fast.rs | 48 + runtime_fast/src/forkcli.rs | 70 + runtime_fast/src/lib.rs | 9 + runtime_fast/src/shm_branches.rs | 33 + runtime_fast/src/shm_conds.rs | 99 + rust-toolchain | 1 + rustfmt.toml | 11 + tests/alloca/alloca.c | 50 + tests/alloca/args | 1 + tests/asan/args | 1 + tests/asan/asan.c | 36 + tests/bitflip/args | 1 + tests/bitflip/bitflip.c | 54 + tests/bool/args | 1 + tests/bool/bool.c | 48 + tests/call_fn/args | 1 + tests/call_fn/call_fn.c | 56 + tests/call_fn2/args | 1 + tests/call_fn2/call_fn2.c | 47 + tests/call_fn3/args | 1 + tests/call_fn3/call_fn3.c | 46 + tests/cf1/args | 1 + tests/cf1/cf1.c | 55 + tests/cf2/args | 1 + tests/cf2/cf2.c | 50 + tests/cf3/args | 1 + tests/cf3/cf3.c | 47 + tests/context/args | 1 + tests/context/context.c | 59 + tests/cpp_string/args | 1 + tests/cpp_string/cpp_string.cpp | 48 + tests/fcmp/args | 1 + tests/fcmp/fcmp.c | 46 + tests/fstream/args | 1 + tests/fstream/fstream.cpp | 36 + tests/gep/args | 1 + tests/gep/gep.c | 40 + tests/gep2/args | 1 + tests/gep2/gep2.c | 46 + tests/if_eq/args | 1 + tests/if_eq/if_eq.c | 47 + tests/infer_type/args | 1 + tests/infer_type/infer_type.c | 53 + tests/input/1.txt | 1 + tests/loop/args | 1 + tests/loop/loop.c | 61 + tests/memcmp/args | 1 + tests/memcmp/memcmp.c | 42 + tests/mini/args | 1 + tests/mini/mini.c | 51 + tests/mini2/args | 1 + tests/mini2/mini2.c | 54 + tests/pointer/args | 1 + tests/pointer/pointer.c | 41 + tests/recursion/args | 1 + tests/recursion/recursion.c | 50 + tests/shift_and/args | 1 + tests/shift_and/shift_and.c | 45 + tests/sign/args | 1 + tests/sign/sign.c | 47 + tests/stat/args | 1 + tests/stat/stat.c | 30 + tests/stdin/args | 1 + tests/stdin/stdin.c | 13 + tests/strcmp/args | 1 + tests/strcmp/strcmp.c | 70 + tests/strcmp2/args | 1 + tests/strcmp2/strcmp2.c | 46 + tests/switch/args | 1 + tests/switch/switch.c | 57 + tests/switch2/args | 1 + tests/switch2/switch2.c | 74 + tests/test.sh | 76 + tests/testcpp.sh | 69 + tests/timeout/args | 1 + tests/timeout/timeout.c | 44 + tools/compare_callstack.sh | 13 + tools/compile_bc.py | 67 + tools/gen_abilist_from_error.sh | 3 + tools/gen_library_abilist.sh | 37 + tools/lava_validation.py | 104 + tools/llvm-diff-parmesan/CMakeLists.txt | 48 + tools/llvm-diff-parmesan/DiffConsumer.cpp | 336 + tools/llvm-diff-parmesan/DiffConsumer.h | 99 + tools/llvm-diff-parmesan/DiffLog.cpp | 50 + tools/llvm-diff-parmesan/DiffLog.h | 83 + tools/llvm-diff-parmesan/DifferenceEngine.cpp | 713 ++ tools/llvm-diff-parmesan/DifferenceEngine.h | 89 + .../id-assigner-pass/.clang-format | 2 + .../id-assigner-pass/.clang-tidy | 17 + .../id-assigner-pass/.gitignore | 17 + .../id-assigner-pass/CMakeLists.txt | 23 + .../id-assigner-pass/include/CMakeLists.txt | 21 + .../include/parmesan/IDAssigner.h | 64 + .../id-assigner-pass/src/CMakeLists.txt | 17 + .../id-assigner-pass/src/IDAssigner.cpp | 547 ++ tools/llvm-diff-parmesan/llvm-diff.cpp | 135 + tools/log_reader/Cargo.toml | 17 + tools/log_reader/src/main.rs | 17 + tools/prune.py | 136 + 534 files changed, 86296 insertions(+), 4 deletions(-) create mode 100644 BUILD_TARGET.md create mode 100644 Cargo.lock create mode 100644 Cargo.toml create mode 100644 Dockerfile create mode 100644 LICENSE create mode 100644 angora.env create mode 100755 build/build.sh create mode 100755 build/build_diff_tool.sh create mode 100755 build/install_llvm.sh create mode 100755 build/install_pin_mode.sh create mode 100755 build/install_rust.sh create mode 100755 build/install_tools.sh create mode 100644 common/Cargo.toml create mode 100644 common/src/cond_stmt_base.rs create mode 100644 common/src/config.rs create mode 100644 common/src/defs.rs create mode 100644 common/src/lib.rs create mode 100644 common/src/log_data.rs create mode 100644 common/src/shm.rs create mode 100644 common/src/tag.rs create mode 100644 docs/build_target.md create mode 100644 docs/configuration.md create mode 100644 docs/coverage.md create mode 100644 docs/environment_variables.md create mode 100644 docs/example.md create mode 100644 docs/exploitation.md create mode 100644 docs/lava-who-fix.md create mode 100644 docs/lava.md create mode 100644 docs/overview.md create mode 100644 docs/pin_mode.md create mode 100644 docs/running.md create mode 100644 docs/troubleshoot.md create mode 100644 docs/ui.md create mode 100644 docs/usage.md create mode 100644 fuzzer/Cargo.toml create mode 100644 fuzzer/src/bin/fuzzer.rs create mode 100644 fuzzer/src/bin/parse_track_file.rs create mode 100644 fuzzer/src/bin/speed_test.rs create mode 100644 fuzzer/src/bind_cpu.rs create mode 100644 fuzzer/src/branches.rs create mode 100644 fuzzer/src/check_dep.rs create mode 100644 fuzzer/src/command.rs create mode 100644 fuzzer/src/cond_stmt/cond_state.rs create mode 100644 fuzzer/src/cond_stmt/cond_stmt.rs create mode 100644 fuzzer/src/cond_stmt/mod.rs create mode 100644 fuzzer/src/cond_stmt/output.rs create mode 100644 fuzzer/src/cond_stmt/shm_conds.rs create mode 100644 fuzzer/src/depot/depot.rs create mode 100644 fuzzer/src/depot/depot_dir.rs create mode 100644 fuzzer/src/depot/dump.rs create mode 100644 fuzzer/src/depot/file.rs create mode 100644 fuzzer/src/depot/mod.rs create mode 100644 fuzzer/src/depot/qpriority.rs create mode 100644 fuzzer/src/depot/sync.rs create mode 100644 fuzzer/src/directed.rs create mode 100644 fuzzer/src/dyncfg/cfg.rs create mode 100644 fuzzer/src/dyncfg/fparse.rs create mode 100644 fuzzer/src/dyncfg/fparser.rs create mode 100644 fuzzer/src/dyncfg/mod.rs create mode 100644 fuzzer/src/executor/executor.rs create mode 100644 fuzzer/src/executor/forksrv.rs create mode 100644 fuzzer/src/executor/limit.rs create mode 100644 fuzzer/src/executor/mod.rs create mode 100644 fuzzer/src/executor/pipe_fd.rs create mode 100644 fuzzer/src/executor/status_type.rs create mode 100644 fuzzer/src/fuzz_loop.rs create mode 100644 fuzzer/src/fuzz_main.rs create mode 100644 fuzzer/src/fuzz_type.rs create mode 100644 fuzzer/src/lib.rs create mode 100644 fuzzer/src/mut_input/mod.rs create mode 100644 fuzzer/src/mut_input/mut_input.rs create mode 100644 fuzzer/src/mut_input/offsets.rs create mode 100644 fuzzer/src/mut_input/rw.rs create mode 100644 fuzzer/src/mut_input/serialize.rs create mode 100644 fuzzer/src/search/Readme.md create mode 100644 fuzzer/src/search/afl.rs create mode 100644 fuzzer/src/search/cbh.rs create mode 100644 fuzzer/src/search/cmpfn.rs create mode 100644 fuzzer/src/search/det.rs create mode 100644 fuzzer/src/search/exploit.rs create mode 100644 fuzzer/src/search/gd.rs create mode 100644 fuzzer/src/search/grad.rs create mode 100644 fuzzer/src/search/handler.rs create mode 100644 fuzzer/src/search/interesting_val.rs create mode 100644 fuzzer/src/search/len.rs create mode 100644 fuzzer/src/search/mb.rs create mode 100644 fuzzer/src/search/method.rs create mode 100644 fuzzer/src/search/mod.rs create mode 100644 fuzzer/src/search/one_byte.rs create mode 100644 fuzzer/src/search/random.rs create mode 100644 fuzzer/src/stats/bunny.rs create mode 100644 fuzzer/src/stats/chart.rs create mode 100644 fuzzer/src/stats/entry.rs create mode 100644 fuzzer/src/stats/format.rs create mode 100644 fuzzer/src/stats/fuzz.rs create mode 100644 fuzzer/src/stats/local.rs create mode 100644 fuzzer/src/stats/mod.rs create mode 100644 fuzzer/src/stats/search.rs create mode 100644 fuzzer/src/stats/show.rs create mode 100644 fuzzer/src/stats/state.rs create mode 100644 fuzzer/src/tmpfs.rs create mode 100644 fuzzer/src/track/filter.rs create mode 100644 fuzzer/src/track/fparser.rs create mode 100644 fuzzer/src/track/load_pin_data.rs create mode 100644 fuzzer/src/track/mod.rs create mode 100644 llvm-diff-parmesan/CMakeLists.txt create mode 100644 llvm-diff-parmesan/DiffConsumer.cpp create mode 100644 llvm-diff-parmesan/DiffConsumer.h create mode 100644 llvm-diff-parmesan/DiffLog.cpp create mode 100644 llvm-diff-parmesan/DiffLog.h create mode 100644 llvm-diff-parmesan/DifferenceEngine.cpp create mode 100644 llvm-diff-parmesan/DifferenceEngine.h create mode 100644 llvm-diff-parmesan/build/CMakeCache.txt create mode 100644 llvm-diff-parmesan/build/CMakeFiles/3.16.5/CMakeASMCompiler.cmake create mode 100644 llvm-diff-parmesan/build/CMakeFiles/3.16.5/CMakeCCompiler.cmake create mode 100644 llvm-diff-parmesan/build/CMakeFiles/3.16.5/CMakeCXXCompiler.cmake create mode 100755 llvm-diff-parmesan/build/CMakeFiles/3.16.5/CMakeDetermineCompilerABI_C.bin create mode 100755 llvm-diff-parmesan/build/CMakeFiles/3.16.5/CMakeDetermineCompilerABI_CXX.bin create mode 100644 llvm-diff-parmesan/build/CMakeFiles/3.16.5/CMakeSystem.cmake create mode 100644 llvm-diff-parmesan/build/CMakeFiles/3.16.5/CompilerIdC/CMakeCCompilerId.c create mode 100755 llvm-diff-parmesan/build/CMakeFiles/3.16.5/CompilerIdC/a.out create mode 100644 llvm-diff-parmesan/build/CMakeFiles/3.16.5/CompilerIdCXX/CMakeCXXCompilerId.cpp create mode 100755 llvm-diff-parmesan/build/CMakeFiles/3.16.5/CompilerIdCXX/a.out create mode 100644 llvm-diff-parmesan/build/CMakeFiles/CMakeDirectoryInformation.cmake create mode 100644 llvm-diff-parmesan/build/CMakeFiles/CMakeRuleHashes.txt create mode 100644 llvm-diff-parmesan/build/CMakeFiles/Makefile.cmake create mode 100644 llvm-diff-parmesan/build/CMakeFiles/Makefile2 create mode 100644 llvm-diff-parmesan/build/CMakeFiles/TargetDirectories.txt create mode 100644 llvm-diff-parmesan/build/CMakeFiles/cmake.check_cache create mode 100644 llvm-diff-parmesan/build/CMakeFiles/intrinsics_gen.dir/DependInfo.cmake create mode 100644 llvm-diff-parmesan/build/CMakeFiles/intrinsics_gen.dir/build.make create mode 100644 llvm-diff-parmesan/build/CMakeFiles/intrinsics_gen.dir/cmake_clean.cmake create mode 100644 llvm-diff-parmesan/build/CMakeFiles/intrinsics_gen.dir/progress.make create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/CXX.includecache create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/DependInfo.cmake create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/DiffConsumer.cpp.o create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/DiffLog.cpp.o create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/DifferenceEngine.cpp.o create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/build.make create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/cmake_clean.cmake create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/depend.internal create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/depend.make create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/flags.make create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/link.txt create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/llvm-diff.cpp.o create mode 100644 llvm-diff-parmesan/build/CMakeFiles/llvm-diff-parmesan.dir/progress.make create mode 100644 llvm-diff-parmesan/build/CMakeFiles/progress.marks create mode 100644 llvm-diff-parmesan/build/Makefile create mode 100644 llvm-diff-parmesan/build/cmake_install.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/CMakeFiles/CMakeDirectoryInformation.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/CMakeFiles/Export/lib/cmake/CollabFuzzIDAssigner/CollabFuzzIDAssignerConfig-noconfig.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/CMakeFiles/Export/lib/cmake/CollabFuzzIDAssigner/CollabFuzzIDAssignerConfig.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/CMakeFiles/progress.marks create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/Makefile create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/cmake_install.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/include/CMakeFiles/CMakeDirectoryInformation.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/include/CMakeFiles/progress.marks create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/include/Makefile create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/include/cmake_install.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/CMakeDirectoryInformation.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/LLVMIDAssigner.dir/CXX.includecache create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/LLVMIDAssigner.dir/DependInfo.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/LLVMIDAssigner.dir/IDAssigner.cpp.o create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/LLVMIDAssigner.dir/build.make create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/LLVMIDAssigner.dir/cmake_clean.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/LLVMIDAssigner.dir/depend.internal create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/LLVMIDAssigner.dir/depend.make create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/LLVMIDAssigner.dir/flags.make create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/LLVMIDAssigner.dir/link.txt create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/LLVMIDAssigner.dir/progress.make create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/install-LLVMIDAssigner-stripped.dir/DependInfo.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/install-LLVMIDAssigner-stripped.dir/build.make create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/install-LLVMIDAssigner-stripped.dir/cmake_clean.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/install-LLVMIDAssigner-stripped.dir/progress.make create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/install-LLVMIDAssigner.dir/DependInfo.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/install-LLVMIDAssigner.dir/build.make create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/install-LLVMIDAssigner.dir/cmake_clean.cmake create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/install-LLVMIDAssigner.dir/progress.make create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/CMakeFiles/progress.marks create mode 100755 llvm-diff-parmesan/build/id-assigner-pass/src/LLVMIDAssigner.so create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/Makefile create mode 100644 llvm-diff-parmesan/build/id-assigner-pass/src/cmake_install.cmake create mode 100755 llvm-diff-parmesan/build/llvm-diff-parmesan create mode 100644 llvm-diff-parmesan/build/targets.json create mode 100644 llvm-diff-parmesan/id-assigner-pass/.clang-format create mode 100644 llvm-diff-parmesan/id-assigner-pass/.clang-tidy create mode 100644 llvm-diff-parmesan/id-assigner-pass/.gitignore create mode 100644 llvm-diff-parmesan/id-assigner-pass/CMakeLists.txt create mode 100644 llvm-diff-parmesan/id-assigner-pass/bitbucket-pipelines.yml create mode 100644 llvm-diff-parmesan/id-assigner-pass/include/CMakeLists.txt create mode 100644 llvm-diff-parmesan/id-assigner-pass/include/collabfuzz/IDAssigner.h create mode 100644 llvm-diff-parmesan/id-assigner-pass/src/CMakeLists.txt create mode 100644 llvm-diff-parmesan/id-assigner-pass/src/IDAssigner.cpp create mode 100644 llvm-diff-parmesan/id-assigner-pass/test/CMakeLists.txt create mode 100644 llvm-diff-parmesan/id-assigner-pass/test/lit.cfg.in create mode 100644 llvm-diff-parmesan/id-assigner-pass/test/src/hello.ll create mode 100644 llvm-diff-parmesan/id-assigner-pass/test/src/hello_debug.ll create mode 100644 llvm-diff-parmesan/llvm-diff.cpp create mode 100644 llvm_mode/CMakeLists.txt create mode 100644 llvm_mode/compiler/CMakeLists.txt create mode 100644 llvm_mode/compiler/angora_clang.c create mode 100644 llvm_mode/dfsan_rt/CMakeLists.txt create mode 100644 llvm_mode/dfsan_rt/abilibstdc++.txt create mode 100644 llvm_mode/dfsan_rt/build_lib.py create mode 100644 llvm_mode/dfsan_rt/cmake/AddCompilerRT.cmake create mode 100644 llvm_mode/dfsan_rt/cmake/BuiltinTests.cmake create mode 100644 llvm_mode/dfsan_rt/cmake/CompilerRTCompile.cmake create mode 100644 llvm_mode/dfsan_rt/cmake/CompilerRTDarwinUtils.cmake create mode 100644 llvm_mode/dfsan_rt/cmake/CompilerRTLink.cmake create mode 100644 llvm_mode/dfsan_rt/cmake/CompilerRTUtils.cmake create mode 100644 llvm_mode/dfsan_rt/cmake/HandleCompilerRT.cmake create mode 100644 llvm_mode/dfsan_rt/cmake/SanitizerUtils.cmake create mode 100644 llvm_mode/dfsan_rt/common_interface_defs.h create mode 100644 llvm_mode/dfsan_rt/dfsan/.clang-format create mode 100644 llvm_mode/dfsan_rt/dfsan/CMakeLists.txt create mode 100644 llvm_mode/dfsan_rt/dfsan/dfsan.cc create mode 100644 llvm_mode/dfsan_rt/dfsan/dfsan.cc.bak create mode 100644 llvm_mode/dfsan_rt/dfsan/dfsan.h create mode 100644 llvm_mode/dfsan_rt/dfsan/dfsan.syms.extra create mode 100644 llvm_mode/dfsan_rt/dfsan/dfsan_custom.cc create mode 100644 llvm_mode/dfsan_rt/dfsan/dfsan_flags.inc create mode 100644 llvm_mode/dfsan_rt/dfsan/dfsan_interceptors.cc create mode 100644 llvm_mode/dfsan_rt/dfsan/dfsan_platform.h create mode 100644 llvm_mode/dfsan_rt/dfsan/done_abilist.txt create mode 100644 llvm_mode/dfsan_rt/dfsan/libc_ubuntu1404_abilist.txt create mode 100755 llvm_mode/dfsan_rt/dfsan/scripts/build-libc-list.py create mode 100755 llvm_mode/dfsan_rt/dfsan/scripts/check_custom_wrappers.sh create mode 100644 llvm_mode/dfsan_rt/dfsan_interface.h create mode 100644 llvm_mode/dfsan_rt/interception/.clang-format create mode 100644 llvm_mode/dfsan_rt/interception/CMakeLists.txt create mode 100644 llvm_mode/dfsan_rt/interception/interception.h create mode 100644 llvm_mode/dfsan_rt/interception/interception_linux.cc create mode 100644 llvm_mode/dfsan_rt/interception/interception_linux.h create mode 100644 llvm_mode/dfsan_rt/interception/interception_mac.cc create mode 100644 llvm_mode/dfsan_rt/interception/interception_mac.h create mode 100644 llvm_mode/dfsan_rt/interception/interception_win.cc create mode 100644 llvm_mode/dfsan_rt/interception/interception_win.h create mode 100644 llvm_mode/dfsan_rt/libclang_rt.dfsan-x86_64.a.syms create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/.clang-format create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/.clang-tidy create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/CMakeLists.txt create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/assembly.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_addrhashmap.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator_bytemap.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator_combined.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator_interface.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator_internal.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator_local_cache.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator_primary32.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator_primary64.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator_secondary.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator_size_class_map.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_allocator_stats.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_asm.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_atomic.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_atomic_clang.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_atomic_clang_other.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_atomic_clang_x86.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_atomic_msvc.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_bitvector.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_bvgraph.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_common.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_common.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_common_interceptors.inc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_common_interceptors_format.inc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_common_interceptors_ioctl.inc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_common_libcdep.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_common_nolibc.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_common_syscalls.inc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_coverage_libcdep.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_coverage_mapping_libcdep.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_deadlock_detector.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_deadlock_detector1.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_deadlock_detector2.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_deadlock_detector_interface.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_flag_parser.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_flag_parser.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_flags.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_flags.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_flags.inc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_freebsd.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_interface_internal.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_internal_defs.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_lfstack.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_libc.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_libc.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_libignore.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_libignore.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_linux.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_linux.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_linux_libcdep.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_linux_mips64.S create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_linux_s390.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_linux_x86_64.S create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_list.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_mac.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_mac.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_malloc_mac.inc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_mutex.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_persistent_allocator.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_persistent_allocator.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_placement_new.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_platform.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_platform_interceptors.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_platform_limits_linux.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_platform_limits_posix.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_platform_limits_posix.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_posix.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_posix.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_posix_libcdep.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_printf.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_procmaps.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_procmaps_common.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_procmaps_freebsd.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_procmaps_linux.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_procmaps_mac.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_quarantine.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_report_decorator.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_stackdepot.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_stackdepot.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_stackdepotbase.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_stacktrace.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_stacktrace.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_stacktrace_libcdep.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_stacktrace_printer.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_stacktrace_printer.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_stoptheworld.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_suppressions.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_suppressions.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_symbolizer.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_symbolizer.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_symbolizer_internal.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_symbolizer_libbacktrace.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_symbolizer_libbacktrace.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_symbolizer_libcdep.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_symbolizer_mac.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_symbolizer_mac.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_symbolizer_win.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_syscall_generic.inc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_syscall_linux_aarch64.inc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_syscall_linux_x86_64.inc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_termination.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_thread_registry.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_thread_registry.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_tls_get_addr.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_tls_get_addr.h create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_unwind_linux_libcdep.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/sanitizer_win.cc create mode 100755 llvm_mode/dfsan_rt/sanitizer_common/scripts/check_lint.sh create mode 100755 llvm_mode/dfsan_rt/sanitizer_common/scripts/cpplint.py create mode 100755 llvm_mode/dfsan_rt/sanitizer_common/scripts/gen_dynamic_list.py create mode 100755 llvm_mode/dfsan_rt/sanitizer_common/scripts/litlint.py create mode 100755 llvm_mode/dfsan_rt/sanitizer_common/scripts/litlint_test.py create mode 100755 llvm_mode/dfsan_rt/sanitizer_common/scripts/sancov.py create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/symbolizer/sanitizer_symbolize.cc create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/symbolizer/sanitizer_wrappers.cc create mode 100755 llvm_mode/dfsan_rt/sanitizer_common/symbolizer/scripts/build_symbolizer.sh create mode 100644 llvm_mode/dfsan_rt/sanitizer_common/symbolizer/scripts/global_symbols.txt create mode 100644 llvm_mode/external_lib/CMakeLists.txt create mode 100644 llvm_mode/external_lib/io_func.c create mode 100644 llvm_mode/external_lib/stdalloc.c create mode 100644 llvm_mode/external_lib/zlib_abilist.txt create mode 100644 llvm_mode/external_lib/zlib_func.c create mode 100644 llvm_mode/include/abilist.h create mode 100644 llvm_mode/include/alloc_inl.h create mode 100644 llvm_mode/include/debug.h create mode 100644 llvm_mode/include/defs.h create mode 100644 llvm_mode/include/version.h create mode 100644 llvm_mode/libcxx/CMakeLists.txt create mode 100644 llvm_mode/libcxx/build_fast/lib/libc++.a create mode 100644 llvm_mode/libcxx/build_fast/lib/libc++abi.a create mode 100644 llvm_mode/libcxx/build_track/lib/libc++.a create mode 100644 llvm_mode/libcxx/build_track/lib/libc++abi.a create mode 100644 llvm_mode/libcxx/compile.sh create mode 100644 llvm_mode/llvm_diff_parmesan/CMakeLists.txt create mode 100644 llvm_mode/llvm_diff_parmesan/DiffConsumer.cpp create mode 100644 llvm_mode/llvm_diff_parmesan/DiffConsumer.h create mode 100644 llvm_mode/llvm_diff_parmesan/DiffLog.cpp create mode 100644 llvm_mode/llvm_diff_parmesan/DiffLog.h create mode 100644 llvm_mode/llvm_diff_parmesan/DifferenceEngine.cpp create mode 100644 llvm_mode/llvm_diff_parmesan/DifferenceEngine.h create mode 100644 llvm_mode/llvm_diff_parmesan/llvm-diff.cpp create mode 100644 llvm_mode/pass/AngoraPass.cc create mode 100644 llvm_mode/pass/CMakeLists.txt create mode 100644 llvm_mode/pass/DFSanPass.cc create mode 100644 llvm_mode/pass/UnfoldBranchPass.cc create mode 100644 llvm_mode/pass/id-assigner-pass/.clang-format create mode 100644 llvm_mode/pass/id-assigner-pass/.clang-tidy create mode 100644 llvm_mode/pass/id-assigner-pass/.gitignore create mode 100644 llvm_mode/pass/id-assigner-pass/CMakeLists.txt create mode 100644 llvm_mode/pass/id-assigner-pass/bitbucket-pipelines.yml create mode 100644 llvm_mode/pass/id-assigner-pass/include/CMakeLists.txt create mode 100644 llvm_mode/pass/id-assigner-pass/include/collabfuzz/IDAssigner.h create mode 100644 llvm_mode/pass/id-assigner-pass/src/CMakeLists.txt create mode 100644 llvm_mode/pass/id-assigner-pass/src/IDAssigner.cpp create mode 100644 llvm_mode/pass/id-assigner-pass/test/CMakeLists.txt create mode 100644 llvm_mode/pass/id-assigner-pass/test/lit.cfg.in create mode 100644 llvm_mode/pass/id-assigner-pass/test/src/hello.ll create mode 100644 llvm_mode/pass/id-assigner-pass/test/src/hello_debug.ll create mode 100644 llvm_mode/rules/CMakeLists.txt create mode 100644 llvm_mode/rules/angora_abilist.txt create mode 100644 llvm_mode/rules/exploitation_list.txt create mode 100644 misc/paper.png create mode 100644 misc/screenshot.png create mode 100644 pin_mode/Makefile create mode 100644 pin_mode/cond_stmt.h create mode 100644 pin_mode/logger.h create mode 100644 pin_mode/makefile.rules create mode 100644 pin_mode/pin_stub.c create mode 100644 pin_mode/pin_track.cpp create mode 100755 pin_mode/run_pin.sh create mode 100644 runtime/Cargo.toml create mode 100644 runtime/include/ffds.h create mode 100644 runtime/include/heapmap.h create mode 100644 runtime/include/len_label.h create mode 100644 runtime/include/log_collect.h create mode 100644 runtime/include/tag_set.h create mode 100644 runtime/src/ffds.rs create mode 100644 runtime/src/heapmap.rs create mode 100644 runtime/src/len_label.rs create mode 100644 runtime/src/lib.rs create mode 100644 runtime/src/logger.rs create mode 100644 runtime/src/tag_set.rs create mode 100644 runtime/src/tag_set_wrap.rs create mode 100644 runtime/src/track.rs create mode 100644 runtime_fast/Cargo.toml create mode 100644 runtime_fast/build.rs create mode 100644 runtime_fast/src/context.c create mode 100644 runtime_fast/src/context.rs create mode 100644 runtime_fast/src/fast.rs create mode 100644 runtime_fast/src/forkcli.rs create mode 100644 runtime_fast/src/lib.rs create mode 100644 runtime_fast/src/shm_branches.rs create mode 100644 runtime_fast/src/shm_conds.rs create mode 100644 rust-toolchain create mode 100644 rustfmt.toml create mode 100644 tests/alloca/alloca.c create mode 100644 tests/alloca/args create mode 100644 tests/asan/args create mode 100644 tests/asan/asan.c create mode 100644 tests/bitflip/args create mode 100644 tests/bitflip/bitflip.c create mode 100644 tests/bool/args create mode 100644 tests/bool/bool.c create mode 100644 tests/call_fn/args create mode 100644 tests/call_fn/call_fn.c create mode 100644 tests/call_fn2/args create mode 100644 tests/call_fn2/call_fn2.c create mode 100644 tests/call_fn3/args create mode 100644 tests/call_fn3/call_fn3.c create mode 100644 tests/cf1/args create mode 100644 tests/cf1/cf1.c create mode 100644 tests/cf2/args create mode 100644 tests/cf2/cf2.c create mode 100644 tests/cf3/args create mode 100644 tests/cf3/cf3.c create mode 100644 tests/context/args create mode 100644 tests/context/context.c create mode 100644 tests/cpp_string/args create mode 100644 tests/cpp_string/cpp_string.cpp create mode 100644 tests/fcmp/args create mode 100644 tests/fcmp/fcmp.c create mode 100644 tests/fstream/args create mode 100644 tests/fstream/fstream.cpp create mode 100644 tests/gep/args create mode 100644 tests/gep/gep.c create mode 100644 tests/gep2/args create mode 100644 tests/gep2/gep2.c create mode 100644 tests/if_eq/args create mode 100644 tests/if_eq/if_eq.c create mode 100644 tests/infer_type/args create mode 100644 tests/infer_type/infer_type.c create mode 100644 tests/input/1.txt create mode 100644 tests/loop/args create mode 100644 tests/loop/loop.c create mode 100644 tests/memcmp/args create mode 100644 tests/memcmp/memcmp.c create mode 100644 tests/mini/args create mode 100644 tests/mini/mini.c create mode 100644 tests/mini2/args create mode 100644 tests/mini2/mini2.c create mode 100644 tests/pointer/args create mode 100644 tests/pointer/pointer.c create mode 100644 tests/recursion/args create mode 100644 tests/recursion/recursion.c create mode 100644 tests/shift_and/args create mode 100644 tests/shift_and/shift_and.c create mode 100644 tests/sign/args create mode 100644 tests/sign/sign.c create mode 100644 tests/stat/args create mode 100644 tests/stat/stat.c create mode 100644 tests/stdin/args create mode 100644 tests/stdin/stdin.c create mode 100644 tests/strcmp/args create mode 100644 tests/strcmp/strcmp.c create mode 100644 tests/strcmp2/args create mode 100644 tests/strcmp2/strcmp2.c create mode 100644 tests/switch/args create mode 100644 tests/switch/switch.c create mode 100644 tests/switch2/args create mode 100644 tests/switch2/switch2.c create mode 100755 tests/test.sh create mode 100755 tests/testcpp.sh create mode 100644 tests/timeout/args create mode 100644 tests/timeout/timeout.c create mode 100644 tools/compare_callstack.sh create mode 100644 tools/compile_bc.py create mode 100644 tools/gen_abilist_from_error.sh create mode 100755 tools/gen_library_abilist.sh create mode 100644 tools/lava_validation.py create mode 100644 tools/llvm-diff-parmesan/CMakeLists.txt create mode 100644 tools/llvm-diff-parmesan/DiffConsumer.cpp create mode 100644 tools/llvm-diff-parmesan/DiffConsumer.h create mode 100644 tools/llvm-diff-parmesan/DiffLog.cpp create mode 100644 tools/llvm-diff-parmesan/DiffLog.h create mode 100644 tools/llvm-diff-parmesan/DifferenceEngine.cpp create mode 100644 tools/llvm-diff-parmesan/DifferenceEngine.h create mode 100644 tools/llvm-diff-parmesan/id-assigner-pass/.clang-format create mode 100644 tools/llvm-diff-parmesan/id-assigner-pass/.clang-tidy create mode 100644 tools/llvm-diff-parmesan/id-assigner-pass/.gitignore create mode 100644 tools/llvm-diff-parmesan/id-assigner-pass/CMakeLists.txt create mode 100644 tools/llvm-diff-parmesan/id-assigner-pass/include/CMakeLists.txt create mode 100644 tools/llvm-diff-parmesan/id-assigner-pass/include/parmesan/IDAssigner.h create mode 100644 tools/llvm-diff-parmesan/id-assigner-pass/src/CMakeLists.txt create mode 100644 tools/llvm-diff-parmesan/id-assigner-pass/src/IDAssigner.cpp create mode 100644 tools/llvm-diff-parmesan/llvm-diff.cpp create mode 100644 tools/log_reader/Cargo.toml create mode 100644 tools/log_reader/src/main.rs create mode 100644 tools/prune.py diff --git a/BUILD_TARGET.md b/BUILD_TARGET.md new file mode 100644 index 0000000..23c7493 --- /dev/null +++ b/BUILD_TARGET.md @@ -0,0 +1,77 @@ +# Example: how to build Objdump + +## 1) Build ParmeSan +Use the included script `build/build.sh` to build ParmeSan and the required tools. + +We really recommend you install the LLVM version supplied by the `build/install_llvm.sh` script. At the end it will show the env vars that need to be set. Tip: write these to a file that you can source later (e.g. `source angora.env`). + +Also install the required tools (`gclang`) using `build/install_tools.sh`. + +```bash +# You might need to change this one to point to your LLVM install path +source angora.env +build/build.sh +export PARMESAN_BASE=$(pwd) +``` + +## 2) Get sources +```bash +# Create a workdir +mkdir workdir +cd workdir +wget http://ftpmirror.gnu.org/binutils/binutils-2.34.tar.xz +# or curl -O http://ftpmirror.gnu.org/binutils/binutils-2.34.tar.xz +tar xf binutils-2.34.tar.xz +mkdir build # Create a build dir +``` + +## 3) Build bitcode file using gclang +```bash +cd bintuils-2.34 +CC=gclang CXX=gclang++ ./configure --with-pic +make -j$(nprocs) # Build in parallel +cd binutils/ +get-bc objdump +# Will create the file objdump.bc +mkdir -p ../../build +cp objdump.bc ../../build +cd ../../build +``` + +## 4) Run ParmeSan pipeline +We have included a script `tools/build_bc.py` that runs the many commands required to get the targets and build the different target binaries. + +Invoke the `build_bc.py` script with the bitcode file as first argument, followed by the command-line arguments to the target program that should be used when profiling. + +For `objdump`, you can, for example, use the `-s -d` flags. Also add `@@` in place where the input file would normally go. So the flags for objdump become `-s -d @@`. If no arguments are given, it will default to just `@@`. + +The script also expects a folder called `in/` with some inputs used for profiling the target application. + +```bash +mkdir in/ +# Get some input seeds for objdump +cp /usr/bin/whoami in/ +# Add small dummy file +echo "AAAAAAAA" > in/a.txt +# Build everything +python $PARMESAN_BASE/tools/compile_bc.py objdump.bc -s -d @@ +# Will take a long time, go get a coffee or a beer +# ... +# After some time it will print the command you can use +# to start the fuzzing. +``` + +## 5) Start fuzzing +Now you can start fuzzing using the command printed in the previous step. + +```bash +# Something like: +/path/to/parmesan/bin/fuzzer -c ./targets.pruned.json -i in -o out -t objdump.track -s objdump.san.fast -- objdump.fast -s -d @@ +``` + +This should start up the fuzzer (with the sanopt optimization), and show you something like the following: + +![ParmeSan Screenshot](/misc/screenshot.png) + + +If you do not want to fuzz it with a sanitizer enable at all, remove the `-s objdump.san.fast` flag. Alternatively, you can also fuzz the target with the sanitizer always enabled. Simply replace `objdump.fast` with `objdump.san.fast` in that case. diff --git a/Cargo.lock b/Cargo.lock new file mode 100644 index 0000000..3a18555 --- /dev/null +++ b/Cargo.lock @@ -0,0 +1,783 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +[[package]] +name = "aho-corasick" +version = "0.7.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "memchr 2.3.3 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "angora" +version = "1.2.2" +dependencies = [ + "angora_common 1.2.2", + "byteorder 1.3.4 (registry+https://github.com/rust-lang/crates.io-index)", + "chrono 0.4.11 (registry+https://github.com/rust-lang/crates.io-index)", + "clap 2.33.1 (registry+https://github.com/rust-lang/crates.io-index)", + "colored 1.9.3 (registry+https://github.com/rust-lang/crates.io-index)", + "csv 1.1.3 (registry+https://github.com/rust-lang/crates.io-index)", + "ctrlc 3.1.4 (registry+https://github.com/rust-lang/crates.io-index)", + "derive_more 0.99.6 (registry+https://github.com/rust-lang/crates.io-index)", + "disjoint-sets 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)", + "itertools 0.9.0 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "libmath 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)", + "log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)", + "memmap 0.7.0 (registry+https://github.com/rust-lang/crates.io-index)", + "num_cpus 1.13.0 (registry+https://github.com/rust-lang/crates.io-index)", + "petgraph 0.5.0 (registry+https://github.com/rust-lang/crates.io-index)", + "pretty_env_logger 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)", + "priority-queue 0.6.0 (registry+https://github.com/rust-lang/crates.io-index)", + "rand 0.7.3 (registry+https://github.com/rust-lang/crates.io-index)", + "runtime 1.2.2", + "serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", + "serde_derive 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", + "serde_json 1.0.53 (registry+https://github.com/rust-lang/crates.io-index)", + "twoway 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)", + "wait-timeout 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "angora_common" +version = "1.2.2" +dependencies = [ + "bincode 1.2.1 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", + "serde_derive 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "ansi_term" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "atty" +version = "0.2.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "hermit-abi 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "autocfg" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "bincode" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "byteorder 1.3.4 (registry+https://github.com/rust-lang/crates.io-index)", + "serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "bitflags" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "bstr" +version = "0.2.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "lazy_static 1.4.0 (registry+https://github.com/rust-lang/crates.io-index)", + "memchr 2.3.3 (registry+https://github.com/rust-lang/crates.io-index)", + "regex-automata 0.1.9 (registry+https://github.com/rust-lang/crates.io-index)", + "serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "byteorder" +version = "1.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "cc" +version = "1.0.53" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "cfg-if" +version = "0.1.10" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "chrono" +version = "0.4.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "num-integer 0.1.42 (registry+https://github.com/rust-lang/crates.io-index)", + "num-traits 0.2.11 (registry+https://github.com/rust-lang/crates.io-index)", + "time 0.1.43 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "clap" +version = "2.33.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "ansi_term 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)", + "atty 0.2.14 (registry+https://github.com/rust-lang/crates.io-index)", + "bitflags 1.2.1 (registry+https://github.com/rust-lang/crates.io-index)", + "strsim 0.8.0 (registry+https://github.com/rust-lang/crates.io-index)", + "textwrap 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)", + "unicode-width 0.1.7 (registry+https://github.com/rust-lang/crates.io-index)", + "vec_map 0.8.2 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "colored" +version = "1.9.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "atty 0.2.14 (registry+https://github.com/rust-lang/crates.io-index)", + "lazy_static 1.4.0 (registry+https://github.com/rust-lang/crates.io-index)", + "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "csv" +version = "1.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "bstr 0.2.13 (registry+https://github.com/rust-lang/crates.io-index)", + "csv-core 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)", + "itoa 0.4.5 (registry+https://github.com/rust-lang/crates.io-index)", + "ryu 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)", + "serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "csv-core" +version = "0.1.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "memchr 2.3.3 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "ctor" +version = "0.1.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "quote 1.0.5 (registry+https://github.com/rust-lang/crates.io-index)", + "syn 1.0.21 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "ctrlc" +version = "3.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "nix 0.17.0 (registry+https://github.com/rust-lang/crates.io-index)", + "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "derive_more" +version = "0.99.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "proc-macro2 1.0.12 (registry+https://github.com/rust-lang/crates.io-index)", + "quote 1.0.5 (registry+https://github.com/rust-lang/crates.io-index)", + "syn 1.0.21 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "disjoint-sets" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "either" +version = "1.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "env_logger" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "atty 0.2.14 (registry+https://github.com/rust-lang/crates.io-index)", + "humantime 1.3.0 (registry+https://github.com/rust-lang/crates.io-index)", + "log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)", + "regex 1.3.7 (registry+https://github.com/rust-lang/crates.io-index)", + "termcolor 1.1.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "fixedbitset" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "fuchsia-cprng" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "getrandom" +version = "0.1.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "wasi 0.9.0+wasi-snapshot-preview1 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "hermit-abi" +version = "0.1.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "humantime" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "quick-error 1.2.3 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "indexmap" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "indexmap" +version = "1.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "autocfg 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "itertools" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "either 1.5.3 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "itoa" +version = "0.4.5" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "lazy_static" +version = "1.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "libc" +version = "0.2.70" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "libmath" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "rand 0.3.23 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "log" +version = "0.4.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "log_reader" +version = "0.1.0" +dependencies = [ + "angora_common 1.2.2", + "runtime 1.2.2", + "serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", + "serde_derive 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", + "serde_json 1.0.53 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "memchr" +version = "2.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "memmap" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "nix" +version = "0.17.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "bitflags 1.2.1 (registry+https://github.com/rust-lang/crates.io-index)", + "cc 1.0.53 (registry+https://github.com/rust-lang/crates.io-index)", + "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "void 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "num-integer" +version = "0.1.42" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "autocfg 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)", + "num-traits 0.2.11 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "num-traits" +version = "0.2.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "autocfg 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "num_cpus" +version = "1.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "hermit-abi 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "petgraph" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "fixedbitset 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)", + "indexmap 1.3.2 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "ppv-lite86" +version = "0.2.6" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "pretty_env_logger" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "chrono 0.4.11 (registry+https://github.com/rust-lang/crates.io-index)", + "env_logger 0.6.2 (registry+https://github.com/rust-lang/crates.io-index)", + "log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "priority-queue" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "indexmap 0.4.1 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "proc-macro2" +version = "1.0.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "unicode-xid 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "quick-error" +version = "1.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "quote" +version = "1.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "proc-macro2 1.0.12 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "rand" +version = "0.3.23" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "rand 0.4.6 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "rand" +version = "0.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "fuchsia-cprng 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "rand_core 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)", + "rdrand 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)", + "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "rand" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "getrandom 0.1.14 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "rand_chacha 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)", + "rand_core 0.5.1 (registry+https://github.com/rust-lang/crates.io-index)", + "rand_hc 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "rand_chacha" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "ppv-lite86 0.2.6 (registry+https://github.com/rust-lang/crates.io-index)", + "rand_core 0.5.1 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "rand_core" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "rand_core 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "rand_core" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "rand_core" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "getrandom 0.1.14 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "rand_hc" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "rand_core 0.5.1 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "rdrand" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "rand_core 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "regex" +version = "1.3.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "aho-corasick 0.7.10 (registry+https://github.com/rust-lang/crates.io-index)", + "memchr 2.3.3 (registry+https://github.com/rust-lang/crates.io-index)", + "regex-syntax 0.6.17 (registry+https://github.com/rust-lang/crates.io-index)", + "thread_local 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "regex-automata" +version = "0.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "byteorder 1.3.4 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "regex-syntax" +version = "0.6.17" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "runtime" +version = "1.2.2" +dependencies = [ + "angora_common 1.2.2", + "bincode 1.2.1 (registry+https://github.com/rust-lang/crates.io-index)", + "lazy_static 1.4.0 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", + "serde_derive 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "runtime_fast" +version = "1.2.2" +dependencies = [ + "angora_common 1.2.2", + "byteorder 1.3.4 (registry+https://github.com/rust-lang/crates.io-index)", + "cc 1.0.53 (registry+https://github.com/rust-lang/crates.io-index)", + "ctor 0.1.14 (registry+https://github.com/rust-lang/crates.io-index)", + "lazy_static 1.4.0 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "ryu" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "serde" +version = "1.0.110" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "serde_derive" +version = "1.0.110" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "proc-macro2 1.0.12 (registry+https://github.com/rust-lang/crates.io-index)", + "quote 1.0.5 (registry+https://github.com/rust-lang/crates.io-index)", + "syn 1.0.21 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "serde_json" +version = "1.0.53" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "itoa 0.4.5 (registry+https://github.com/rust-lang/crates.io-index)", + "ryu 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)", + "serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "strsim" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "syn" +version = "1.0.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "proc-macro2 1.0.12 (registry+https://github.com/rust-lang/crates.io-index)", + "quote 1.0.5 (registry+https://github.com/rust-lang/crates.io-index)", + "unicode-xid 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "termcolor" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "winapi-util 0.1.5 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "textwrap" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "unicode-width 0.1.7 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "thread_local" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "lazy_static 1.4.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "time" +version = "0.1.43" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", + "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "twoway" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "memchr 2.3.3 (registry+https://github.com/rust-lang/crates.io-index)", + "unchecked-index 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "unchecked-index" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "unicode-width" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "unicode-xid" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "vec_map" +version = "0.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "void" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "wait-timeout" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "wasi" +version = "0.9.0+wasi-snapshot-preview1" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "winapi" +version = "0.3.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "winapi-i686-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)", + "winapi-x86_64-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "winapi-i686-pc-windows-gnu" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[[package]] +name = "winapi-util" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "winapi-x86_64-pc-windows-gnu" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" + +[metadata] +"checksum aho-corasick 0.7.10 (registry+https://github.com/rust-lang/crates.io-index)" = "8716408b8bc624ed7f65d223ddb9ac2d044c0547b6fa4b0d554f3a9540496ada" +"checksum ansi_term 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)" = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b" +"checksum atty 0.2.14 (registry+https://github.com/rust-lang/crates.io-index)" = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8" +"checksum autocfg 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)" = "f8aac770f1885fd7e387acedd76065302551364496e46b3dd00860b2f8359b9d" +"checksum bincode 1.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "5753e2a71534719bf3f4e57006c3a4f0d2c672a4b676eec84161f763eca87dbf" +"checksum bitflags 1.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693" +"checksum bstr 0.2.13 (registry+https://github.com/rust-lang/crates.io-index)" = "31accafdb70df7871592c058eca3985b71104e15ac32f64706022c58867da931" +"checksum byteorder 1.3.4 (registry+https://github.com/rust-lang/crates.io-index)" = "08c48aae112d48ed9f069b33538ea9e3e90aa263cfa3d1c24309612b1f7472de" +"checksum cc 1.0.53 (registry+https://github.com/rust-lang/crates.io-index)" = "404b1fe4f65288577753b17e3b36a04596ee784493ec249bf81c7f2d2acd751c" +"checksum cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)" = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822" +"checksum chrono 0.4.11 (registry+https://github.com/rust-lang/crates.io-index)" = "80094f509cf8b5ae86a4966a39b3ff66cd7e2a3e594accec3743ff3fabeab5b2" +"checksum clap 2.33.1 (registry+https://github.com/rust-lang/crates.io-index)" = "bdfa80d47f954d53a35a64987ca1422f495b8d6483c0fe9f7117b36c2a792129" +"checksum colored 1.9.3 (registry+https://github.com/rust-lang/crates.io-index)" = "f4ffc801dacf156c5854b9df4f425a626539c3a6ef7893cc0c5084a23f0b6c59" +"checksum csv 1.1.3 (registry+https://github.com/rust-lang/crates.io-index)" = "00affe7f6ab566df61b4be3ce8cf16bc2576bca0963ceb0955e45d514bf9a279" +"checksum csv-core 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)" = "2b2466559f260f48ad25fe6317b3c8dac77b5bdb5763ac7d9d6103530663bc90" +"checksum ctor 0.1.14 (registry+https://github.com/rust-lang/crates.io-index)" = "cf6b25ee9ac1995c54d7adb2eff8cfffb7260bc774fb63c601ec65467f43cd9d" +"checksum ctrlc 3.1.4 (registry+https://github.com/rust-lang/crates.io-index)" = "7a4ba686dff9fa4c1c9636ce1010b0cf98ceb421361b0bb3d6faeec43bd217a7" +"checksum derive_more 0.99.6 (registry+https://github.com/rust-lang/crates.io-index)" = "46b046a346c374c6c3c84d2070bfe33904504686bdf949c2d8eb22edad3f270c" +"checksum disjoint-sets 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)" = "4ccbbca7d6a247007ca2535c616d4bb4a5fcad176ef0218671f96b88c52c3d34" +"checksum either 1.5.3 (registry+https://github.com/rust-lang/crates.io-index)" = "bb1f6b1ce1c140482ea30ddd3335fc0024ac7ee112895426e0a629a6c20adfe3" +"checksum env_logger 0.6.2 (registry+https://github.com/rust-lang/crates.io-index)" = "aafcde04e90a5226a6443b7aabdb016ba2f8307c847d524724bd9b346dd1a2d3" +"checksum fixedbitset 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "37ab347416e802de484e4d03c7316c48f1ecb56574dfd4a46a80f173ce1de04d" +"checksum fuchsia-cprng 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)" = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba" +"checksum getrandom 0.1.14 (registry+https://github.com/rust-lang/crates.io-index)" = "7abc8dd8451921606d809ba32e95b6111925cd2906060d2dcc29c070220503eb" +"checksum hermit-abi 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)" = "61565ff7aaace3525556587bd2dc31d4a07071957be715e63ce7b1eccf51a8f4" +"checksum humantime 1.3.0 (registry+https://github.com/rust-lang/crates.io-index)" = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f" +"checksum indexmap 0.4.1 (registry+https://github.com/rust-lang/crates.io-index)" = "7164c96d6e18ccc3ce43f3dedac996c21a220670a106c275b96ad92110401362" +"checksum indexmap 1.3.2 (registry+https://github.com/rust-lang/crates.io-index)" = "076f042c5b7b98f31d205f1249267e12a6518c1481e9dae9764af19b707d2292" +"checksum itertools 0.9.0 (registry+https://github.com/rust-lang/crates.io-index)" = "284f18f85651fe11e8a991b2adb42cb078325c996ed026d994719efcfca1d54b" +"checksum itoa 0.4.5 (registry+https://github.com/rust-lang/crates.io-index)" = "b8b7a7c0c47db5545ed3fef7468ee7bb5b74691498139e4b3f6a20685dc6dd8e" +"checksum lazy_static 1.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646" +"checksum libc 0.2.70 (registry+https://github.com/rust-lang/crates.io-index)" = "3baa92041a6fec78c687fa0cc2b3fae8884f743d672cf551bed1d6dac6988d0f" +"checksum libmath 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "dfd3416934a853ae80d5c3b006f632dfcbaf320300c5167e88a469e9ac214502" +"checksum log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)" = "14b6052be84e6b71ab17edffc2eeabf5c2c3ae1fdb464aae35ac50c67a44e1f7" +"checksum memchr 2.3.3 (registry+https://github.com/rust-lang/crates.io-index)" = "3728d817d99e5ac407411fa471ff9800a778d88a24685968b36824eaf4bee400" +"checksum memmap 0.7.0 (registry+https://github.com/rust-lang/crates.io-index)" = "6585fd95e7bb50d6cc31e20d4cf9afb4e2ba16c5846fc76793f11218da9c475b" +"checksum nix 0.17.0 (registry+https://github.com/rust-lang/crates.io-index)" = "50e4785f2c3b7589a0d0c1dd60285e1188adac4006e8abd6dd578e1567027363" +"checksum num-integer 0.1.42 (registry+https://github.com/rust-lang/crates.io-index)" = "3f6ea62e9d81a77cd3ee9a2a5b9b609447857f3d358704331e4ef39eb247fcba" +"checksum num-traits 0.2.11 (registry+https://github.com/rust-lang/crates.io-index)" = "c62be47e61d1842b9170f0fdeec8eba98e60e90e5446449a0545e5152acd7096" +"checksum num_cpus 1.13.0 (registry+https://github.com/rust-lang/crates.io-index)" = "05499f3756671c15885fee9034446956fff3f243d6077b91e5767df161f766b3" +"checksum petgraph 0.5.0 (registry+https://github.com/rust-lang/crates.io-index)" = "29c127eea4a29ec6c85d153c59dc1213f33ec74cead30fe4730aecc88cc1fd92" +"checksum ppv-lite86 0.2.6 (registry+https://github.com/rust-lang/crates.io-index)" = "74490b50b9fbe561ac330df47c08f3f33073d2d00c150f719147d7c54522fa1b" +"checksum pretty_env_logger 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)" = "717ee476b1690853d222af4634056d830b5197ffd747726a9a1eee6da9f49074" +"checksum priority-queue 0.6.0 (registry+https://github.com/rust-lang/crates.io-index)" = "602c2e38842965277b124586dbc4691d83f37af5b4ecd7c9e46908e1bd7d5b35" +"checksum proc-macro2 1.0.12 (registry+https://github.com/rust-lang/crates.io-index)" = "8872cf6f48eee44265156c111456a700ab3483686b3f96df4cf5481c89157319" +"checksum quick-error 1.2.3 (registry+https://github.com/rust-lang/crates.io-index)" = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0" +"checksum quote 1.0.5 (registry+https://github.com/rust-lang/crates.io-index)" = "42934bc9c8ab0d3b273a16d8551c8f0fcff46be73276ca083ec2414c15c4ba5e" +"checksum rand 0.3.23 (registry+https://github.com/rust-lang/crates.io-index)" = "64ac302d8f83c0c1974bf758f6b041c6c8ada916fbb44a609158ca8b064cc76c" +"checksum rand 0.4.6 (registry+https://github.com/rust-lang/crates.io-index)" = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293" +"checksum rand 0.7.3 (registry+https://github.com/rust-lang/crates.io-index)" = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03" +"checksum rand_chacha 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402" +"checksum rand_core 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)" = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b" +"checksum rand_core 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)" = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc" +"checksum rand_core 0.5.1 (registry+https://github.com/rust-lang/crates.io-index)" = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19" +"checksum rand_hc 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c" +"checksum rdrand 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2" +"checksum regex 1.3.7 (registry+https://github.com/rust-lang/crates.io-index)" = "a6020f034922e3194c711b82a627453881bc4682166cabb07134a10c26ba7692" +"checksum regex-automata 0.1.9 (registry+https://github.com/rust-lang/crates.io-index)" = "ae1ded71d66a4a97f5e961fd0cb25a5f366a42a41570d16a763a69c092c26ae4" +"checksum regex-syntax 0.6.17 (registry+https://github.com/rust-lang/crates.io-index)" = "7fe5bd57d1d7414c6b5ed48563a2c855d995ff777729dcd91c369ec7fea395ae" +"checksum ryu 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)" = "ed3d612bc64430efeb3f7ee6ef26d590dce0c43249217bddc62112540c7941e1" +"checksum serde 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)" = "99e7b308464d16b56eba9964e4972a3eee817760ab60d88c3f86e1fecb08204c" +"checksum serde_derive 1.0.110 (registry+https://github.com/rust-lang/crates.io-index)" = "818fbf6bfa9a42d3bfcaca148547aa00c7b915bec71d1757aa2d44ca68771984" +"checksum serde_json 1.0.53 (registry+https://github.com/rust-lang/crates.io-index)" = "993948e75b189211a9b31a7528f950c6adc21f9720b6438ff80a7fa2f864cea2" +"checksum strsim 0.8.0 (registry+https://github.com/rust-lang/crates.io-index)" = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a" +"checksum syn 1.0.21 (registry+https://github.com/rust-lang/crates.io-index)" = "4696caa4048ac7ce2bcd2e484b3cef88c1004e41b8e945a277e2c25dc0b72060" +"checksum termcolor 1.1.0 (registry+https://github.com/rust-lang/crates.io-index)" = "bb6bfa289a4d7c5766392812c0a1f4c1ba45afa1ad47803c11e1f407d846d75f" +"checksum textwrap 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)" = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060" +"checksum thread_local 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)" = "d40c6d1b69745a6ec6fb1ca717914848da4b44ae29d9b3080cbee91d72a69b14" +"checksum time 0.1.43 (registry+https://github.com/rust-lang/crates.io-index)" = "ca8a50ef2360fbd1eeb0ecd46795a87a19024eb4b53c5dc916ca1fd95fe62438" +"checksum twoway 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "6b40075910de3a912adbd80b5d8bad6ad10a23eeb1f5bf9d4006839e899ba5bc" +"checksum unchecked-index 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "eeba86d422ce181a719445e51872fa30f1f7413b62becb52e95ec91aa262d85c" +"checksum unicode-width 0.1.7 (registry+https://github.com/rust-lang/crates.io-index)" = "caaa9d531767d1ff2150b9332433f32a24622147e5ebb1f26409d5da67afd479" +"checksum unicode-xid 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "826e7639553986605ec5979c7dd957c7895e93eabed50ab2ffa7f6128a75097c" +"checksum vec_map 0.8.2 (registry+https://github.com/rust-lang/crates.io-index)" = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191" +"checksum void 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)" = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d" +"checksum wait-timeout 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "9f200f5b12eb75f8c1ed65abd4b2db8a6e1b138a20de009dacee265a2498f3f6" +"checksum wasi 0.9.0+wasi-snapshot-preview1 (registry+https://github.com/rust-lang/crates.io-index)" = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519" +"checksum winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)" = "8093091eeb260906a183e6ae1abdba2ef5ef2257a21801128899c3fc699229c6" +"checksum winapi-i686-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" +"checksum winapi-util 0.1.5 (registry+https://github.com/rust-lang/crates.io-index)" = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178" +"checksum winapi-x86_64-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" diff --git a/Cargo.toml b/Cargo.toml new file mode 100644 index 0000000..aab615f --- /dev/null +++ b/Cargo.toml @@ -0,0 +1,8 @@ +[workspace] +members = [ + "common", + "fuzzer", + "runtime_fast", + "runtime", + "tools/log_reader", +] diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..2b114b7 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,31 @@ +FROM ubuntu:20.04 + +RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections +RUN DEBIAN_FRONTEND=noninteractive apt-get update && \ + apt-get -y upgrade && \ + apt-get install -y git build-essential wget zlib1g-dev golang-go python3-pip python3-dev python-is-python3 build-essential cmake && \ + #apt-get install -y git build-essential wget zlib1g-dev golang-go python-pip python-dev build-essential cmake && \ + apt-get clean + + +ENV RUSTUP_HOME=/usr/local/rustup \ + CARGO_HOME=/usr/local/cargo \ + PIN_ROOT=/pin-3.7-97619-g0d0c92f4f-gcc-linux \ + GOPATH=/go \ + PATH=/clang+llvm/bin:/usr/local/cargo/bin:/parmesan/bin/:/go/bin:$PATH \ + LD_LIBRARY_PATH=/clang+llvm/lib:$LD_LIBRARY_PATH + +RUN mkdir -p parmesan +COPY . parmesan +WORKDIR parmesan + +RUN ./build/install_rust.sh +RUN PREFIX=/ ./build/install_llvm.sh +RUN ./build/install_tools.sh +RUN ./build/build.sh +#RUN ./build/install_pin_mode.sh +# ParmeSan does not support PIN atm + +VOLUME ["/data"] +WORKDIR /data +#ENTRYPOINT [ "/opt/env.init" ] diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..261eeb9 --- /dev/null +++ b/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/README.md b/README.md index 9bef546..38cd379 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,103 @@ -# ParmeSan -ParmeSan: Sanitizer-guided Greybox Fuzzing +# ParmeSan: Sanitizer-guided Greybox Fuzzing -Paper: [ParmeSan: Sanitizer-guided Greybox Fuzzing](https://download.vusec.net/papers/parmesan_sec20.pdf) +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) -The code will be available here soon. +ParmeSan is a sanitizer-guided greybox fuzzer based on +[Angora](https://github.com/AngoraFuzzer/Angora). + +## Published Work + +USENIX Security 2020: [ParmeSan: Sanitizer-guided Greybox Fuzzing](https://www.usenix.org/conference/usenixsecurity20/presentation/osterlund). + +The paper can be found here: [ParmeSan: Sanitizer-guided Greybox Fuzzing](https://download.vusec.net/papers/parmesan_sec20.pdf) + + +## Building ParmeSan +See the instructions for [Angora](https://github.com/AngoraFuzzer). + +Basically run the following scripts to install the dependencies and build ParmeSan: +```bash +build/install_rust.sh +PREFIX=/path/to/install/llvm build/install_llvm.sh +build/install_tools.sh +build/build.sh +``` + +ParmeSan also builds a tool `bin/llvm-diff-parmesan`, which can be used for target +acquisition. + +## Building a target +First build your program into a bitcode file using `clang` (e.g., base64.bc). Then build your target in the same way, but with your selected sanitizer enabled. To get a single bitcode file for larger projects, the easiest solution is to use [gllvm](https://github.com/SRI-CSL/gllvm). + +```bash +# Build the bitcode files for target acquisition +USE_FAST=1 $(pwd)/bin/angora-clang -emit-llvm -o base64.fast.bc -c base64.bc +USE_FAST=1 $(pwd)/bin/angora-clang -fsanitize=address -emit-llvm -o base64.fast.asan.bc -c base64.bc +# Build the actual binaries to be fuzzed +USE_FAST=1 $(pwd)/bin/angora-clang -o base64.fast -c base64.bc +USE_TRACK=1 $(pwd)/bin/angora-clang -o base64.track -c base64.bc +``` + +Then acquire the targets using: +```bash +bin/llvm-diff-parmesan -json base64.fast.bc base64.fast.asan.bc +``` + +This will output a file `targets.json`, which you provide to ParmeSan with the `-c` flag. + +For example: +```bash +$(pwd)/bin/fuzzer -c ./targets.json -i in -o out -t base64.track -- base64.fast -d @@` +``` + +## Options +ParmeSan's SanOpt option can speed up the fuzzing process by dynamically +switching over to a sanitized binary only once the fuzzer reaches one of the +targets specified in the `targets.json` file. + +Enable using the `-s [SANITIZED_BIN]` option. + +Build the sanitized binary in the following way: +```bash +USE_FAST=1 $(pwd)/bin/angora-clang -fsanitize=address -o base64.asan.fast -c base64.bc +``` + +## Targets input file +The targets input file consisit of a JSON file with the following format: +```json +{ + "targets": [1,2,3,4], + "edges": [[1,2], [2,3]], + "callsite_dominators": {"1": [3,4,5]} +} +``` + +Where the targets denote the identify of the cmp instruction to target (i.e., the id assigned by the `__angora_trace_cmp()` calls) and edges is the overlay graph of cmp ids (i.e., which cmps are connected to each other). The `edges` filed can be empty, since ParmeSan will add newly discovered edges automatically, but note that the performance will be better if you provide the static CFG. + +It is also possible to run ParmeSan in pure directed mode (`-D` option), +meaning that it will only consider new seeds if the seed triggers coverage that +is on a direct path to one of the specified targets. Note that this requires a +somewhat complete static CFG to work (an incomplete CFG might contain no paths +to the targets at all, which would mean that no new coverage will be considered +at all). + +![ParmeSan Screenshot](/misc/screenshot.png) + +## How to get started +Have a look at [BUILD_TARGET.md](/BUILD_TARGET.md) for a step-by-step tutorial on how to get started fuzzing with ParmeSan. + +## FAQ + +* Q: I get a warning like `==1561377==WARNING: DataFlowSanitizer: call to uninstrumented function gettext` when running the (track) instrumented program. +* A: In many cases you can ignore this, but it will lose the taint (meaning worse performance). You need to add the function to the abilist (e.g., `llvm_mode/dfsan_rt/dfsan/done_abilist.txt`) and add a custom DFSan wrapper (in `llvm_mode/dfsan_rt/dfsan/dfsan_custom.cc`). See the [Angora documentation](https://github.com/AngoraFuzzer/Angora/blob/master/docs/example.md) for more info. +* Q: I get an compiler error when building the track binary. +* A: ParmeSan/ Angora uses DFSan for dynamic data-flow analysis. In certain cases building target applications can be a bit tricky (especially in the case of C++ targets). Make sure to disable as much inline assembly as possible and make sure that you link the correct libraries/ llvm libc++. Some programs also do weird stuff like an indirect call to a vararg function. This is not supported by DFSan at the moment, so the easy solution is to patch out these calls, or do something like [indirect call promotion](https://llvm.org/devmtg/2015-10/slides/Baev-IndirectCallPromotion.pdf). +* Q: `llvm-diff-parmesan` generates too many targets! +* A: You can do target pruning using the scripts in `tools/` (in particular `tools/prune.py`) or use [ASAP](https://github.com/dslab-epfl/asap) to generate a target bitcode file with fewer sanitizer targets. + +## Docker image +You can also get the pre-built docker image of ParmeSan. + +```bash +docker pull vusec/parmesan +``` diff --git a/angora.env b/angora.env new file mode 100644 index 0000000..05f421b --- /dev/null +++ b/angora.env @@ -0,0 +1,2 @@ +export PATH=/opt/clang-angora/clang+llvm/bin:$PATH +export LD_LIBRARY_PATH=/opt/clang-angora/clang+llvm/lib:$LD_LIBRARY_PATH diff --git a/build/build.sh b/build/build.sh new file mode 100755 index 0000000..55db019 --- /dev/null +++ b/build/build.sh @@ -0,0 +1,38 @@ +#!/bin/bash +BIN_PATH=$(readlink -f "$0") +ROOT_DIR=$(dirname $(dirname $BIN_PATH)) + +set -euxo pipefail + +if ! [ -x "$(command -v llvm-config)" ]; then + ${ROOT_DIR}/build/install_llvm.sh + export PATH=${HOME}/clang+llvm/bin:$PATH + export LD_LIBRARY_PATH=${HOME}/clang+llvm/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH} + export CC=clang + export CXX=clang++ +fi + +PREFIX=${PREFIX:-${ROOT_DIR}/bin/} + +cargo build +cargo build --release + +rm -rf ${PREFIX} +mkdir -p ${PREFIX} +mkdir -p ${PREFIX}/lib +cp target/release/fuzzer ${PREFIX} +cp target/release/*.a ${PREFIX}/lib +cp target/release/log_reader ${PREFIX} + +cd llvm_mode +rm -rf build +mkdir -p build +cd build +cmake -DCMAKE_INSTALL_PREFIX=${PREFIX} -DCMAKE_BUILD_TYPE=Release .. +make # VERBOSE=1 +make install # VERBOSE=1 + +#llvm-diff-parmesan +(cd ${ROOT_DIR}/tools/llvm-diff-parmesan && mkdir -p build && cd build && cmake .. && cmake --build . && cp llvm-diff-parmesan ../../../bin/) +#id-assigner-standalone (HACK) +(cd ${ROOT_DIR}/tools/llvm-diff-parmesan && mkdir -p build-pass && cd build-pass && cmake -DBUILD_STANDALONE_PASS=1 ../id-assigner-pass && cmake --build . && cp src/*.so ../../../bin/pass/) diff --git a/build/build_diff_tool.sh b/build/build_diff_tool.sh new file mode 100755 index 0000000..2a4a4ce --- /dev/null +++ b/build/build_diff_tool.sh @@ -0,0 +1,2 @@ +#llvm-diff-parmesan +(cd tools/llvm-diff-parmesan && mkdir -p build && cd build && cmake .. && cmake --build . && cp llvm-diff-parmesan ../../../bin/) diff --git a/build/install_llvm.sh b/build/install_llvm.sh new file mode 100755 index 0000000..c668560 --- /dev/null +++ b/build/install_llvm.sh @@ -0,0 +1,19 @@ +#!/bin/bash +set -eux + +LINUX_VER=${LINUX_VER:-ubuntu-16.04} +LLVM_VER=${LLVM_VER:-7.0.0} +PREFIX=${PREFIX:-${HOME}} + +LLVM_DEP_URL=https://releases.llvm.org/${LLVM_VER} +TAR_NAME=clang+llvm-${LLVM_VER}-x86_64-linux-gnu-${LINUX_VER} + +wget -q ${LLVM_DEP_URL}/${TAR_NAME}.tar.xz +tar -C ${PREFIX} -xf ${TAR_NAME}.tar.xz +rm ${TAR_NAME}.tar.xz +mv ${PREFIX}/${TAR_NAME} ${PREFIX}/clang+llvm + +set +x +echo "Please set:" +echo "export PATH=\$PREFIX/clang+llvm/bin:\$PATH" +echo "export LD_LIBRARY_PATH=\$PREFIX/clang+llvm/lib:\$LD_LIBRARY_PATH" diff --git a/build/install_pin_mode.sh b/build/install_pin_mode.sh new file mode 100755 index 0000000..6679a75 --- /dev/null +++ b/build/install_pin_mode.sh @@ -0,0 +1,12 @@ +#!/bin/bash + +set -euxo pipefail + +# install pin mode +git init && git submodule update --init --recursive +cd pin_mode/libdft64 +PREFIX=/ ./install_pin.sh +make +cp env.init /opt/ +cd .. +make OBJDIR=../bin/lib/ \ No newline at end of file diff --git a/build/install_rust.sh b/build/install_rust.sh new file mode 100755 index 0000000..1188123 --- /dev/null +++ b/build/install_rust.sh @@ -0,0 +1,18 @@ +#!/bin/bash + +set -euxo pipefail + +# from https://github.com/rust-lang-nursery/docker-rust-nightly/blob/master/nightly/Dockerfile + +url="https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init" +wget "$url" +chmod +x rustup-init +# RUSTUP_DIST_SERVER="https://mirrors.ustc.edu.cn/rust-static" RUSTUP_UPDATE_ROOT="https://mirrors.ustc.edu.cn/rust-static/rustup" +./rustup-init -y --no-modify-path --default-toolchain stable +# ./rustup-init -y --no-modify-path --default-toolchain nightly + +rm rustup-init +chmod -R a+w $RUSTUP_HOME $CARGO_HOME +rustup --version +cargo --version +rustc --version diff --git a/build/install_tools.sh b/build/install_tools.sh new file mode 100755 index 0000000..293fe32 --- /dev/null +++ b/build/install_tools.sh @@ -0,0 +1,12 @@ +#!/bin/bash + +set -euxo pipefail + +#wllvm and gllvm +pip3 install --upgrade pip==9.0.3 +pip3 install wllvm +mkdir ${HOME}/go +go get github.com/SRI-CSL/gllvm/cmd/... + +#llvm-diff-parmesan +#(cd tools/llvm-diff-parmesan && mkdir build && cd build && cmake .. && cmake --build . && cp llvm-diff-parmesan ../../../bin/) diff --git a/common/Cargo.toml b/common/Cargo.toml new file mode 100644 index 0000000..577861b --- /dev/null +++ b/common/Cargo.toml @@ -0,0 +1,11 @@ +[package] +name = "angora_common" +version = "1.2.2" +authors = ["sp1npx "] +edition = "2018" + +[dependencies] +serde="1.0" +serde_derive = "1.0" +bincode = "1.0" +libc = "0.2" diff --git a/common/src/cond_stmt_base.rs b/common/src/cond_stmt_base.rs new file mode 100644 index 0000000..3aaa76e --- /dev/null +++ b/common/src/cond_stmt_base.rs @@ -0,0 +1,83 @@ +use crate::defs::*; +use serde_derive::{Deserialize, Serialize}; + +#[derive(Debug, Clone, Default, Copy, Serialize, Deserialize)] +#[repr(C)] // It should be repr C since we will used it in shared memory +pub struct CondStmtBase { + pub cmpid: u32, + pub context: u32, + pub last_callsite: u32, + pub order: u32, + pub belong: u32, + + pub condition: u32, + pub level: u32, + pub op: u32, + pub size: u32, + + pub lb1: u32, + pub lb2: u32, + + pub arg1: u64, + pub arg2: u64, +} + +/* +#[derive(Serialize, Deserialize, PartialEq, Debug, Clone)] +pub struct CondStmtMb { + pub base: CondStmtBase, + pub magic_bytes: Option<(Vec, Vec)>, +} +*/ + +impl PartialEq for CondStmtBase { + fn eq(&self, other: &CondStmtBase) -> bool { + self.cmpid == other.cmpid && self.context == other.context && self.order == other.order + } +} + +impl Eq for CondStmtBase {} + +impl CondStmtBase { + pub fn flip_condition(&mut self) { + if self.condition == COND_FALSE_ST { + self.condition = COND_TRUE_ST; + } else { + self.condition = COND_FALSE_ST; + } + } + pub fn is_explore(&self) -> bool { + self.op <= COND_MAX_EXPLORE_OP + } + + pub fn is_exploitable(&self) -> bool { + self.op > COND_MAX_EXPLORE_OP && self.op <= COND_MAX_EXPLOIT_OP + } + + pub fn is_signed(&self) -> bool { + (self.op & COND_SIGN_MASK) > 0 + || ((self.op & COND_BASIC_MASK) >= COND_ICMP_SGT_OP + && (self.op & COND_BASIC_MASK) <= COND_ICMP_SLE_OP) + } + + pub fn is_afl(&self) -> bool { + self.op == COND_AFL_OP + } + + pub fn may_be_bool(&self) -> bool { + // sign or unsigned + self.op & 0xFF == COND_ICMP_EQ_OP && self.arg1 <= 1 && self.arg2 <= 1 + } + + pub fn is_float(&self) -> bool { + (self.op & COND_BASIC_MASK) <= COND_FCMP_TRUE + } + + pub fn is_switch(&self) -> bool { + (self.op & COND_BASIC_MASK) == COND_SW_OP + } + + pub fn is_done(&self) -> bool { + self.condition == COND_DONE_ST + } +} diff --git a/common/src/config.rs b/common/src/config.rs new file mode 100644 index 0000000..27d8d86 --- /dev/null +++ b/common/src/config.rs @@ -0,0 +1,45 @@ +// ************ Switches ************** +// length +pub const ENABLE_INPUT_LEN_EXPLORATION: bool = true; +pub const ENABLE_RANDOM_LEN: bool = false; +pub const ENABLE_MICRO_RANDOM_LEN: bool = true; + +// other +pub const DISABLE_INFER_SHAPE_IF_HAS_AND_OP: bool = true; +pub const PREFER_FAST_COND: bool = true; + +// ************ Resources **************** +pub const MAX_INPUT_LEN: usize = 15000; + +// branch.rs +pub const MAP_SIZE_POW2: usize = 20; +pub const BRANCHES_SIZE: usize = 1 << MAP_SIZE_POW2; + +// executor.rs: +pub const TMOUT_SKIP: usize = 3; +pub const TIME_LIMIT: u64 = 1; +pub const MEM_LIMIT: u64 = 200; // MB +pub const TIME_LIMIT_TRACK: u64 = 12; +pub const MEM_LIMIT_TRACK: u64 = 0; +pub const LONG_FUZZ_TIME: usize = 8; +pub const MAX_INVARIABLE_NUM: usize = 16; +pub const MAX_NUM_MINIMAL_OPTIMA_ALL: usize = 28; +// based the bit bucket: [1], [2], [3], [4, 7], [8, 15], [16, 31], [32, 127], [128, infinity] +pub const MAX_COND_ORDER: u32 = 16; + +// ************ Mutation **************** +// SEARCH +pub const ENABLE_DET_MUTATION: bool = true; +pub const MAX_SEARCH_EXEC_NUM: usize = 376; +pub const MAX_EXPLOIT_EXEC_NUM: usize = 66; +pub const MAX_NUM_MINIMAL_OPTIMA_ROUND: usize = 8; +pub const MAX_RANDOM_SAMPLE_NUM: usize = 10; +pub const GD_MOMENTUM_BETA: f64 = 0.0; +pub const GD_ESCAPE_RATIO: f64 = 1.0; +pub const BONUS_EXEC_NUM: usize = 66; + +// AFL +pub const MUTATE_ARITH_MAX: u32 = 30; +pub const RANDOM_LEN_NUM: usize = 30; +pub const MAX_HAVOC_FLIP_TIMES: usize = 45; // for all bytes +pub const MAX_SPLICE_TIMES: usize = 45; diff --git a/common/src/defs.rs b/common/src/defs.rs new file mode 100644 index 0000000..35b907c --- /dev/null +++ b/common/src/defs.rs @@ -0,0 +1,105 @@ +use std; +// -- envs +pub static DISABLE_CPU_BINDING_VAR: &str = "ANGORA_DISABLE_CPU_BINDING"; +pub static ANGORA_BIN_DIR: &str = "ANGORA_BIN_DIR"; + +// executor.rs +pub static TRACK_OUTPUT_VAR: &str = "ANGORA_TRACK_OUTPUT"; +pub static COND_STMT_ENV_VAR: &str = "ANGORA_COND_STMT_SHM_ID"; +pub static BRANCHES_SHM_ENV_VAR: &str = "ANGORA_BRANCHES_SHM_ID"; +pub static LD_LIBRARY_PATH_VAR: &str = "LD_LIBRARY_PATH"; +pub static ASAN_OPTIONS_VAR: &str = "ASAN_OPTIONS"; +pub static MSAN_OPTIONS_VAR: &str = "MSAN_OPTIONS"; +pub static ASAN_OPTIONS_CONTENT: &str = + "abort_on_error=1:detect_leaks=0:symbolize=0:allocator_may_return_null=1"; +pub const MSAN_ERROR_CODE: i32 = 86; +pub static MSAN_OPTIONS_CONTENT: &str = + "exit_code=86:symbolize=0:abort_on_error=1:allocator_may_return_null=1:msan_track_origins=0"; + +// depot.rs +pub static CRASHES_DIR: &str = "crashes"; +pub static HANGS_DIR: &str = "hangs"; +pub static INPUTS_DIR: &str = "queue"; + +// forksrv.rs +pub static ENABLE_FORKSRV: &str = "ANGORA_ENABLE_FORKSRV"; +pub static FORKSRV_SOCKET_PATH_VAR: &str = "ANGORA_FORKSRV_SOCKET_PATH"; + +// command.rs +pub static ANGORA_DIR_NAME: &str = "angora"; +pub static ANGORA_LOG_FILE: &str = "angora.log"; +pub static COND_QUEUE_FILE: &str = "cond_queue.csv"; +pub static CHART_STAT_FILE: &str = "chart_stat.json"; + +pub const SLOW_SPEED: u32 = 888888; +pub const UNREACHABLE: u64 = std::u64::MAX; + +// ** Cond Type +// < 0xFF: simple if +// http://llvm.org/doxygen/InstrTypes_8h_source.html +// Opcode U L G E Intuitive operation +pub const COND_FCMP_FALSE: u32 = 0; +///< 0 0 0 0 Always false (always folded) +pub const COND_FCMP_OEQ: u32 = 1; +///< 0 0 0 1 True if ordered and equal +pub const COND_FCMP_OGT: u32 = 2; +///< 0 0 1 0 True if ordered and greater than +pub const COND_FCMP_OGE: u32 = 3; +///< 0 0 1 1 True if ordered and greater than or equal +pub const COND_FCMP_OLT: u32 = 4; +///< 0 1 0 0 True if ordered and less than +pub const COND_FCMP_OLE: u32 = 5; +///< 0 1 0 1 True if ordered and less than or equal +pub const COND_FCMP_ONE: u32 = 6; +///< 0 1 1 0 True if ordered and operands are unequal +pub const COND_FCMP_ORD: u32 = 7; +///< 0 1 1 1 True if ordered (no nans) +pub const COND_FCMP_UNO: u32 = 8; +///< 1 0 0 0 True if unordered: isnan(X) | isnan(Y) +pub const COND_FCMP_UEQ: u32 = 9; +///< 1 0 0 1 True if unordered or equal +pub const COND_FCMP_UGT: u32 = 10; +///< 1 0 1 0 True if unordered or greater than +pub const COND_FCMP_UGE: u32 = 11; +///< 1 0 1 1 True if unordered; greater than; or equal +pub const COND_FCMP_ULT: u32 = 12; +///< 1 1 0 0 True if unordered or less than +pub const COND_FCMP_ULE: u32 = 13; +///< 1 1 0 1 True if unordered; less than; or equal +pub const COND_FCMP_UNE: u32 = 14; +///< 1 1 1 0 True if unordered or not equal +pub const COND_FCMP_TRUE: u32 = 15; +///< 1 1 1 1 Always true (always folded) + +pub const COND_ICMP_EQ_OP: u32 = 32; +pub const COND_ICMP_NE_OP: u32 = 33; +pub const COND_ICMP_UGT_OP: u32 = 34; +pub const COND_ICMP_UGE_OP: u32 = 35; +pub const COND_ICMP_ULT_OP: u32 = 36; +pub const COND_ICMP_ULE_OP: u32 = 37; +pub const COND_ICMP_SGT_OP: u32 = 38; +pub const COND_ICMP_SGE_OP: u32 = 39; +pub const COND_ICMP_SLT_OP: u32 = 40; +pub const COND_ICMP_SLE_OP: u32 = 41; +pub const COND_SW_OP: u32 = 0x00FF; + +pub const COND_BASIC_MASK: u32 = 0xFF; +pub const COND_SIGN_MASK: u32 = 0x100; +pub const COND_BOOL_MASK: u32 = 0x200; +// pub const COND_CALL_MASK: u32 = 0x400; +// pub const COND_CALL_REV_MASK: u32 = 0xFBFF; + +pub const COND_MAX_EXPLORE_OP: u32 = 0x4000 - 1; +pub const COND_MAX_EXPLOIT_OP: u32 = 0x5000 - 1; + +pub const COND_AFL_OP: u32 = 0x8001; +// sensititve offsets +pub const COND_FN_OP: u32 = 0x8002; +pub const COND_LEN_OP: u32 = 0x8003; +// pub const COND_ENTER_FN: u32 = 0x8010; +// pub const COND_LEAVE_FN: u32 = 0x8011; + +// condition field +pub const COND_FALSE_ST: u32 = 0; +pub const COND_TRUE_ST: u32 = 1; +pub const COND_DONE_ST: u32 = 2; diff --git a/common/src/lib.rs b/common/src/lib.rs new file mode 100644 index 0000000..958563d --- /dev/null +++ b/common/src/lib.rs @@ -0,0 +1,14 @@ +pub mod cond_stmt_base; +pub mod config; +pub mod defs; +pub mod log_data; +pub mod shm; +pub mod tag; + + +// void __unfold_branch_fn(uint32_t) {} + +#[no_mangle] +pub fn __unfold_branch_fn(_x: u32) { + +} diff --git a/common/src/log_data.rs b/common/src/log_data.rs new file mode 100644 index 0000000..e875148 --- /dev/null +++ b/common/src/log_data.rs @@ -0,0 +1,20 @@ +use crate::{cond_stmt_base::CondStmtBase, tag::TagSeg}; +use serde_derive::{Deserialize, Serialize}; +use std::collections::HashMap; + +#[derive(Serialize, Deserialize, PartialEq, Debug)] +pub struct LogData { + pub cond_list: Vec, + pub tags: HashMap>, + pub magic_bytes: HashMap, Vec)>, +} + +impl LogData { + pub fn new() -> Self { + Self { + cond_list: vec![], + tags: HashMap::new(), + magic_bytes: HashMap::new(), + } + } +} diff --git a/common/src/shm.rs b/common/src/shm.rs new file mode 100644 index 0000000..7e48b30 --- /dev/null +++ b/common/src/shm.rs @@ -0,0 +1,113 @@ +use libc; +use std::{ + self, + ops::{Deref, DerefMut}, +}; + +// T must be fixed size +pub struct SHM { + id: i32, + size: usize, + ptr: *mut T, +} + +impl SHM { + pub fn new() -> Self { + let size = std::mem::size_of::() as usize; + let id = unsafe { + libc::shmget( + libc::IPC_PRIVATE, + size, + libc::IPC_CREAT | libc::IPC_EXCL | 0o600, + ) + }; + let ptr = unsafe { libc::shmat(id, std::ptr::null(), 0) as *mut T }; + + SHM:: { + id: id as i32, + size, + ptr, + } + } + + pub fn from_id(id: i32) -> Self { + let size = std::mem::size_of::() as usize; + let ptr = unsafe { libc::shmat(id as libc::c_int, std::ptr::null(), 0) as *mut T }; + SHM:: { id, size, ptr } + } + + pub fn clear(&mut self) { + unsafe { libc::memset(self.ptr as *mut libc::c_void, 0, self.size) }; + } + + pub fn get_id(&self) -> i32 { + self.id + } + + pub fn get_ptr(&self) -> *mut T { + self.ptr + } + + pub fn is_fail(&self) -> bool { + -1 == self.ptr as isize + } + +} + +impl Deref for SHM { + type Target = T; + fn deref(&self) -> &Self::Target { + unsafe { &*self.ptr } + } +} + +impl DerefMut for SHM { + fn deref_mut(&mut self) -> &mut Self::Target { + unsafe { &mut *self.ptr } + } +} + +impl std::fmt::Debug for SHM { + fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result { + write!(f, "{}, {}, {:p}", self.id, self.size, self.ptr) + } +} + +impl Drop for SHM { + fn drop(&mut self) { + unsafe { libc::shmctl(self.id, libc::IPC_RMID, std::ptr::null_mut()) }; + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn test_u8() { + let mut one = SHM::::new(); + *one = 1; + assert_eq!(1, *one); + } + + #[test] + fn test_array() { + let mut arr = SHM::<[u8; 10]>::new(); + arr.clear(); + let sl = &mut arr; + assert_eq!(0, sl[4]); + sl[4] = 33; + assert_eq!(33, sl[4]); + } + + #[test] + fn test_shm_fail() { + let arr = SHM::<[u8; 10]>::from_id(88888888); + assert!(arr.is_fail()); + + let arr = SHM::<[u8; 10]>::new(); + assert!(!arr.is_fail()); + let arr2 = SHM::<[u8; 10]>::from_id(arr.get_id()); + assert!(!arr2.is_fail()); + } +} diff --git a/common/src/tag.rs b/common/src/tag.rs new file mode 100644 index 0000000..b54b9cd --- /dev/null +++ b/common/src/tag.rs @@ -0,0 +1,19 @@ +use serde_derive::{Deserialize, Serialize}; + +#[derive(Serialize, Deserialize, PartialEq, Eq, Debug, Clone, Copy, Hash)] +#[repr(C)] +pub struct TagSeg { + pub sign: bool, + pub begin: u32, + pub end: u32, +} + +// impl TagSeg { +// pub fn slice_from<'a>(&self, v: &'a [u8]) -> &'a [u8] { +// &v[(self.begin as usize)..(self.end as usize)] +// } + +// pub fn slice_from_mut<'a>(&self, v: &'a mut [u8]) -> &'a mut [u8] { +// &mut v[(self.begin as usize)..(self.end as usize)] +// } +// } diff --git a/docs/build_target.md b/docs/build_target.md new file mode 100644 index 0000000..3c0aafd --- /dev/null +++ b/docs/build_target.md @@ -0,0 +1,127 @@ +# Building a Target Program + +Angora currently only supports compile time instrumentation. Two instrumented +copies of the target program are required, specifically one with taint tracking +support and one with branch and constraint information counting. + +The process of building each copy is mostly identical. The resulting program is +dependent on using the environment variables `USE_FAST` and `USE_TRACK`. The +configuration result can be used across both compile processes, thus one would +only need to store one compiled version elsewhere before compiling the other +version. + +We have also added support for wllvm. + +### Makefile + +*If the root directory of the project contains `configure`, use the method for autoconf.* + +The following commands assume that the Makefile uses the `CC` and `CXX` +environment variables. Manual changes should be made if otherwise. + +``` +CC=/path-to-angora/bin/angora-clang CXX=/path-to-angora/bin/angora-clang++ make +USE_TRACK=1 CC=/path-to-angora/bin/angora-clang CXX=/path-to-angora/bin/angora-clang++ make +``` + +### autoconf + +*If configuration fails, check if the LD_LIBRARY_PATH environment variable contains +the path for `libruntime` and `libruntime_fast`.* + +*Some projects also requires the `LD` environment variable to be set to `angora-clang` for compilation.* + +*Dynamic linking should be disabled due to DFSan implementation reasons.* + +``` +# Many autoconf scripts allow the use of --disable-shared switch to disable +# dynamic linking. +CC=/path-to-angora/bin/angora-clang CXX=/path-to-angora/bin/angora-clang++ \ + ./configure +make # default: USE_FAST=1 +USE_TRACK=1 make +``` + +### cmake +``` +cmake -DCMAKE_C_COMPILER=/path-to-angora/bin/angora-clang \ + -DCMAKE_CXX_COMPILER=/path-to-angora/bin/angora-clang++ \ + -DBUILD_SHARED_LIBS=OFF ../src +make # default: USE_FAST=1 +USE_TRACK=1 make +``` + +### wllvm (or gllvm) + +- [wllvm](https://github.com/travitch/whole-program-llvm) +- [gllvm](https://github.com/SRI-CSL/gllvm) + +``` +sudo pip install wllvm +export LLVM_COMPILER=clang +CC=wllvm CFLAGS=-O0 ./configure --disable-shared +make +extract-bc xx +# You should add the shared libraries here, e.g. -lz +/path-to-angora/bin/angora-clang xx.bc -o xx.fast +USE_TRACK=1 /path-to-angora/bin/angora-clang xx.bc -o xx.taint +``` + +The running result of Angora that use wllvm/gllvm may be different from compiling directly because of compiler optimization. + +## Build external libraries +If the external libraries are your targets (e.g. you are interested and want solve constraints in them), +we can use `USE_TRACK=1 make` to compile them. +Otherwise, we can use following rules to propagate taints while our program enters their code. +Here, we use zlib as example. + +### Model an external library +View it as a blackbox, and define models for them. See rules in https://clang.llvm.org/docs/DataFlowSanitizer.html. +- ignore this library + +``` +./angora/tools/gen_library_abilist.sh /usr/lib/x86_64-linux-gnu/libz.so discard > zlib_abilist.txt +export ANGORA_TAINT_RULE_LIST=/path-to/zlib_abilist.txt +``` + +- use functional rules + +``` +./angora/tools/gen_library_abilist.sh /usr/lib/x86_64-linux-gnu/libz.so functional > zlib_abilist.txt +export ANGORA_TAINT_RULE_LIST=/path-to/zlib_abilist.txt +``` + +- use custom rules +Example: how to custom `crc32` function in `zlib` library. (see `llvm_mode/external_lib` directory) + +``` +# rename only certain functions to be custom after: +./angora/tools/gen_library_abilist.sh /usr/lib/x86_64-linux-gnu/libz.so discard > zlib_abilist.txt + +# or set all as custom (not recommended) +./angora/tools/gen_library_abilist.sh /usr/lib/x86_64-linux-gnu/libz.so custom > zlib_abilist.txt + +export ANGORA_TAINT_RULE_LIST=/path-to/zlib_abilist.txt +# write your custom function, e.g. llvm_mode/external_lib/zlib-func.c and llvm_mode/external_lib/zlib_abilist.txt +# compile it and +export ANGORA_TAINT_CUSTOM_RULE=/path-to/zlib-func.o +``` + + +### Build External Libraries with DFSan Support +Use `USE_DFSAN=1 make` to build them. + +## Build C++ program and C++ standard library +- C++ program: CXX=/path-to-angora/bin/angora-clang++ or -DCMAKE_CXX_COMPILER=... +- C++ standard library: we have built one under ubuntu 16.04 64bits in llvm_mode/libcxx. You can built it by yourself with the following commands and move the libraries to llvm_mode/libcxx directory and bin/lib. (run libcxx_dfsan/compile.sh) + +``` +# http://lists.llvm.org/pipermail/cfe-dev/2015-January/040876.html +# install cmake ninja and download LLVM&CLANG source code +CC=~/angora/bin/angora-clang CXX=~/angora/bin/angora-clang++ cmake -G Ninja ../llvm -DLIBCXXABI_ENABLE_SHARED=NO -DLIBCXX_ENABLE_SHARED=NO -DLLVM_FORCE_USE_OLD_TOOLCHAIN=YES -DLIBCXX_CXX_ABI=libcxxabi +USE_DFSAN=1 ninja cxx cxxabi +# move them to llvm_mode/libcxx and bin/lib +``` + +## Add taints in input functions +Angora models most input functions in `llvm_mode/external_lib/io-func.c`. But it doesn't support some input functions like `scanf` or other input function in external libraries. You can add taints by yourself by the approach described in *Model an external library*. For example, program `who` use `getutxent` to read input, and we add taints in `__dfsw_getutxent` in `io-func.c` file. \ No newline at end of file diff --git a/docs/configuration.md b/docs/configuration.md new file mode 100644 index 0000000..c842c8c --- /dev/null +++ b/docs/configuration.md @@ -0,0 +1,6 @@ +# Configuration Files + +- `llvm_mode/include/defs.h`: Configuration and definition file for llvm pass. +- `llvm_mode/rules/angora_abilist.txt` : Taint propagation rules for functions in libraries in llvm mode. +- `llvm_mode/rules/exploitation_list.txt` : Security sensitive functions or instructions in llvm mode. +- `common/src/config.rs`: Configuration file for fuzzer. diff --git a/docs/coverage.md b/docs/coverage.md new file mode 100644 index 0000000..3cc8654 --- /dev/null +++ b/docs/coverage.md @@ -0,0 +1,31 @@ +# Evaluate coverage +- tool: [afl-cov](https://github.com/mrash/afl-cov) + +# Install gcov and genhtml +``` +sudo apt-get install lcov + +``` + +# build +- make +``` +CC=gcc CFLAGS="-fprofile-arcs -ftest-coverage -g -O0" LFLAGS="-lgcov --coverage" make +``` + +- autoconf +``` +CFLAGS="-fprofile-arcs -ftest-coverage -g -O0" LIBS=-lgcov ../src/configure --prefix=`pwd`/install --disable-shared +``` + +- cmake +``` +cmake -DENABLE_GCOV -DBUILD_SHARED_LIBS=OFF -DCMAKE_BUILD_TYPE=Debug ../src + +option(ENABLE_GCOV "Enable gcov." Off) +if (ENABLE_GCOV) + SET(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} -fprofile-arcs -ftest-coverage") + SET(CMAKE_C_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG} -fprofile-arcs -ftest-coverage") + SET(CMAKE_EXE_LINKER_FLAGS_DEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG} -fprofile-arcs -ftest-coverage -lgcov") + endif() +``` diff --git a/docs/environment_variables.md b/docs/environment_variables.md new file mode 100644 index 0000000..64f5a57 --- /dev/null +++ b/docs/environment_variables.md @@ -0,0 +1,18 @@ +# Environment variables for compiling + +- `USE_FAST=1`: use fast mode to compile the program. It includes branch counting, getting the feedback of the fuzzing constraint (the output of its function). +- `USE_TRACK=1`: use taint tracking and collect all constraints. +- `USE_DFSAN=1`: use taint tracking. +- `ANGORA_CUSTOM_FN_CONTEXT=k` : Use only the last k ( 0 <= k <= 32) function call location as the context, e.g. `ANGORA_CUSTOM_FN_CONTEXT=8`. Angora disables context if k is 0. +- `ANGORA_GEN_ID_RANDOM=1` : Generate ids for predicates randomly instead of the hash of their locations. +- `ANGORA_OUTPUT_COND_LOC=1` : (Debug option) Output the location of each predicate during compiling. +- `ANGORA_TAINT_CUSTOM_RULE=/path/to/object` : object contains those proxy function (how to propagate taints), e.g. `ANGORA_TAINT_CUSTOM_RULE=~/angora/bin/lib/zlib-func.o` . You should add it as custom type in the file passed by `ANGORA_TAINT_RULE_LIST` first. +- `ANGORA_TAINT_RULE_LIST=/path/to/list` : DataFlowSanitizer’s [ABI list](https://clang.llvm.org/docs/DataFlowSanitizer.html), e.g. `ANGORA_TAINT_RULE_LIST=~/angora/bin/rules/zlib_abilist.txt`. +- `ANGORA_INST_RATIO`: + +# Environment variables for running + +- `RUST_LOG=trace`: enable tracing output +- `RUST_LOG=debug`: enable debugging output +- `ANGORA_DISABLE_CPU_BINDING=1`: Disable cpu binding. + diff --git a/docs/example.md b/docs/example.md new file mode 100644 index 0000000..b652197 --- /dev/null +++ b/docs/example.md @@ -0,0 +1,109 @@ +# Fuzz program *file* by Angora + +## Build programs + +### Download +``` sh +wget https://github.com/file/file/archive/FILE5_32.tar.gz +tar -xvzf FILE5_32.tar.gz +``` + +### Compile program for tracking +``` sh +cp -r file-FILE5_32 track +cd track +autoreconf -i +CC=~/angora/bin/angora-clang ./configure --prefix=`pwd`/install --disable-shared + +USE_TRACK=1 make +``` + +We found some errors: +``` +/usr/bin/ld: ./.libs/libmagic.a(compress.o): in function `uncompresszlib': +/home/xx/example/track/src/compress.c:507: undefined reference to `dfs$inflateInit_' +/usr/bin/ld: /home/xx/example/track/src/compress.c:507: undefined reference to `dfs$inflateInit2_' +/usr/bin/ld: /home/xx/example/track/src/compress.c:511: undefined reference to `dfs$inflate' +/usr/bin/ld: /home/xx/example/track/src/compress.c:516: undefined reference to `dfs$inflateEnd' +/usr/bin/ld: /home/xx/example/track/src/compress.c:525: undefined reference to `dfs$zError' +``` +Because *file* depends on *zlib*, we should models *zlib*'s function in taint analysis. we create a file call *zlib_abilist.txt*, and it contains: +``` +fun:inflateInit_=uninstrumented +fun:inflateInit2_=uninstrumented +fun:inflateInit2__=uninstrumented +fun:inflate=uninstrumented +fun:inflateEnd=uninstrumented +fun:zError=uninstrumented +fun:inflateInit_=discard +fun:inflateInit2_=discard +fun:inflateInit2__=discard +fun:inflate=discard +fun:inflateEnd=discard +fun:zError=discard +``` +We ignore all taints while calling *zlib*'s function. +You also can get it by: (described in [Build Target](./build_target.md)) +``` +./angora/tools/gen_library_abilist.sh /usr/lib/x86_64-linux-gnu/libz.so discard > zlib_abilist.txt +``` + +Then, we set it in our environment and compile again. +``` +export ANGORA_TAINT_RULE_LIST=~/path-to/zlib_abilist.txt +make clean +USE_TRACK=1 make +make install +``` + +### Compile program for branch counting +``` sh +cd .. +cp -r file-FILE5_32 fast +cd fast +autoreconf -i +CC=~/angora/bin/angora-clang ./configure --prefix=`pwd`/install --disable-shared +make +make install +``` + + +## Seeds +``` +cd .. +mkdir seeds +echo "Hello World" > seeds/seed.txt +``` + +## Run Angora + +``` + ~/angora/angora_fuzzer -i seeds -o output -t ./track/install/bin/file -- ./fast/install/bin/file -m ./fast/install/share/misc/magic.mgc @@ +``` + +## Re-run +``` +# Termination with ^C +~/angora/angora_fuzzer -i - -o output -t ./track/install/bin/file -- ./fast/install/bin/file -m ./fast/install/share/misc/magic.mgc @@ +``` + +## Run alongside AFL +Angora has implemented some AFL like random mutation approaches, but they are too simple. You can disable it and run Angora alongside AFL. +### Build with AFL +``` +cp -r file-FILE5_32 afl +cd afl +autoreconf -i +CC=~/afl/afl-clang-fast ./configure --prefix=`pwd`/install --disable-shared +make +make install +``` + +### Run!!! +``` +~/afl/afl-fuzz -i seeds -o output -S afl_s -- ./afl/install/bin/file @@ + +# --sync_afl to allow sync seeds with AFL +# -A to disable AFL's random mutation in Angora. +~/angora/angora_fuzzer --sync_afl -A -i seeds -o output -t ./track/install/bin/file -- ./fast/install/bin/file -m ./fast/install/share/misc/magic.mgc @@ +``` diff --git a/docs/exploitation.md b/docs/exploitation.md new file mode 100644 index 0000000..d432055 --- /dev/null +++ b/docs/exploitation.md @@ -0,0 +1,13 @@ +# Exploitation + +As BuzzFuzz, Angora supports finding which input bytes were processed by "attack point" we defined by taint tracking. You can add your custom "attack point" in `llvm_mode/rules/exploitation_list.txt`, and then recompile the tested program. + +``` +# the 2th(start from 0) argument of function memeset is an attack point +fun:memset:i2 +# the 0th argument of instruction (LLVM IR) inttoptr is an attack point +ins:inttoptr=i0 +``` + +## Reference +- Vijay Ganesh, Tim Leek, and Martin Rinard. “Taintbased directed whitebox fuzzing”. In: Proceedings of the 31st International Conference on Software Engineering. 2009, pp. 474–484. \ No newline at end of file diff --git a/docs/lava-who-fix.md b/docs/lava-who-fix.md new file mode 100644 index 0000000..9f57c9e --- /dev/null +++ b/docs/lava-who-fix.md @@ -0,0 +1,86 @@ +# LAVA-M `who` Dataset Performance Analysis + +This fix log explains the numerous improvements that went into Angora and their +purposes in improving the performance on the LAVA-M dataset. + +## Taint Propagation in Allocation Functions (Solved) + +The `who` program calls `x2nrealloc()` while parsing the input `utmp` structs. +`x2nrealloc()` in turn calls the standard C library function `realloc()`, thus +requiring our taint propagation rules to conform to the semantics of `*alloc()` +functions. Since `realloc()` may change the base address of the heap chunk, an +efficient strategy would be to determine whether the base has changed and copy +the corresponding labels to the destination address if required. + +This strategy would require that our runtime libraries hook to standard library +allocation functions to correctly propagate the taint labels. Since we should +preserve the relationships between each byte and their corresponding label, we +would have to save the allocation size of the heap chunk. An easy solution +would be to record the base and bound of a chunk within the chunk itself. +However, some `libc` functions allocate heap memory internally and statically +link to `*alloc()` functions, rendering this method impractical. + +### Solution: Saving allocation metadata in a HashMap + +The solution to this problem is to utilize a HashMap to record the +base and bound information for allcoations. This only requires modifications to +the `__dfsw_*alloc()` functions. The HashMap insertion, deletion and querying +operations are implemented in Rust. The HashMap uses base pointer values as the +key and bound values as the value. Minimal instrumentation is required for this +approach. The source code can be found in the repository under the `llvm_mode/external_lib` +directory. + +## Path Coverage (Unsolved) + +There are also implicit dependencies within `who`. A simplified version would +be: + +``` +time_t boottime = TYPE_MINIMUM (time_t); +... +while (n--) + { + if (utmp_buf->type == 7) { + lava_1234 = boottime... + } + + ... + + if (utmp_buf->type == 2) { + boottime = utmp_buf->time... + } + utmp_buf++; + } +``` + +The code requires that a previous element in the input array should have its +`type` member set to 2 while the current element should have its `type` member +set to 7 so that input values are given to boottime, in turn allowing `lava_*` +variables to receive the value. + +Solving this type of bugs would require recording path coverage, a problem +neither AFL nor Angora aims to solve. + +## Member Variable Size in Struct (Partially Solved) + +A few unsolved cases have their test values assembled from bytes taken from a +string in a struct, like the example below: + +``` +int lava_1234 = 0; +char * host = ... ; // Get a string from input +lava_1234 |= ((uchar *) (host))[0] << (0*8); +lava_1234 |= ((uchar *) (host))[1] << (1*8); +lava_1234 |= ((uchar *) (host))[2] << (2*8); +lava_1234 |= ((uchar *) (host))[3] << (3*8); +... +``` + +LAVA introduces an problem where the length of the string could be less than 4 +bytes. This would result in the remaining bytes not being properly tainted, +therefore the condition cannot be solved reliably. + +The current workaround is to provide the fuzzer with a seed that ensures +the length of each member variable is greater than 4, ensuring that the +`lava_*` variables can be fully tainted. + diff --git a/docs/lava.md b/docs/lava.md new file mode 100644 index 0000000..86e17e6 --- /dev/null +++ b/docs/lava.md @@ -0,0 +1,108 @@ +# Run Angora on LAVA dataset +- Dataset: [Download](http://panda.moyix.net/~moyix/lava_corpus.tar.xz) + +## Compile +In this tutorial, we use [gllvm](https://github.com/SRI-CSL/gllvm) to get LLVM bitcode, then use Angora to compile it. But you can choose other compile approach described in [Building a Target Program](build_target.md). + +``` sh +# we use base64 as the example, the other three programs are the same. +cd /path-to-base64/ +CC=gclang CFLAGS="-g -O0" ./configure --disable-shared --prefix=`pwd`/lava-install +make +get-bc base64 +~/angora-open-source/bin/angora-clang base64.bc -o base64.fast +USE_TRACK=1 ~/angora-open-source/bin/angora-clang base64.bc -o base64.tt +``` + +## base64 +- seeds: any random input +- command +``` +~/angora/angora_fuzzer -i ./input -o ./output -j 1 -t ./base64.tt -- ./base64.fast -d @@ +``` +- validation: `python3 ~/angora/tools/lava_validation.py ./output /path-to-lava/LAVA-M/base64/validated_bugs ./base64 -d` +- we can find 48 bugs. Also unlisted bugs: [274, 521, 526, 527]. + +## md5sum + +- Fix lava bugs (they exists in my environment). +``` c +// In src/md5sum.c line 541 +- char *filename IF_LINT ( = NULL); ++ char* filename = NULL; +// In src/md5sum.c line 543 +- unsigned char *hex_digest IF_LINT ( = NULL); ++ unsigned char *hex_digest = NULL; +``` +- seeds: md5sum need providing real program in your file system to check the md5 digests. Otherwise, Angora can't pass those checks. +``` +870c9a2edda2a9400179487e4be0f8fe /bin/tempfile +43ff9c3b7c5f3d045feb32ca6bad3348 /bin/touch +1091007513eea6d4158a3563ae3be888 /bin/rm +1091007513eea6d4158a3563ae3be888 /bin/rm +``` + +- command +``` +~/angora/angora_fuzzer -i ./input -o ./output -j 1 -t ./md5sum.tt -- ./md5sum.fast -c @@ +``` +- Angora can find 57 bugs, including 4 unlisted bugs: [281, 287, 314, 499]. But Angora can not find [555, 387, 571, 305]. Because the related variables for these bugs are collected in line 618-631 in src/md5sum.c, they can not be visited if we have set hex_digest as NULL to fix the *real* bug. + +## uniq +- uniq may use some inline code to read input. We need to modify the makefile to make it use a libc function call to read input, so we can hook these functions. +```sh +# run below scripts after configure +find . -type f -name "*.h" -exec sed -i 's/#define\s*HAVE_GETC_UNLOCKED\s*[0-9]/#undef HAVE_GETC_UNLOCKED/' {} + +find . -type f -name "*.h" -exec sed -i 's/#define\s*HAVE_DECL_GETC_UNLOCKED\s*[0-9]/#undef HAVE_GETC_UNLOCKED/' {} + +``` + +## who +- seeds: we create a minimal seed by: +``` c +#include +#include +#include +int main() { + struct utmp *u; + while((u = getutent())) + { + FILE *f1 = fopen("utmp0", "wb"); + int r1 = fwrite(u, sizeof (struct utmp), 1, f1); + fclose(f1); + + break; + } + endutent(); +} +``` + +- the program who won't output bug id, so we need modify `src/who.c` +```c +// move to somewhere after #include "..." +unsigned int lava_get(unsigned int bug_num) { + +#define SWAP_UINT32(x) (((x) >> 24) | (((x) & 0x00FF0000) >> 8) | (((x) & 0x0000FF00) << 8) | ((x) << 24)) + if (0x6c617661 - bug_num == lava_val[bug_num] || + SWAP_UINT32(0x6c617661 - bug_num) == lava_val[bug_num]) { + printf("Successfully triggered bug %d, crashing now!\n", bug_num); + fflush(0); + //exit(0); + } + else { + //printf("Not successful for bug %d; val = %08x not %08x or %08x\n", bug_num, lava_val[bug_num], 0x6c617661 + bug_num, 0x6176616c + bug_num); + } + return lava_val[bug_num]; +} +``` + +- command +``` sh +# -M 0 to set unlimited memory since who has "memory exhausted" warning. +~/angora/angora_fuzzer -i ./input -o ./output -M 0 -j 1 -t ./who.tt -- ./who.fast @@ +``` + +- Angora can find 1400~1700 bugs (including unlisted bugs). + +**Update Jan 15, 2019** + +Angora is able to find ~2400 bugs after using the fix explained here [Angora LAVA `who` Fix](./lava-who-fix.md). diff --git a/docs/overview.md b/docs/overview.md new file mode 100644 index 0000000..9190ce4 --- /dev/null +++ b/docs/overview.md @@ -0,0 +1,43 @@ +# Angora Overview + +Angora consists of a fuzzer, instrumenting compilers and runtime libraries. +Target programs should be compiled with instrumentation in order to collect +runtime information. + +Two copies of the target program should be prepared, specifically one with +taint tracking instrumentation and the other with branch and constraint +instrumentation. This ensures a reasonable amount of efficiency when fuzzing +due to taint tracking being resource demanding. + +Similar to AFL, Angora mutates a set of seeds to increase program coverage. +Inputs that trigger new explored branches will be appended to the queue. +Angora implements a wide selection of strategies to solve branch constraints. +For each new seed, taint tracking will be applied to learn which part of the +input will affect which branch constraint. Then mutations will be applied to +the input with the tainted parts in consideration. This allows for efficient +and precise input generation which significantly increases input coverage. + +**More details are available in the published works** + +## Directory Structure + +- `build`: Scripts for building Angora components. +- `common`: Common constants and data structures. +- `fuzzer`: Contains the source code for the fuzzer. The fuzzer runs the target program and repeatedly mutates the input attempting to increase its code coverage statistics. + - `src/bin`: Source files for the executable binaries. + - `src/depot`: Depot module for input/output file management. + - `src/executor`: Executor module for managing target program runs. + - `src/search`: Exploration strategies. You are free to implement and integrate your own strategy with Angora. + - `src/cond_stmt`: Conditional statement module for constraints. + - `src/mut_input`: Input bytes for conditional statements. + - `src/track`: Parse taint analysis result. + - `src/stats`: Statistical chart. + - `src/branches`: Branch counting. +- `llvm_mode`: Includes source code for instrumenting compilers and DFSan, the taint tracking framework. +- `pin_mode`: Includes source code for instrumenting based on Intel Pin. +- `runtime`: Taint tracking runtime library for target program. +- `runtime_fast`: Branch and constraint information collection library for target program. +- `tests`: Sample tests to evaluate fuzzer performance. +- `tools`: Some scripts. +- `docs`: Documentation. + diff --git a/docs/pin_mode.md b/docs/pin_mode.md new file mode 100644 index 0000000..a8628cd --- /dev/null +++ b/docs/pin_mode.md @@ -0,0 +1,35 @@ +# Angora's Pin mode - Use libdft64 for taint tracking + +Angora now supports using [libdft64](https://github.com/AngoraFuzzer/libdft64) for taint anlysis instead of DFSan (LLVM mode). +The feature is still experimental. + +## Build requirements + +- [libdft64](https://github.com/AngoraFuzzer/libdft64) + +### Environment Variables +``` +export LIBDFT_PATH=/path-to-libdft64 +``` + +## Build Pin mode +``` +cd pin_mode +make OBJDIR=../bin/lib/ +``` + +## Build a target program + +As [Build a target program](./build_target.md) mentioned, Angora uses two variables `USE_FAST` and `USE_TRACK` to compile two different version programs respectively. In Pin mode, Angora uses variable `USE_PIN` to compile the one with taint tracking instead of `USE_TRACK`. + +``` +USE_PIN=1 CC=/path-to-angora/bin/angora-clang CXX=/path-to-angora/bin/angora-clang++ make +``` + +## Run Angora in Pin mode + +Command line options `-m` is used to set which mode you are using in fuzzing. We have "llvm" and "pin" modes. + +``` +./angora_fuzzer -m pin -i input -o output -t path-to-taint-program-pin -- program args(..) +``` \ No newline at end of file diff --git a/docs/running.md b/docs/running.md new file mode 100644 index 0000000..4d7c0ff --- /dev/null +++ b/docs/running.md @@ -0,0 +1,35 @@ +# Running Angora + +## Run in Docker Container + +The Dockerfile provided allows Angora to run in a container. + +*Caution: Angora assigns different threads with specific process affinity levels. +Running multiple Angora instances in different containers can result in decreased +efficiency.* + +``` +echo core | sudo tee /proc/sys/kernel/core_pattern +docker build -t angora ./ +docker run --privileged -v /path-to-code-and-seed:/data -it --rm angora /bin/bash +``` + + +## Tests + +A number of tests have been provided. Feel free to add your own to test the +capabilities of Angora. + +``` +cd tests +./test.sh +``` + +## Run alongside AFL + +If you are running AFL and its output directory is `output`, run +``` +./angora_fuzzer -i input -o output -t path-to-taint-program --sync_afl -- program args(..) +``` + +Since the implementation of AFL mutation approach in Angora is too simple, the best practice is run it together with AFL, and use `-A` to disable Angora's AFL approach. diff --git a/docs/troubleshoot.md b/docs/troubleshoot.md new file mode 100644 index 0000000..8125655 --- /dev/null +++ b/docs/troubleshoot.md @@ -0,0 +1,22 @@ +# Troubleshoot + +## Target program compilation errors + +- `dfs$***` undefined errors in compiling: See *Model external library* section. + +- Can't find xlocal.h while compiling C++ with Angora. + +``` +ln -s /usr/include/locale.h /usr/include/xlocale.h +``` + +- `*scanf()` functions not modelled: Replace `*scanf()` functions. + +## Runtime errors + +- Failed to find any branches during dry run: Ensure the binary is instrumented and the input +directory is populated. Otherwise no branches can be found. + +- Multiple inconsistent warnings. It caused by the fast and track programs has different behaviors. If most constraints are inconsistent, ensure they are compiled with the same environment. Otherwise, report us. + +- Density is too large (> 10%). Please increase `MAP_SIZE_POW2` in `common/src/config.rs`. Or disable function-call context(density > 50%) by compiling with `ANGORA_CUSTOM_FN_CONTEXT=k` (k is an integer and 0 <= k <= 32) environment variable. Angora disables context if k is 0. diff --git a/docs/ui.md b/docs/ui.md new file mode 100644 index 0000000..003df3d --- /dev/null +++ b/docs/ui.md @@ -0,0 +1,74 @@ +# UI Terminology + +## Layout +``` + ANGORA (\_/) + FUZZER (x'.') + -- OVERVIEW -- + TIMING | RUN: [00:00:05], TRACK: [00:00:00] + COVERAGE | EDGE: 10.50, DENSITY: 0.00% + EXECS | TOTAL: 27, ROUND: 10, MAX_R: 1 + SPEED | PERIOD: 5.40r/s TIME: 212.40us, + FOUND | PATH: 10, HANGS: 0, CRASHES: 0 + -- FUZZ -- + EXPLORE | CONDS: 8, EXEC: 22, TIME: [00:00:00], FOUND: 8 - 0 - 0 + EXPLOIT | CONDS: 0, EXEC: 0, TIME: [00:00:00], FOUND: 0 - 0 - 0 + CMPFN | CONDS: 0, EXEC: 0, TIME: [00:00:00], FOUND: 0 - 0 - 0 + LEN | CONDS: 1, EXEC: 4, TIME: [00:00:00], FOUND: 1 - 0 - 0 + AFL | CONDS: 0, EXEC: 0, TIME: [00:00:00], FOUND: 0 - 0 - 0 + OTHER | CONDS: 0, EXEC: 1, TIME: [00:00:00], FOUND: 1 - 0 - 0 + -- SEARCH -- + SEARCH | CMP: 8 / 8, BOOL: 0 / 0, SW: 0 / 0 + UNDESIR | CMP: 0 / 0, BOOL: 0 / 0, SW: 0 / 0 + ONEBYTE | CMP: 0 / 0, BOOL: 0 / 0, SW: 0 / 0 + INCONSIS | CMP: 0 / 0, BOOL: 0 / 0, SW: 0 / 0 + -- STATE -- + | NORMAL: 40d - 104p, NORMAL_END: 0d - 0p, ONE_BYTE: 486d - 530p + | DET: 0d - 0p, TIMEOUT: 0d - 0p, UNSOLVABLE: 0d - 0p +``` + +## Terminology +- `OVERVIEW`: Overall Stats + - `TIMING`: Timing stats + - `ALL`: Elapsed fuzzing time + - `TRACK`: Accumulated taint tracking time + - `COVERAGE`: Program branch coverage status + - `EDGE`: Average edge coverage + - `DENSITY`: Coverage map density + - `EXECS`: Execution statistics + - `TOTAL`: Total execution count + - `ROUND`: Current round execution count + - `MAX_R`: Maximum rounds + - `SPEED`: Execution speed statistics + - `PERIOD`: Executions per second + - `TIME`: Average execution time for fast pass + - `FOUND`: Fuzzing results + - `PATH`: Total path count + - `HANGS`: Total timeout count + - `CRASHES`: Total crash count +- `FUZZ`: Fuzzing Strategy Statistics + - Methods: + - `EXPLORE`: Exploration strategies + - `EXPLOIT`: Exploitation strategies + - `CMPFN`: `*cmp` function strategies + - `LEN`: Length exploitation + - `AFL`: Strategies derived from AFL + - `OTHER`: Other strategies + - Metrics: + - `CONDS`: Conditions fuzzed under this strategy + - `EXEC`: Executions done under this strategy + - `TIME`: Accumulated fuzzing time elapsed under this strategy + - `FOUND`: Fuzzing results under this strategy +- `SEARCH`: Search statistics + - Types: + - `SEARCH`: Ordinary comparisons + - `UNDESIR`: Undesirable comparisons + - `ONEBYTE`: One byte fuzzing + - `INCONSIS`: Inconsistencies of ids between programs + - Metrics: + - `CMP`: Comparison evaluations solved / all + - `BOOL`: Boolean values solved / all + - `SW`: Switch comparisons solved / all +- `STATE`: State for the constraints + - `d`: Solved + - `p`: Pending, not solved. \ No newline at end of file diff --git a/docs/usage.md b/docs/usage.md new file mode 100644 index 0000000..59beea5 --- /dev/null +++ b/docs/usage.md @@ -0,0 +1,30 @@ +# Angora usage +``` +# /path-to-angora/angora_fuzzer --help +angora-fuzzer 1.2.2 +fuzz some program + +USAGE: + fuzzer [FLAGS] [OPTIONS] --input --output [--] ... + +FLAGS: + -A, --disable_afl_mutation Disable the fuzzer to mutate inputs using AFL's mutation strategies + -E, --disable_exploitation Disable the fuzzer to mutate sensitive bytes to exploit bugs + -h, --help Prints help information + -S, --sync_afl Sync the seeds with AFL. Output directory should be in AFL's directory structure. + -V, --version Prints version information + +OPTIONS: + -i, --input Sets the directory of input seeds, use "-" to restart with existing output directory + -M, --memory_limit Memory limit for programs, default is 200(MB) + -m, --mode Which binary instrumentation framework are you using? [possible values: llvm, pin] + -o, --output Sets the directory of outputs + -r, --search_method Which search method to run the program in? [possible values: gd, random, mb] + -j, --jobs Sets the number of thread jobs, default is 1 + -T, --time_limit