diff --git a/.gitattributes b/.gitattributes index 9d221b90a8ef09d1a033a2444c46b8b8e9ce1d5f..2751d1e393de484de4ca7fe8124c1f789489c7f4 100644 --- a/.gitattributes +++ b/.gitattributes @@ -287,14 +287,6 @@ libMEDSannotation/src/MEDS_InstructionCheckAnnotation.cpp -text libMEDSannotation/src/MEDS_Register.cpp -text libMEDSannotation/src/Makefile -text libMEDSannotation/src/VirtualOffset.cpp -text -libintegertransform/Makefile -text -libintegertransform/include/integertransform.hpp -text -libintegertransform/src/Makefile -text -libintegertransform/src/integertransform.cpp -text -libintegertransform/tests/Makefile -text -libintegertransform/tests/clark1.c -text -libintegertransform/tests/int32overflow.c -text -libintegertransform/tests/sample_meds_int.annot -text libtransform/Makefile -text libtransform/include/integertransform.hpp -text libtransform/include/transform.hpp -text diff --git a/libintegertransform/Makefile b/libintegertransform/Makefile deleted file mode 100644 index 8eeb9bea022e83cddb938e52c3155e2962f19924..0000000000000000000000000000000000000000 --- a/libintegertransform/Makefile +++ /dev/null @@ -1,5 +0,0 @@ -all: - cd src; make - -clean: - cd src; make clean diff --git a/libintegertransform/include/integertransform.hpp b/libintegertransform/include/integertransform.hpp deleted file mode 100644 index 107be7e43e1b029010287aa6b273877da87019ed..0000000000000000000000000000000000000000 --- a/libintegertransform/include/integertransform.hpp +++ /dev/null @@ -1,45 +0,0 @@ -#ifndef _INTEGER_TRANSFORM_H_ -#define _INTEGER_TRANSFORM_H_ - -#include <string> -#include <set> -#include <map> - -#include <libIRDB-core.hpp> -#include "MEDS_InstructionCheckAnnotation.hpp" -#include "VirtualOffset.hpp" - -using namespace std; -using namespace libIRDB; - -class IntegerTransform -{ - public: - IntegerTransform(VariantID_t *, VariantIR_t*, std::map<VirtualOffset, MEDS_InstructionCheckAnnotation> *p_annotations, set<std::string> *p_filteredFunctions); - int execute(); - - private: - void handleOverflowCheck(Instruction_t *p_instruction, const MEDS_InstructionCheckAnnotation& p_annotation); - void addOverflowCheck(Instruction_t *p_instruction, const MEDS_InstructionCheckAnnotation& p_annotation); - - virtual_offset_t getAvailableAddress(VariantIR_t *p_virp); - - // utility functions - bool isMultiplyInstruction32(libIRDB::Instruction_t*); - bool isAddSubNonEspInstruction32(libIRDB::Instruction_t*); - - private: - VariantID_t *m_variantID; - VariantIR_t *m_variantIR; - std::map<VirtualOffset, MEDS_InstructionCheckAnnotation> *m_annotations; - set<std::string> *m_filteredFunctions; -}; - -// make sure these match the function names in $STRATA/src/posix/x86_linux/detector_number_handling/overflow_detector.c - -#define INTEGER_OVERFLOW_DETECTOR "integer_overflow_detector" -#define ADDSUB_OVERFLOW_DETECTOR_SIGNED_32 "addsub_overflow_detector_signed_32" -#define ADDSUB_OVERFLOW_DETECTOR_UNSIGNED_32 "addsub_overflow_detector_unsigned_32" -#define MUL_OVERFLOW_DETECTOR_32 "mul_overflow_detector_32" - -#endif diff --git a/libintegertransform/src/Makefile b/libintegertransform/src/Makefile deleted file mode 100644 index 64e0240cdf229c47c9027f51f66f989294961ecd..0000000000000000000000000000000000000000 --- a/libintegertransform/src/Makefile +++ /dev/null @@ -1,14 +0,0 @@ -LIB=../lib/libintegertransform.a - -OBJS=integertransform.o - -all: $(OBJS) - -$(OBJS): ../include/*.hpp - -clean: - rm -f $(OBJS) - -.cpp.o: - g++ -g -c -I. -I../include -I../../libIRDB/include -I../../libMEDSannotation/include -I../../beaengine/include $< - ar rc $(LIB) $@ diff --git a/libintegertransform/src/integertransform.cpp b/libintegertransform/src/integertransform.cpp deleted file mode 100644 index 846a55e659b3c9d0e779dd13b412130bf12198f5..0000000000000000000000000000000000000000 --- a/libintegertransform/src/integertransform.cpp +++ /dev/null @@ -1,353 +0,0 @@ -#include "integertransform.hpp" - -IntegerTransform::IntegerTransform(VariantID_t *p_variantID, VariantIR_t *p_variantIR, std::map<VirtualOffset, MEDS_InstructionCheckAnnotation> *p_annotations, set<std::string> *p_filteredFunctions) -{ - m_variantID = p_variantID; // Current variant ID - m_variantIR = p_variantIR; // IR (off the database) for variant - m_annotations = p_annotations; // MEDS annotations - m_filteredFunctions = p_filteredFunctions; // Blacklisted funtions -} - -// iterate through all functions -// filter those functions that should be ignored -// iterate through all instructions in function -// if MEDS annotation says to instrument -// add instrumentation -int IntegerTransform::execute() -{ - for( - set<Function_t*>::const_iterator itf=m_variantIR->GetFunctions().begin(); - itf!=m_variantIR->GetFunctions().end(); - ++itf - ) - { - Function_t* func=*itf; - - cerr << "integertransform: looking at function: " << func->GetName() << endl; - - if (m_filteredFunctions->find(func->GetName()) != m_filteredFunctions->end()) - continue; - - for( - set<Instruction_t*>::const_iterator it=func->GetInstructions().begin(); - it!=func->GetInstructions().end(); - ++it) - { - Instruction_t* insn=*it; - - if (insn && insn->GetAddress()) - { - virtual_offset_t irdb_vo = insn->GetAddress()->GetVirtualOffset(); - if (irdb_vo == 0) continue; - - VirtualOffset vo(irdb_vo); - - MEDS_InstructionCheckAnnotation annotation = (*m_annotations)[vo]; - if (!annotation.isValid()) continue; - - if (annotation.isOverflow()) - { - cerr << "integertransform: overflow annotation: " << annotation.toString(); - handleOverflowCheck(insn, annotation); - } - else if (annotation.isUnderflow()) - { - cerr << "integertransform: underflow annotation: " << annotation.toString(); - handleOverflowCheck(insn, annotation); - } - else if (annotation.isTruncation()) - { - cerr << "integertransform: truncation annotation: " << annotation.toString(); - - } - else if (annotation.isSignedness()) - { - cerr << "integertransform: signedness annotation: " << annotation.toString(); - } - else - cerr << "integertransform: unknown annotation: " << annotation.toString(); - } - } // end iterate over all instructions in a function - } // end iterate over all functions - - cerr << "integertransform: testing: do not write new variant to DB" << endl; - m_variantIR->WriteToDB(); - - // for now just be happy - return 0; -} - -void IntegerTransform::handleOverflowCheck(Instruction_t *p_instruction, const MEDS_InstructionCheckAnnotation& p_annotation) -{ - if (isMultiplyInstruction32(p_instruction)) - addOverflowCheck(p_instruction, p_annotation); - else if (p_annotation.getBitWidth() == 32) - { - addOverflowCheck(p_instruction, p_annotation); - } -} - -// -// <instruction to instrument> -// jno <originalFallthroughInstruction> -// pusha -// pushf -// push_arg -// push L1 -// ... setup detector ... -// L1: pop_arg -// popf -// popa -// -void IntegerTransform::addOverflowCheck(Instruction_t *p_instruction, const MEDS_InstructionCheckAnnotation& p_annotation) -{ -cerr << "void IntegerTransform::addOverflowCheck(): enter: " << p_instruction->GetComment() << endl; - assert(m_variantIR && p_instruction); - - string detector; // name of SPRI/STRATA callback handler function - string dataBits; - - AddressID_t *jncond_a =new AddressID_t; - AddressID_t *pusha_a =new AddressID_t; - AddressID_t *pushf_a =new AddressID_t; - AddressID_t *pusharg_a =new AddressID_t; - AddressID_t *pushret_a =new AddressID_t; - AddressID_t *poparg_a =new AddressID_t; - AddressID_t *popf_a =new AddressID_t; - AddressID_t *popa_a =new AddressID_t; - - jncond_a->SetFileID(p_instruction->GetAddress()->GetFileID()); - pusha_a->SetFileID(p_instruction->GetAddress()->GetFileID()); - pushf_a->SetFileID(p_instruction->GetAddress()->GetFileID()); - pusharg_a->SetFileID(p_instruction->GetAddress()->GetFileID()); - pushret_a->SetFileID(p_instruction->GetAddress()->GetFileID()); - poparg_a->SetFileID(p_instruction->GetAddress()->GetFileID()); - popf_a->SetFileID(p_instruction->GetAddress()->GetFileID()); - popa_a->SetFileID(p_instruction->GetAddress()->GetFileID()); - - Instruction_t* jncond_i = new Instruction_t; - Instruction_t* pusha_i = new Instruction_t; - Instruction_t* pushf_i = new Instruction_t; - Instruction_t* pusharg_i = new Instruction_t; - Instruction_t* pushret_i = new Instruction_t; - Instruction_t* poparg_i = new Instruction_t; - Instruction_t* popf_i = new Instruction_t; - Instruction_t* popa_i = new Instruction_t; - - Function_t* origFunction = p_instruction->GetFunction(); - - jncond_i->SetFunction(origFunction); - pusha_i->SetFunction(origFunction); - pushf_i->SetFunction(origFunction); - pusharg_i->SetFunction(origFunction); - pushret_i->SetFunction(origFunction); - poparg_i->SetFunction(origFunction); - popf_i->SetFunction(origFunction); - popa_i->SetFunction(origFunction); - - // pin the poparg instruction - virtual_offset_t postDetectorReturn = getAvailableAddress(m_variantIR); - poparg_a->SetVirtualOffset(postDetectorReturn); - - jncond_i->SetAddress(jncond_a); - pusha_i->SetAddress(pusha_a); - pushf_i->SetAddress(pushf_a); - pusharg_i->SetAddress(pusharg_a); - pushret_i->SetAddress(pushret_a); - poparg_i->SetAddress(poparg_a); - popf_i->SetAddress(popf_a); - popa_i->SetAddress(popa_a); - - // set fallthrough for the original instruction - Instruction_t* nextOrig_i = p_instruction->GetFallthrough(); - p_instruction->SetFallthrough(jncond_i); - - // jncond - dataBits.resize(2); - if (isMultiplyInstruction32(p_instruction)) - { - dataBits[0] = 0x71; // jno - dataBits[1] = 0x00; // value doesn't matter, we will fill it in later - detector = string(MUL_OVERFLOW_DETECTOR_32); - cerr << "integertransform: MUL OVERFLOW 32" << endl; - } - else if (p_annotation.isSigned()) - { - dataBits[0] = 0x71; // jno - dataBits[1] = 0x00; // value doesn't matter, we will fill it in later - - detector = string(ADDSUB_OVERFLOW_DETECTOR_SIGNED_32); - cerr << "integertransform: ADD/SUB OVERFLOW SIGNED 32" << endl; - } - else if (p_annotation.isUnsigned()) - { - dataBits[0] = 0x73; // jnc - dataBits[1] = 0x00; // value doesn't matter, we will fill it in later - - detector = string(ADDSUB_OVERFLOW_DETECTOR_UNSIGNED_32); - cerr << "integertransform: ADD/SUB OVERFLOW UNSIGNED 32" << endl; - } - - jncond_i->SetDataBits(dataBits); - jncond_i->SetComment(jncond_i->getDisassembly()); - jncond_i->SetFallthrough(pusha_i); - jncond_i->SetTarget(nextOrig_i); - p_instruction->SetFallthrough(jncond_i); - - // pusha - dataBits.resize(1); - dataBits[0] = 0x60; - pusha_i->SetDataBits(dataBits); - pusha_i->SetComment(pusha_i->getDisassembly()); - pusha_i->SetFallthrough(pushf_i); - - // pushf - dataBits.resize(1); - dataBits[0] = 0x9c; - pushf_i->SetDataBits(dataBits); - pushf_i->SetComment(pushf_i->getDisassembly()); - pushf_i->SetFallthrough(pusharg_i); - - // push arg - dataBits.resize(5); - dataBits[0] = 0x68; - virtual_offset_t *tmp = (virtual_offset_t *) &dataBits[1]; - *tmp = p_instruction->GetAddress()->GetVirtualOffset(); - pusharg_i->SetDataBits(dataBits); - pusharg_i->SetComment(pusharg_i->getDisassembly()); - pusharg_i->SetFallthrough(pushret_i); - - // pushret - dataBits.resize(5); - dataBits[0] = 0x68; - tmp = (virtual_offset_t *) &dataBits[1]; - *tmp = postDetectorReturn; - pushret_i->SetDataBits(dataBits); - pushret_i->SetComment(pushret_i->getDisassembly()); - pushret_i->SetFallthrough(poparg_i); - - // poparg - dataBits.resize(1); - dataBits[0] = 0x58; - poparg_i->SetDataBits(dataBits); - poparg_i->SetComment(poparg_i->getDisassembly() + " -- with callback to " + detector + " orig: " + p_instruction->GetComment()) ; - poparg_i->SetFallthrough(popa_i); - poparg_i->SetIndirectBranchTargetAddress(poparg_a); - poparg_i->SetCallback(detector); - - // popf - dataBits.resize(1); - dataBits[0] = 0x9d; - popf_i->SetDataBits(dataBits); - popf_i->SetComment(popf_i->getDisassembly()); - popf_i->SetFallthrough(popa_i); - - // popa - dataBits.resize(1); - dataBits[0] = 0x61; - popa_i->SetDataBits(dataBits); - popa_i->SetComment(popa_i->getDisassembly()); - popa_i->SetFallthrough(nextOrig_i); - - // add new address to IR - m_variantIR->GetAddresses().insert(jncond_a); - m_variantIR->GetAddresses().insert(pusha_a); - m_variantIR->GetAddresses().insert(pusharg_a); - m_variantIR->GetAddresses().insert(pushf_a); - m_variantIR->GetAddresses().insert(pushret_a); - m_variantIR->GetAddresses().insert(popf_a); - m_variantIR->GetAddresses().insert(poparg_a); - m_variantIR->GetAddresses().insert(popa_a); - - // add new instructions to IR - m_variantIR->GetInstructions().insert(jncond_i); - m_variantIR->GetInstructions().insert(pusha_i); - m_variantIR->GetInstructions().insert(pusharg_i); - m_variantIR->GetInstructions().insert(pushf_i); - m_variantIR->GetInstructions().insert(pushret_i); - m_variantIR->GetInstructions().insert(popf_i); - m_variantIR->GetInstructions().insert(poparg_i); - m_variantIR->GetInstructions().insert(popa_i); -cerr << "void IntegerTransform::addOverflowCheck(): exit" << endl; -} - -virtual_offset_t IntegerTransform::getAvailableAddress(VariantIR_t *p_virp) -{ - // traverse all instructions - // grab address - virtual_offset_t availableAddressOffset = 0; - for( - set<Instruction_t*>::const_iterator it=p_virp->GetInstructions().begin(); - it!=p_virp->GetInstructions().end(); - ++it - ) - { - Instruction_t* insn=*it; - if (!insn) continue; - - AddressID_t* addr = insn->GetAddress(); - virtual_offset_t offset = addr->GetVirtualOffset(); - - if (offset > availableAddressOffset) - { - availableAddressOffset = offset; - } - } - - // @todo: lookup instruction size so that we don't waste any space - // for some reason the max available address is incorrect! was ist los? -static int counter = -16; - counter += 16; - return 0xf0000000 + counter; -// availableAddressOffset + 16; -} - -// -// Returns true iff instruction is mul or imul -// -bool IntegerTransform::isMultiplyInstruction32(Instruction_t *p_instruction) -{ - if (!p_instruction) - return false; - - DISASM disasm; - - p_instruction->Disassemble(disasm); - - // look for "mul ..." or "imul ..." - // beaengine adds space at the end of the mnemonic string - return strcasestr(disasm.Instruction.Mnemonic, "mul ") != NULL; -} - -// -// Returns true iff instruction is mul or imul -// -bool IntegerTransform::isAddSubNonEspInstruction32(Instruction_t *p_instruction) -{ - if (!p_instruction) - return false; - - DISASM disasm; - - // look for "add ..." or "sub ..." - // look for "addl ..." or "subl ..." - p_instruction->Disassemble(disasm); - - // beaengine adds space at the end of the mnemonic string - if (strcasestr(disasm.Instruction.Mnemonic, "add ")) - { - return true; - } - else if (strcasestr(disasm.Instruction.Mnemonic, "sub ")) - { - if (strcasestr(disasm.Argument1.ArgMnemonic,"esp") && - (disasm.Argument2.ArgType & 0xFFFF0000 & (CONSTANT_TYPE | ABSOLUTE_))) - { - // optimization: filter out "sub esp, K" - return false; - } - return true; - } - - return false; -} diff --git a/libintegertransform/tests/Makefile b/libintegertransform/tests/Makefile deleted file mode 100644 index 4a145dcc14545084b2d906af31da9c6f588df422..0000000000000000000000000000000000000000 --- a/libintegertransform/tests/Makefile +++ /dev/null @@ -1,62 +0,0 @@ -CC=DO_NOT_USE -CXX=DO_NOT_USE -CFLAGS=DO_NOT_USE -LD=DO_NOT_USE - -.SUFFIXES: .o .c .cpp .exe - -#exes=dumbledore_cmd.exe test1.exe -#exes=overflow1.exe #overflow2.exe -#exes=dumbledore_cmd.exe -exes=integerbug.exe - - -all: env_check ${exes} - -.PHONY: env_check - -.o.exe: -# ${PEASOUP_HOME}/tools/ps_link.sh $< -o $@ - gcc $< -o $@ - ${PEASOUP_HOME}/tools/ps_analyze.sh $@ $@ --step ilr=off --step concolic=off --step p1transform=off --step integertransform=off - -.c.o: - ${PEASOUP_HOME}/tools/ps_comp.sh $< - -.cpp.o: - ${PEASOUP_HOME}/tools/ps_comp++.sh $< - - -env_check: - @echo checking env vars; \ - if [ "X${TOOLCHAIN}" = "X" ]; then \ - echo TOOLCHAIN environment variable should be set.; \ - exit -1;\ - elif [ "X${STRATA}" = "X" ]; then \ - echo STRATA environment variable should be set. ;\ - exit -1;\ - elif [ "X${SMPSA_HOME}" = "X" ]; then \ - echo SMPSA_HOME environment variable should be set.; \ - exit -1;\ - elif [ "X${PEASOUP_HOME}" = "X" ]; then \ - echo PEASOUP_HOME environment variable should be set.; \ - exit -1;\ - elif [ "X${STRATA_HOME}" = "X" ]; then \ - echo STRATA_HOME environment variable should be set.; \ - exit -1;\ - fi ; - - -clean: - rm -f *.o *.syms *.map - rm -f *.exe *.dis *.data *.idb *.log *.ncexe *.readelf temp.* *.temp *.stratafied *.asm *.SMPobjdump *.id0 *.id1 *.til *.nam - rm -Rf concolic.files_* - rm -Rf peasoup_executable_directory.* - rm -f strata.log.* - rm -f *.sym - ${PEASOUP_HOME}/tools/db/drop_my_tables.sh - ${PEASOUP_HOME}/tools/db/pdb_setup.sh - -concclean: - rm -Rf concolic.files_* - rm strata.log.* diff --git a/libintegertransform/tests/clark1.c b/libintegertransform/tests/clark1.c deleted file mode 100644 index b362593c2e2ecbed14479a6b2fe0867fbd3d2473..0000000000000000000000000000000000000000 --- a/libintegertransform/tests/clark1.c +++ /dev/null @@ -1,108 +0,0 @@ -#include <stdio.h> -#include <limits.h> - -int main() { - unsigned short us15, us15copy; - signed short s15copy, s15inccopy, s16trunc; - unsigned int us17; - signed int sneg1; - int count; - - printf("Enter 32767 to trigger errors of signedness and overflow, smaller otherwise.\n"); - - printf("Enter unsigned short value: "); - - count = scanf("%hu", &us15); - - printf("\n"); - - - - if (count != 1) printf("\nINPUT ERROR\n"); - - if (32768 > (us15 + 1)) { /* Conditional branch here implies unsigned */ - - printf("Bypassing signedness and overflow errors.\n"); - - } - else if (32767 == us15) { - - printf("Preparing to trigger signedness and overflow errors.\n"); - - } - else { - - printf("Preparing to trigger signedness error.\n"); - - } - - printf("Input value: %hu Signed copy: %hd\n ", us15, s15copy); - - ++s15copy; /* OVERFLOW ERROR */ - - ++us15copy; /* Check for overflow, but no error */ - - s15inccopy = us15copy; /* SIGNEDNESS ERROR */ - - printf(" (Overflow) Signed copy then increment: %hd\n", s15copy); - - printf(" (Signedness) Increment then signed copy: %hd\n", s15inccopy); - - printf("\nEnter -1 to trigger underflow, positive int otherwise: "); - - count = scanf("%d", &sneg1); - - if (count != 1) printf("\nINPUT ERROR\n"); - - printf("\n"); - - if (-1 < sneg1) { /* Conditional branch here implies signed */ - - printf("Bypassing underflow error.\n"); - - } - - else if (-1 == sneg1) { - - printf("Preparing to trigger underflow error.\n"); - - } - - sneg1 -= INT_MAX; /* underflow check should occur, but no error. */ - - - printf("Value minus INT_MAX = %d\n", sneg1); - - --sneg1; /* UNDERFLOW ERROR */ - - printf(" (Underflow) Value minus INT_MAX minus 1 = %d\n", sneg1); - - printf("\nEnter 131071 to trigger truncation, small positive int otherwise: "); - - count = scanf("%u", &us17); - - if (count != 1) printf("\nINPUT ERROR\n"); - - printf("\n"); - - if (65536 > us17) { /* Conditional branch here implies unsigned */ - - printf("Bypassing truncation error.\n"); - - } - else if (131071 == us17) { - - printf("Preparing to trigger truncation error.\n"); - - } - - s16trunc = us17; /* TRUNCATION ERROR */ - - printf("Unsigned value = %u\n", us17); - - printf(" (Truncation) Value copied to signed short = %hd\n", s16trunc); - - - return 0; -} - diff --git a/libintegertransform/tests/int32overflow.c b/libintegertransform/tests/int32overflow.c deleted file mode 100644 index 152d18eeb3f2f822fba615e53132ce04f21a1702..0000000000000000000000000000000000000000 --- a/libintegertransform/tests/int32overflow.c +++ /dev/null @@ -1,22 +0,0 @@ -#include <stdio.h> - -int main(int argc, char **argv) -{ - unsigned int x; - - x = 0xFFFFFFFF; - x++; - - printf("Value of unsigned int (add): %u\n", x); - - unsigned int s; - s = 0; - s--; - printf("Value of unsigned int (sub): %u\n", s); - - unsigned int m1 = 5; - unsigned int m2 = 0xFFFFFFFF; - m1 = m1 * m2; - printf("Value of unsigned int (mul): %u\n", m1); - -} diff --git a/libintegertransform/tests/sample_meds_int.annot b/libintegertransform/tests/sample_meds_int.annot deleted file mode 100644 index 2caefdab49607af67cd9863aa1ee30f11957735f..0000000000000000000000000000000000000000 --- a/libintegertransform/tests/sample_meds_int.annot +++ /dev/null @@ -1,3 +0,0 @@ -80483f5 3 INSTR CHECK OVERFLOW UNSIGNED 32 EAX ZZ add eax, 1 -8048417 3 INSTR CHECK OVERFLOW UNSIGNED 32 EAX ZZ sub eax, 1 -8048445 3 INSTR CHECK OVERFLOW UNSIGNED 32 EAX ZZ mul eax, 1