chengyusong / kirenenko Goto Github PK
View Code? Open in Web Editor NEWThis project forked from angorafuzzer/angora
Super Fast Concolic Execution Engine based on Source Code Taint Tracing
License: Apache License 2.0
This project forked from angorafuzzer/angora
Super Fast Concolic Execution Engine based on Source Code Taint Tracing
License: Apache License 2.0
Hi, Chengyu.
I guess you have used xxhash for making hash.
But in your hash table, you are using other hash, which seems very weak.
Did you intentionally use the weak hash? or just forget to use the xxhash value?
std::map
is broken when compiling with ko-clang++. It works when using regular clang++.
Here's my test case ("test.cpp"). It sets up a std::map<std::string, std::string>
and adds items to it one by one. At every step, it iterates over the whole map to print its contents, and also searches for a specific item with .find()
.
#include <cstdio>
#include <map>
#include <string>
typedef std::map<std::string, std::string> string_map_t;
void search_for_target(string_map_t &string_map) {
printf("Current entries:");
for (auto it = string_map.begin(); it != string_map.end(); ++it) {
printf(" %s", it->first.c_str());
}
printf("\nSearching for \"key_target\": ");
auto found = string_map.find("key_target");
if (found != string_map.end()) {
printf("Found! \"%s\"\n", found->second.c_str());
} else {
printf("Not found...\n");
}
}
int main(int argc, const char *argv[]) {
string_map_t string_map = {};
search_for_target(string_map);
string_map["key_A"] = "value_A";
search_for_target(string_map);
string_map["key_B"] = "value_B";
search_for_target(string_map);
string_map["key_target"] = "value_target";
search_for_target(string_map);
string_map["key_C"] = "value_C";
search_for_target(string_map);
string_map["key_D"] = "value_D";
search_for_target(string_map);
return 0;
}
Compile with standard clang++ and ko-clang++ commands (you can also optionally add -stdlib=libc++ -lc++ -lc++abi
to the clang++ call to make it more like the ko-clang++ one, but it doesn't affect the overall outcome):
$ clang++ -o test test.cpp
$ ko-clang++ -o test_ko test.cpp
Output when compiled with regular clang++ (correct): The map grows as expected, and once "key_target" is added, .find()
starts finding it:
$ ./test
Current entries:
Searching for "key_target": Not found...
Current entries: key_A
Searching for "key_target": Not found...
Current entries: key_A key_B
Searching for "key_target": Not found...
Current entries: key_A key_B key_target
Searching for "key_target": Found! "value_target"
Current entries: key_A key_B key_C key_target
Searching for "key_target": Found! "value_target"
Current entries: key_A key_B key_C key_D key_target
Searching for "key_target": Found! "value_target"
Output when compiled with ko-clang++ (incorrect): Once an item is added to the map, iteration and searching both break. Iterators only ever yield the first item, and .find()
always returns the most recently added item.
$ ./test_ko
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function mbtowc
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function __ctype_get_mb_cur_max
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function newlocale
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function mbtowc
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function __ctype_get_mb_cur_max
Current entries:
Searching for "key_target": Not found...
Current entries: key_A
Searching for "key_target": Found! "value_A"
Current entries: key_A
Searching for "key_target": Found! "value_B"
Current entries: key_A
Searching for "key_target": Found! "value_target"
Current entries: key_A
Searching for "key_target": Found! "value_C"
Current entries: key_A
Searching for "key_target": Found! "value_D"
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function wcrtomb
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function wcrtomb
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function wcrtomb
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function wcrtomb
My environment, if it helps: LLVM 6.0.1 in an Ubuntu 18.04 Docker container.
Hi !
~/Documents/Kirenenko/z3 ~/Documents/Kirenenko
+ popd
~/Documents/Kirenenko
+ mkdir -p /home/arash/Documents/Kirenenko/bin/
+ mkdir -p /home/arash/Documents/Kirenenko/bin//lib
+ pushd llvm_mode
~/Documents/Kirenenko/llvm_mode ~/Documents/Kirenenko
+ rm -rf build
+ mkdir -p build
+ pushd build
~/Documents/Kirenenko/llvm_mode/build ~/Documents/Kirenenko/llvm_mode ~/Documents/Kirenenko
+ CC=clang
+ CXX=clang++
+ cmake -DCMAKE_INSTALL_PREFIX=/home/arash/Documents/Kirenenko/bin/ -DCMAKE_BUILD_TYPE=Release ..
-- The C compiler identification is Clang 10.0.0
-- The CXX compiler identification is Clang 10.0.0
-- The ASM compiler identification is Clang
-- Found assembler: /usr/bin/clang
-- Check for working C compiler: /usr/bin/clang
-- Check for working C compiler: /usr/bin/clang -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Detecting C compile features
-- Detecting C compile features - done
-- Check for working CXX compiler: /usr/bin/clang++
-- Check for working CXX compiler: /usr/bin/clang++ -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Detecting CXX compile features
-- Detecting CXX compile features - done
CMake Error at CMakeLists.txt:5 (find_package):
Could not find a configuration file for package "LLVM" that is compatible
with requested version "6".
The following configuration files were considered but not accepted:
/usr/lib/llvm-10/cmake/LLVMConfig.cmake, version: 10.0.0
/lib/llvm-10/cmake/LLVMConfig.cmake, version: 10.0.0
-- Configuring incomplete, errors occurred!
See also "/home/arash/Documents/Kirenenko/llvm_mode/build/CMakeFiles/CMakeOutput.log".
See also "/home/arash/Documents/Kirenenko/llvm_mode/build/CMakeFiles/CMakeError.log".
Solution?
Hi,
I wanted to try out Kirenenko but ran into two problems.
Dockerfile attempt:
srv10201 /Kirenenko # docker build -t kirenenko .
[...]
[ 96%] Building CXX object dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/dfsan_custom.cc.o
[ 96%] Built target RTSanitizerCommonNoHooks.x86_64
In file included from /kirenenko/llvm_mode/dfsan_rt/dfsan/dfsan.cc:46:
/usr/include/z3++.h:24:9: fatal error: 'cassert' file not found
#include<cassert>
^~~~~~~~~
1 error generated.
make[2]: *** [dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/dfsan.cc.o] Error 1
make[2]: *** Waiting for unfinished jobs....
dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/build.make:62: recipe for target 'dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/dfsan.cc.o' failed
CMakeFiles/Makefile2:1239: recipe for target 'dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/all' failed
make[1]: *** [dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/all] Error 2
make[1]: *** Waiting for unfinished jobs....
[ 96%] Linking CXX shared module libUnfoldBranchPass.so
[ 96%] Built target UnfoldBranchPass
[ 97%] Linking CXX shared module libAngoraPass.so
[ 97%] Built target AngoraPass
[ 97%] Linking CXX shared module libTaintPass.so
[ 97%] Built target TaintPass
[ 98%] Linking CXX shared module libDFSanPass.so
[ 98%] Built target DFSanPass
Makefile:129: recipe for target 'all' failed
make: *** [all] Error 2
The command '/bin/sh -c ./build/build.sh' returned a non-zero code: 2
plain build attempt (clang 6.0):
srv10201 /Kirenenko/llvm_mode/build # make
[ 1%] Built target KOClang
[ 2%] Built target TaintPass
[ 3%] Built target DFSanPass
[ 4%] Built target AngoraPass
[ 5%] Built target UnfoldBranchPass
[ 6%] Built target taint_linker_script
[ 7%] Built target RTInterception.x86_64
[ 7%] Building CXX object dfsan_rt/sanitizer_common/CMakeFiles/RTSanitizerCommon.x86_64.dir/sanitizer_platform_limits_posix.cc.o
/Kirenenko/llvm_mode/dfsan_rt/sanitizer_common/sanitizer_platform_limits_posix.cc:1163:1: error:
'assertion_failed__1163' declared as an array with a negative size
CHECK_SIZE_AND_OFFSET(ipc_perm, mode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Kirenenko/llvm_mode/dfsan_rt/sanitizer_common/sanitizer_platform_limits_posix.h:1513:3: note:
expanded from macro 'CHECK_SIZE_AND_OFFSET'
COMPILER_CHECK(sizeof(((__sanitizer_##CLASS *) NULL)->MEMBER) == \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Kirenenko/llvm_mode/dfsan_rt/sanitizer_common/sanitizer_internal_defs.h:336:30: note:
expanded from macro 'COMPILER_CHECK'
#define COMPILER_CHECK(pred) IMPL_COMPILER_ASSERT(pred, __LINE__)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Kirenenko/llvm_mode/dfsan_rt/sanitizer_common/sanitizer_internal_defs.h:342:57: note:
expanded from macro 'IMPL_COMPILER_ASSERT'
typedef char IMPL_PASTE(assertion_failed_##_, line)[2*(int)(pred)-1]
^~~~~~~~~~~~~~~
1 error generated.
make[2]: *** [dfsan_rt/sanitizer_common/CMakeFiles/RTSanitizerCommon.x86_64.dir/build.make:310: dfsan_rt/sanitizer_common/CMakeFiles/RTSanitizerCommon.x86_64.dir/sanitizer_platform_limits_posix.cc.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:568: dfsan_rt/sanitizer_common/CMakeFiles/RTSanitizerCommon.x86_64.dir/all] Error 2
make: *** [Makefile:130: all] Error 2
so ... what is the shortest path to get a working build?
thank you.
In the below program, when LOOP_COUNT > 3, there are no constraints generated when the optimization level is set to O3
#define LOOP_COUNT 4
int main(int argc, char **argv) {
if (argc < 2)
return 0;
FILE *fp;
char buf[255];
size_t ret;
fp = fopen(argv[1], "rb");
if (!fp) {
printf("st err\n");
return 0;
}
int len = 20;
ret = fread(buf, sizeof *buf, len, fp);
fclose(fp);
int count = 0;
for(int i=0;i<LOOP_COUNT;i++) {
switch (buf[i]) {
case 'u':
count++;
break;
default:
break;
}
}
switch (count) {
case 2:
printf("hit!\n");
abort();
default:
break;
}
return 0;
}
เมียน @[email protected]
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.