chengyusong / kirenenko Goto Github PK
View Code? Open in Web Editor NEWThis project forked from angorafuzzer/angora
Super Fast Concolic Execution Engine based on Source Code Taint Tracing
License: Apache License 2.0
kirenenko's People
Contributors
Stargazers
Watchers
Forkers
whhan deeby chenju2k6 mcgrady1 stevenskevin reflecting-light hexhive nativefaith40 donnykk liftdatkirenenko's Issues
Weak hash value for hash table
Hi, Chengyu.
I guess you have used xxhash for making hash.
But in your hash table, you are using other hash, which seems very weak.
Did you intentionally use the weak hash? or just forget to use the xxhash value?
std::map is broken
std::map is broken when compiling with ko-clang++. It works when using regular clang++.
Here's my test case ("test.cpp"). It sets up a std::map<std::string, std::string> and adds items to it one by one. At every step, it iterates over the whole map to print its contents, and also searches for a specific item with .find().
#include <cstdio>
#include <map>
#include <string>
typedef std::map<std::string, std::string> string_map_t;
void search_for_target(string_map_t &string_map) {
printf("Current entries:");
for (auto it = string_map.begin(); it != string_map.end(); ++it) {
printf(" %s", it->first.c_str());
}
printf("\nSearching for \"key_target\": ");
auto found = string_map.find("key_target");
if (found != string_map.end()) {
printf("Found! \"%s\"\n", found->second.c_str());
} else {
printf("Not found...\n");
}
}
int main(int argc, const char *argv[]) {
string_map_t string_map = {};
search_for_target(string_map);
string_map["key_A"] = "value_A";
search_for_target(string_map);
string_map["key_B"] = "value_B";
search_for_target(string_map);
string_map["key_target"] = "value_target";
search_for_target(string_map);
string_map["key_C"] = "value_C";
search_for_target(string_map);
string_map["key_D"] = "value_D";
search_for_target(string_map);
return 0;
}Compile with standard clang++ and ko-clang++ commands (you can also optionally add -stdlib=libc++ -lc++ -lc++abi to the clang++ call to make it more like the ko-clang++ one, but it doesn't affect the overall outcome):
$ clang++ -o test test.cpp
$ ko-clang++ -o test_ko test.cpp
Output when compiled with regular clang++ (correct): The map grows as expected, and once "key_target" is added, .find() starts finding it:
$ ./test
Current entries:
Searching for "key_target": Not found...
Current entries: key_A
Searching for "key_target": Not found...
Current entries: key_A key_B
Searching for "key_target": Not found...
Current entries: key_A key_B key_target
Searching for "key_target": Found! "value_target"
Current entries: key_A key_B key_C key_target
Searching for "key_target": Found! "value_target"
Current entries: key_A key_B key_C key_D key_target
Searching for "key_target": Found! "value_target"
Output when compiled with ko-clang++ (incorrect): Once an item is added to the map, iteration and searching both break. Iterators only ever yield the first item, and .find() always returns the most recently added item.
$ ./test_ko
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function mbtowc
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function __ctype_get_mb_cur_max
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function newlocale
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function pthread_cond_broadcast
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function mbtowc
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function __ctype_get_mb_cur_max
Current entries:
Searching for "key_target": Not found...
Current entries: key_A
Searching for "key_target": Found! "value_A"
Current entries: key_A
Searching for "key_target": Found! "value_B"
Current entries: key_A
Searching for "key_target": Found! "value_target"
Current entries: key_A
Searching for "key_target": Found! "value_C"
Current entries: key_A
Searching for "key_target": Found! "value_D"
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function wcrtomb
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function wcrtomb
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function wcrtomb
==27699==WARNING: DataFlowSanitizer: call to uninstrumented function wcrtomb
My environment, if it helps: LLVM 6.0.1 in an Ubuntu 18.04 Docker container.
Build failure
Hi !
~/Documents/Kirenenko/z3 ~/Documents/Kirenenko
+ popd
~/Documents/Kirenenko
+ mkdir -p /home/arash/Documents/Kirenenko/bin/
+ mkdir -p /home/arash/Documents/Kirenenko/bin//lib
+ pushd llvm_mode
~/Documents/Kirenenko/llvm_mode ~/Documents/Kirenenko
+ rm -rf build
+ mkdir -p build
+ pushd build
~/Documents/Kirenenko/llvm_mode/build ~/Documents/Kirenenko/llvm_mode ~/Documents/Kirenenko
+ CC=clang
+ CXX=clang++
+ cmake -DCMAKE_INSTALL_PREFIX=/home/arash/Documents/Kirenenko/bin/ -DCMAKE_BUILD_TYPE=Release ..
-- The C compiler identification is Clang 10.0.0
-- The CXX compiler identification is Clang 10.0.0
-- The ASM compiler identification is Clang
-- Found assembler: /usr/bin/clang
-- Check for working C compiler: /usr/bin/clang
-- Check for working C compiler: /usr/bin/clang -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Detecting C compile features
-- Detecting C compile features - done
-- Check for working CXX compiler: /usr/bin/clang++
-- Check for working CXX compiler: /usr/bin/clang++ -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Detecting CXX compile features
-- Detecting CXX compile features - done
CMake Error at CMakeLists.txt:5 (find_package):
Could not find a configuration file for package "LLVM" that is compatible
with requested version "6".
The following configuration files were considered but not accepted:
/usr/lib/llvm-10/cmake/LLVMConfig.cmake, version: 10.0.0
/lib/llvm-10/cmake/LLVMConfig.cmake, version: 10.0.0
-- Configuring incomplete, errors occurred!
See also "/home/arash/Documents/Kirenenko/llvm_mode/build/CMakeFiles/CMakeOutput.log".
See also "/home/arash/Documents/Kirenenko/llvm_mode/build/CMakeFiles/CMakeError.log".
Solution?
build failures
Hi,
I wanted to try out Kirenenko but ran into two problems.
Dockerfile attempt:
srv10201 /Kirenenko # docker build -t kirenenko .
[...]
[ 96%] Building CXX object dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/dfsan_custom.cc.o
[ 96%] Built target RTSanitizerCommonNoHooks.x86_64
In file included from /kirenenko/llvm_mode/dfsan_rt/dfsan/dfsan.cc:46:
/usr/include/z3++.h:24:9: fatal error: 'cassert' file not found
#include<cassert>
^~~~~~~~~
1 error generated.
make[2]: *** [dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/dfsan.cc.o] Error 1
make[2]: *** Waiting for unfinished jobs....
dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/build.make:62: recipe for target 'dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/dfsan.cc.o' failed
CMakeFiles/Makefile2:1239: recipe for target 'dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/all' failed
make[1]: *** [dfsan_rt/dfsan/CMakeFiles/dfsan_rt-x86_64.dir/all] Error 2
make[1]: *** Waiting for unfinished jobs....
[ 96%] Linking CXX shared module libUnfoldBranchPass.so
[ 96%] Built target UnfoldBranchPass
[ 97%] Linking CXX shared module libAngoraPass.so
[ 97%] Built target AngoraPass
[ 97%] Linking CXX shared module libTaintPass.so
[ 97%] Built target TaintPass
[ 98%] Linking CXX shared module libDFSanPass.so
[ 98%] Built target DFSanPass
Makefile:129: recipe for target 'all' failed
make: *** [all] Error 2
The command '/bin/sh -c ./build/build.sh' returned a non-zero code: 2
plain build attempt (clang 6.0):
srv10201 /Kirenenko/llvm_mode/build # make
[ 1%] Built target KOClang
[ 2%] Built target TaintPass
[ 3%] Built target DFSanPass
[ 4%] Built target AngoraPass
[ 5%] Built target UnfoldBranchPass
[ 6%] Built target taint_linker_script
[ 7%] Built target RTInterception.x86_64
[ 7%] Building CXX object dfsan_rt/sanitizer_common/CMakeFiles/RTSanitizerCommon.x86_64.dir/sanitizer_platform_limits_posix.cc.o
/Kirenenko/llvm_mode/dfsan_rt/sanitizer_common/sanitizer_platform_limits_posix.cc:1163:1: error:
'assertion_failed__1163' declared as an array with a negative size
CHECK_SIZE_AND_OFFSET(ipc_perm, mode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Kirenenko/llvm_mode/dfsan_rt/sanitizer_common/sanitizer_platform_limits_posix.h:1513:3: note:
expanded from macro 'CHECK_SIZE_AND_OFFSET'
COMPILER_CHECK(sizeof(((__sanitizer_##CLASS *) NULL)->MEMBER) == \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Kirenenko/llvm_mode/dfsan_rt/sanitizer_common/sanitizer_internal_defs.h:336:30: note:
expanded from macro 'COMPILER_CHECK'
#define COMPILER_CHECK(pred) IMPL_COMPILER_ASSERT(pred, __LINE__)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Kirenenko/llvm_mode/dfsan_rt/sanitizer_common/sanitizer_internal_defs.h:342:57: note:
expanded from macro 'IMPL_COMPILER_ASSERT'
typedef char IMPL_PASTE(assertion_failed_##_, line)[2*(int)(pred)-1]
^~~~~~~~~~~~~~~
1 error generated.
make[2]: *** [dfsan_rt/sanitizer_common/CMakeFiles/RTSanitizerCommon.x86_64.dir/build.make:310: dfsan_rt/sanitizer_common/CMakeFiles/RTSanitizerCommon.x86_64.dir/sanitizer_platform_limits_posix.cc.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:568: dfsan_rt/sanitizer_common/CMakeFiles/RTSanitizerCommon.x86_64.dir/all] Error 2
make: *** [Makefile:130: all] Error 2
so ... what is the shortest path to get a working build?
thank you.
Incorrect constraints collecting under O3
In the below program, when LOOP_COUNT > 3, there are no constraints generated when the optimization level is set to O3
#define LOOP_COUNT 4
int main(int argc, char **argv) {
if (argc < 2)
return 0;
FILE *fp;
char buf[255];
size_t ret;
fp = fopen(argv[1], "rb");
if (!fp) {
printf("st err\n");
return 0;
}
int len = 20;
ret = fread(buf, sizeof *buf, len, fp);
fclose(fp);
int count = 0;
for(int i=0;i<LOOP_COUNT;i++) {
switch (buf[i]) {
case 'u':
count++;
break;
default:
break;
}
}
switch (count) {
case 2:
printf("hit!\n");
abort();
default:
break;
}
return 0;
}
บ้า
เมียน @[email protected]
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.