mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-11 09:41:35 +00:00
refactored whitelist and blacklist in llvm_mode
This commit is contained in:
parent
07db922024
commit
0c3d06c41e
@ -500,3 +500,4 @@ __attribute__((constructor)) void __dislocator_init(void) {
|
|||||||
align_allocations = !!getenv("AFL_ALIGNED_ALLOC");
|
align_allocations = !!getenv("AFL_ALIGNED_ALLOC");
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -1,4 +1,3 @@
|
|||||||
#
|
|
||||||
# american fuzzy lop++ - LLVM instrumentation
|
# american fuzzy lop++ - LLVM instrumentation
|
||||||
# -----------------------------------------
|
# -----------------------------------------
|
||||||
#
|
#
|
||||||
@ -271,42 +270,45 @@ ifeq "$(LLVM_LTO)" "1"
|
|||||||
endif
|
endif
|
||||||
endif
|
endif
|
||||||
|
|
||||||
../libLLVMInsTrim.so: LLVMInsTrim.so.cc MarkNodes.cc | test_deps
|
afl-llvm-common.o: afl-llvm-common.cc afl-llvm-common.h
|
||||||
-$(CXX) $(CLANG_CFL) -DLLVMInsTrim_EXPORTS -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< MarkNodes.cc -o $@ $(CLANG_LFL)
|
$(CXX) $(CFLAGS) `$(LLVM_CONFIG) --cxxflags` -fno-rtti -fPIC -std=$(LLVM_STDCXX) -c $< -o $@
|
||||||
|
|
||||||
../afl-llvm-pass.so: afl-llvm-pass.so.cc | test_deps
|
../libLLVMInsTrim.so: LLVMInsTrim.so.cc MarkNodes.cc afl-llvm-common.o | test_deps
|
||||||
|
-$(CXX) $(CLANG_CFL) -DLLVMInsTrim_EXPORTS -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< MarkNodes.cc -o $@ $(CLANG_LFL) afl-llvm-common.o
|
||||||
|
|
||||||
|
../afl-llvm-pass.so: afl-llvm-pass.so.cc afl-llvm-common.o | test_deps
|
||||||
ifeq "$(LLVM_MIN_4_0_1)" "0"
|
ifeq "$(LLVM_MIN_4_0_1)" "0"
|
||||||
$(info [!] N-gram branch coverage instrumentation is not available for llvm version $(LLVMVER))
|
$(info [!] N-gram branch coverage instrumentation is not available for llvm version $(LLVMVER))
|
||||||
endif
|
endif
|
||||||
$(CXX) $(CLANG_CFL) -DLLVMInsTrim_EXPORTS -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL)
|
$(CXX) $(CLANG_CFL) -DLLVMInsTrim_EXPORTS -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
|
||||||
|
|
||||||
../afl-llvm-lto-whitelist.so: afl-llvm-lto-whitelist.so.cc
|
../afl-llvm-lto-whitelist.so: afl-llvm-lto-whitelist.so.cc afl-llvm-common.o
|
||||||
ifeq "$(LLVM_LTO)" "1"
|
ifeq "$(LLVM_LTO)" "1"
|
||||||
$(CXX) $(CLANG_CFL) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL)
|
$(CXX) $(CLANG_CFL) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
|
||||||
endif
|
endif
|
||||||
|
|
||||||
../afl-llvm-lto-instrumentation.so: afl-llvm-lto-instrumentation.so.cc
|
../afl-llvm-lto-instrumentation.so: afl-llvm-lto-instrumentation.so.cc afl-llvm-common.o
|
||||||
ifeq "$(LLVM_LTO)" "1"
|
ifeq "$(LLVM_LTO)" "1"
|
||||||
$(CXX) $(CLANG_CFL) -Wno-writable-strings -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL)
|
$(CXX) $(CLANG_CFL) -Wno-writable-strings -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
|
||||||
$(CC) $(CFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -fPIC -c afl-llvm-rt-lto.o.c -o ../afl-llvm-rt-lto.o
|
$(CC) $(CFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -fPIC -c afl-llvm-rt-lto.o.c -o ../afl-llvm-rt-lto.o
|
||||||
@$(CC) $(CFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -m64 -fPIC -c afl-llvm-rt-lto.o.c -o ../afl-llvm-rt-lto-64.o 2>/dev/null; if [ "$$?" = "0" ]; then : ; fi
|
@$(CC) $(CFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -m64 -fPIC -c afl-llvm-rt-lto.o.c -o ../afl-llvm-rt-lto-64.o 2>/dev/null; if [ "$$?" = "0" ]; then : ; fi
|
||||||
@$(CC) $(CFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -m32 -fPIC -c afl-llvm-rt-lto.o.c -o ../afl-llvm-rt-lto-32.o 2>/dev/null; if [ "$$?" = "0" ]; then : ; fi
|
@$(CC) $(CFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -m32 -fPIC -c afl-llvm-rt-lto.o.c -o ../afl-llvm-rt-lto-32.o 2>/dev/null; if [ "$$?" = "0" ]; then : ; fi
|
||||||
endif
|
endif
|
||||||
|
|
||||||
# laf
|
# laf
|
||||||
../split-switches-pass.so: split-switches-pass.so.cc | test_deps
|
../split-switches-pass.so: split-switches-pass.so.cc afl-llvm-common.o | test_deps
|
||||||
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL)
|
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
|
||||||
../compare-transform-pass.so: compare-transform-pass.so.cc | test_deps
|
../compare-transform-pass.so: compare-transform-pass.so.cc afl-llvm-common.o | test_deps
|
||||||
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL)
|
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
|
||||||
../split-compares-pass.so: split-compares-pass.so.cc | test_deps
|
../split-compares-pass.so: split-compares-pass.so.cc afl-llvm-common.o | test_deps
|
||||||
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL)
|
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
|
||||||
# /laf
|
# /laf
|
||||||
|
|
||||||
../cmplog-routines-pass.so: cmplog-routines-pass.cc | test_deps
|
../cmplog-routines-pass.so: cmplog-routines-pass.cc afl-llvm-common.o | test_deps
|
||||||
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL)
|
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
|
||||||
|
|
||||||
../cmplog-instructions-pass.so: cmplog-instructions-pass.cc | test_deps
|
../cmplog-instructions-pass.so: cmplog-instructions-pass.cc afl-llvm-common.o | test_deps
|
||||||
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL)
|
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
|
||||||
|
|
||||||
../afl-llvm-rt.o: afl-llvm-rt.o.c | test_deps
|
../afl-llvm-rt.o: afl-llvm-rt.o.c | test_deps
|
||||||
$(CC) $(CFLAGS) -Wno-unused-result -fPIC -c $< -o $@
|
$(CC) $(CFLAGS) -Wno-unused-result -fPIC -c $< -o $@
|
||||||
|
@ -40,6 +40,7 @@ typedef long double max_align_t;
|
|||||||
#include "debug.h"
|
#include "debug.h"
|
||||||
|
|
||||||
#include "MarkNodes.h"
|
#include "MarkNodes.h"
|
||||||
|
#include "afl-llvm-common.h"
|
||||||
|
|
||||||
using namespace llvm;
|
using namespace llvm;
|
||||||
|
|
||||||
@ -53,9 +54,8 @@ namespace {
|
|||||||
struct InsTrim : public ModulePass {
|
struct InsTrim : public ModulePass {
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
std::list<std::string> myWhitelist;
|
uint32_t function_minimum_size = 1;
|
||||||
uint32_t function_minimum_size = 1;
|
uint32_t debug = 0;
|
||||||
uint32_t debug = 0;
|
|
||||||
|
|
||||||
private:
|
private:
|
||||||
std::mt19937 generator;
|
std::mt19937 generator;
|
||||||
@ -69,24 +69,10 @@ struct InsTrim : public ModulePass {
|
|||||||
|
|
||||||
public:
|
public:
|
||||||
static char ID;
|
static char ID;
|
||||||
|
|
||||||
InsTrim() : ModulePass(ID), generator(0) {
|
InsTrim() : ModulePass(ID), generator(0) {
|
||||||
|
|
||||||
char *instWhiteListFilename = getenv("AFL_LLVM_WHITELIST");
|
initWhitelist();
|
||||||
if (instWhiteListFilename) {
|
|
||||||
|
|
||||||
std::string line;
|
|
||||||
std::ifstream fileStream;
|
|
||||||
fileStream.open(instWhiteListFilename);
|
|
||||||
if (!fileStream) report_fatal_error("Unable to open AFL_LLVM_WHITELIST");
|
|
||||||
getline(fileStream, line);
|
|
||||||
while (fileStream) {
|
|
||||||
|
|
||||||
myWhitelist.push_back(line);
|
|
||||||
getline(fileStream, line);
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -107,26 +93,6 @@ struct InsTrim : public ModulePass {
|
|||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// ripped from aflgo
|
|
||||||
static bool isBlacklisted(const Function *F) {
|
|
||||||
|
|
||||||
static const char *Blacklist[] = {
|
|
||||||
|
|
||||||
"asan.", "llvm.", "sancov.", "__ubsan_handle_", "ign.", "__afl_",
|
|
||||||
"_fini", "__libc_csu", "__asan", "__msan", "msan."
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
for (auto const &BlacklistFunc : Blacklist) {
|
|
||||||
|
|
||||||
if (F->getName().startswith(BlacklistFunc)) { return true; }
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
return false;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
bool runOnModule(Module &M) override {
|
bool runOnModule(Module &M) override {
|
||||||
|
|
||||||
char be_quiet = 0;
|
char be_quiet = 0;
|
||||||
@ -192,138 +158,11 @@ struct InsTrim : public ModulePass {
|
|||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (!isInWhitelist(&F)) continue;
|
||||||
|
|
||||||
// if the function below our minimum size skip it (1 or 2)
|
// if the function below our minimum size skip it (1 or 2)
|
||||||
if (F.size() < function_minimum_size) { continue; }
|
if (F.size() < function_minimum_size) { continue; }
|
||||||
|
|
||||||
if (!myWhitelist.empty()) {
|
|
||||||
|
|
||||||
bool instrumentBlock = false;
|
|
||||||
DebugLoc Loc;
|
|
||||||
StringRef instFilename;
|
|
||||||
unsigned int instLine = 0;
|
|
||||||
|
|
||||||
#if LLVM_VERSION_MAJOR >= 4 || \
|
|
||||||
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR >= 7)
|
|
||||||
for (auto &BB : F) {
|
|
||||||
|
|
||||||
BasicBlock::iterator IP = BB.getFirstInsertionPt();
|
|
||||||
IRBuilder<> IRB(&(*IP));
|
|
||||||
if (!Loc) Loc = IP->getDebugLoc();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
if (Loc) {
|
|
||||||
|
|
||||||
DILocation *cDILoc = dyn_cast<DILocation>(Loc.getAsMDNode());
|
|
||||||
|
|
||||||
instLine = cDILoc->getLine();
|
|
||||||
instFilename = cDILoc->getFilename();
|
|
||||||
|
|
||||||
if (instFilename.str().empty()) {
|
|
||||||
|
|
||||||
/* If the original location is empty, try using the inlined location
|
|
||||||
*/
|
|
||||||
DILocation *oDILoc = cDILoc->getInlinedAt();
|
|
||||||
if (oDILoc) {
|
|
||||||
|
|
||||||
instFilename = oDILoc->getFilename();
|
|
||||||
instLine = oDILoc->getLine();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#else
|
|
||||||
for (auto &BB : F) {
|
|
||||||
|
|
||||||
BasicBlock::iterator IP = BB.getFirstInsertionPt();
|
|
||||||
IRBuilder<> IRB(&(*IP));
|
|
||||||
if (Loc.isUnknown()) Loc = IP->getDebugLoc();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!Loc.isUnknown()) {
|
|
||||||
|
|
||||||
DILocation cDILoc(Loc.getAsMDNode(C));
|
|
||||||
|
|
||||||
instLine = cDILoc.getLineNumber();
|
|
||||||
instFilename = cDILoc.getFilename();
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
/* Either we couldn't figure out our location or the location is
|
|
||||||
* not whitelisted, so we skip instrumentation. */
|
|
||||||
if (!instrumentBlock) {
|
|
||||||
|
|
||||||
if (!be_quiet) {
|
|
||||||
|
|
||||||
if (!instFilename.str().empty())
|
|
||||||
SAYF(cYEL "[!] " cBRI
|
|
||||||
"Not in whitelist, skipping %s line %u...\n",
|
|
||||||
instFilename.str().c_str(), instLine);
|
|
||||||
else
|
|
||||||
SAYF(cYEL "[!] " cBRI
|
|
||||||
"No filename information found, skipping it");
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
continue;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
if (isBlacklisted(&F)) continue;
|
|
||||||
|
|
||||||
std::unordered_set<BasicBlock *> MS;
|
std::unordered_set<BasicBlock *> MS;
|
||||||
if (!MarkSetOpt) {
|
if (!MarkSetOpt) {
|
||||||
|
|
||||||
|
202
llvm_mode/afl-llvm-common.cc
Normal file
202
llvm_mode/afl-llvm-common.cc
Normal file
@ -0,0 +1,202 @@
|
|||||||
|
#define AFL_LLVM_PASS
|
||||||
|
|
||||||
|
#include "config.h"
|
||||||
|
#include "debug.h"
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <unistd.h>
|
||||||
|
#include <sys/time.h>
|
||||||
|
|
||||||
|
#include <list>
|
||||||
|
#include <string>
|
||||||
|
#include <fstream>
|
||||||
|
|
||||||
|
#include "afl-llvm-common.h"
|
||||||
|
|
||||||
|
using namespace llvm;
|
||||||
|
|
||||||
|
static std::list<std::string> myWhitelist;
|
||||||
|
|
||||||
|
char *getBBName(const llvm::BasicBlock *BB) {
|
||||||
|
|
||||||
|
static char *name;
|
||||||
|
|
||||||
|
if (!BB->getName().empty()) {
|
||||||
|
|
||||||
|
name = strdup(BB->getName().str().c_str());
|
||||||
|
return name;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
std::string Str;
|
||||||
|
raw_string_ostream OS(Str);
|
||||||
|
|
||||||
|
BB->printAsOperand(OS, false);
|
||||||
|
name = strdup(OS.str().c_str());
|
||||||
|
return name;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Function that we never instrument or analyze */
|
||||||
|
/* Note: this blacklist check is also called in isInWhitelist() */
|
||||||
|
bool isBlacklisted(const llvm::Function *F) {
|
||||||
|
|
||||||
|
static const char *Blacklist[] = {
|
||||||
|
|
||||||
|
"asan.", "llvm.", "sancov.", "__ubsan_handle_", "ign.", "__afl_",
|
||||||
|
"_fini", "__libc_csu", "__asan", "__msan", "msan."
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
for (auto const &BlacklistFunc : Blacklist) {
|
||||||
|
|
||||||
|
if (F->getName().startswith(BlacklistFunc)) { return true; }
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
return false;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
void initWhitelist() {
|
||||||
|
|
||||||
|
char *instWhiteListFilename = getenv("AFL_LLVM_WHITELIST");
|
||||||
|
if (instWhiteListFilename) {
|
||||||
|
|
||||||
|
std::string line;
|
||||||
|
std::ifstream fileStream;
|
||||||
|
fileStream.open(instWhiteListFilename);
|
||||||
|
if (!fileStream) report_fatal_error("Unable to open AFL_LLVM_WHITELIST");
|
||||||
|
getline(fileStream, line);
|
||||||
|
while (fileStream) {
|
||||||
|
|
||||||
|
myWhitelist.push_back(line);
|
||||||
|
getline(fileStream, line);
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
bool isInWhitelist(llvm::Function *F) {
|
||||||
|
|
||||||
|
// is this a function with code? If it is external we dont instrument it
|
||||||
|
// anyway and cant be in the whitelist. Or if it is blacklisted.
|
||||||
|
if (!F->size() || isBlacklisted(F)) return false;
|
||||||
|
|
||||||
|
// if we do not have a whitelist return true
|
||||||
|
if (myWhitelist.empty()) return true;
|
||||||
|
|
||||||
|
// let's try to get the filename for the function
|
||||||
|
auto bb = &F->getEntryBlock();
|
||||||
|
BasicBlock::iterator IP = bb->getFirstInsertionPt();
|
||||||
|
IRBuilder<> IRB(&(*IP));
|
||||||
|
DebugLoc Loc = IP->getDebugLoc();
|
||||||
|
|
||||||
|
#if LLVM_VERSION_MAJOR >= 4 || \
|
||||||
|
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR >= 7)
|
||||||
|
if (Loc) {
|
||||||
|
|
||||||
|
DILocation *cDILoc = dyn_cast<DILocation>(Loc.getAsMDNode());
|
||||||
|
|
||||||
|
unsigned int instLine = cDILoc->getLine();
|
||||||
|
StringRef instFilename = cDILoc->getFilename();
|
||||||
|
|
||||||
|
if (instFilename.str().empty()) {
|
||||||
|
|
||||||
|
/* If the original location is empty, try using the inlined location
|
||||||
|
*/
|
||||||
|
DILocation *oDILoc = cDILoc->getInlinedAt();
|
||||||
|
if (oDILoc) {
|
||||||
|
|
||||||
|
instFilename = oDILoc->getFilename();
|
||||||
|
instLine = oDILoc->getLine();
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
(void)instLine;
|
||||||
|
|
||||||
|
/* Continue only if we know where we actually are */
|
||||||
|
if (!instFilename.str().empty()) {
|
||||||
|
|
||||||
|
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
||||||
|
it != myWhitelist.end(); ++it) {
|
||||||
|
|
||||||
|
/* We don't check for filename equality here because
|
||||||
|
* filenames might actually be full paths. Instead we
|
||||||
|
* check that the actual filename ends in the filename
|
||||||
|
* specified in the list. */
|
||||||
|
if (instFilename.str().length() >= it->length()) {
|
||||||
|
|
||||||
|
if (instFilename.str().compare(
|
||||||
|
instFilename.str().length() - it->length(), it->length(),
|
||||||
|
*it) == 0) {
|
||||||
|
|
||||||
|
return true;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
#else
|
||||||
|
if (!Loc.isUnknown()) {
|
||||||
|
|
||||||
|
DILocation cDILoc(Loc.getAsMDNode(C));
|
||||||
|
|
||||||
|
unsigned int instLine = cDILoc.getLineNumber();
|
||||||
|
StringRef instFilename = cDILoc.getFilename();
|
||||||
|
|
||||||
|
(void)instLine;
|
||||||
|
/* Continue only if we know where we actually are */
|
||||||
|
if (!instFilename.str().empty()) {
|
||||||
|
|
||||||
|
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
||||||
|
it != myWhitelist.end(); ++it) {
|
||||||
|
|
||||||
|
/* We don't check for filename equality here because
|
||||||
|
* filenames might actually be full paths. Instead we
|
||||||
|
* check that the actual filename ends in the filename
|
||||||
|
* specified in the list. */
|
||||||
|
if (instFilename.str().length() >= it->length()) {
|
||||||
|
|
||||||
|
if (instFilename.str().compare(
|
||||||
|
instFilename.str().length() - it->length(), it->length(),
|
||||||
|
*it) == 0) {
|
||||||
|
|
||||||
|
return true;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
#endif
|
||||||
|
else {
|
||||||
|
|
||||||
|
// we could not find out the location. in this case we say it is not
|
||||||
|
// in the whitelist
|
||||||
|
|
||||||
|
return false;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
//
|
||||||
|
return false;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
41
llvm_mode/afl-llvm-common.h
Normal file
41
llvm_mode/afl-llvm-common.h
Normal file
@ -0,0 +1,41 @@
|
|||||||
|
#ifndef __AFLLLVMCOMMON_H
|
||||||
|
#define __AFLLLVMCOMMON_H
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <unistd.h>
|
||||||
|
|
||||||
|
#include <list>
|
||||||
|
#include <string>
|
||||||
|
#include <fstream>
|
||||||
|
#include <sys/time.h>
|
||||||
|
|
||||||
|
#include "llvm/Config/llvm-config.h"
|
||||||
|
#if LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR < 5
|
||||||
|
typedef long double max_align_t;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#include "llvm/IR/IRBuilder.h"
|
||||||
|
#include "llvm/IR/LegacyPassManager.h"
|
||||||
|
#include "llvm/IR/BasicBlock.h"
|
||||||
|
#include "llvm/IR/Module.h"
|
||||||
|
#include "llvm/Support/Debug.h"
|
||||||
|
#include "llvm/Support/MathExtras.h"
|
||||||
|
#include "llvm/Transforms/IPO/PassManagerBuilder.h"
|
||||||
|
|
||||||
|
#if LLVM_VERSION_MAJOR > 3 || \
|
||||||
|
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR > 4)
|
||||||
|
#include "llvm/IR/DebugInfo.h"
|
||||||
|
#include "llvm/IR/CFG.h"
|
||||||
|
#else
|
||||||
|
#include "llvm/DebugInfo.h"
|
||||||
|
#include "llvm/Support/CFG.h"
|
||||||
|
#endif
|
||||||
|
|
||||||
|
char *getBBName(const llvm::BasicBlock *BB);
|
||||||
|
bool isBlacklisted(const llvm::Function *F);
|
||||||
|
void initWhitelist();
|
||||||
|
bool isInWhitelist(llvm::Function *F);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
@ -57,6 +57,7 @@
|
|||||||
#include "llvm/Pass.h"
|
#include "llvm/Pass.h"
|
||||||
|
|
||||||
#include <set>
|
#include <set>
|
||||||
|
#include "afl-llvm-common.h"
|
||||||
|
|
||||||
using namespace llvm;
|
using namespace llvm;
|
||||||
|
|
||||||
@ -104,52 +105,6 @@ class AFLLTOPass : public ModulePass {
|
|||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Get the internal llvm name of a basic block
|
|
||||||
// This is an ugly debug support so it is commented out :-)
|
|
||||||
/*
|
|
||||||
static char *getBBName(const BasicBlock *BB) {
|
|
||||||
|
|
||||||
static char *name;
|
|
||||||
|
|
||||||
if (!BB->getName().empty()) {
|
|
||||||
|
|
||||||
name = strdup(BB->getName().str().c_str());
|
|
||||||
return name;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
std::string Str;
|
|
||||||
raw_string_ostream OS(Str);
|
|
||||||
|
|
||||||
BB->printAsOperand(OS, false);
|
|
||||||
|
|
||||||
name = strdup(OS.str().c_str());
|
|
||||||
|
|
||||||
return name;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
*/
|
|
||||||
|
|
||||||
static bool isBlacklisted(const Function *F) {
|
|
||||||
|
|
||||||
static const char *Blacklist[] = {
|
|
||||||
|
|
||||||
"asan.", "llvm.", "sancov.", "__ubsan_handle_", "ign.", "__afl_",
|
|
||||||
"_fini", "__libc_csu", "__asan", "__msan", "msan."
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
for (auto const &BlacklistFunc : Blacklist) {
|
|
||||||
|
|
||||||
if (F->getName().startswith(BlacklistFunc)) { return true; }
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
return false;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
bool runOnModule(Module &M) override;
|
bool runOnModule(Module &M) override;
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
|
@ -46,6 +46,8 @@
|
|||||||
#include "llvm/Transforms/IPO/PassManagerBuilder.h"
|
#include "llvm/Transforms/IPO/PassManagerBuilder.h"
|
||||||
#include "llvm/IR/CFG.h"
|
#include "llvm/IR/CFG.h"
|
||||||
|
|
||||||
|
#include "afl-llvm-common.h"
|
||||||
|
|
||||||
using namespace llvm;
|
using namespace llvm;
|
||||||
|
|
||||||
namespace {
|
namespace {
|
||||||
@ -86,26 +88,6 @@ class AFLwhitelist : public ModulePass {
|
|||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// ripped from aflgo
|
|
||||||
static bool isBlacklisted(const Function *F) {
|
|
||||||
|
|
||||||
static const SmallVector<std::string, 5> Blacklist = {
|
|
||||||
|
|
||||||
"asan.", "llvm.", "sancov.", "__ubsan_handle_", "ign.", "__afl_",
|
|
||||||
"_fini", "__libc_csu", "__asan", "__msan", "msan."
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
for (auto const &BlacklistFunc : Blacklist) {
|
|
||||||
|
|
||||||
if (F->getName().startswith(BlacklistFunc)) { return true; }
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
return false;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
bool runOnModule(Module &M) override;
|
bool runOnModule(Module &M) override;
|
||||||
|
|
||||||
// StringRef getPassName() const override {
|
// StringRef getPassName() const override {
|
||||||
|
@ -61,6 +61,7 @@ typedef long double max_align_t;
|
|||||||
#include "llvm/Support/CFG.h"
|
#include "llvm/Support/CFG.h"
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
#include "afl-llvm-common.h"
|
||||||
#include "llvm-ngram-coverage.h"
|
#include "llvm-ngram-coverage.h"
|
||||||
|
|
||||||
using namespace llvm;
|
using namespace llvm;
|
||||||
@ -73,58 +74,17 @@ class AFLCoverage : public ModulePass {
|
|||||||
static char ID;
|
static char ID;
|
||||||
AFLCoverage() : ModulePass(ID) {
|
AFLCoverage() : ModulePass(ID) {
|
||||||
|
|
||||||
char *instWhiteListFilename = getenv("AFL_LLVM_WHITELIST");
|
initWhitelist();
|
||||||
if (instWhiteListFilename) {
|
|
||||||
|
|
||||||
std::string line;
|
|
||||||
std::ifstream fileStream;
|
|
||||||
fileStream.open(instWhiteListFilename);
|
|
||||||
if (!fileStream) report_fatal_error("Unable to open AFL_LLVM_WHITELIST");
|
|
||||||
getline(fileStream, line);
|
|
||||||
while (fileStream) {
|
|
||||||
|
|
||||||
myWhitelist.push_back(line);
|
|
||||||
getline(fileStream, line);
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
// ripped from aflgo
|
|
||||||
static bool isBlacklisted(const Function *F) {
|
|
||||||
|
|
||||||
static const char *Blacklist[] = {
|
|
||||||
|
|
||||||
"asan.", "llvm.", "sancov.", "__ubsan_handle_", "ign.", "__afl_",
|
|
||||||
"_fini", "__libc_csu", "__asan", "__msan", "msan."
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
for (auto const &BlacklistFunc : Blacklist) {
|
|
||||||
|
|
||||||
if (F->getName().startswith(BlacklistFunc)) { return true; }
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
return false;
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
bool runOnModule(Module &M) override;
|
bool runOnModule(Module &M) override;
|
||||||
|
|
||||||
// StringRef getPassName() const override {
|
|
||||||
|
|
||||||
// return "American Fuzzy Lop Instrumentation";
|
|
||||||
// }
|
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
std::list<std::string> myWhitelist;
|
uint32_t ngram_size = 0;
|
||||||
uint32_t ngram_size = 0;
|
uint32_t debug = 0;
|
||||||
uint32_t debug = 0;
|
uint32_t map_size = MAP_SIZE;
|
||||||
uint32_t map_size = MAP_SIZE;
|
char * ctx_str = NULL;
|
||||||
char * ctx_str = NULL;
|
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -334,9 +294,7 @@ bool AFLCoverage::runOnModule(Module &M) {
|
|||||||
fprintf(stderr, "FUNCTION: %s (%zu)\n", F.getName().str().c_str(),
|
fprintf(stderr, "FUNCTION: %s (%zu)\n", F.getName().str().c_str(),
|
||||||
F.size());
|
F.size());
|
||||||
|
|
||||||
if (isBlacklisted(&F)) continue;
|
if (!isInWhitelist(&F)) continue;
|
||||||
|
|
||||||
// AllocaInst *CallingContext = nullptr;
|
|
||||||
|
|
||||||
if (ctx_str && F.size() > 1) { // Context sensitive coverage
|
if (ctx_str && F.size() > 1) { // Context sensitive coverage
|
||||||
// load the context ID of the previous function and write to to a local
|
// load the context ID of the previous function and write to to a local
|
||||||
@ -391,115 +349,6 @@ bool AFLCoverage::runOnModule(Module &M) {
|
|||||||
BasicBlock::iterator IP = BB.getFirstInsertionPt();
|
BasicBlock::iterator IP = BB.getFirstInsertionPt();
|
||||||
IRBuilder<> IRB(&(*IP));
|
IRBuilder<> IRB(&(*IP));
|
||||||
|
|
||||||
if (!myWhitelist.empty()) {
|
|
||||||
|
|
||||||
bool instrumentBlock = false;
|
|
||||||
|
|
||||||
/* Get the current location using debug information.
|
|
||||||
* For now, just instrument the block if we are not able
|
|
||||||
* to determine our location. */
|
|
||||||
DebugLoc Loc = IP->getDebugLoc();
|
|
||||||
#if LLVM_VERSION_MAJOR >= 4 || \
|
|
||||||
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR >= 7)
|
|
||||||
if (Loc) {
|
|
||||||
|
|
||||||
DILocation *cDILoc = dyn_cast<DILocation>(Loc.getAsMDNode());
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc->getLine();
|
|
||||||
StringRef instFilename = cDILoc->getFilename();
|
|
||||||
|
|
||||||
if (instFilename.str().empty()) {
|
|
||||||
|
|
||||||
/* If the original location is empty, try using the inlined location
|
|
||||||
*/
|
|
||||||
DILocation *oDILoc = cDILoc->getInlinedAt();
|
|
||||||
if (oDILoc) {
|
|
||||||
|
|
||||||
instFilename = oDILoc->getFilename();
|
|
||||||
instLine = oDILoc->getLine();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#else
|
|
||||||
if (!Loc.isUnknown()) {
|
|
||||||
|
|
||||||
DILocation cDILoc(Loc.getAsMDNode(C));
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc.getLineNumber();
|
|
||||||
StringRef instFilename = cDILoc.getFilename();
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* Either we couldn't figure out our location or the location is
|
|
||||||
* not whitelisted, so we skip instrumentation. */
|
|
||||||
if (!instrumentBlock) continue;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
// in CTX mode we have to restore the original context for the caller -
|
// in CTX mode we have to restore the original context for the caller -
|
||||||
// she might be calling other functions which need the correct CTX
|
// she might be calling other functions which need the correct CTX
|
||||||
if (ctx_str && has_calls) {
|
if (ctx_str && has_calls) {
|
||||||
@ -628,54 +477,11 @@ bool AFLCoverage::runOnModule(Module &M) {
|
|||||||
* Counter + 1 -> {Counter, OverflowFlag}
|
* Counter + 1 -> {Counter, OverflowFlag}
|
||||||
* Counter + OverflowFlag -> Counter
|
* Counter + OverflowFlag -> Counter
|
||||||
*/
|
*/
|
||||||
/* // we keep the old solutions just in case
|
|
||||||
// Solution #1
|
|
||||||
if (neverZero_counters_str[0] == '1') {
|
|
||||||
|
|
||||||
CallInst *AddOv =
|
|
||||||
IRB.CreateBinaryIntrinsic(Intrinsic::uadd_with_overflow, Counter,
|
|
||||||
ConstantInt::get(Int8Ty, 1));
|
|
||||||
AddOv->setMetadata(M.getMDKindID("nosanitize"),
|
|
||||||
MDNode::get(C, None)); Value *SumWithOverflowBit = AddOv; Incr =
|
|
||||||
IRB.CreateAdd(IRB.CreateExtractValue(SumWithOverflowBit, 0), // sum
|
|
||||||
IRB.CreateZExt( // convert from one bit
|
|
||||||
type to 8 bits type IRB.CreateExtractValue(SumWithOverflowBit, 1), //
|
|
||||||
overflow Int8Ty));
|
|
||||||
// Solution #2
|
|
||||||
|
|
||||||
} else if (neverZero_counters_str[0] == '2') {
|
|
||||||
|
|
||||||
auto cf = IRB.CreateICmpEQ(Counter,
|
|
||||||
ConstantInt::get(Int8Ty, 255)); Value *HowMuch =
|
|
||||||
IRB.CreateAdd(ConstantInt::get(Int8Ty, 1), cf); Incr =
|
|
||||||
IRB.CreateAdd(Counter, HowMuch);
|
|
||||||
// Solution #3
|
|
||||||
|
|
||||||
} else if (neverZero_counters_str[0] == '3') {
|
|
||||||
|
|
||||||
*/
|
|
||||||
// this is the solution we choose because llvm9 should do the right
|
|
||||||
// thing here
|
|
||||||
auto cf = IRB.CreateICmpEQ(Incr, Zero);
|
auto cf = IRB.CreateICmpEQ(Incr, Zero);
|
||||||
auto carry = IRB.CreateZExt(cf, Int8Ty);
|
auto carry = IRB.CreateZExt(cf, Int8Ty);
|
||||||
Incr = IRB.CreateAdd(Incr, carry);
|
Incr = IRB.CreateAdd(Incr, carry);
|
||||||
/*
|
|
||||||
// Solution #4
|
|
||||||
|
|
||||||
} else if (neverZero_counters_str[0] == '4') {
|
|
||||||
|
|
||||||
auto cf = IRB.CreateICmpULT(Incr, ConstantInt::get(Int8Ty, 1));
|
|
||||||
auto carry = IRB.CreateZExt(cf, Int8Ty);
|
|
||||||
Incr = IRB.CreateAdd(Incr, carry);
|
|
||||||
|
|
||||||
} else {
|
|
||||||
|
|
||||||
fprintf(stderr, "Error: unknown value for AFL_NZERO_COUNTS: %s
|
|
||||||
(valid is 1-4)\n", neverZero_counters_str); exit(-1);
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
*/
|
|
||||||
#if LLVM_VERSION_MAJOR < 9
|
#if LLVM_VERSION_MAJOR < 9
|
||||||
|
|
||||||
}
|
}
|
||||||
|
@ -47,6 +47,7 @@
|
|||||||
#endif
|
#endif
|
||||||
|
|
||||||
#include <set>
|
#include <set>
|
||||||
|
#include "afl-llvm-common.h"
|
||||||
|
|
||||||
using namespace llvm;
|
using namespace llvm;
|
||||||
|
|
||||||
@ -58,22 +59,7 @@ class CmpLogInstructions : public ModulePass {
|
|||||||
static char ID;
|
static char ID;
|
||||||
CmpLogInstructions() : ModulePass(ID) {
|
CmpLogInstructions() : ModulePass(ID) {
|
||||||
|
|
||||||
char *instWhiteListFilename = getenv("AFL_LLVM_WHITELIST");
|
initWhitelist();
|
||||||
if (instWhiteListFilename) {
|
|
||||||
|
|
||||||
std::string line;
|
|
||||||
std::ifstream fileStream;
|
|
||||||
fileStream.open(instWhiteListFilename);
|
|
||||||
if (!fileStream) report_fatal_error("Unable to open AFL_LLVM_WHITELIST");
|
|
||||||
getline(fileStream, line);
|
|
||||||
while (fileStream) {
|
|
||||||
|
|
||||||
myWhitelist.push_back(line);
|
|
||||||
getline(fileStream, line);
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -91,8 +77,7 @@ class CmpLogInstructions : public ModulePass {
|
|||||||
}
|
}
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
std::list<std::string> myWhitelist;
|
int be_quiet = 0;
|
||||||
int be_quiet = 0;
|
|
||||||
|
|
||||||
private:
|
private:
|
||||||
bool hookInstrs(Module &M);
|
bool hookInstrs(Module &M);
|
||||||
@ -185,119 +170,10 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
|
|||||||
/* iterate over all functions, bbs and instruction and add suitable calls */
|
/* iterate over all functions, bbs and instruction and add suitable calls */
|
||||||
for (auto &F : M) {
|
for (auto &F : M) {
|
||||||
|
|
||||||
|
if (!isInWhitelist(&F)) continue;
|
||||||
|
|
||||||
for (auto &BB : F) {
|
for (auto &BB : F) {
|
||||||
|
|
||||||
if (!myWhitelist.empty()) {
|
|
||||||
|
|
||||||
BasicBlock::iterator IP = BB.getFirstInsertionPt();
|
|
||||||
|
|
||||||
bool instrumentBlock = false;
|
|
||||||
|
|
||||||
/* Get the current location using debug information.
|
|
||||||
* For now, just instrument the block if we are not able
|
|
||||||
* to determine our location. */
|
|
||||||
DebugLoc Loc = IP->getDebugLoc();
|
|
||||||
#if LLVM_VERSION_MAJOR >= 4 || \
|
|
||||||
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR >= 7)
|
|
||||||
if (Loc) {
|
|
||||||
|
|
||||||
DILocation *cDILoc = dyn_cast<DILocation>(Loc.getAsMDNode());
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc->getLine();
|
|
||||||
StringRef instFilename = cDILoc->getFilename();
|
|
||||||
|
|
||||||
if (instFilename.str().empty()) {
|
|
||||||
|
|
||||||
/* If the original location is empty, try using the inlined location
|
|
||||||
*/
|
|
||||||
DILocation *oDILoc = cDILoc->getInlinedAt();
|
|
||||||
if (oDILoc) {
|
|
||||||
|
|
||||||
instFilename = oDILoc->getFilename();
|
|
||||||
instLine = oDILoc->getLine();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#else
|
|
||||||
if (!Loc.isUnknown()) {
|
|
||||||
|
|
||||||
DILocation cDILoc(Loc.getAsMDNode(C));
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc.getLineNumber();
|
|
||||||
StringRef instFilename = cDILoc.getFilename();
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* Either we couldn't figure out our location or the location is
|
|
||||||
* not whitelisted, so we skip instrumentation. */
|
|
||||||
if (!instrumentBlock) continue;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
for (auto &IN : BB) {
|
for (auto &IN : BB) {
|
||||||
|
|
||||||
CmpInst *selectcmpInst = nullptr;
|
CmpInst *selectcmpInst = nullptr;
|
||||||
|
@ -47,6 +47,7 @@
|
|||||||
#endif
|
#endif
|
||||||
|
|
||||||
#include <set>
|
#include <set>
|
||||||
|
#include "afl-llvm-common.h"
|
||||||
|
|
||||||
using namespace llvm;
|
using namespace llvm;
|
||||||
|
|
||||||
@ -58,22 +59,7 @@ class CmpLogRoutines : public ModulePass {
|
|||||||
static char ID;
|
static char ID;
|
||||||
CmpLogRoutines() : ModulePass(ID) {
|
CmpLogRoutines() : ModulePass(ID) {
|
||||||
|
|
||||||
char *instWhiteListFilename = getenv("AFL_LLVM_WHITELIST");
|
initWhitelist();
|
||||||
if (instWhiteListFilename) {
|
|
||||||
|
|
||||||
std::string line;
|
|
||||||
std::ifstream fileStream;
|
|
||||||
fileStream.open(instWhiteListFilename);
|
|
||||||
if (!fileStream) report_fatal_error("Unable to open AFL_LLVM_WHITELIST");
|
|
||||||
getline(fileStream, line);
|
|
||||||
while (fileStream) {
|
|
||||||
|
|
||||||
myWhitelist.push_back(line);
|
|
||||||
getline(fileStream, line);
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -91,8 +77,7 @@ class CmpLogRoutines : public ModulePass {
|
|||||||
}
|
}
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
std::list<std::string> myWhitelist;
|
int be_quiet = 0;
|
||||||
int be_quiet = 0;
|
|
||||||
|
|
||||||
private:
|
private:
|
||||||
bool hookRtns(Module &M);
|
bool hookRtns(Module &M);
|
||||||
@ -132,119 +117,10 @@ bool CmpLogRoutines::hookRtns(Module &M) {
|
|||||||
/* iterate over all functions, bbs and instruction and add suitable calls */
|
/* iterate over all functions, bbs and instruction and add suitable calls */
|
||||||
for (auto &F : M) {
|
for (auto &F : M) {
|
||||||
|
|
||||||
|
if (!isInWhitelist(&F)) continue;
|
||||||
|
|
||||||
for (auto &BB : F) {
|
for (auto &BB : F) {
|
||||||
|
|
||||||
if (!myWhitelist.empty()) {
|
|
||||||
|
|
||||||
BasicBlock::iterator IP = BB.getFirstInsertionPt();
|
|
||||||
|
|
||||||
bool instrumentBlock = false;
|
|
||||||
|
|
||||||
/* Get the current location using debug information.
|
|
||||||
* For now, just instrument the block if we are not able
|
|
||||||
* to determine our location. */
|
|
||||||
DebugLoc Loc = IP->getDebugLoc();
|
|
||||||
#if LLVM_VERSION_MAJOR >= 4 || \
|
|
||||||
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR >= 7)
|
|
||||||
if (Loc) {
|
|
||||||
|
|
||||||
DILocation *cDILoc = dyn_cast<DILocation>(Loc.getAsMDNode());
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc->getLine();
|
|
||||||
StringRef instFilename = cDILoc->getFilename();
|
|
||||||
|
|
||||||
if (instFilename.str().empty()) {
|
|
||||||
|
|
||||||
/* If the original location is empty, try using the inlined location
|
|
||||||
*/
|
|
||||||
DILocation *oDILoc = cDILoc->getInlinedAt();
|
|
||||||
if (oDILoc) {
|
|
||||||
|
|
||||||
instFilename = oDILoc->getFilename();
|
|
||||||
instLine = oDILoc->getLine();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#else
|
|
||||||
if (!Loc.isUnknown()) {
|
|
||||||
|
|
||||||
DILocation cDILoc(Loc.getAsMDNode(C));
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc.getLineNumber();
|
|
||||||
StringRef instFilename = cDILoc.getFilename();
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* Either we couldn't figure out our location or the location is
|
|
||||||
* not whitelisted, so we skip instrumentation. */
|
|
||||||
if (!instrumentBlock) continue;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
for (auto &IN : BB) {
|
for (auto &IN : BB) {
|
||||||
|
|
||||||
CallInst *callInst = nullptr;
|
CallInst *callInst = nullptr;
|
||||||
|
@ -47,6 +47,7 @@
|
|||||||
#endif
|
#endif
|
||||||
|
|
||||||
#include <set>
|
#include <set>
|
||||||
|
#include "afl-llvm-common.h"
|
||||||
|
|
||||||
using namespace llvm;
|
using namespace llvm;
|
||||||
|
|
||||||
@ -58,22 +59,7 @@ class CompareTransform : public ModulePass {
|
|||||||
static char ID;
|
static char ID;
|
||||||
CompareTransform() : ModulePass(ID) {
|
CompareTransform() : ModulePass(ID) {
|
||||||
|
|
||||||
char *instWhiteListFilename = getenv("AFL_LLVM_WHITELIST");
|
initWhitelist();
|
||||||
if (instWhiteListFilename) {
|
|
||||||
|
|
||||||
std::string line;
|
|
||||||
std::ifstream fileStream;
|
|
||||||
fileStream.open(instWhiteListFilename);
|
|
||||||
if (!fileStream) report_fatal_error("Unable to open AFL_LLVM_WHITELIST");
|
|
||||||
getline(fileStream, line);
|
|
||||||
while (fileStream) {
|
|
||||||
|
|
||||||
myWhitelist.push_back(line);
|
|
||||||
getline(fileStream, line);
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -91,8 +77,7 @@ class CompareTransform : public ModulePass {
|
|||||||
}
|
}
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
std::list<std::string> myWhitelist;
|
int be_quiet = 0;
|
||||||
int be_quiet = 0;
|
|
||||||
|
|
||||||
private:
|
private:
|
||||||
bool transformCmps(Module &M, const bool processStrcmp,
|
bool transformCmps(Module &M, const bool processStrcmp,
|
||||||
@ -140,119 +125,10 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
|
|||||||
* strcmp/memcmp/strncmp/strcasecmp/strncasecmp */
|
* strcmp/memcmp/strncmp/strcasecmp/strncasecmp */
|
||||||
for (auto &F : M) {
|
for (auto &F : M) {
|
||||||
|
|
||||||
|
if (!isInWhitelist(&F)) continue;
|
||||||
|
|
||||||
for (auto &BB : F) {
|
for (auto &BB : F) {
|
||||||
|
|
||||||
if (!myWhitelist.empty()) {
|
|
||||||
|
|
||||||
BasicBlock::iterator IP = BB.getFirstInsertionPt();
|
|
||||||
|
|
||||||
bool instrumentBlock = false;
|
|
||||||
|
|
||||||
/* Get the current location using debug information.
|
|
||||||
* For now, just instrument the block if we are not able
|
|
||||||
* to determine our location. */
|
|
||||||
DebugLoc Loc = IP->getDebugLoc();
|
|
||||||
#if LLVM_VERSION_MAJOR >= 4 || \
|
|
||||||
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR >= 7)
|
|
||||||
if (Loc) {
|
|
||||||
|
|
||||||
DILocation *cDILoc = dyn_cast<DILocation>(Loc.getAsMDNode());
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc->getLine();
|
|
||||||
StringRef instFilename = cDILoc->getFilename();
|
|
||||||
|
|
||||||
if (instFilename.str().empty()) {
|
|
||||||
|
|
||||||
/* If the original location is empty, try using the inlined location
|
|
||||||
*/
|
|
||||||
DILocation *oDILoc = cDILoc->getInlinedAt();
|
|
||||||
if (oDILoc) {
|
|
||||||
|
|
||||||
instFilename = oDILoc->getFilename();
|
|
||||||
instLine = oDILoc->getLine();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#else
|
|
||||||
if (!Loc.isUnknown()) {
|
|
||||||
|
|
||||||
DILocation cDILoc(Loc.getAsMDNode(C));
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc.getLineNumber();
|
|
||||||
StringRef instFilename = cDILoc.getFilename();
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* Either we couldn't figure out our location or the location is
|
|
||||||
* not whitelisted, so we skip instrumentation. */
|
|
||||||
if (!instrumentBlock) continue;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
for (auto &IN : BB) {
|
for (auto &IN : BB) {
|
||||||
|
|
||||||
CallInst *callInst = nullptr;
|
CallInst *callInst = nullptr;
|
||||||
|
@ -46,6 +46,7 @@
|
|||||||
#endif
|
#endif
|
||||||
|
|
||||||
using namespace llvm;
|
using namespace llvm;
|
||||||
|
#include "afl-llvm-common.h"
|
||||||
|
|
||||||
namespace {
|
namespace {
|
||||||
|
|
||||||
@ -55,41 +56,7 @@ class SplitComparesTransform : public ModulePass {
|
|||||||
static char ID;
|
static char ID;
|
||||||
SplitComparesTransform() : ModulePass(ID) {
|
SplitComparesTransform() : ModulePass(ID) {
|
||||||
|
|
||||||
char *instWhiteListFilename = getenv("AFL_LLVM_WHITELIST");
|
initWhitelist();
|
||||||
if (instWhiteListFilename) {
|
|
||||||
|
|
||||||
std::string line;
|
|
||||||
std::ifstream fileStream;
|
|
||||||
fileStream.open(instWhiteListFilename);
|
|
||||||
if (!fileStream) report_fatal_error("Unable to open AFL_LLVM_WHITELIST");
|
|
||||||
getline(fileStream, line);
|
|
||||||
while (fileStream) {
|
|
||||||
|
|
||||||
myWhitelist.push_back(line);
|
|
||||||
getline(fileStream, line);
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
static bool isBlacklisted(const Function *F) {
|
|
||||||
|
|
||||||
static const char *Blacklist[] = {
|
|
||||||
|
|
||||||
"asan.", "llvm.", "sancov.", "__ubsan_handle_", "ign.", "__afl_",
|
|
||||||
"_fini", "__libc_csu", "__asan", "__msan", "msan."
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
for (auto const &BlacklistFunc : Blacklist) {
|
|
||||||
|
|
||||||
if (F->getName().startswith(BlacklistFunc)) { return true; }
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
return false;
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -106,8 +73,7 @@ class SplitComparesTransform : public ModulePass {
|
|||||||
}
|
}
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
std::list<std::string> myWhitelist;
|
int be_quiet = 0;
|
||||||
int be_quiet = 0;
|
|
||||||
|
|
||||||
private:
|
private:
|
||||||
int enableFPSplit;
|
int enableFPSplit;
|
||||||
@ -137,121 +103,10 @@ bool SplitComparesTransform::simplifyCompares(Module &M) {
|
|||||||
* all integer comparisons with >= and <= predicates to the icomps vector */
|
* all integer comparisons with >= and <= predicates to the icomps vector */
|
||||||
for (auto &F : M) {
|
for (auto &F : M) {
|
||||||
|
|
||||||
if (isBlacklisted(&F)) continue;
|
if (!isInWhitelist(&F)) continue;
|
||||||
|
|
||||||
for (auto &BB : F) {
|
for (auto &BB : F) {
|
||||||
|
|
||||||
if (!myWhitelist.empty()) {
|
|
||||||
|
|
||||||
bool instrumentBlock = false;
|
|
||||||
|
|
||||||
BasicBlock::iterator IP = BB.getFirstInsertionPt();
|
|
||||||
|
|
||||||
/* Get the current location using debug information.
|
|
||||||
* For now, just instrument the block if we are not able
|
|
||||||
* to determine our location. */
|
|
||||||
DebugLoc Loc = IP->getDebugLoc();
|
|
||||||
#if LLVM_VERSION_MAJOR >= 4 || \
|
|
||||||
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR >= 7)
|
|
||||||
if (Loc) {
|
|
||||||
|
|
||||||
DILocation *cDILoc = dyn_cast<DILocation>(Loc.getAsMDNode());
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc->getLine();
|
|
||||||
StringRef instFilename = cDILoc->getFilename();
|
|
||||||
|
|
||||||
if (instFilename.str().empty()) {
|
|
||||||
|
|
||||||
/* If the original location is empty, try using the inlined location
|
|
||||||
*/
|
|
||||||
DILocation *oDILoc = cDILoc->getInlinedAt();
|
|
||||||
if (oDILoc) {
|
|
||||||
|
|
||||||
instFilename = oDILoc->getFilename();
|
|
||||||
instLine = oDILoc->getLine();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#else
|
|
||||||
if (!Loc.isUnknown()) {
|
|
||||||
|
|
||||||
DILocation cDILoc(Loc.getAsMDNode(C));
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc.getLineNumber();
|
|
||||||
StringRef instFilename = cDILoc.getFilename();
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* Either we couldn't figure out our location or the location is
|
|
||||||
* not whitelisted, so we skip instrumentation. */
|
|
||||||
if (!instrumentBlock) continue;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
for (auto &IN : BB) {
|
for (auto &IN : BB) {
|
||||||
|
|
||||||
CmpInst *selectcmpInst = nullptr;
|
CmpInst *selectcmpInst = nullptr;
|
||||||
|
@ -49,6 +49,7 @@
|
|||||||
#endif
|
#endif
|
||||||
|
|
||||||
#include <set>
|
#include <set>
|
||||||
|
#include "afl-llvm-common.h"
|
||||||
|
|
||||||
using namespace llvm;
|
using namespace llvm;
|
||||||
|
|
||||||
@ -60,41 +61,7 @@ class SplitSwitchesTransform : public ModulePass {
|
|||||||
static char ID;
|
static char ID;
|
||||||
SplitSwitchesTransform() : ModulePass(ID) {
|
SplitSwitchesTransform() : ModulePass(ID) {
|
||||||
|
|
||||||
char *instWhiteListFilename = getenv("AFL_LLVM_WHITELIST");
|
initWhitelist();
|
||||||
if (instWhiteListFilename) {
|
|
||||||
|
|
||||||
std::string line;
|
|
||||||
std::ifstream fileStream;
|
|
||||||
fileStream.open(instWhiteListFilename);
|
|
||||||
if (!fileStream) report_fatal_error("Unable to open AFL_LLVM_WHITELIST");
|
|
||||||
getline(fileStream, line);
|
|
||||||
while (fileStream) {
|
|
||||||
|
|
||||||
myWhitelist.push_back(line);
|
|
||||||
getline(fileStream, line);
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
static bool isBlacklisted(const Function *F) {
|
|
||||||
|
|
||||||
static const char *Blacklist[] = {
|
|
||||||
|
|
||||||
"asan.", "llvm.", "sancov.", "__ubsan_handle_", "ign.", "__afl_",
|
|
||||||
"_fini", "__libc_csu", "__asan", "__msan", "msan."
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
for (auto const &BlacklistFunc : Blacklist) {
|
|
||||||
|
|
||||||
if (F->getName().startswith(BlacklistFunc)) { return true; }
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
return false;
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -126,8 +93,7 @@ class SplitSwitchesTransform : public ModulePass {
|
|||||||
typedef std::vector<CaseExpr> CaseVector;
|
typedef std::vector<CaseExpr> CaseVector;
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
std::list<std::string> myWhitelist;
|
int be_quiet = 0;
|
||||||
int be_quiet = 0;
|
|
||||||
|
|
||||||
private:
|
private:
|
||||||
bool splitSwitches(Module &M);
|
bool splitSwitches(Module &M);
|
||||||
@ -347,122 +313,12 @@ bool SplitSwitchesTransform::splitSwitches(Module &M) {
|
|||||||
* all switches to switches vector for later processing */
|
* all switches to switches vector for later processing */
|
||||||
for (auto &F : M) {
|
for (auto &F : M) {
|
||||||
|
|
||||||
if (isBlacklisted(&F)) continue;
|
if (!isInWhitelist(&F)) continue;
|
||||||
|
|
||||||
for (auto &BB : F) {
|
for (auto &BB : F) {
|
||||||
|
|
||||||
SwitchInst *switchInst = nullptr;
|
SwitchInst *switchInst = nullptr;
|
||||||
|
|
||||||
if (!myWhitelist.empty()) {
|
|
||||||
|
|
||||||
bool instrumentBlock = false;
|
|
||||||
BasicBlock::iterator IP = BB.getFirstInsertionPt();
|
|
||||||
|
|
||||||
/* Get the current location using debug information.
|
|
||||||
* For now, just instrument the block if we are not able
|
|
||||||
* to determine our location. */
|
|
||||||
DebugLoc Loc = IP->getDebugLoc();
|
|
||||||
#if LLVM_VERSION_MAJOR >= 4 || \
|
|
||||||
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR >= 7)
|
|
||||||
if (Loc) {
|
|
||||||
|
|
||||||
DILocation *cDILoc = dyn_cast<DILocation>(Loc.getAsMDNode());
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc->getLine();
|
|
||||||
StringRef instFilename = cDILoc->getFilename();
|
|
||||||
|
|
||||||
if (instFilename.str().empty()) {
|
|
||||||
|
|
||||||
/* If the original location is empty, try using the inlined location
|
|
||||||
*/
|
|
||||||
DILocation *oDILoc = cDILoc->getInlinedAt();
|
|
||||||
if (oDILoc) {
|
|
||||||
|
|
||||||
instFilename = oDILoc->getFilename();
|
|
||||||
instLine = oDILoc->getLine();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#else
|
|
||||||
if (!Loc.isUnknown()) {
|
|
||||||
|
|
||||||
DILocation cDILoc(Loc.getAsMDNode(C));
|
|
||||||
|
|
||||||
unsigned int instLine = cDILoc.getLineNumber();
|
|
||||||
StringRef instFilename = cDILoc.getFilename();
|
|
||||||
|
|
||||||
(void)instLine;
|
|
||||||
|
|
||||||
/* Continue only if we know where we actually are */
|
|
||||||
if (!instFilename.str().empty()) {
|
|
||||||
|
|
||||||
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
||||||
it != myWhitelist.end(); ++it) {
|
|
||||||
|
|
||||||
/* We don't check for filename equality here because
|
|
||||||
* filenames might actually be full paths. Instead we
|
|
||||||
* check that the actual filename ends in the filename
|
|
||||||
* specified in the list. */
|
|
||||||
if (instFilename.str().length() >= it->length()) {
|
|
||||||
|
|
||||||
if (instFilename.str().compare(
|
|
||||||
instFilename.str().length() - it->length(),
|
|
||||||
it->length(), *it) == 0) {
|
|
||||||
|
|
||||||
instrumentBlock = true;
|
|
||||||
break;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* Either we couldn't figure out our location or the location is
|
|
||||||
* not whitelisted, so we skip instrumentation. */
|
|
||||||
if (!instrumentBlock) continue;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((switchInst = dyn_cast<SwitchInst>(BB.getTerminator()))) {
|
if ((switchInst = dyn_cast<SwitchInst>(BB.getTerminator()))) {
|
||||||
|
|
||||||
if (switchInst->getNumCases() < 1) continue;
|
if (switchInst->getNumCases() < 1) continue;
|
||||||
|
Loading…
x
Reference in New Issue
Block a user