kevinkoo001 / ccr Goto Github PK

Hi, this seems like a neat tool. I have seen similar tools like multicompiler and was interested in testing it out. I did a quick test with nginx and was able to use prander with the nginx executable itself. But, I tried on some corresponding shared libraries ngx_http_geoip_module.so, ngx_http_image_filter_module.so, and ngx_http_xslt_filter_module.so but saw a mismatch in the instrumented file size and the original file size and could not shuffle the shared libraries. Are there specific command line flags I have to provide to prander or ccr for shared libraries?

tpottei1@tpottei1-ThinkPad-E570:/source-packages/ng_source/nginx-1.14.0/debian/build-extras/objs$ readelf -SW ngx_http_geoip_module.so | grep rand
[35] .rand PROGBITS 0000000000000000 014b1c 000515 00 0 0 1
tpottei1@tpottei1-ThinkPad-E570:/source-packages/ng_source/nginx-1.14.0/debian/build-extras/objs$ python /home/tpottei1/CCR/randomizer/prander.py /home/tpottei1/source-packages/ng_source/nginx-1.14.0/debian/build-extras/objs/ngx_http_image_filter_module.so

___   ___   __         ___                     _

/ \ / \ /\ / _ _ __ __ _ _ __ | | ___ _ __
/ / / / / //_ / /)/ '/ _ | '_ \ / _ |/ _ \ '|
/ // // _ _/ /| | | (| | | | | (| | / |
_/_// _/ / || _,|| ||_,|___|/

Compiler-assisted Code Randomization: Practical Randomizer
(In the 39th IEEE Symposium on Security & Privacy 2018)

2020-05-28 01:15:58,962 [INFO ] Reading the metadata from the .rand section... (shuffleInfoReader.py:164)
2020-05-28 01:15:58,962 [INFO ] Offset to the object : 0xe0 (shuffleInfoReader.py:165)
2020-05-28 01:15:58,962 [INFO ] Offset to the main() : 0x00 (shuffleInfoReader.py:166)
2020-05-28 01:15:58,962 [INFO ] Total Emitted Bytes : 0x21d0 (shuffleInfoReader.py:167)
2020-05-28 01:15:58,962 [INFO ] Number of Objects : 1 (shuffleInfoReader.py:168)
2020-05-28 01:15:58,962 [INFO ] Number of Functions : 11 (shuffleInfoReader.py:169)
2020-05-28 01:15:58,962 [INFO ] Number of Basic Blocks: 447 (shuffleInfoReader.py:170)
2020-05-28 01:15:58,964 [INFO ] Fixups in .text : 573 (shuffleInfoReader.py:56)
2020-05-28 01:15:58,964 [INFO ] Fixups in .rodata : 16 (shuffleInfoReader.py:56)
2020-05-28 01:15:58,964 [INFO ] Fixups in .data : 50 (shuffleInfoReader.py:56)
2020-05-28 01:15:58,964 [INFO ] Fixups in .data.rel.ro : 4 (shuffleInfoReader.py:56)
2020-05-28 01:15:58,965 [INFO ] Number of Jump Tables : 4 (shuffleInfoReader.py:200)
2020-05-28 01:15:58,966 [INFO ] Building up the layout... (prander.py:43)
100% [>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>]
2020-05-28 01:15:58,979 [INFO ] Sanity check for /home/tpottei1/source-packages/ng_source/nginx-1.14.0/debian/build-extras/objs/ngx_http_image_filter_module.so... (reorderInfo.py:593)
2020-05-28 01:15:58,980 [INFO ] All sanity checks have been PASSED!! (reorderInfo.py:618)
2020-05-28 01:15:58,980 [INFO ] Performing reordering (@fun)... (prander.py:48)
2020-05-28 01:15:58,980 [INFO ] # of Function Constraints: 0 (reorderEngine.py:236)
2020-05-28 01:15:58,982 [INFO ] Instrumenting the binary... (prander.py:66)
2020-05-28 01:15:58,983 [INFO ] Processing section [.dynsym] (binaryBuilder.py:875)
100% [>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>]
2020-05-28 01:15:58,990 [INFO ] Processing section [.rela.dyn] (binaryBuilder.py:875)
2020-05-28 01:15:59,037 [INFO ] Processing section [.text] (binaryBuilder.py:875)
100% [>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>]
2020-05-28 01:15:59,040 [INFO ] Processing section [.rodata] (binaryBuilder.py:875)
100% [>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>]
2020-05-28 01:15:59,041 [INFO ] Processing section [.eh_frame] (binaryBuilder.py:875)
2020-05-28 01:15:59,046 [INFO ] Processing section [.eh_frame_hdr] (binaryBuilder.py:875)
2020-05-28 01:15:59,052 [INFO ] Processing section [.init_array] (binaryBuilder.py:875)
2020-05-28 01:15:59,052 [INFO ] Processing section [.data.rel.ro] (binaryBuilder.py:875)
100% [>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>]
2020-05-28 01:15:59,052 [INFO ] Processing section [.data] (binaryBuilder.py:875)
100% [>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>]
Traceback (most recent call last):
File "/home/tpottei1/goCCR/CCR3/CCR/randomizer/prander.py", line 161, in
transformBinary(fp, opts, R, granularity=granularity, showlevel=4)
File "/home/tpottei1/goCCR/CCR3/CCR/randomizer/prander.py", line 89, in transformBinary
transformBinaryImpl(target, opts, C.METADATA_PATH, granularity, R, hasRandSection=True, showlevel=showlevel)
File "/home/tpottei1/goCCR/CCR3/CCR/randomizer/prander.py", line 71, in transformBinaryImpl
BB.instrumentBin(oldBin, newBin, isSymbolUpdate)
File "/home/tpottei1/goCCR/CCR3/CCR/randomizer/binaryBuilder.py", line 928, in instrumentBin
(layoutName, start, end, end - start, len(self.instBin))
AssertionError: Size Mismatch (.debug_info): Orig[0xc61c:0x1483d] SecSz:33313B InstBinSz: 361764B

Hello, I can not use ccr to compile code below, the error message like this:
root@b94c935ff494:/CCR/test# ccr++ -o ./funcptr ./funcptr.c
clang-3.9: warning: treating 'c' input as 'c++' when in C++ mode, this behavior is deprecated
[CCR-ERROR] Was not able to find the [email protected] for /tmp/funcptr-f2e918.o
ld: object.h:1459: uint64_t gold::Relobj::yarp_object_id(std::__cxx11::string): Assertion `0' failed.
clang-3.9: error: unable to execute command: Aborted (core dumped)
clang-3.9: error: linker command failed due to signal (use -v to see invocation)

#include
using namespace std;
#include <stdio.h>
#include <unistd.h>
#define CTOR_PRIO 3

attribute((constructor(CTOR_PRIO)))
void __cbsr_auto_early(void) {
fprintf(stderr,"__cbsr_auto_early。");
}

attribute((constructor()))
void __cbsr_auto_early_1(void) {
fprintf(stderr,"__cbsr_auto_early_1。");
}
int main() {
int a = 10;
int b = 20;
int c;
while(true){
printf("%d + %d = %d\n",a,b,c);
cout << "!!!Hello World!!!" << endl; // prints !!!Hello World!!!
sleep(1);
}
return 0;
}

is there anything wrong?

I'm interested in building with llvm-9.0.0. I updated the LLVM directory in your buildscript, but then am getting many errors when it tries to link libclang_shared.so . The errors all refer to google::protobuf::* . did I miss a step?

Recently, I need to test your tools. But I don't know how to build C/C++ projects which originally compiled with makefile. Do you have some docs about that? Or can I get technical support?

Attempting to run prander.py on the funcptr example (or any other binary compiled with CCR on my system) breaks with the following error:

rburrow@ics-dev:~/CCR$ python randomizer/prander.py -s ./examples/funcptr

    ___   ___   __         ___                     _
   / __\ / __\ /__\       / _ \_ __ __ _ _ __   __| | ___ _ __
  / /   / /   / \//_____ / /_)/ '__/ _` | '_ \ / _` |/ _ \ '__|
 / /___/ /___/ _  \_____/ ___/| | | (_| | | | | (_| |  __/ |
 \____/\____/\/ \_/     \/    |_|  \__,_|_| |_|\__,_|\___|_/

 Compiler-assisted Code Randomization: Practical Randomizer
 (In the 39th IEEE Symposium on Security & Privacy 2018)

2019-10-29 14:31:18,779 [INFO   ] Reading the metadata from the .rand section... (shuffleInfoReader.py:164)
2019-10-29 14:31:18,780 [INFO   ]       Offset to the object  : 0xf0 (shuffleInfoReader.py:165)
2019-10-29 14:31:18,780 [INFO   ]       Offset to the main()  : 0x20 (shuffleInfoReader.py:166)
2019-10-29 14:31:18,781 [INFO   ]       Total Emitted Bytes   : 0x0310 (shuffleInfoReader.py:167)
2019-10-29 14:31:18,781 [INFO   ]       Number of Objects     : 1 (shuffleInfoReader.py:168)
2019-10-29 14:31:18,781 [INFO   ]       Number of Functions   : 9 (shuffleInfoReader.py:169)
2019-10-29 14:31:18,781 [INFO   ]       Number of Basic Blocks: 32 (shuffleInfoReader.py:170)
2019-10-29 14:31:18,782 [INFO   ]       Fixups in .text : 56  (shuffleInfoReader.py:56)
2019-10-29 14:31:18,782 [INFO   ]       Fixups in .rodata       : 18  (shuffleInfoReader.py:56)
2019-10-29 14:31:18,783 [INFO   ]       Fixups in .data : 4  (shuffleInfoReader.py:56)
2019-10-29 14:31:18,783 [INFO   ]       Number of Jump Tables : 1 (shuffleInfoReader.py:200)
2019-10-29 14:31:18,784 [INFO   ] Building up the layout... (prander.py:43)
                                        100% [>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>]
2019-10-29 14:31:18,801 [INFO   ] Sanity check for ./examples/funcptr...  (reorderInfo.py:593)
2019-10-29 14:31:18,801 [INFO   ]       All sanity checks have been PASSED!! (reorderInfo.py:618)
2019-10-29 14:31:18,802 [INFO   ] Performing reordering (@FUN)... (prander.py:48)
2019-10-29 14:31:18,802 [INFO   ]       # of Function Constraints: 0 (reorderEngine.py:236)
2019-10-29 14:31:18,803 [INFO   ] Instrumenting the binary... (prander.py:66)
2019-10-29 14:31:18,805 [INFO   ]       Processing section [.dynsym] (binaryBuilder.py:841)
                                        100% [>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>]
2019-10-29 14:31:18,810 [INFO   ]       Processing section [.rela.dyn] (binaryBuilder.py:841)
2019-10-29 14:31:18,813 [INFO   ]       Processing section [.text] (binaryBuilder.py:841)
Traceback (most recent call last):
  File "randomizer/prander.py", line 161, in <module>
    transformBinary(fp, opts, R, granularity=granularity, showlevel=4)
  File "randomizer/prander.py", line 89, in transformBinary
    transformBinaryImpl(target, opts, C.METADATA_PATH, granularity, R, hasRandSection=True, showlevel=showlevel)
  File "randomizer/prander.py", line 71, in transformBinaryImpl
    BB.instrumentBin(oldBin, newBin, isSymbolUpdate)
  File "/home/rburrow/CCR/randomizer/binaryBuilder.py", line 848, in instrumentBin
    self.patchCodeSection(sectionChunk)
  File "/home/rburrow/CCR/randomizer/binaryBuilder.py", line 163, in patchCodeSection
    self.instBin += self.PK(FMT.INT, mainBBL.newVA)
AttributeError: 'NoneType' object has no attribute 'newVA'

It appears a call to getBBlByVA() does not return any value if the VA provided is not in the dictionary and that is not being handled.

I am running this on Ubuntu 18.04.1 and had no problems building ccr or compiling the binaries themselves.

I have been trying to build ffmpeg git repo with some issues. I first modified their makefile to replace all calls to $(LD) with $(CC) since it appears that building intermediary .o files with ccr and then linking with the modified loader causes those binaries to fail. e.g.

echo "int main() { return 0; }" > test.c;
ccr -c -o test.o test.c;
/home/<user>/CCR/binutils-2.27/gold/ld-new -o a.out test.o
./a.out

will cause a seg-fault.

I've modified their makefile to link using ccr instead of ld, but now I get the following errors when trying to randomize:
WARNING:root: [.text] Fails to discover the reference BBL (Fixup#9)
and
WARNING:root: [.data] No legitimate RefBBL (Fixup#9776)

I've attached the modified Makefile, and the environment can be setup by running

CCR=/usr/local/bin/ccr
CCRPP=/usr/local/bin/ccr++
./configure --cc=$CCR --cxx=$CCRPP

Any help would be greatly appreciated!