mirror of
https://github.com/lifting-bits/mcsema
synced 2026-06-08 15:31:09 +00:00
Kuan-Yen Chou
372a3fcea4
The x86 and x86_64 binaries are re-compiled with clang-10 from the
vcpkg, cxx-common libraries, because KLEE would fail with segfault if
the LLVM bitcode is lifted from binaries compiled with GCC (10.2.0). It
may be worth looking into why KLEE fails with the bitcodes lifted from
GCC compiled binaries in this case.
The AArch64 binary is re-compiled with aarch64-linux-gnu-gcc (10.2.0),
but mcsema-lift-10.0 fails with the following message.
```
F1228 23:41:38.079257 120074 Analyze.cpp:491] Check failed: dest_size < 64u (64 vs. 64)
*** Check failure stack trace: ***
@ 0x11601cc google::LogMessageFatal::~LogMessageFatal()
@ 0x785c3c anvill::XrefExprFolder::VisitTrunc()
@ 0x786108 anvill::XrefExprFolder::VisitICmp()
@ 0x660113 mcsema::(anonymous namespace)::LowerXrefs()::$_1::operator()()
@ 0x65b388 mcsema::(anonymous namespace)::LowerXrefs()
@ 0x65a458 mcsema::OptimizeModule()
@ 0x657bdc mcsema::LiftCodeIntoModule()
@ 0x66e9ee main
@ 0x7ffb0e016152 __libc_start_main
@ 0x61bafe _start
@ (nil) (unknown)
```
I have not tried compiling the AArch64 binary with clang
(`-target aarch64-linux-gnu`). It may be worth trying and see if the
resulting bitcode works with KLEE.
18 lines
839 B
Diff
18 lines
839 B
Diff
diff --git a/lib/Core/Executor.cpp b/lib/Core/Executor.cpp
|
|
index e3186bbf..2eca8d91 100644
|
|
--- a/lib/Core/Executor.cpp
|
|
+++ b/lib/Core/Executor.cpp
|
|
@@ -2096,7 +2096,11 @@ void Executor::executeInstruction(ExecutionState &state, KInstruction *ki) {
|
|
// checking the type, since C defaults to returning int for
|
|
// undeclared functions.
|
|
if (!caller->use_empty()) {
|
|
- terminateStateOnExecError(state, "return void when caller expected a result");
|
|
+ result = ConstantExpr::alloc(0, Expr::Int64);
|
|
+ bindLocal(kcaller, state, result);
|
|
+ klee_warning("Injected fake return for function: %s",
|
|
+ ri->getFunction()->getName().str().c_str());
|
|
+ //terminateStateOnExecError(state, "return void when caller expected a result");
|
|
}
|
|
}
|
|
}
|