39 Commits

Author SHA1 Message Date
Peter Goodman 31f267bd5f Cmake refactor (#693)
* Update to latest remill APIs and way of using CMake.

* Minor fixes

* Bug fixes for AArch64

* Tweaks

* Adds some nifty functionality useful for debugging some aarch64 bugs

* Fixes a subtle bug

* Bug fixes

* Make the test suite use explicit args

* Bug fix in xrefs

* Disable tests for now
2020-09-22 23:22:56 -04:00
Peter Goodman c002b8505c Formats the code with clang-format and my additional stylistic mojojojo (#682) 2020-08-05 16:14:01 -04:00
Peter Goodman 2d55d02cc3 API improvements. Must be used with the api_improvements branches of Remill and Anvill (#666)
* API improvements. Must be used with the api_improvements branch of both Remill and McSema

fixes for x86 and running the lifted code with klee

* Update dockerfile to clone anvill

* update remill commit id

* Add python3 to dockerfile

* update python3

* disable abi script

* Updated cmake to find anvill

* Update main.cpp

* update find_package for anvill

* WIP:updated prebuild cfg

* update prebuild cfg files

* enable abi build for testsuite

* Fix memory leak

* install missing package for testcases

* frontend: Reflect cfg file changes in dyninst frontend.

* frontend: Update local files copyrights to reflect overall change to agplv3.

* fix failing testcases

* update test cfgs

* Fix test failure with local state pointer

* set the flag to use local state_ptr in default mode

Co-authored-by: kumarak <iit.akshay@gmail.com>
Co-authored-by: Lukas Korencik <xkorenc1@fi.muni.cz>
2020-07-23 02:14:56 -04:00
Eric Kilmer effd27daa9 Small final docker image (#655)
* Small final Docker image
* Ubuntu 20.04 support
* LLVM10 Fixes
2020-05-21 02:04:38 -04:00
Aiethel a577f39745 Test suite hotfix (#601)
* Add explicit targets to unit tests from src

* run_tests.py no longer crashes when program does not generate expected file as output.

* Fix bunch of issues if file is not lifted/recompiled properly

* Gzip empty command line arguments test case
2019-10-30 13:35:58 -04:00
Aiethel d42db800a4 Test suite v2 (#589)
* Parse flavors

* Batch folder is now created/deleted properly

* Shared libraries as symlinks in special dir

* Simple README file

* Get binary info

* Simple cfg retrieval

* Lifter has path to cfg as argument

* Flags for eventual evaluation

* Check policy and presence of cfg file

* Print results of getting the cfgs

* Check of batch sanity fix

* run_test cli parsing

* Add abi_libraries directory parsing

* Shared libraries directory parsing

* Lift and recompile

* Before actual test implementation

* Playground for testing

* Actual testing

* Split test cases on per binary bases

* Add some commits

* Result print

* Enhance README.txt

* Populate.py to copy needed binaries

* Add short decsription of populate.py

* Support flavor all

* add ida frontend implementation

* Basic tag files

* Basic inputs

* Missing comma

* Change inputs handling

* Separate function for copy files

* Naming convention

* Handle missing test case class

* Create bin if it is missing

* Create so_dir if it is missing

* Remove not used cmd argument

* Add several more test_suites

* ida frontend lift function can now be selected

* Smarter tests

* BasicTest does not need setUp

* Prevent system-wide installed binaries from being run instead of tested

* Simple comment

* Pass rest of are passed to lift

* Fix parser error with unspecified lift_args

* Variable name

* Change default interpreter to python3

* Fix optional argument parsing for the subsequent lift

* typo in mcsema-disass

* More details in README

* Simplify usage of IDA frontend

* ida frontend stores logs

* Add script to compile programs and generate tags if desired

* Year on copyright

* Add hello world src examples of tests.

* Add test addition example to README

* Correct extension for log files

* Basic linker flags

* Fix crash if file in bin is missing when tag is present

* Bunch of test files

* Empty runs

* Test_suite name should have maxsplit=1

* Dynamically create test_suites for src programs from definitions

* Define cases

* Stdin

* Split tests into another file

* WIP: stdin from string

* Another string to be matched if binary is pie

* Fix typo in test case

* Add color support

* Improve stdout output

* Add wrappers to make colors more use friendly

* Move object representation of test results into separate file

* Add magneta

* Cleaner verbose output

* Log partial results, so they can be dumped into file later for comparison

* Replace usage of internals of color.Colors

* Refactor how constants are hidden in Colors

* Add load/save test results into json

* Simple printer of multiple results

* result_data.compare() now takes formatter as argument which handles all printing

* result_data compare() code cleanup

* Missing closing bracket in get_cfg

* Test cases now correctly process stdin

* Add option to save log as json

* Move global variable input_dir into correct module

* Add missing suites for files compiled from sources

* Compile does not crash when tags are not being stubbed

* Fix passing stdin into Popen - input is bytes instead of str

* Some tests no longer print floats

* populate: Add color support

* run_tests: Multithread support

* run_tests: Introduces option to specify number of threads to use

* get_cfg: Introduces option to specify number of threads to use

* Update README with compile.py information

* Change --lib_dir to --runtime_lib to avoid llvm version problems

* WIP: Set default compiler to clang-8

* Logs are now stored inside batch_name_cfg/logs

* Fix bug in log file filename generation

* get_cfg: If all is specified as flavor, even empty tag files are selected

* Changed run_tests.py --libc_dir to --abi_lib_dir to match mcsema-lift naming conventions

* run_test: Timeout is now set to 5sec per test

* run_tests: timeout is static attribute of BaseTest.

* run_tests: Expand grep tests

* run_tests: timeout is now logged as type of test result

* src: Add test for global ctors/dtors.

* src: Compile script can now use user-defined compilators

* run: Add runners for global ctor/dtor tests.

* compile: TAGS can now be specified as first line in src file

* src: Add TAGS to source files

* compile: Source files can now contain more complex header

* compile: Config is now responsible for whole process

* src: reflect changes in compile script

* Missing copyright header

* Add util script

* populate: Reflect changes in tags structure

* get_cfg: Replace flavors by tags to be consistent

* get_cfg: Reflect changes in tags structure

* run: Parse configs

* run: Rework lift to use class instead of random stuff everywhere

* run: Removed unittest

* run: Remove tests.py

* src: Add headers to src tests

* run: Obliterate last remnants of tests.py

* Update README to reflect changes

* Change README from plaintext to markdown

* Update .remill_commit_id

* Update .remill_commit_id
2019-10-27 18:54:22 -04:00
Peter Goodman 7d2dfe6e94 Attempt to resolve Issue #521 (#522)
* Attempt to resolve Issue #521

* minor fix

* minor fix

* minor fix

* Simplifications and comments

* If it's a copy of shared data, then don't treat it as an xref

* Error log if there is segment variable with the same name as external var

* Added flag and checks if the variable needs initialization if already defined;

* fix noreturn for the functions throwing exceptions;

* review changes

* Update get_cfg.py

* Update get_cfg.py

* Fix the recovery of exception action table chain

* Update the prebuild cfg for testsuite

* Fix entrypoint function not getting recovered in ida7

* Change the order of idc.GetFunctionName and idc.GetTrueName while looking for function name
2019-03-02 20:59:08 -05:00
artemdinaburg a2f7f0f189 Fix Issue #491 (#492)
* Update CMakeLists to look for idat64 (IDA 7+)
* Update documentation
2018-11-28 02:09:35 -05:00
kumarak 4a47d349a1 Variable recovery from debug-less binaries (#482)
* InlineAsm fails due to function type mismatch

* disable ada failing testcases;

* semi-naive approach to recover the global variables without debuginfo

* Recover the globals and generate the global proto file

* Traverse the mlil instruction and collects memory addresses read/written

* Collect the function arguments and resolve its possible values ahead of time

* Add function handler and Instruction handler; refactor the changes

* Guard amd64 specific function calls in ABI_libc

* Put a compile-time guard around amd64 specific function definitions

* extend the instructions handling

* variable recovery handle the external and internal function return values;

* remove the check for blacklist addresses

* Initial attempt at variable recovery tests. Still needs work

* Updating globals tests

* Fix up recover and test script

* added a README, easier to read output from comparisons

* Add state variable for function entry

* State initialization and update it with the function call

* Adding binary-only variable recovery tests

* C++ exception test to var recovery

* Fix argument register lookup

* mask the symbols recovered from .init/.fini sections

* impoved inter-function analysis; fix the size of variables due to wrong operand size

* fixed operand size; get segment end to fix the size of last variable

* Compare function set for memory access

* split the list to addr ref and memory refs for the variables

* Update alias set generation

* switch to llil for analysis
2018-10-15 10:21:21 -04:00
Peter Goodman fd3bce8809 Issue 395 abi libs complex numbers (#436)
* -abi-libraries can work with function returning complex types

* -abi-libraries can now work with most functions taking complex numbers

* Code style improvements

* LLVM 3.5 compatibility

* long double complex numbers are now correctly passed to external function

* Code style changes, fix of float complex return for 64bit

* Older version of llvm allow pointer to be casted to type it is pointing to

* Add option to return integers in two registers if calling convention supports it.

* Byval attribute fix, small code style changes

* Floats are now correctly unpacked from xmm

* Add test for basic calls into complex.h

* Complex number test is now C-program

* Adding new prebuilt CFGs for unit tests

* WIP: Rework. Vector type is now one of the "simple" types. Easier code structure to support vector types in external libs

* Skeleton for vector passing

* WIP: Unpolished version of remake of constrant tables. Add constraint table also for return variables

* Code style changes, some small reworks.

* Incompatible return type now ends with error message instead of crash

* Code style

* Tables with information about registers used by different calling conventions are created only once.

* Changed severity of log, default for reg vectors are now xmm

* Win64 now uses only 4 registers to transfer arguments

* Code style improvements

* CallingConventionInfo now initialize ConstraintTable/s for specific gArch

* Remove kNoArgs since ConstraintTable can now use std::vector::size()

* Fixed iteration of ext_func arguments

* 32bit can now return i64 via two registers

* Code style
2018-08-30 16:12:31 -04:00
artemdinaburg d2582c7abd Build Tests in Travis (#406)
Always generate integration tests and then run the generated integration tests travis. We get around a lack of IDA by providing pre-built CFGs for examples.

Closes #407
2018-05-22 21:13:43 -04:00
kumarak a708bafc42 InlineAsm function type mismatch (#409)
* InlineAsm fails due to function type mismatch

* disable ada failing testcases;

* Generate ABI library for integration test

* Change ArrayRef to vector; getting corrupted for llvm >= 3.9
2018-05-18 05:58:34 -04:00
kumarak fffbb0e30b Missing llvm.global_ctors from the lifted bitcode (#405)
* Check for the global ctors/dtors during ABI library unload

* Add std::terminate to std-def list

* Fix integration test
2018-04-19 22:50:02 -04:00
kumarak a3483e4bf1 C++ exception handling support (#391)
* Initial changes to parse the eh_frame and exception table

* linearly scan the function to find missing blocks

* Update protobuf format for lp; need to tag instructions or basic blocks to associate it with the lp

* tag instructions with lp; removed debug logs

* updated comments and protobuf; use utility functions for pointer size;

* travis build failure; make lp_ea optional field

* Collect the exception handling bb chunks; Create a passthrough for the lifted landingpad;

* Generate the passthrough IR and attach the landing pad with function invoke

* Generate the eh_frame/exception table and add personality function with one raising the exception.

* catch/cleanup wrapper for the exception handling; Disable CFG simplification pass temporarily for invoke inst;

* invoke wrapper to fix stack and base pointers

* recover type indices of the exception type

* fix exception table offset

* Add the function definition for setting the rsp/rpb correctly after eh return;

* Changes for abi_library support in exception handling

* Remove unwind attribute from ext_* functions to generate eh table

* Support the lifting of multiple exception types thrown;

* Fix the multiple declaration of personality function in lifted bitcode;

* Add --recover_exception flag to lift the exception table

* Update the list of external functions with c++ ABI's; Fix basic block split issue for exception chunks;

* Weak linkage for external function causing the garbage value for out_of_range destructor. Temporarily disabled;

* cleanup redundant changes and resolve conflicts

* Update --std-defs list with the c++ exception ABIs

* Fix merge fail

* exception test binaries for integration test; Move to clang++ for recompiling the bitcode.

* Fix the exception handling support for llvm 3.5

* Disable the optimization passes for the function having landingpad;

* Temporary changes to add ABI libraries for exception tests.

* Remove the noreturn attribute to fix the problem with -03 optimization

* review comment changes

* Change wrapper function name across invoke;

* review changes

* Updated comments text

* Remove duplicate clauses from the list; Add arguments for personalityfn and fix review comments.

* Update the flag name to --exception_personalityfn;

* Update the flag name to --exception_personality_func;

* Follow the variable naming convention;

* Update comments

* travis build fix for unused variable

* Create the map of type indices from original binary. Runtime routine to fix the RDX with correct type index;

* Add _Unwind_Resume to --abi_libraries functions list;

* Update comments & code restructure

* Exception handling changes and utility functions for 32 bit;

* DWORD for 32-bit system
2018-04-12 14:05:45 -04:00
artemdinaburg 7a7dc48a16 Fix Integration Tests (#394)
* Remove old documentation
* Fix cmake lists to set C/CXX compiler first, to avoid infinite loops
* Fix pthread tests
* Add documentation
* Making ADA tests work with test generator
* Strip resulting binary for cpp_construtor so it works with .init/.fini
* Looser comparison for output validation
* Update test suite with Ubuntu 14.04 CFGs for travis-ci
2018-03-29 18:26:00 -04:00
artemdinaburg 6e2e2b53d2 Integration tests work on multiuser systems (#390)
* Stop using /tmp to store files
* More verbose output about what is being executed so its easier to
  debug test failures
2018-03-28 12:39:44 -04:00
artemdinaburg 5dd79c35df Update README, Make --prefix work, check test results (#353)
* The test runner now knows about mcsema installations that aren't global

* We now check the output of the integration test suite in travis. This will cause travis to fail since we're currently failing tests

* Lots of README updates

* Use like 99% less sudo
* Better script to fix local IDA Python installations
* Support for building local installs in a virtualenv
* Remove the protobuf install that led people astray
2018-01-18 19:50:54 -05:00
kumarak b6d18e1a5f Issue 319 thread support (#343)
* Added pthread sample testcase

* Ada threading testapp

* ada testcases

* pthread testcase

* update pthread worker testcase

* update the licence header
2017-12-04 12:33:33 -08:00
kumarak 4c8387dc0e Issue 330 libc constructor crash (#335)
* Issue #330; --libc_constructor flag was producing the crashing bitcode for apache; Special case the constructor/destructor segment to lift them together as one GV;

* Testcase for the cpp constructor/destructor function

* Update test_suite generator start.py

* updated comments

* Update the comments about Issue#330, handle condition if the init_array and fini_array are not adjacent;

* Updated comments, remove non-utf character getting copied from the IDA;

* Updated command line reference

Added a brief description of the command line arguments `--libc_constructor` and `--libc_destructor`.

* review comment changes
2017-11-22 20:37:25 -05:00
Alessandro Gario a8b85fdb8a Add support for the new cxx-common and llvm35 (#320)
* Add support for the new cxx-common and llvm35

This closes #317

* Code review changes

* Code review changes
2017-11-09 14:52:10 -05:00
Alessandro Gario 6015890d14 This PR enables the XZ test (#312)
* Travis: Enable the XZ test.

* Travis: Show the clang command line when recompilation fails.
2017-11-06 13:22:50 -05:00
Alessandro Gario 406e674636 Add Travis support to the use_remill_semantics branch (#310)
* Imported the new test framework

* Added the new Travis script

* Change Ubuntu version to Xenial (16.04)

* Travis: Various fixes; also enabled CMAKE_VERBOSE_MAKEFILE

* Travis: The test binaries were being excluded by gitignore. Add clang's static analysis

* Travis: the CC and CXX variables were not being set

* Travis: Explicitly set the compiler (CMAKE_CXX_COMPILER) along with the CXX env var

* Travis: Disable the XZ test (currently broken), show the clang static analyzer summary

* Travis: Move the CI shellscript to the script folder. Add src headers

* Travis: Test a known Remill version to avoid random breakages
2017-11-05 16:18:21 -05:00
Peter Goodman 249506b571 Privatize isels instead of remove them; let the optimizer remove them. Add a flag to lift_program.py to not try to relink. This is nifty for aarch64 testsing. 2017-10-10 11:04:46 -04:00
Peter Goodman bf62bb3807 Updated the reg tracer PIN tool so that its output more closely matches the output from lifted bitcode. This required special handling of REP-prefixed instructions and thunks. This commit should fix issue #285. Added some checks to avoid treating certain kinds of data embedded in code sections as code. This came up with some windows DLLs. Played around with the reference-adding and string-adding heuristics. The most recent SQLite3 bug was due to a reference being added where it shouldn't have been. SQLite3's .databases command still does not do the right thing, though. 2017-09-15 00:54:31 -04:00
Peter Goodman dd517bebe6 Added two nifty tools, one for automating the process of lifting and recompiling a single binary, whilst also spitting out shell commands that can replicate the process, and another for applying the lifting program in parallel to a directory containing binaries. 2017-08-31 19:21:13 -04:00
Peter Goodman 93b4aa56b4 WIP. Modified license to apache 2.0 to follow remill, also most code is new anyway. 2017-04-15 16:27:35 -04:00
artemdinaburg d72596cafe Adding netcat test to integration tests (#207)
* add netcat test
* update test scripts to escape displayed command lines
* new defs for Linux
* add libbsd-dev to bootstrap so we can rebuild netcat
* add some forgotten ELF files to git
2017-03-23 10:34:02 -04:00
artemdinaburg 2bd0259485 Externally specify semantics definitions (#205)
Main updates:

* Externally specify semantics definitions (see Arch/X86/Semantics/Bitcode/)
* Add the CMake glue to automatically build them into one giant bitcode library
* Create helper functions and macros (e.g. EXTERNAL_SEMANTICS) to specify that a semantic is externally defined
* Use FXAM as an example instruction where we do external semantics
* Add gzip to the integration tests because it hits the new FXAM code

Incidental fixes:

Add SUB64mi32 and SBB64mi32 to the translation map
Remove dependency on MCSEMA_DIR and use CMAKE_SOURCE_DIR
2017-03-21 12:24:09 -04:00
artemdinaburg b566ab9adb Runtime to lib (#199)
* Working on Issue #184. Sort of have the linux runtimes compiling to archives with CMake, though there are some issues with the test cases all breaking.

* Initial attempt at better windows bootstrap

* Lower build requirements to Win7 and VS2013

* Fix Linux runtime lib generation

* A tiny bit of cleanup before attempting to build Windows libraries

* Bootstrap with clang on Windows

* Win32 libs now building, still need to test Win64 and Linux

* Fix Linux build

* Fix bootstrap & build for Win64

* Update ls.cfg

* Update README.md

Updating Windows installation requirements

* Updating documentation to reflect new build command lines
2017-03-20 13:20:06 -04:00
artemdinaburg 0b60a39c19 Add .: (#196)
integration_test.py
libFuzzer
linux

./libFuzzer:
buildFuzzer.sh
crash-9991751ea97f13a1b7eeeb9e54c69be96cc782f7
driver.cc
FuzzerCrossOver.o
FuzzerDriver.o
FuzzerInterface.o
FuzzerIO.o
FuzzerLoop.o
FuzzerMain.o
FuzzerMutate.o
FuzzerSanitizerOptions.o
FuzzerSHA1.o
FuzzerTraceState.o
FuzzerUtil.o
fuzzme.bc
fuzzme.cc
fuzzme.cfg
fuzzme.log
README.md

./linux:
amd64
generate_expected_output.py
hello.c
lodsb.c
Makefile
stringpool.c
switch.c
x86

./linux/amd64:
config.json
expected_outputs.json
hello.cfg
hello.elf
lodsb.cfg
lodsb.elf
ls.cfg
ls.elf
stringpool.cfg
stringpool.elf
switch.cfg
switch.elf
xz.cfg
xz.elf

./linux/x86:
config.json
expected_outputs.json
hello.cfg
hello.elf
lodsb.cfg
lodsb.elf
stringpool.cfg
stringpool.elf
switch.cfg
switch.elf test to integrated tests
2017-03-15 18:12:51 -04:00
artemdinaburg 1ef32c088e Add tests for translating xz (#187)
* Add tests to test translation of `xz`
* Add two new entries to the linux defs file
* Update testing scripts to run shell commands and record output
* Add liblzma-dev to bootstrap so we can re-link translated `xz`
2017-03-13 22:09:19 -04:00
artemdinaburg bf3dfac419 Fix combined string data refs (#182)
* Fix string pooling data reference issues

* Be more liberal about what we consider valid data references
* This fixes #108
* Update Makefile to clean CFGs we generate from ELFs
* Update integration tests to run the `ls` test

* Turn debug back off for integration test
2017-03-10 22:23:09 -05:00
artemdinaburg 98cc56cdd1 Show how to use mcsema with libFuzzer (#176)
* Guide for using libFuzzer with mcsema
* Show where to find docs from the libFuzzer directory
* Updating global README
2017-03-10 14:16:17 -05:00
josh2059 aa50010f8d LODSB and SCASB implementations (#143)
* making the MOV32ri handler work for MOV32ri_alt as well
* implementing the LODS instruction
* Add an integration test that uses lodsb
* calling doScas() when scas without a prefix happen
* Add some scasb to the lodsb test
2017-03-07 00:50:18 -05:00
artemdinaburg 94824aff78 Document How To Add Integration Tests (#126)
* Integration Test Documentation

* Document how to add a new test to the integeration test framework
* Add the `switch` test as a part of the documentation process

* Missed some files

* Fixing documentation links

* Updating version info in Adding A New Test guide
2017-03-06 19:51:56 -05:00
artemdinaburg bf6e76065c Enable 32-bit input tests (#125)
* Fix bootstrap to correctly build 32-bit code (by adding `-m32`)
* Enable 32-bit input tests
* Add g++-multilib prerequisite
2017-03-04 02:37:18 -05:00
artemdinaburg 69b7b3d562 Enable validation of program output in integration tests (#124)
* Add scripts to generate ground truth for program outputs
* Enable program output validation for integration tests
2017-03-03 19:21:00 -05:00
artemdinaburg a471e2a55a Prefix support for mcsema-disass (#120) (#123)
* Prefix support in bootstrap.sh
* Use the new location as a default in the tests Makefile
2017-03-03 14:21:57 -05:00
artemdinaburg 0c8e47657d Integration Test Updates (#122)
Updating integration tests. Slowly addressing #94 .

* Added a simple string pool example and /bin/ls
* Tests all the way up to recompilation of translated bitcode
* Added travis caching to avoid rebuilds of LLVM. Builds now take ~half the time.
* bootstrap now installs gcc-multilib to do 32-bit integration tests
2017-03-02 19:29:47 -05:00