aboutsummaryrefslogtreecommitdiff
path: root/instrumentation
diff options
context:
space:
mode:
authorvan Hauser <vh@thc.org>2021-01-22 13:50:16 +0100
committervan Hauser <vh@thc.org>2021-01-22 13:50:16 +0100
commit46010a87049bdf32ef23b08d25c186aba3aae442 (patch)
treeaec7b30077dedc5f63fcc04b05c1b889133894a8 /instrumentation
parentac21e4dd7304c3306a9acb5fa6ac051d3ab64b20 (diff)
downloadAFLplusplus-46010a87049bdf32ef23b08d25c186aba3aae442.tar.gz
prepare for cmplog rtn std::string support for llvm and g++
Diffstat (limited to 'instrumentation')
-rw-r--r--instrumentation/afl-compiler-rt.o.c65
-rw-r--r--instrumentation/cmplog-routines-pass.cc5
2 files changed, 70 insertions, 0 deletions
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 14da4caa..322141ba 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1594,6 +1594,71 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
}
+// gcc libstdc++
+// _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7compareEPKc
+static u8 *get_gcc_stdstring(u8 *string) {
+
+ u32 *len = (u32 *)(string + 8);
+
+ if (*len < 16) { // in structure
+
+ return (string + 16);
+
+ } else { // in memory
+
+ u8 **ptr = (u8 **)string;
+ return (*ptr);
+
+ }
+
+}
+
+// llvm libc++ _ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocator
+// IcEEE7compareEmmPKcm
+static u8 *get_llvm_stdstring(u8 *string) {
+
+ // length is in: if ((string[0] & 1) == 0) u8 len = (string[0] >> 1);
+ // or: if (string[0] & 1) u32 *len = (u32 *) (string + 8);
+
+ if (string[0] & 1) { // in memory
+
+ u8 **ptr = (u8 **)(string + 16);
+ return (*ptr);
+
+ } else { // in structure
+
+ return (string + 1);
+
+ }
+
+}
+
+void __cmplog_rtn_gcc_stdstring_cstring(u8 *stdstring, u8 *cstring) {
+
+ __cmplog_rtn_hook(get_gcc_stdstring(stdstring), cstring);
+
+}
+
+void __cmplog_rtn_gcc_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
+
+ __cmplog_rtn_hook(get_gcc_stdstring(stdstring1),
+ get_gcc_stdstring(stdstring2));
+
+}
+
+void __cmplog_rtn_llvm_stdstring_cstring(u8 *stdstring, u8 *cstring) {
+
+ __cmplog_rtn_hook(get_llvm_stdstring(stdstring), cstring);
+
+}
+
+void __cmplog_rtn_llvm_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
+
+ __cmplog_rtn_hook(get_llvm_stdstring(stdstring1),
+ get_llvm_stdstring(stdstring2));
+
+}
+
/* COVERAGE manipulation features */
// this variable is then used in the shm setup to create an additional map
diff --git a/instrumentation/cmplog-routines-pass.cc b/instrumentation/cmplog-routines-pass.cc
index e92883ae..8adf42d5 100644
--- a/instrumentation/cmplog-routines-pass.cc
+++ b/instrumentation/cmplog-routines-pass.cc
@@ -131,6 +131,11 @@ bool CmpLogRoutines::hookRtns(Module &M) {
FunctionType *FT = Callee->getFunctionType();
+ // _ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm
+ // => libc++ => llvm => __cmplog_rtn_llvm_stdstring_cstring(u8 *stdstring1, u8 *stdstring2)
+ // _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7compareEPKc
+ // => libstdc++ => gcc => __cmplog_rtn_gcc_stdstring_cstring
+
bool isPtrRtn = FT->getNumParams() >= 2 &&
!FT->getReturnType()->isVoidTy() &&
FT->getParamType(0) == FT->getParamType(1) &&