SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cmplog and value profile MSVC fixes

Browse Source
This commit is contained in:
andreafioraldi 2021-04-28 12:12:07 +02:00
parent 4747a35936
commit 6c035d13a3
3 changed files with 44 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
libafl_targets/src/cmplog.c
View File

@ -6,6 +6,12 @@
#define CMPLOG_KIND_INS 0 #define CMPLOG_KIND_INS 0
#define CMPLOG_KIND_RTN 1 #define CMPLOG_KIND_RTN 1
#ifdef _WIN32
#define RETADDR (uintptr_t)_ReturnAddress()
#else
#define RETADDR (uintptr_t)__builtin_return_address(0)
#endif
typedef struct CmpLogHeader { typedef struct CmpLogHeader {
uint16_t hits; uint16_t hits;
uint8_t shape; uint8_t shape;
@ -31,6 +37,11 @@ extern uint8_t libafl_cmplog_enabled;
#pragma weak __sanitizer_cov_trace_const_cmp2 = __sanitizer_cov_trace_cmp2 #pragma weak __sanitizer_cov_trace_const_cmp2 = __sanitizer_cov_trace_cmp2
#pragma weak __sanitizer_cov_trace_const_cmp4 = __sanitizer_cov_trace_cmp4 #pragma weak __sanitizer_cov_trace_const_cmp4 = __sanitizer_cov_trace_cmp4
#pragma weak __sanitizer_cov_trace_const_cmp8 = __sanitizer_cov_trace_cmp8 #pragma weak __sanitizer_cov_trace_const_cmp8 = __sanitizer_cov_trace_cmp8
#elif defined(_MSC_VER)
#pragma comment(linker, "/alternatename:__sanitizer_cov_trace_const_cmp1=__sanitizer_cov_trace_cmp1")
#pragma comment(linker, "/alternatename:__sanitizer_cov_trace_const_cmp2=__sanitizer_cov_trace_cmp2")
#pragma comment(linker, "/alternatename:__sanitizer_cov_trace_const_cmp4=__sanitizer_cov_trace_cmp4")
#pragma comment(linker, "/alternatename:__sanitizer_cov_trace_const_cmp8=__sanitizer_cov_trace_cmp8")
#else #else
void __sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2) __attribute__((alias("__sanitizer_cov_trace_cmp1"))); void __sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2) __attribute__((alias("__sanitizer_cov_trace_cmp1")));
void __sanitizer_cov_trace_const_cmp2(uint16_t arg1, uint16_t arg2) void __sanitizer_cov_trace_const_cmp2(uint16_t arg1, uint16_t arg2)
@ -41,11 +52,12 @@ void __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp8"))); __attribute__((alias("__sanitizer_cov_trace_cmp8")));
#endif #endif
void __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2) { void __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2) {
if (!libafl_cmplog_enabled) return; if (!libafl_cmplog_enabled) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0); uintptr_t k = RETADDR;
k = (k >> 4) ^ (k << 8); k = (k >> 4) ^ (k << 8);
k &= CMPLOG_MAP_W - 1; k &= CMPLOG_MAP_W - 1;
@ -72,7 +84,7 @@ void __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2) {
if (!libafl_cmplog_enabled) return; if (!libafl_cmplog_enabled) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0); uintptr_t k = RETADDR;
k = (k >> 4) ^ (k << 8); k = (k >> 4) ^ (k << 8);
k &= CMPLOG_MAP_W - 1; k &= CMPLOG_MAP_W - 1;
@ -99,7 +111,7 @@ void __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2) {
if (!libafl_cmplog_enabled) return; if (!libafl_cmplog_enabled) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0); uintptr_t k = RETADDR;
k = (k >> 4) ^ (k << 8); k = (k >> 4) ^ (k << 8);
k &= CMPLOG_MAP_W - 1; k &= CMPLOG_MAP_W - 1;
@ -125,7 +137,7 @@ void __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2) {
if (!libafl_cmplog_enabled) return; if (!libafl_cmplog_enabled) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0); uintptr_t k = RETADDR;
k = (k >> 4) ^ (k << 8); k = (k >> 4) ^ (k << 8);
k &= CMPLOG_MAP_W - 1; k &= CMPLOG_MAP_W - 1;
@ -159,7 +171,7 @@ void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
for (uint64_t i = 0; i < cases[0]; i++) { for (uint64_t i = 0; i < cases[0]; i++) {
uintptr_t k = (uintptr_t)__builtin_return_address(0) + i; uintptr_t k = RETADDR + i;
k = (k >> 4) ^ (k << 8); k = (k >> 4) ^ (k << 8);
k &= CMPLOG_MAP_W - 1; k &= CMPLOG_MAP_W - 1;

15
libafl_targets/src/lib.rs
View File

@ -5,16 +5,21 @@ pub mod pcguard;
#[cfg(any(feature = "pcguard_edges", feature = "pcguard_hitcounts"))] #[cfg(any(feature = "pcguard_edges", feature = "pcguard_hitcounts"))]
pub use pcguard::*; pub use pcguard::*;
#[cfg(feature = "value_profile")]
pub mod value_profile;
#[cfg(feature = "value_profile")]
pub use value_profile::*;
#[cfg(feature = "libfuzzer")] #[cfg(feature = "libfuzzer")]
pub mod libfuzzer; pub mod libfuzzer;
#[cfg(feature = "libfuzzer")] #[cfg(feature = "libfuzzer")]
pub use libfuzzer::*; pub use libfuzzer::*;
#[cfg(all(feature = "value_profile", feature = "cmplog"))]
compile_error!(
"the libafl_targets `value_profile` and `cmplog` features are mutually exclusive."
);
#[cfg(feature = "value_profile")]
pub mod value_profile;
#[cfg(feature = "value_profile")]
pub use value_profile::*;
#[cfg(feature = "cmplog")] #[cfg(feature = "cmplog")]
pub mod cmplog; pub mod cmplog;
#[cfg(feature = "cmplog")] #[cfg(feature = "cmplog")]

22
libafl_targets/src/value_profile.c
View File

@ -7,6 +7,12 @@
extern uint8_t libafl_cmp_map[MAP_SIZE]; extern uint8_t libafl_cmp_map[MAP_SIZE];
#ifdef _WIN32
#define RETADDR (uintptr_t)_ReturnAddress()
#else
#define RETADDR (uintptr_t)__builtin_return_address(0)
#endif
#ifdef __GNUC__ #ifdef __GNUC__
#define MAX(a, b) \ #define MAX(a, b) \
({ \ ({ \
@ -20,6 +26,12 @@ extern uint8_t libafl_cmp_map[MAP_SIZE];
#define MAX(a, b) (((a) > (b)) ? (a) : (b)) #define MAX(a, b) (((a) > (b)) ? (a) : (b))
#endif #endif
#ifdef _MSC_VER
#include <intrin.h>
#define __builtin_popcount __popcnt
#define __builtin_popcountll __popcnt64
#endif
#if defined(__APPLE__) #if defined(__APPLE__)
#pragma weak __sanitizer_cov_trace_const_cmp1 = __sanitizer_cov_trace_cmp1 #pragma weak __sanitizer_cov_trace_const_cmp1 = __sanitizer_cov_trace_cmp1
#pragma weak __sanitizer_cov_trace_const_cmp2 = __sanitizer_cov_trace_cmp2 #pragma weak __sanitizer_cov_trace_const_cmp2 = __sanitizer_cov_trace_cmp2
@ -42,7 +54,7 @@ void __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2)
void __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2) { void __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2) {
uintptr_t k = (uintptr_t)__builtin_return_address(0); uintptr_t k = RETADDR;
k = (k >> 4) ^ (k << 8); k = (k >> 4) ^ (k << 8);
k &= MAP_SIZE - 1; k &= MAP_SIZE - 1;
libafl_cmp_map[k] = MAX(libafl_cmp_map[k], (__builtin_popcount(~(arg1 ^ arg2)))); libafl_cmp_map[k] = MAX(libafl_cmp_map[k], (__builtin_popcount(~(arg1 ^ arg2))));
@ -51,7 +63,7 @@ void __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2) {
void __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2) { void __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2) {
uintptr_t k = (uintptr_t)__builtin_return_address(0); uintptr_t k = RETADDR;
k = (k >> 4) ^ (k << 8); k = (k >> 4) ^ (k << 8);
k &= MAP_SIZE - 1; k &= MAP_SIZE - 1;
libafl_cmp_map[k] = MAX(libafl_cmp_map[k], (__builtin_popcount(~(arg1 ^ arg2)))); libafl_cmp_map[k] = MAX(libafl_cmp_map[k], (__builtin_popcount(~(arg1 ^ arg2))));
@ -60,7 +72,7 @@ void __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2) {
void __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2) { void __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2) {
uintptr_t k = (uintptr_t)__builtin_return_address(0); uintptr_t k = RETADDR;
k = (k >> 4) ^ (k << 8); k = (k >> 4) ^ (k << 8);
k &= MAP_SIZE - 1; k &= MAP_SIZE - 1;
libafl_cmp_map[k] = MAX(libafl_cmp_map[k], (__builtin_popcount(~(arg1 ^ arg2)))); libafl_cmp_map[k] = MAX(libafl_cmp_map[k], (__builtin_popcount(~(arg1 ^ arg2))));
@ -69,7 +81,7 @@ void __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2) {
void __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2) { void __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2) {
uintptr_t k = (uintptr_t)__builtin_return_address(0); uintptr_t k = RETADDR;
k = (k >> 4) ^ (k << 8); k = (k >> 4) ^ (k << 8);
k &= MAP_SIZE - 1; k &= MAP_SIZE - 1;
libafl_cmp_map[k] = MAX(libafl_cmp_map[k], (__builtin_popcountll(~(arg1 ^ arg2)))); libafl_cmp_map[k] = MAX(libafl_cmp_map[k], (__builtin_popcountll(~(arg1 ^ arg2))));
@ -78,7 +90,7 @@ void __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2) {
void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) { void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
uintptr_t rt = (uintptr_t)__builtin_return_address(0); uintptr_t rt = RETADDR;
if (cases[1] == 64) { if (cases[1] == 64) {
for (uint64_t i = 0; i < cases[0]; i++) { for (uint64_t i = 0; i < cases[0]; i++) {