The x86 and x86_64 binaries are re-compiled with clang-10 from the
vcpkg, cxx-common libraries, because KLEE would fail with segfault if
the LLVM bitcode is lifted from binaries compiled with GCC (10.2.0). It
may be worth looking into why KLEE fails with the bitcodes lifted from
GCC compiled binaries in this case.
The AArch64 binary is re-compiled with aarch64-linux-gnu-gcc (10.2.0),
but mcsema-lift-10.0 fails with the following message.
```
F1228 23:41:38.079257 120074 Analyze.cpp:491] Check failed: dest_size < 64u (64 vs. 64)
*** Check failure stack trace: ***
@ 0x11601cc google::LogMessageFatal::~LogMessageFatal()
@ 0x785c3c anvill::XrefExprFolder::VisitTrunc()
@ 0x786108 anvill::XrefExprFolder::VisitICmp()
@ 0x660113 mcsema::(anonymous namespace)::LowerXrefs()::$_1::operator()()
@ 0x65b388 mcsema::(anonymous namespace)::LowerXrefs()
@ 0x65a458 mcsema::OptimizeModule()
@ 0x657bdc mcsema::LiftCodeIntoModule()
@ 0x66e9ee main
@ 0x7ffb0e016152 __libc_start_main
@ 0x61bafe _start
@ (nil) (unknown)
```
I have not tried compiling the AArch64 binary with clang
(`-target aarch64-linux-gnu`). It may be worth trying and see if the
resulting bitcode works with KLEE.
* Docs: Update links with the new organization name
* CI/Travis: Update remotes with the new organization name
* mcsema-disass: Update links with the new organization name
* Dockerfile: Update remotes with the new organization name
* CMake: Small refactor, style changes
* CMake: Fix the install target for Windows
* Windows: Add build instructions
* CMake: Add support for find_package(remill)
* CMake: Fail when the Python package can't be installed
* CMake: Fix the 'install' target on Linux
* CMake: Copy the Updated settings.cmake from Remill
* Travis: Update the build script
* Update the remill commit id
* CMake: Only use C++14 when compiling on Windows
* CMake: Fix the Python package installer
* Update the Windows documentation
* Update .remill_commit_id
Update to track the tip of master
* Change default install location to /usr/local
* Indentation fixes
* Fix CMake error introduced in d2582c7
This regression has been in the branch for a while, and it is caused
by the ABI library in mcsema/OS/Linux. The commit that introduced the
problem enabled an 'add_subdirectory' directive that was initially
commented out.
The problem with CMake was primarly due to the 'project(name BC)'
statement, trying to enable back the BC language (which was removed
due to broken Visual Studio support).
I've kept the add_subdirectory enabled, but only when building on
linux. CMake works fine now, but compilation fails due to missing
include headers referenced by ABI_libc.h (like ultrasound.h, which
appears to come from the kernel headers).
=======
alessandro@tob-ubuntu1804-remill:~/Projects/remill/tools/mcsema$ git bisect run /tmp/bisect.sh
running /tmp/bisect.sh
CMake has failed to configure the project!
Bisecting: 5 revisions left to test after this (roughly 3 steps)
[67164c725e] Update README.md
running /tmp/bisect.sh
CMake has successfully configured the project!
Bisecting: 2 revisions left to test after this (roughly 2 steps)
[d2582c7abd] Build Tests in Travis (#406)
running /tmp/bisect.sh
CMake has failed to configure the project!
Bisecting: 0 revisions left to test after this (roughly 1 step)
[a708bafc42] InlineAsm function type mismatch (#409)
running /tmp/bisect.sh
CMake has successfully configured the project!
d2582c7abd is the first bad commit
commit d2582c7abd
Author: artemdinaburg <artem@dinaburg.org>
Date: Tue May 22 21:13:43 2018 -0400
Build Tests in Travis (#406)
Always generate integration tests and then run the generated integration tests travis. We get around a lack of IDA by providing pre-built CFGs for examples.
Closes#407
:100644 100644 4154fe1e118fbfcee113 M CMakeLists.txt
:040000 040000 4bb5e0a484491dba1a1d M mcsema
:040000 040000 28398aa7462461062d36 M scripts
:040000 040000 97f8342b53c1487df961 M tests
bisect run success
* Fix for building 32-bit abi libraries
* Minor cmake tweaks
* Install 32-bit libraries on Travis-CI for Linux
* Fix installation of 32-bit libs to work around travis bug
* Handle C++ bitcode files
* Bump remill commit id
* Support bc file generation on ubuntu 14.04
* Bump the Remill commit ID.
* Fix incorrect stack var sizes
* Recover references to stack vars
* Fix requested changes
* Skip jump table entries in segment xrefs
* Fix sections being incorrectly considered code
* Ignore some symbols binja inserts
Binja inserts a few symbols it identifies that shouldn't be picked up as
globals, so skip these.
TODO: Look into a better way to identify globals than looking through
and filtering variable symbols
* Fix the links to our repos (#364)
* Bring back the mcsema-lift option for --list-supported (#365)
* Bring back the mcsema-lift option for --list-supported
* Discard changes to whitespace from last commit.
* Fix several xref warnings and issues
* Tail call targets now picked up as control flow xrefs
* Tail call targets added as successors
* Fix duplicate blocks being lifted as a result of tail calls being inlined
* Ignore duplicate xrefs as a result of how binja shows the instruction in IL
* Pick up missing xrefs when an instruction is expanded to multiple IL instructions
* Only classify the memory operand of a LOAD/STORE as a memory/displacement xref
* Fixes an issue where we assume that every symbol in the module passed to --library is external, whereas that's false. (#368)
* Bump up commit id to include support of atomic intrinsic (#367)
* Bump up commit id to include support of atomic intrinsic
* update remill commit id
* change cs_action to catch & cleanup type, not looking into catch types; (#371)
* Klee maze example (#369)
* In progress. Working on an example of using KLEE on a Maze, but with the maze program being compiled to x86, amd64, and aarch64.
* Making lots of progress on getting lifting and runnning an aarch64 maze program on amd64, but using --explicit_args. The key thing I'm working through right now is a jump offset table, but where the offset is a block pc, rather than a table base. Also adding various bits of code here and there to making runnning with klee more directly doable, and working on a debugging facility to track down when the emulated program counter gets out of sync with the original program.
* Fixed a subtle @PAGE and @PAGEOFF-related reference bug on AArch64. Partially disabled the special jump offset table handling I had in table.py, as it doesn't (yet) handle the shifted table values. However, I still have the code there, so that it can recognize that a basic block address is used as a possible offset, so that I can remove the block address as a reference, which permits a new heuristic on the C++ side to work. On the C++ side, when there's a jump instruction that isn't associated with a cross-reference flow, I try to auto-augment it with addition switch cases, targeting blocks with no predecessors (as present in the CFG). This seems to work reasonably well.
* Improved the scripts and updated the READMEs.
* Minor rephrase
* Minor rephrase
* Making the stack start a bit further back reduces things like KLEE messing up (#373)
* Changing indentation level, adding more logging statements to track what's going on.
* Manually merged in Kareem's changes before doing an auto merge.
* Got the Maze example working with binary ninja.
* In progress. Working on an example of using KLEE on a Maze, but with the maze program being compiled to x86, amd64, and aarch64.
* Making lots of progress on getting lifting and runnning an aarch64 maze program on amd64, but using --explicit_args. The key thing I'm working through right now is a jump offset table, but where the offset is a block pc, rather than a table base. Also adding various bits of code here and there to making runnning with klee more directly doable, and working on a debugging facility to track down when the emulated program counter gets out of sync with the original program.
* Fixed a subtle @PAGE and @PAGEOFF-related reference bug on AArch64. Partially disabled the special jump offset table handling I had in table.py, as it doesn't (yet) handle the shifted table values. However, I still have the code there, so that it can recognize that a basic block address is used as a possible offset, so that I can remove the block address as a reference, which permits a new heuristic on the C++ side to work. On the C++ side, when there's a jump instruction that isn't associated with a cross-reference flow, I try to auto-augment it with addition switch cases, targeting blocks with no predecessors (as present in the CFG). This seems to work reasonably well.
* Improved the scripts and updated the READMEs.
* Minor rephrase
* Minor rephrase
Eric Kilmer