Skip to content

Commit 3102206

Browse files
jchoi2022jchoi2022
authored
Merge pull request #14 from SoftSec-KAIST/dev
Update Eclipser to v2.0
2 parents 59cb9c0 + ca070ce commit 3102206

File tree

149 files changed

+3831
-7887
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

149 files changed

+3831
-7887
lines changed

‎.gitignore

+5-8
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,11 @@ obj/
1212
.vscode/
1313

1414
#etc
15-
Instrumentor/sparsehash/sparsehash-2.0.3
16-
Instrumentor/sparsehash/sparsehash-2.0.3.tar.gz
17-
Instrumentor/sparsehash/.compiled
18-
Instrumentor/qemu/.prepared
19-
Instrumentor/qemu/qemu-2.3.0*
20-
Instrumentor/qemu/.compiled_x86
21-
Instrumentor/qemu/.compiled_x64
22-
Instrumentor/qemu/.compiled
15+
Instrumentor/.prepared
16+
Instrumentor/qemu-2.10.0*
17+
Instrumentor/.compiled_x86
18+
Instrumentor/.compiled_x64
19+
Instrumentor/.compiled
2320
*.swp
2421
*.bin
2522
box

‎CHANGELOG.md

+17
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,22 @@
11
# Eclipser Change Log
22

3+
## v2.0
4+
5+
* Simplify architecture by removing multiple input source fuzzing. This feature
6+
has been supported for the comparison against KLEE.
7+
* Remove our own random fuzzing module, and support integration with AFL.
8+
* Fix QEMU instrumentation code (update to QEMU-2.10.0, fix bugs, optimize).
9+
* Add a feature to decide execution timeout automatically.
10+
* Clean up codes.
11+
* Update command line interface.
12+
* Update test examples.
13+
14+
## v1.1
15+
16+
* Fix initial seed set handling.
17+
* Use edge coverage instead of node coverage.
18+
* Fix the default parameters for maximum file/stdin length.
19+
320
## v1.0
421

522
* Stop polluting '/tmp/' directory and keep the intermediate files internally.

‎Instrumentor/qemu/build_qemu_x64.sh ‎Instrumentor/build_qemu_x64.sh

+11-15
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,15 @@
1616
#
1717
# http://www.apache.org/licenses/LICENSE-2.0
1818

19+
VERSION="2.10.0"
20+
1921
build_qemu () {
2022
echo "[*] Configuring QEMU for x86_64..."
2123

22-
cd qemu-2.3.0-$1-x64 || exit 1
24+
cd qemu-${VERSION}-$1-x64 || exit 1
2325

2426
CFLAGS="-O3" ./configure --disable-system --enable-linux-user \
25-
--python=python2 --enable-guest-base --disable-gtk --disable-sdl --disable-vnc \
27+
--python=python2 --disable-gtk --disable-sdl --disable-vnc \
2628
--target-list="x86_64-linux-user" || exit 1
2729

2830
echo "[+] Configuration complete."
@@ -38,22 +40,16 @@ build_qemu () {
3840
cd ..
3941
}
4042

41-
### Build QEMU tracers
42-
43-
build_qemu pathcov
44-
mv "./qemu-trace" "../../build/qemu-trace-pathcov-x64" || exit 1
45-
echo "[+] Successfully created 'qemu-trace-pathcov-x64'."
46-
47-
build_qemu syscall
48-
mv "./qemu-trace" "../../build/qemu-trace-syscall-x64" || exit 1
49-
echo "[+] Successfully created 'qemu-trace-syscall-x64'."
43+
build_qemu coverage
44+
mv "./qemu-trace" "../build/qemu-trace-coverage-x64" || exit 1
45+
echo "[+] Successfully created 'qemu-trace-coverage-x64'."
5046

51-
build_qemu feedback
52-
mv "./qemu-trace" "../../build/qemu-trace-feedback-x64" || exit 1
53-
echo "[+] Successfully created 'qemu-trace-feedback-x64'."
47+
build_qemu branch
48+
mv "./qemu-trace" "../build/qemu-trace-branch-x64" || exit 1
49+
echo "[+] Successfully created 'qemu-trace-branch-x64'."
5450

5551
build_qemu bbcount
56-
mv "./qemu-trace" "../../build/qemu-trace-bbcount-x64" || exit 1
52+
mv "./qemu-trace" "../build/qemu-trace-bbcount-x64" || exit 1
5753
echo "[+] Successfully created 'qemu-trace-bbcount-x64'."
5854

5955
exit 0

‎Instrumentor/qemu/build_qemu_x86.sh ‎Instrumentor/build_qemu_x86.sh

+11-15
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,15 @@
1616
#
1717
# http://www.apache.org/licenses/LICENSE-2.0
1818

19+
VERSION="2.10.0"
20+
1921
build_qemu () {
2022
echo "[*] Configuring QEMU for i386..."
2123

22-
cd qemu-2.3.0-$1-x86 || exit 1
24+
cd qemu-${VERSION}-$1-x86 || exit 1
2325

2426
CFLAGS="-O3" ./configure --disable-system --enable-linux-user \
25-
--python=python2 --enable-guest-base --disable-gtk --disable-sdl --disable-vnc \
27+
--python=python2 --disable-gtk --disable-sdl --disable-vnc \
2628
--target-list="i386-linux-user" || exit 1
2729

2830
echo "[+] Configuration complete."
@@ -38,22 +40,16 @@ build_qemu () {
3840
cd ..
3941
}
4042

41-
### Build QEMU tracers
42-
43-
build_qemu pathcov
44-
mv "./qemu-trace" "../../build/qemu-trace-pathcov-x86" || exit 1
45-
echo "[+] Successfully created 'qemu-trace-pathcov-x86'."
46-
47-
build_qemu syscall
48-
mv "./qemu-trace" "../../build/qemu-trace-syscall-x86" || exit 1
49-
echo "[+] Successfully created 'qemu-trace-syscall-x86'."
43+
build_qemu coverage
44+
mv "./qemu-trace" "../build/qemu-trace-coverage-x86" || exit 1
45+
echo "[+] Successfully created 'qemu-trace-coverage-x86'."
5046

51-
build_qemu feedback
52-
mv "./qemu-trace" "../../build/qemu-trace-feedback-x86" || exit 1
53-
echo "[+] Successfully created 'qemu-trace-feedback-x86'."
47+
build_qemu branch
48+
mv "./qemu-trace" "../build/qemu-trace-branch-x86" || exit 1
49+
echo "[+] Successfully created 'qemu-trace-branch-x86'."
5450

5551
build_qemu bbcount
56-
mv "./qemu-trace" "../../build/qemu-trace-bbcount-x86" || exit 1
52+
mv "./qemu-trace" "../build/qemu-trace-bbcount-x86" || exit 1
5753
echo "[+] Successfully created 'qemu-trace-bbcount-x86'."
5854

5955
exit 0

‎Instrumentor/generate_bbcount_patch.sh

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/bash
2+
3+
VERSION="2.10.0"
4+
5+
cp -r qemu-${VERSION}-bbcount-x64 qemu-${VERSION}-bbcount
6+
7+
cp qemu-${VERSION}-bbcount/eclipser.cc ./patches-bbcount/
8+
9+
cp qemu-${VERSION}/accel/tcg/cpu-exec.c \
10+
qemu-${VERSION}-bbcount/accel/tcg/cpu-exec.c.orig
11+
diff -Naur qemu-${VERSION}-bbcount/accel/tcg/cpu-exec.c.orig \
12+
qemu-${VERSION}-bbcount/accel/tcg/cpu-exec.c \
13+
> patches-bbcount/cpu-exec.diff
14+
15+
cp qemu-${VERSION}/Makefile.target \
16+
qemu-${VERSION}-bbcount/Makefile.target.orig
17+
diff -Naur qemu-${VERSION}-bbcount/Makefile.target.orig \
18+
qemu-${VERSION}-bbcount/Makefile.target \
19+
> patches-bbcount/makefile-target.diff
20+
21+
cp qemu-${VERSION}/linux-user/syscall.c \
22+
qemu-${VERSION}-bbcount/linux-user/syscall.c.orig
23+
diff -Naur qemu-${VERSION}-bbcount/linux-user/syscall.c.orig \
24+
qemu-${VERSION}-bbcount/linux-user/syscall.c \
25+
> patches-bbcount/syscall.diff
26+
27+
rm -rf qemu-${VERSION}-bbcount

‎Instrumentor/generate_branch_patch.sh

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/bash
2+
3+
VERSION="2.10.0"
4+
5+
cp -r qemu-${VERSION}-branch-x64 qemu-${VERSION}-branch
6+
7+
cp qemu-${VERSION}-branch/afl-qemu-cpu-inl.h ./patches-branch/afl-qemu-cpu-inl.h
8+
9+
cp qemu-${VERSION}-branch/tcg/eclipser.c ./patches-branch/eclipser.c
10+
11+
cp qemu-${VERSION}/accel/tcg/cpu-exec.c \
12+
qemu-${VERSION}-branch/accel/tcg/cpu-exec.c.orig
13+
diff -Naur qemu-${VERSION}-branch/accel/tcg/cpu-exec.c.orig \
14+
qemu-${VERSION}-branch/accel/tcg/cpu-exec.c \
15+
> patches-branch/cpu-exec.diff
16+
17+
cp qemu-${VERSION}/Makefile.target \
18+
qemu-${VERSION}-branch/Makefile.target.orig
19+
diff -Naur qemu-${VERSION}-branch/Makefile.target.orig \
20+
qemu-${VERSION}-branch/Makefile.target \
21+
> patches-branch/makefile-target.diff
22+
23+
cp qemu-${VERSION}/linux-user/syscall.c \
24+
qemu-${VERSION}-branch/linux-user/syscall.c.orig
25+
diff -Naur qemu-${VERSION}-branch/linux-user/syscall.c.orig \
26+
qemu-${VERSION}-branch/linux-user/syscall.c \
27+
> patches-branch/syscall.diff
28+
29+
cp qemu-${VERSION}/tcg/optimize.c \
30+
qemu-${VERSION}-branch/tcg/optimize.c.orig
31+
diff -Naur qemu-${VERSION}-branch/tcg/optimize.c.orig \
32+
qemu-${VERSION}-branch/tcg/optimize.c \
33+
> patches-branch/optimize.diff
34+
35+
cp qemu-${VERSION}/tcg/tcg-op.h \
36+
qemu-${VERSION}-branch/tcg/tcg-op.h.orig
37+
diff -Naur qemu-${VERSION}-branch/tcg/tcg-op.h.orig \
38+
qemu-${VERSION}-branch/tcg/tcg-op.h \
39+
> patches-branch/tcg-op.diff
40+
41+
cp qemu-${VERSION}/tcg/tcg-opc.h \
42+
qemu-${VERSION}-branch/tcg/tcg-opc.h.orig
43+
diff -Naur qemu-${VERSION}-branch/tcg/tcg-opc.h.orig \
44+
qemu-${VERSION}-branch/tcg/tcg-opc.h \
45+
> patches-branch/tcg-opc.diff
46+
47+
cp qemu-${VERSION}/tcg/i386/tcg-target.inc.c \
48+
qemu-${VERSION}-branch/tcg/i386/tcg-target.inc.c.orig
49+
diff -Naur qemu-${VERSION}-branch/tcg/i386/tcg-target.inc.c.orig \
50+
qemu-${VERSION}-branch/tcg/i386/tcg-target.inc.c \
51+
> patches-branch/tcg-target.diff
52+
53+
cp qemu-${VERSION}/target/i386/helper.h \
54+
qemu-${VERSION}-branch/target/i386/helper.h.orig
55+
diff -Naur qemu-${VERSION}-branch/target/i386/helper.h.orig \
56+
qemu-${VERSION}-branch/target/i386/helper.h \
57+
> patches-branch/target-helper.diff
58+
59+
cp qemu-${VERSION}/target/i386/translate.c \
60+
qemu-${VERSION}-branch/target/i386/translate.c.orig
61+
diff -Naur qemu-${VERSION}-branch/target/i386/translate.c.orig \
62+
qemu-${VERSION}-branch/target/i386/translate.c \
63+
> patches-branch/target-translate.diff
64+
65+
rm -rf qemu-${VERSION}-branch

‎Instrumentor/generate_common_patch.sh

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/bash
2+
3+
VERSION="2.10.0"
4+
5+
diff -Naur qemu-${VERSION}/configure.orig \
6+
qemu-${VERSION}/configure \
7+
> patches-common/configure.diff
8+
9+
diff -Naur qemu-${VERSION}/linux-user/elfload.c.orig \
10+
qemu-${VERSION}/linux-user/elfload.c \
11+
> patches-common/elfload.diff
12+
13+
diff -Naur qemu-${VERSION}/util/memfd.c.orig \
14+
qemu-${VERSION}/util/memfd.c \
15+
> patches-common/memfd.diff
16+
17+
diff -Naur qemu-${VERSION}/linux-user/signal.c.orig \
18+
qemu-${VERSION}/linux-user/signal.c \
19+
> patches-common/signal.diff

‎Instrumentor/generate_coverage_patch.sh

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/bin/bash
2+
3+
VERSION="2.10.0"
4+
5+
cp -r qemu-${VERSION}-coverage-x64 qemu-${VERSION}-coverage
6+
7+
cp qemu-${VERSION}-coverage/accel/tcg/afl-qemu-cpu-inl.h ./patches-coverage/
8+
9+
cp qemu-${VERSION}-coverage/accel/tcg/eclipser.c ./patches-coverage/
10+
11+
cp qemu-${VERSION}/accel/tcg/cpu-exec.c \
12+
qemu-${VERSION}-coverage/accel/tcg/cpu-exec.c.orig
13+
diff -Naur qemu-${VERSION}-coverage/accel/tcg/cpu-exec.c.orig \
14+
qemu-${VERSION}-coverage/accel/tcg/cpu-exec.c \
15+
> patches-coverage/cpu-exec.diff
16+
17+
cp qemu-${VERSION}/accel/tcg/Makefile.objs \
18+
qemu-${VERSION}-coverage/accel/tcg/Makefile.objs.orig
19+
diff -Naur qemu-${VERSION}-coverage/accel/tcg/Makefile.objs.orig \
20+
qemu-${VERSION}-coverage/accel/tcg/Makefile.objs \
21+
> patches-coverage/makefile-objs.diff
22+
23+
cp qemu-${VERSION}/linux-user/syscall.c \
24+
qemu-${VERSION}-coverage/linux-user/syscall.c.orig
25+
diff -Naur qemu-${VERSION}-coverage/linux-user/syscall.c.orig \
26+
qemu-${VERSION}-coverage/linux-user/syscall.c \
27+
> patches-coverage/syscall.diff
28+
29+
cp qemu-${VERSION}/target/i386/helper.h \
30+
qemu-${VERSION}-coverage/target/i386/helper.h.orig
31+
diff -Naur qemu-${VERSION}-coverage/target/i386/helper.h.orig \
32+
qemu-${VERSION}-coverage/target/i386/helper.h \
33+
> patches-coverage/target-helper.diff
34+
35+
cp qemu-${VERSION}/target/i386/translate.c \
36+
qemu-${VERSION}-coverage/target/i386/translate.c.orig
37+
diff -Naur qemu-${VERSION}-coverage/target/i386/translate.c.orig \
38+
qemu-${VERSION}-coverage/target/i386/translate.c \
39+
> patches-coverage/target-translate.diff
40+
41+
rm -rf qemu-${VERSION}-coverage

‎Instrumentor/patches-bbcount/cpu-exec.diff

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
--- qemu-2.10.0-bbcount/accel/tcg/cpu-exec.c.orig 2020-09-29 08:25:21.151543920 -0700
2+
+++ qemu-2.10.0-bbcount/accel/tcg/cpu-exec.c 2020-09-29 08:23:51.822938454 -0700
3+
@@ -36,6 +36,10 @@
4+
#include "sysemu/cpus.h"
5+
#include "sysemu/replay.h"
6+
7+
+extern abi_ulong eclipser_entry_point;
8+
+extern void eclipser_setup(void);
9+
+extern void eclipser_log_bb(abi_ulong addr);
10+
+
11+
/* -icount align implementation. */
12+
13+
typedef struct SyncClocks {
14+
@@ -144,6 +148,11 @@
15+
int tb_exit;
16+
uint8_t *tb_ptr = itb->tc_ptr;
17+
18+
+ if(itb->pc == eclipser_entry_point) {
19+
+ eclipser_setup();
20+
+ }
21+
+ eclipser_log_bb(itb->pc);
22+
+
23+
qemu_log_mask_and_addr(CPU_LOG_EXEC, itb->pc,
24+
"Trace %p [%d: " TARGET_FMT_lx "] %s\n",
25+
itb->tc_ptr, cpu->cpu_index, itb->pc,

0 commit comments

Comments
 (0)