Skip to content

Commit 4018d82

Browse files
jchoi2022jchoi2022
committed
Release the first prototype
1 parent 5afcf05 commit 4018d82

File tree

107 files changed

+10972
-2
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

107 files changed

+10972
-2
lines changed

‎.gitignore

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
## Ignore Visual Studio temporary files, build results, and
2+
## files generated by popular Visual Studio add-ons.
3+
4+
# Build results
5+
build/
6+
bin/
7+
obj/
8+
9+
# Visual Studio 2015 cache/options directory
10+
.vs/
11+
# Visual Studio Code directory
12+
.vscode/
13+
14+
#etc
15+
Instrumentor/sparsehash/sparsehash-2.0.3
16+
Instrumentor/sparsehash/sparsehash-2.0.3.tar.gz
17+
Instrumentor/sparsehash/.compiled
18+
Instrumentor/qemu/qemu-2.3.0*
19+
Instrumentor/qemu/.compiled
20+
*.swp
21+
*.bin
22+
box

‎Eclipser.sln

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 15
4+
VisualStudioVersion = 15.0.26124.0
5+
MinimumVisualStudioVersion = 15.0.26124.0
6+
Project("{F2A71F9B-5D33-465A-A702-920D77279786}") = "Eclipser", "src\Eclipser.fsproj", "{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|Any CPU = Debug|Any CPU
11+
Debug|x64 = Debug|x64
12+
Debug|x86 = Debug|x86
13+
Release|Any CPU = Release|Any CPU
14+
Release|x64 = Release|x64
15+
Release|x86 = Release|x86
16+
EndGlobalSection
17+
GlobalSection(SolutionProperties) = preSolution
18+
HideSolutionNode = FALSE
19+
EndGlobalSection
20+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
21+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
22+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Debug|Any CPU.Build.0 = Debug|Any CPU
23+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Debug|x64.ActiveCfg = Debug|x64
24+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Debug|x64.Build.0 = Debug|x64
25+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Debug|x86.ActiveCfg = Debug|x86
26+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Debug|x86.Build.0 = Debug|x86
27+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Release|Any CPU.ActiveCfg = Release|Any CPU
28+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Release|Any CPU.Build.0 = Release|Any CPU
29+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Release|x64.ActiveCfg = Release|x64
30+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Release|x64.Build.0 = Release|x64
31+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Release|x86.ActiveCfg = Release|x86
32+
{D4004E4F-AB8A-4177-8B83-FA6F0B2AA8C1}.Release|x86.Build.0 = Release|x86
33+
EndGlobalSection
34+
EndGlobal

‎Instrumentor/qemu/build_qemu_support.sh

+262
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,262 @@
1+
#!/bin/sh
2+
#
3+
# QEMU build script for Eclipser's instrumentation
4+
#
5+
# Modified codes from AFL's QEMU mode (original license below).
6+
# --------------------------------------
7+
#
8+
# Written by Andrew Griffiths <agriffiths@google.com> and
9+
# Michal Zalewski <lcamtuf@google.com>
10+
#
11+
# Copyright 2015, 2016 Google Inc. All rights reserved.
12+
#
13+
# Licensed under the Apache License, Version 2.0 (the "License");
14+
# you may not use this file except in compliance with the License.
15+
# You may obtain a copy of the License at:
16+
#
17+
# http://www.apache.org/licenses/LICENSE-2.0
18+
19+
build_qemu () {
20+
if [ $2 = "x86" ]; then
21+
CPU_TARGET="i386"
22+
elif [ $2 = "x64" ]; then
23+
CPU_TARGET="x86_64"
24+
else
25+
echo "Invalid CPU architecture provided"
26+
exit 0
27+
fi
28+
29+
echo "[*] Configuring QEMU for $CPU_TARGET..."
30+
31+
cd qemu-2.3.0-$1-$2 || exit 1
32+
33+
CFLAGS="-O3" ./configure --disable-system --enable-linux-user \
34+
--enable-guest-base --disable-gtk --disable-sdl --disable-vnc \
35+
--target-list="${CPU_TARGET}-linux-user" || exit 1
36+
37+
echo "[+] Configuration complete."
38+
39+
echo "[*] Attempting to build QEMU (fingers crossed!)..."
40+
41+
make || exit 1
42+
43+
echo "[+] Build process successful!"
44+
45+
echo "[*] Copying binary..."
46+
cp -f "${CPU_TARGET}-linux-user/qemu-${CPU_TARGET}" "../qemu-trace" || exit 1
47+
cd ..
48+
}
49+
50+
QEMU_URL="https://download.qemu.org/qemu-2.3.0.tar.bz2"
51+
QEMU_SHA384="7a0f0c900f7e2048463cc32ff3e904965ab466c8428847400a0f2dcfe458108a68012c4fddb2a7e7c822b4fd1a49639b"
52+
53+
echo "========================================="
54+
echo "Chatkey instrumentation QEMU build script"
55+
echo "========================================="
56+
echo
57+
58+
echo "[*] Performing basic sanity checks..."
59+
60+
if [ ! "`uname -s`" = "Linux" ]; then
61+
62+
echo "[-] Error: QEMU instrumentation is supported only on Linux."
63+
exit 1
64+
65+
fi
66+
67+
if [ ! -f "patches-pathcov/chatkey.cc" -o ! -f "patches-syscall/chatkey.c" -o ! -f "patches-feedback/chatkey.c" ]; then
68+
69+
echo "[-] Error: key files not found - wrong working directory?"
70+
exit 1
71+
72+
fi
73+
74+
for i in libtool wget python automake autoconf sha384sum bison iconv; do
75+
76+
T=`which "$i" 2>/dev/null`
77+
78+
if [ "$T" = "" ]; then
79+
80+
echo "[-] Error: '$i' not found, please install first."
81+
exit 1
82+
83+
fi
84+
85+
done
86+
87+
if [ ! -d "/usr/include/glib-2.0/" -a ! -d "/usr/local/include/glib-2.0/" ]; then
88+
89+
echo "[-] Error: devel version of 'glib2' not found, please install first."
90+
exit 1
91+
92+
fi
93+
94+
echo "[+] All checks passed!"
95+
96+
ARCHIVE="`basename -- "$QEMU_URL"`"
97+
98+
CKSUM=`sha384sum -- "$ARCHIVE" 2>/dev/null | cut -d' ' -f1`
99+
100+
if [ ! "$CKSUM" = "$QEMU_SHA384" ]; then
101+
102+
echo "[*] Downloading QEMU 2.3.0 from the web..."
103+
rm -f "$ARCHIVE"
104+
wget -O "$ARCHIVE" -- "$QEMU_URL" || exit 1
105+
106+
CKSUM=`sha384sum -- "$ARCHIVE" 2>/dev/null | cut -d' ' -f1`
107+
108+
fi
109+
110+
if [ "$CKSUM" = "$QEMU_SHA384" ]; then
111+
112+
echo "[+] Cryptographic signature on $ARCHIVE checks out."
113+
114+
else
115+
116+
echo "[-] Error: signature mismatch on $ARCHIVE (perhaps download error?)."
117+
exit 1
118+
119+
fi
120+
121+
echo "[*] Uncompressing archive (this will take a while)..."
122+
123+
rm -rf "qemu-2.3.0" || exit 1
124+
rm -rf "qemu-2.3.0-pathcov" || exit 1
125+
rm -rf "qemu-2.3.0-syscall" || exit 1
126+
rm -rf "qemu-2.3.0-feedback" || exit 1
127+
rm -rf "qemu-2.3.0-bbcount" || exit 1
128+
rm -rf "qemu-2.3.0-pathcov-x86" || exit 1
129+
rm -rf "qemu-2.3.0-pathcov-x64" || exit 1
130+
rm -rf "qemu-2.3.0-syscall-x86" || exit 1
131+
rm -rf "qemu-2.3.0-syscall-x64" || exit 1
132+
rm -rf "qemu-2.3.0-feedback-x86" || exit 1
133+
rm -rf "qemu-2.3.0-feedback-x64" || exit 1
134+
rm -rf "qemu-2.3.0-bbcount-x86" || exit 1
135+
rm -rf "qemu-2.3.0-bbcount-x64" || exit 1
136+
tar xf "$ARCHIVE" || exit 1
137+
138+
echo "[+] Unpacking successful."
139+
140+
echo "[*] Backup target files of patches-common/ (for later use)"
141+
cp qemu-2.3.0/linux-user/elfload.c qemu-2.3.0/linux-user/elfload.c.orig
142+
cp qemu-2.3.0/linux-user/linuxload.c qemu-2.3.0/linux-user/linuxload.c.orig
143+
cp qemu-2.3.0/linux-user/signal.c qemu-2.3.0/linux-user/signal.c.orig
144+
cp qemu-2.3.0/translate-all.c qemu-2.3.0/translate-all.c.orig
145+
cp qemu-2.3.0/scripts/texi2pod.pl qemu-2.3.0/scripts/texi2pod.pl.orig
146+
cp qemu-2.3.0/user-exec.c qemu-2.3.0/user-exec.c.orig
147+
148+
echo "[*] Applying common patches..."
149+
patch -p0 <patches-common/elfload.diff || exit 1
150+
patch -p0 <patches-common/linuxload.diff || exit 1
151+
patch -p0 <patches-common/signal.diff || exit 1
152+
patch -p0 <patches-common/translate-all.diff || exit 1
153+
patch -p0 <patches-common/texi2pod.diff || exit 1
154+
patch -p0 <patches-common/user-exec.diff || exit 1
155+
156+
cp -r "qemu-2.3.0" "qemu-2.3.0-pathcov"
157+
cp -r "qemu-2.3.0" "qemu-2.3.0-syscall"
158+
cp -r "qemu-2.3.0" "qemu-2.3.0-feedback"
159+
cp -r "qemu-2.3.0" "qemu-2.3.0-bbcount"
160+
161+
### Patch for pathcov tracer
162+
163+
echo "[*] Applying patches for pathcov..."
164+
165+
patch -p0 <patches-pathcov/syscall.diff || exit 1
166+
patch -p0 <patches-pathcov/cpu-exec.diff || exit 1
167+
patch -p0 <patches-pathcov/exec-all.diff || exit 1
168+
patch -p0 <patches-pathcov/translate.diff || exit 1
169+
patch -p0 <patches-pathcov/makefile-target.diff || exit 1
170+
cp patches-pathcov/chatkey.cc qemu-2.3.0-pathcov/
171+
cp patches-pathcov/afl-qemu-cpu-inl.h qemu-2.3.0-pathcov/
172+
cp patches-pathcov/chatkey-utils.h qemu-2.3.0-pathcov/
173+
174+
echo "[+] Patching done."
175+
176+
### Patch for syscall tracer
177+
178+
echo "[*] Applying patches for syscall..."
179+
180+
patch -p0 <patches-syscall/cpu-exec.diff || exit 1
181+
patch -p0 <patches-syscall/syscall.diff || exit 1
182+
patch -p0 <patches-syscall/makefile-objs.diff || exit 1
183+
cp patches-syscall/chatkey.c qemu-2.3.0-syscall/linux-user/
184+
185+
echo "[+] Patching done."
186+
187+
### Patch for feedback tracer
188+
189+
echo "[*] Applying patches for feedback..."
190+
191+
patch -p0 <patches-feedback/cpu-exec.diff || exit 1
192+
patch -p0 <patches-feedback/syscall.diff || exit 1
193+
patch -p0 <patches-feedback/makefile-target.diff || exit 1
194+
patch -p0 <patches-feedback/translate.diff || exit 1
195+
patch -p0 <patches-feedback/tcg-target.diff || exit 1
196+
patch -p0 <patches-feedback/tcg-op.diff || exit 1
197+
patch -p0 <patches-feedback/tcg-opc.diff || exit 1
198+
patch -p0 <patches-feedback/tcg.diff || exit 1
199+
patch -p0 <patches-feedback/optimize.diff || exit 1
200+
cp patches-feedback/chatkey.c qemu-2.3.0-feedback/tcg/
201+
cp patches-feedback/afl-qemu-cpu-inl.h qemu-2.3.0-feedback/
202+
203+
echo "[+] Patching done."
204+
205+
### Patch for basic block count tracer
206+
207+
echo "[*] Applying patches for bbcount..."
208+
209+
patch -p0 <patches-bbcount/syscall.diff || exit 1
210+
patch -p0 <patches-bbcount/cpu-exec.diff || exit 1
211+
patch -p0 <patches-bbcount/makefile-target.diff || exit 1
212+
patch -p0 <patches-bbcount/makefile-objs.diff || exit 1
213+
patch -p0 <patches-bbcount/main.diff || exit 1
214+
cp patches-bbcount/chatkey.cc qemu-2.3.0-bbcount/linux-user/
215+
echo "[+] Patching done."
216+
217+
### Copy directories, one for x86 and the other for x64
218+
219+
cp -r "qemu-2.3.0-pathcov" "qemu-2.3.0-pathcov-x86"
220+
mv "qemu-2.3.0-pathcov" "qemu-2.3.0-pathcov-x64"
221+
cp -r "qemu-2.3.0-syscall" "qemu-2.3.0-syscall-x86"
222+
mv "qemu-2.3.0-syscall" "qemu-2.3.0-syscall-x64"
223+
cp -r "qemu-2.3.0-feedback" "qemu-2.3.0-feedback-x86"
224+
mv "qemu-2.3.0-feedback" "qemu-2.3.0-feedback-x64"
225+
cp -r "qemu-2.3.0-bbcount" "qemu-2.3.0-bbcount-x86"
226+
mv "qemu-2.3.0-bbcount" "qemu-2.3.0-bbcount-x64"
227+
228+
### Build QEMU tracers
229+
230+
build_qemu pathcov x86
231+
mv "./qemu-trace" "../../build/qemu-trace-pathcov-x86" || exit 1
232+
echo "[+] Successfully created 'qemu-trace-pathcov-x86'."
233+
234+
build_qemu pathcov x64
235+
mv "./qemu-trace" "../../build/qemu-trace-pathcov-x64" || exit 1
236+
echo "[+] Successfully created 'qemu-trace-pathcov-x64'."
237+
238+
build_qemu syscall x86
239+
mv "./qemu-trace" "../../build/qemu-trace-syscall-x86" || exit 1
240+
echo "[+] Successfully created 'qemu-trace-syscall-x86'."
241+
242+
build_qemu syscall x64
243+
mv "./qemu-trace" "../../build/qemu-trace-syscall-x64" || exit 1
244+
echo "[+] Successfully created 'qemu-trace-syscall-x64'."
245+
246+
build_qemu feedback x86
247+
mv "./qemu-trace" "../../build/qemu-trace-feedback-x86" || exit 1
248+
echo "[+] Successfully created 'qemu-trace-feedback-x86'."
249+
250+
build_qemu feedback x64
251+
mv "./qemu-trace" "../../build/qemu-trace-feedback-x64" || exit 1
252+
echo "[+] Successfully created 'qemu-trace-feedback-x64'."
253+
254+
build_qemu bbcount x86
255+
mv "./qemu-trace" "../../build/qemu-trace-bbcount-x86" || exit 1
256+
echo "[+] Successfully created 'qemu-trace-bbcount-x86'."
257+
258+
build_qemu bbcount x64
259+
mv "./qemu-trace" "../../build/qemu-trace-bbcount-x64" || exit 1
260+
echo "[+] Successfully created 'qemu-trace-bbcount-x64'."
261+
262+
exit 0

‎Instrumentor/qemu/gen_bbcount_patch.sh

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/bin/bash
2+
3+
cp -r qemu-2.3.0-bbcount-x64 qemu-2.3.0-bbcount
4+
5+
cp qemu-2.3.0-bbcount/chatkey.cc ./patches-bbcount/chatkey.cc
6+
7+
cp qemu-2.3.0/linux-user/syscall.c qemu-2.3.0-bbcount/linux-user/syscall.c.orig
8+
diff -Naur qemu-2.3.0-bbcount/linux-user/syscall.c.orig qemu-2.3.0-bbcount/linux-user/syscall.c > patches-bbcount/syscall.diff
9+
10+
cp qemu-2.3.0/cpu-exec.c qemu-2.3.0-bbcount/cpu-exec.c.orig
11+
diff -Naur qemu-2.3.0-bbcount/cpu-exec.c.orig qemu-2.3.0-bbcount/cpu-exec.c > patches-bbcount/cpu-exec.diff
12+
13+
cp qemu-2.3.0/Makefile.target qemu-2.3.0-bbcount/Makefile.target.orig
14+
diff -Naur qemu-2.3.0-bbcount/Makefile.target.orig qemu-2.3.0-bbcount/Makefile.target > patches-bbcount/makefile-target.diff
15+
16+
cp qemu-2.3.0/linux-user/Makefile.objs qemu-2.3.0-bbcount/linux-user/Makefile.objs.orig
17+
diff -Naur qemu-2.3.0-bbcount/linux-user/Makefile.objs.orig qemu-2.3.0-bbcount/linux-user/Makefile.objs > patches-bbcount/makefile-objs.diff
18+
19+
cp qemu-2.3.0/linux-user/main.c qemu-2.3.0-bbcount/linux-user/main.c.orig
20+
diff -Naur qemu-2.3.0-bbcount/linux-user/main.c.orig qemu-2.3.0-bbcount/linux-user/main.c > patches-bbcount/main.diff
21+
22+
rm -rf qemu-2.3.0 qemu-2.3.0-bbcount

‎Instrumentor/qemu/gen_feedback_patch.sh

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/bin/bash
2+
3+
cp qemu-2.3.0-feedback/tcg/chatkey.c ./patches-feedback/chatkey.c
4+
5+
cp qemu-2.3.0-feedback/afl-qemu-cpu-inl.h ./patches-feedback/afl-qemu-cpu-inl.h
6+
7+
cp qemu-2.3.0/target-i386/translate.c qemu-2.3.0-feedback/target-i386/translate.c.orig
8+
diff -Naur qemu-2.3.0-feedback/target-i386/translate.c.orig qemu-2.3.0-feedback/target-i386/translate.c > patches-feedback/translate.diff
9+
10+
cp qemu-2.3.0/cpu-exec.c qemu-2.3.0-feedback/cpu-exec.c.orig
11+
diff -Naur qemu-2.3.0-feedback/cpu-exec.c.orig qemu-2.3.0-feedback/cpu-exec.c > patches-feedback/cpu-exec.diff
12+
13+
cp qemu-2.3.0/linux-user/syscall.c qemu-2.3.0-feedback/linux-user/syscall.c.orig
14+
diff -Naur qemu-2.3.0-feedback/linux-user/syscall.c.orig qemu-2.3.0-feedback/linux-user/syscall.c > patches-feedback/syscall.diff
15+
16+
cp qemu-2.3.0/Makefile.target qemu-2.3.0-feedback/Makefile.target.orig
17+
diff -Naur qemu-2.3.0-feedback/Makefile.target.orig qemu-2.3.0-feedback/Makefile.target > patches-feedback/makefile-target.diff
18+
19+
cp qemu-2.3.0/tcg/tcg-opc.h qemu-2.3.0-feedback/tcg/tcg-opc.h.orig
20+
diff -Naur qemu-2.3.0-feedback/tcg/tcg-opc.h.orig qemu-2.3.0-feedback/tcg/tcg-opc.h > patches-feedback/tcg-opc.diff
21+
22+
cp qemu-2.3.0/tcg/tcg-op.h qemu-2.3.0-feedback/tcg/tcg-op.h.orig
23+
diff -Naur qemu-2.3.0-feedback/tcg/tcg-op.h.orig qemu-2.3.0-feedback/tcg/tcg-op.h > patches-feedback/tcg-op.diff
24+
25+
cp qemu-2.3.0/tcg/i386/tcg-target.c qemu-2.3.0-feedback/tcg/i386/tcg-target.c.orig
26+
diff -Naur qemu-2.3.0-feedback/tcg/i386/tcg-target.c.orig qemu-2.3.0-feedback/tcg/i386/tcg-target.c > patches-feedback/tcg-target.diff
27+
28+
cp qemu-2.3.0/tcg/tcg.h qemu-2.3.0-feedback/tcg/tcg.h.orig
29+
diff -Naur qemu-2.3.0-feedback/tcg/tcg.h.orig qemu-2.3.0-feedback/tcg/tcg.h > patches-feedback/tcg.diff
30+
31+
cp qemu-2.3.0/tcg/optimize.c qemu-2.3.0-feedback/tcg/optimize.c.orig
32+
diff -Naur qemu-2.3.0-feedback/tcg/optimize.c.orig qemu-2.3.0-feedback/tcg/optimize.c > patches-feedback/optimize.diff

‎Instrumentor/qemu/gen_pathcov_patch.sh

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/bin/bash
2+
3+
cp qemu-2.3.0-pathcov/chatkey.cc ./patches-pathcov/chatkey.cc
4+
5+
cp qemu-2.3.0-pathcov/afl-qemu-cpu-inl.h ./patches-pathcov/afl-qemu-cpu-inl.h
6+
7+
cp qemu-2.3.0-pathcov/chatkey-utils.h ./patches-pathcov/chatkey-utils.h
8+
9+
cp qemu-2.3.0/linux-user/syscall.c qemu-2.3.0-pathcov/linux-user/syscall.c.orig
10+
diff -Naur qemu-2.3.0-pathcov/linux-user/syscall.c.orig qemu-2.3.0-pathcov/linux-user/syscall.c > patches-pathcov/syscall.diff
11+
12+
cp qemu-2.3.0/target-i386/translate.c qemu-2.3.0-pathcov/target-i386/translate.c.orig
13+
diff -Naur qemu-2.3.0-pathcov/target-i386/translate.c.orig qemu-2.3.0-pathcov/target-i386/translate.c > patches-pathcov/translate.diff
14+
15+
cp qemu-2.3.0/cpu-exec.c qemu-2.3.0-pathcov/cpu-exec.c.orig
16+
diff -Naur qemu-2.3.0-pathcov/cpu-exec.c.orig qemu-2.3.0-pathcov/cpu-exec.c > patches-pathcov/cpu-exec.diff
17+
18+
cp qemu-2.3.0/Makefile.target qemu-2.3.0-pathcov/Makefile.target.orig
19+
diff -Naur qemu-2.3.0-pathcov/Makefile.target.orig qemu-2.3.0-pathcov/Makefile.target > patches-pathcov/makefile-target.diff
20+
21+
cp qemu-2.3.0/include/exec/exec-all.h ./qemu-2.3.0-pathcov/include/exec/exec-all.h.orig
22+
diff -Naur qemu-2.3.0-pathcov/include/exec/exec-all.h.orig qemu-2.3.0-pathcov/include/exec/exec-all.h > patches-pathcov/exec-all.diff

0 commit comments

Comments
 (0)