Unable to find target in callgraph when fuzzing Apache httpd about aflgo HOT 9 CLOSED

Thanks for your issue report!

Let me ask you a few questions:

• What is your LLVM version?
• Did you set the appropriate CC, CXX, CFLAGS, CXXFLAGS and install the GOLD plugin?
• Does the compilation complete successfully?
• Is 'Ftarget.txt' empty?
  • If yes, are 'BBnames.txt', 'BBcalls.txt', and 'Fnames.txt' empty as well?
  • If not, can you grep for a target function name in the 'dot-files/callgraph.dot' and see if it exists?

from aflgo.

Thank you for your reply.

1. aflgo-compiler 2.49b
2. Yes.

tianyu@ubuntu-vm0:~/app$ echo $CC $CXX
/home/tianyu/aflgo/afl-clang-fast /home/tianyu/aflgo/afl-clang-fast++
tianyu@ubuntu-vm0:~/app$ echo $CFLAGS $CXXFLAGS 
-targets=/home/tianyu/app/temp/BBtargets.txt -outdir=/home/tianyu/app/temp -fuse-ld=gold -flto -Wl,-plugin-opt=save-temps -targets=/home/tianyu/app/temp/BBtargets.txt -outdir=/home/tianyu/app/temp -fuse-ld=gold -flto -Wl,-plugin-opt=save-temps

3. Yes.
4. Ftargets.txt is not empty:

initialize_module
gen_client
initialize_module
gen_client

The exact problem is that we cannot find the target function in dot-files/callgraph.dot.

from aflgo.

Can you report the output of the following commands?

1. clang --version to check LLVM version
2. ld -plugin /path/to/LLVMgold.so to check whether Gold plugin works. The Gold plugin is used to generate the bitcode file (*.bc) for the compiled binaries. The bitcode file is used only to extract the callgraph. Once everything is integrated into a single LLVM pass, Gold and the generation of *.dot files will be redundant.
3. grep initialize_module dot-files/callgraph.dot. If empty,
   • can you try to locate the bitcode for the main binary (e.g., httpd.0.0.*.bc), and
   • execute opt -dot-callgraph <path-to-main.binary.bc> >/dev/null?
   • This regenerates the callgraph.dot in the current folder: grep initialize_module callgraph.dot.

from aflgo.

I used libxml2 to make an example,but after I build libxml2,I found Ftargets.txt and BBcalls are empty

from aflgo.

Hi,
Can you please provide more information like what version of libxml2 you are testing and how do you specify the target(s) -- you test a specific patch or you set the targets manually?

You can check your "step*.log" and "state" files inside your temporary folder ($TMP_DIR) to see whether there is some trivial error there.

Please also report the output of the following commands:

1. clang --version to check LLVM version
2. ld -plugin /path/to/LLVMgold.so to check whether Gold plugin works. The Gold plugin is used to generate the bitcode file (*.bc) for the compiled binaries. The bitcode file is used only to extract the callgraph. Once everything is integrated into a single LLVM pass, Gold and the generation of *.dot files will be redundant.

Thuan

from aflgo.

from aflgo.

Hi Oscar,
Do you see any log file (step*.log) in your $TMP_DIR? If so, please share it with me for a quick look.
Thuan

from aflgo.

from aflgo.

Hi,
The targets can be generated automatically from code changes as shown in Readme.md. You can also specify targets manually or using some other tools -- a static analysis tool for example, just ensure that you follow the format as in BBtargets.txt.

Thuan

from aflgo.