mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-08 16:21:32 +00:00
331 lines
8.0 KiB
C++
331 lines
8.0 KiB
C++
/*
|
|
american fuzzy lop++ - LLVM CmpLog instrumentation
|
|
--------------------------------------------------
|
|
|
|
Written by Andrea Fioraldi <andreafioraldi@gmail.com>
|
|
|
|
Copyright 2015, 2016 Google Inc. All rights reserved.
|
|
Copyright 2019-2020 AFLplusplus Project. All rights reserved.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at:
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
|
|
#include <list>
|
|
#include <string>
|
|
#include <fstream>
|
|
#include <sys/time.h>
|
|
#include "llvm/Config/llvm-config.h"
|
|
|
|
#include "llvm/ADT/Statistic.h"
|
|
#include "llvm/IR/IRBuilder.h"
|
|
#include "llvm/IR/LegacyPassManager.h"
|
|
#include "llvm/IR/Module.h"
|
|
#include "llvm/Support/Debug.h"
|
|
#include "llvm/Support/raw_ostream.h"
|
|
#include "llvm/Transforms/IPO/PassManagerBuilder.h"
|
|
#include "llvm/Transforms/Utils/BasicBlockUtils.h"
|
|
#include "llvm/Pass.h"
|
|
#include "llvm/Analysis/ValueTracking.h"
|
|
|
|
#if LLVM_VERSION_MAJOR > 3 || \
|
|
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR > 4)
|
|
#include "llvm/IR/Verifier.h"
|
|
#include "llvm/IR/DebugInfo.h"
|
|
#else
|
|
#include "llvm/Analysis/Verifier.h"
|
|
#include "llvm/DebugInfo.h"
|
|
#define nullptr 0
|
|
#endif
|
|
|
|
#include <set>
|
|
|
|
using namespace llvm;
|
|
|
|
namespace {
|
|
|
|
class CmpLogRoutines : public ModulePass {
|
|
|
|
public:
|
|
static char ID;
|
|
CmpLogRoutines() : ModulePass(ID) {
|
|
|
|
char *instWhiteListFilename = getenv("AFL_LLVM_WHITELIST");
|
|
if (instWhiteListFilename) {
|
|
|
|
std::string line;
|
|
std::ifstream fileStream;
|
|
fileStream.open(instWhiteListFilename);
|
|
if (!fileStream) report_fatal_error("Unable to open AFL_LLVM_WHITELIST");
|
|
getline(fileStream, line);
|
|
while (fileStream) {
|
|
|
|
myWhitelist.push_back(line);
|
|
getline(fileStream, line);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
bool runOnModule(Module &M) override;
|
|
|
|
#if LLVM_VERSION_MAJOR < 4
|
|
const char *getPassName() const override {
|
|
|
|
#else
|
|
StringRef getPassName() const override {
|
|
|
|
#endif
|
|
return "cmplog routines";
|
|
|
|
}
|
|
|
|
protected:
|
|
std::list<std::string> myWhitelist;
|
|
int be_quiet = 0;
|
|
|
|
private:
|
|
bool hookRtns(Module &M);
|
|
|
|
};
|
|
|
|
} // namespace
|
|
|
|
char CmpLogRoutines::ID = 0;
|
|
|
|
bool CmpLogRoutines::hookRtns(Module &M) {
|
|
|
|
std::vector<CallInst *> calls;
|
|
LLVMContext & C = M.getContext();
|
|
|
|
Type * VoidTy = Type::getVoidTy(C);
|
|
PointerType *VoidPtrTy = PointerType::get(VoidTy, 0);
|
|
|
|
#if LLVM_VERSION_MAJOR < 9
|
|
Constant *
|
|
#else
|
|
FunctionCallee
|
|
#endif
|
|
c = M.getOrInsertFunction("__cmplog_rtn_hook", VoidTy, VoidPtrTy,
|
|
VoidPtrTy
|
|
#if LLVM_VERSION_MAJOR < 5
|
|
,
|
|
NULL
|
|
#endif
|
|
);
|
|
#if LLVM_VERSION_MAJOR < 9
|
|
Function *cmplogHookFn = cast<Function>(c);
|
|
#else
|
|
FunctionCallee cmplogHookFn = c;
|
|
#endif
|
|
|
|
/* iterate over all functions, bbs and instruction and add suitable calls */
|
|
for (auto &F : M) {
|
|
|
|
for (auto &BB : F) {
|
|
|
|
if (!myWhitelist.empty()) {
|
|
|
|
BasicBlock::iterator IP = BB.getFirstInsertionPt();
|
|
|
|
bool instrumentBlock = false;
|
|
|
|
/* Get the current location using debug information.
|
|
* For now, just instrument the block if we are not able
|
|
* to determine our location. */
|
|
DebugLoc Loc = IP->getDebugLoc();
|
|
#if LLVM_VERSION_MAJOR >= 4 || \
|
|
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR >= 7)
|
|
if (Loc) {
|
|
|
|
DILocation *cDILoc = dyn_cast<DILocation>(Loc.getAsMDNode());
|
|
|
|
unsigned int instLine = cDILoc->getLine();
|
|
StringRef instFilename = cDILoc->getFilename();
|
|
|
|
if (instFilename.str().empty()) {
|
|
|
|
/* If the original location is empty, try using the inlined location
|
|
*/
|
|
DILocation *oDILoc = cDILoc->getInlinedAt();
|
|
if (oDILoc) {
|
|
|
|
instFilename = oDILoc->getFilename();
|
|
instLine = oDILoc->getLine();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
(void)instLine;
|
|
|
|
/* Continue only if we know where we actually are */
|
|
if (!instFilename.str().empty()) {
|
|
|
|
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
it != myWhitelist.end(); ++it) {
|
|
|
|
/* We don't check for filename equality here because
|
|
* filenames might actually be full paths. Instead we
|
|
* check that the actual filename ends in the filename
|
|
* specified in the list. */
|
|
if (instFilename.str().length() >= it->length()) {
|
|
|
|
if (instFilename.str().compare(
|
|
instFilename.str().length() - it->length(),
|
|
it->length(), *it) == 0) {
|
|
|
|
instrumentBlock = true;
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#else
|
|
if (!Loc.isUnknown()) {
|
|
|
|
DILocation cDILoc(Loc.getAsMDNode(C));
|
|
|
|
unsigned int instLine = cDILoc.getLineNumber();
|
|
StringRef instFilename = cDILoc.getFilename();
|
|
|
|
(void)instLine;
|
|
|
|
/* Continue only if we know where we actually are */
|
|
if (!instFilename.str().empty()) {
|
|
|
|
for (std::list<std::string>::iterator it = myWhitelist.begin();
|
|
it != myWhitelist.end(); ++it) {
|
|
|
|
/* We don't check for filename equality here because
|
|
* filenames might actually be full paths. Instead we
|
|
* check that the actual filename ends in the filename
|
|
* specified in the list. */
|
|
if (instFilename.str().length() >= it->length()) {
|
|
|
|
if (instFilename.str().compare(
|
|
instFilename.str().length() - it->length(),
|
|
it->length(), *it) == 0) {
|
|
|
|
instrumentBlock = true;
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
/* Either we couldn't figure out our location or the location is
|
|
* not whitelisted, so we skip instrumentation. */
|
|
if (!instrumentBlock) continue;
|
|
|
|
}
|
|
|
|
for (auto &IN : BB) {
|
|
|
|
CallInst *callInst = nullptr;
|
|
|
|
if ((callInst = dyn_cast<CallInst>(&IN))) {
|
|
|
|
Function *Callee = callInst->getCalledFunction();
|
|
if (!Callee) continue;
|
|
if (callInst->getCallingConv() != llvm::CallingConv::C) continue;
|
|
|
|
FunctionType *FT = Callee->getFunctionType();
|
|
|
|
bool isPtrRtn = FT->getNumParams() >= 2 &&
|
|
!FT->getReturnType()->isVoidTy() &&
|
|
FT->getParamType(0) == FT->getParamType(1) &&
|
|
FT->getParamType(0)->isPointerTy();
|
|
|
|
if (!isPtrRtn) continue;
|
|
|
|
calls.push_back(callInst);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!calls.size()) return false;
|
|
if (!be_quiet)
|
|
errs() << "Hooking " << calls.size()
|
|
<< " calls with pointers as arguments\n";
|
|
|
|
for (auto &callInst : calls) {
|
|
|
|
Value *v1P = callInst->getArgOperand(0), *v2P = callInst->getArgOperand(1);
|
|
|
|
IRBuilder<> IRB(callInst->getParent());
|
|
IRB.SetInsertPoint(callInst);
|
|
|
|
std::vector<Value *> args;
|
|
args.push_back(v1P);
|
|
args.push_back(v2P);
|
|
|
|
IRB.CreateCall(cmplogHookFn, args, "tmp");
|
|
|
|
// errs() << callInst->getCalledFunction()->getName() << "\n";
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
bool CmpLogRoutines::runOnModule(Module &M) {
|
|
|
|
if (getenv("AFL_QUIET") == NULL)
|
|
llvm::errs()
|
|
<< "Running cmplog-routines-pass by andreafioraldi@gmail.com\n";
|
|
else
|
|
be_quiet = 1;
|
|
hookRtns(M);
|
|
verifyModule(M);
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
static void registerCmpLogRoutinesPass(const PassManagerBuilder &,
|
|
legacy::PassManagerBase &PM) {
|
|
|
|
auto p = new CmpLogRoutines();
|
|
PM.add(p);
|
|
|
|
}
|
|
|
|
static RegisterStandardPasses RegisterCmpLogRoutinesPass(
|
|
PassManagerBuilder::EP_OptimizerLast, registerCmpLogRoutinesPass);
|
|
|
|
static RegisterStandardPasses RegisterCmpLogRoutinesPass0(
|
|
PassManagerBuilder::EP_EnabledOnOptLevel0, registerCmpLogRoutinesPass);
|
|
|