Adventures in Fuzzing Instruction Selection. 1 EuroLLVM 2017 Justin Bogner
|
|
|
- Karin Stanley
- 6 years ago
- Views:
Transcription
1 Adventures in Fuzzing Instruction Selection 1 EuroLLVM 2017 Justin Bogner
2 Overview Hardening instruction selection using fuzzers Motivated by Global ISel Leveraging libfuzzer to find backend bugs Techniques applicable to other parts of LLVM 2 Fuzzing Instruction Selection EuroLLVM 2017
3 Fuzzing Recap Using random inputs to find bugs Input generation Mutations of representative inputs Guided evolutionary fuzzing (afl-fuzz, libfuzzer) 3 Fuzzing Instruction Selection EuroLLVM 2017
4 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } 4 Fuzzing Instruction Selection EuroLLVM 2017
5 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } > 0 'H' > 1 Corpus 'i' > 2 '!' 5 Fuzzing Instruction Selection EuroLLVM 2017
6 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } Unit: <empty> Mutations: q Corpus > 0 'H' > 1 'i' > 2 '!' 6 Fuzzing Instruction Selection EuroLLVM 2017
7 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } Unit: <empty> Mutations: q Corpus q > 0 'H' > 1 'i' > 2 '!' 7 Fuzzing Instruction Selection EuroLLVM 2017
8 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } Unit: <empty> Mutations: q X 7 y Corpus q > 0 'H' > 1 'i' > 2 '!' 8 Fuzzing Instruction Selection EuroLLVM 2017
9 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } Unit: q Mutations: qz y Corpus q > 0 'H' > 1 'i' > 2 '!' 9 Fuzzing Instruction Selection EuroLLVM 2017
10 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } Unit: q Mutations: qz y H Corpus q > 0 'H' > 1 'i' > 2 '!' 10 Fuzzing Instruction Selection EuroLLVM 2017
11 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } Unit: q Mutations: qz y H qm Corpus > 0 'H' > 1 'i' H q > 2 '!' 11 Fuzzing Instruction Selection EuroLLVM 2017
12 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } Unit: H Mutations: HF Corpus > 0 'H' > 1 'i' H q > 2 '!' 12 Fuzzing Instruction Selection EuroLLVM 2017
13 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } Unit: H Mutations: HF Hi Corpus > 0 'H' > 1 'i' H q HF > 2 '!' 13 Fuzzing Instruction Selection EuroLLVM 2017
14 libfuzzer extern "C" int LLVMFuzzerTestOneInput( const uint8_t *Data, size_t Size) { if (Size > 0 && Data[0] == 'H') if (Size > 1 && Data[1] == 'i') if (Size > 2 && Data[2] == '!') exit(0); return 0; } Unit: Hi Mutations: Hh xi HiR Hi! Corpus > 0 'H' > 1 'i' H q HF > 2 HiR '!' 14 Fuzzing Instruction Selection EuroLLVM 2017
15 Fuzzers in LLVM clang-fuzzer clang-format-fuzzer llvm-as-fuzzer llvm-mc-fuzzer... but no llc-fuzzer 15 Fuzzing Instruction Selection EuroLLVM 2017
16 Beyond Parser Bugs static void g(){} signed*qwchar_t; overridedouble++!=~;inline-=}y=^bitand{;*=or;goto*&&k}==n int XS/=~char16_t&s<=const_cast<Xchar*>(thread_local3+=char32_t 16 Fuzzing Instruction Selection EuroLLVM 2017
17 Beyond Parser = global i8 addrspace(1)*@0 = private constant i32 = private constant i32 = private @a = ad private aeflias internal h2dden ction() { entry: ret void }pac e(1) global i Fuzzing Instruction Selection EuroLLVM 2017
18 Structured Fuzzing e f define b 0a a 0a c d 20 6c {.BB:. %L2 = l f c a e oad i1, i1* unde f c a e oad i8, i8* unde a c c f. br label %BB a 0a a 0a c d BB9:. %L6 = c 6f c a e 64 load i1, i1* und c 6f c a e 64 load i8, i8* und a d ef. %B8 = sdiv c 36 2c c 32 0a i1 %L6, %L2. %A c 36 2c c 32 0a i8 %L6, %L2. %A d c 6c 6f c 6f = alloca float a d c 6c 6f %A4 = alloca 18 Fuzzing Instruction Selection EuroLLVM 2017
19 Structured Fuzzing e f define b 0a a 0a c d 20 6c {.BB:. %L2 = l f c a e oad i1, i1* unde f c a e oad i8, i8* unde a c c f. br label %BB a 0a a 0a c d BB9:. %L6 = c 6f c a e 64 load i1, i1* und c 6f c a e 64 load i8, i8* und a d ef. %B8 = sdiv c 36 2c c 32 0a i1 %L6, %L2. %A c 36 2c c 32 0a i8 %L6, %L2. %A d c 6c 6f c 6f = alloca float a d c 6c 6f %A4 = alloca 19 Fuzzing Instruction Selection EuroLLVM 2017
20 Structured Fuzzing e f define b 0a a 0a c d 20 6c {.BB:. %L2 = l f c a e oad i1, i1* unde f c a e oad i8, i8* unde a c c f. br label %BB a 0a a 0a c d BB9:. %L6 = c 6f c a e 64 load i1, i1* und c 6f c a e 64 load i8, i8* und a d ef. %B8 = sdiv c 36 2c c 32 0a i1 %L6, %L2. %A c 36 2c c 32 0a i8 %L6, %L2. %A d c 6c 6f c 6f = alloca float a d c 6c 6f %A4 = alloca 20 Fuzzing Instruction Selection EuroLLVM 2017
21 Custom Mutator API // Optional user-provided custom mutator. // Mutates raw data in [Data, Data+Size) inplace. // Returns the new size, which is not greater than MaxSize. // Given the same Seed produces the same mutation. size_t LLVMFuzzerCustomMutator(uint8_t *Data, size_t Size, size_t MaxSize, unsigned int Seed); 21 Fuzzing Instruction Selection EuroLLVM 2017
22 Where to Mutate? Frontend IR IR/opt passes Selection Entry Point MIR Machine passes Assembly 22 Fuzzing Instruction Selection EuroLLVM 2017
23 llvm-stress Random IR generator Used for new backends and FastISel Excellent for bringup, forgotten later 23 Fuzzing Instruction Selection EuroLLVM 2017
24 LLVM IR Mutator Work in terms of operations on SSA values Each operation has sources and a sink Sinks should be side effects to avoid dead code It's safe to disconnect sinks and DCE at will 24 Fuzzing Instruction Selection EuroLLVM 2017
25 Adding one operation Divide a block into potential sources and sinks Choose or create one source Choose an operation Fill in the other sources define { BB: %L1 = load i16, i16* undef %L2 = load i16, i16* undef %B1 = lshr i16 %L1, %L2 store i16 %B1, i16* undef ret void } Steal an argument of a later operation as a sink Clean up dead code 25 Fuzzing Instruction Selection EuroLLVM 2017
26 Adding one operation Divide a block into potential sources and sinks Choose or create one source define { BB: %L1 = load i16, i16* undef %L2 = load i16, i16* undef Choose an operation Fill in the other sources Steal an argument of a later operation as a sink Clean up dead code } %B1 = lshr i16 %L1, %L2 store i16 %B1, i16* undef ret void 26 Fuzzing Instruction Selection EuroLLVM 2017
27 Adding one operation Divide a block into potential sources and sinks Choose or create one source define { BB: %L1 = load i16, i16* undef %L2 = load i16, i16* undef Choose an operation Fill in the other sources Steal an argument of a later operation as a sink Clean up dead code } %B1 = lshr i16 %L1, %L2 store i16 %B1, i16* undef ret void 27 Fuzzing Instruction Selection EuroLLVM 2017
28 Adding one operation Divide a block into potential sources and sinks Choose or create one source Choose an operation Fill in the other sources define { BB: %L1 = load i16, i16* undef %L2 = load i16, i16* undef %B2 = add i16 %L1,? %B1 = lshr i16 %L1, %L2 store i16 %B1, i16* undef ret void } Steal an argument of a later operation as a sink Clean up dead code 28 Fuzzing Instruction Selection EuroLLVM 2017
29 Adding one operation Divide a block into potential sources and sinks Choose or create one source Choose an operation Fill in the other sources define { BB: %L1 = load i16, i16* undef %L2 = load i16, i16* undef %B2 = add i16 %L1, %L1 %B1 = lshr i16 %L1, %L2 store i16 %B1, i16* undef ret void } Steal an argument of a later operation as a sink Clean up dead code 29 Fuzzing Instruction Selection EuroLLVM 2017
30 Adding one operation Divide a block into potential sources and sinks Choose or create one source Choose an operation Fill in the other sources define { BB: %L1 = load i16, i16* undef %L2 = load i16, i16* undef %B2 = add i16 %L1, %L1 %B1 = lshr i16 %L1, %L2 store i16 %B1, i16* undef ret void } Steal an argument of a later operation as a sink Clean up dead code 30 Fuzzing Instruction Selection EuroLLVM 2017
31 Adding one operation Divide a block into potential sources and sinks Choose or create one source Choose an operation Fill in the other sources define { BB: %L1 = load i16, i16* undef %L2 = load i16, i16* undef %B2 = add i16 %L1, %L1 %B1 = lshr i16 %L1, %B2 store i16 %B1, i16* undef ret void } Steal an argument of a later operation as a sink Clean up dead code 31 Fuzzing Instruction Selection EuroLLVM 2017
32 Adding one operation Divide a block into potential sources and sinks Choose or create one source Choose an operation Fill in the other sources define { BB: %L1 = load i16, i16* undef %B2 = add i16 %L1, %L1 %B1 = lshr i16 %L1, %B2 store i16 %B1, i16* undef ret void } Steal an argument of a later operation as a sink Clean up dead code 32 Fuzzing Instruction Selection EuroLLVM 2017
33 Splitting Blocks BB: %L7 = load i1, i1* undef br label %BB5 BB: %L7 = load i1, i1* undef br label %BB5 BB5: %L6 = load i1, i1* undef %B8 = sdiv i1 %L6, %L7 %A7 = alloca float %A4 = alloca float %L5 = load float, float* %A4 %A1 = alloca float %L3 = load float, float* %A1 %L1 = load i32, i32* undef %B6 = frem float %L3, %L5 %A = alloca i32 %L = load i32, i32* %A %B = xor i32 %L, %L1 %B1 = xor i32 %B, %B store i32 %B1, i32* %A store float %B6, float* %A7 store i1 %B8, i1* undef ret void BB5: %L6 = load i1, i1* undef %B8 = sdiv i1 %L6, %L7 %A7 = alloca float %A4 = alloca float br i1 %B8, label %BB5, label %BB1 BB1: %L5 = load float, float* %A4 %A1 = alloca float %L3 = load float, float* %A1 %L1 = load i32, i32* undef %B6 = frem float %L3, %L5 %A = alloca i32 %L = load i32, i32* %A %B = xor i32 %L, %L1 %B1 = xor i32 %B, %B store i32 %B1, i32* %A store float %B6, float* %A7 store i1 %B8, i1* undef ret void 33 Fuzzing Instruction Selection EuroLLVM 2017
34 Removing Code Probability of removal Ideal Size Size of Bitcode 70% 90% Max 34 Fuzzing Instruction Selection EuroLLVM 2017
35 Finding Bugs By Sffubs (Own work) [CC BY-SA 3.0] via Wikimedia Commons 35 Fuzzing Instruction Selection EuroLLVM 2017
36 Correctness Checks Garbage in, garbage out Comparing instruction selectors Semantics-preserving mutations 36 Fuzzing Instruction Selection EuroLLVM 2017
37 Mutation Library Legal types are configurable New operations follow a simple interface Mix and match the operations you want 37 Fuzzing Instruction Selection EuroLLVM 2017
38 Mutation Library MutationStrategy Inject Modify Add Remove FSub SplitBlock Fuzzing Instruction Selection EuroLLVM 2017
39 Results Found various AArch64 GlobalISel bugs SelectionDAG is surprisingly hard to crash Test your own backends today IR mutator library available for other fuzzers 39 Fuzzing Instruction Selection EuroLLVM 2017
40 Questions? 40 Fuzzing Instruction Selection EuroLLVM 2017
41 41 Fuzzing Instruction Selection EuroLLVM 2017
KLEE Workshop Feeding the Fuzzers. with KLEE. Marek Zmysłowski MOBILE SECURITY TEAM R&D INSTITUTE POLAND
Feeding the Fuzzers with KLEE Marek Zmysłowski MOBILE SECURITY TEAM R&D INSTITUTE POLAND This presentation was created with help and commitment of the Samsung R&D Poland Mobile Security team. KLEE and
GlobalISel LLVM s Latest Instruction Selection Framework
GlobalISel LLVM s Latest Instruction Selection Framework Diana Picuş Instruction Selection Target-independent IR ISel Machine-dependent IR 2 Instruction Selection LLVM IR define i32 @(i32 %a, i32 %b) {
Structure-aware fuzzing
Structure-aware fuzzing for real-world projects Réka Kovács Eötvös Loránd University, Hungary rekanikolett@gmail.com 1 Overview tutorial, no groundbreaking discoveries Motivation growing code size -> growing
INTRODUCTION TO LLVM Bo Wang SA 2016 Fall
INTRODUCTION TO LLVM Bo Wang SA 2016 Fall LLVM Basic LLVM IR LLVM Pass OUTLINE What is LLVM? LLVM is a compiler infrastructure designed as a set of reusable libraries with well-defined interfaces. Implemented
15-411: LLVM. Jan Hoffmann. Substantial portions courtesy of Deby Katz
15-411: LLVM Jan Hoffmann Substantial portions courtesy of Deby Katz and Gennady Pekhimenko, Olatunji Ruwase,Chris Lattner, Vikram Adve, and David Koes Carnegie What is LLVM? A collection of modular and
Coverage-guided Fuzzing of Individual Functions Without Source Code
Coverage-guided Fuzzing of Individual Functions Without Source Code Alessandro Di Federico Politecnico di Milano October 25, 2018 1 Index Coverage-guided fuzzing An overview of rev.ng Experimental results
LLVM, Clang and Embedded Linux Systems. Bruno Cardoso Lopes University of Campinas
LLVM, Clang and Embedded Linux Systems Bruno Cardoso Lopes University of Campinas What s LLVM? What s LLVM Compiler infrastructure Frontend (clang) IR Optimizer Backends JIT Tools Assembler Disassembler
Tutorial: Building a backend in 24 hours. Anton Korobeynikov
Tutorial: Building a backend in 24 hours Anton Korobeynikov anton@korobeynikov.info Outline 1. From IR to assembler: codegen pipeline 2. MC 3. Parts of a backend 4. Example step-by-step The Pipeline LLVM
Apple LLVM GPU Compiler: Embedded Dragons. Charu Chandrasekaran, Apple Marcello Maggioni, Apple
Apple LLVM GPU Compiler: Embedded Dragons Charu Chandrasekaran, Apple Marcello Maggioni, Apple 1 Agenda How Apple uses LLVM to build a GPU Compiler Factors that affect GPU performance The Apple GPU compiler
libfuzzer Kostya Serebryany May 2016
libfuzzer Kostya Serebryany May 2016 Dynamic Tools @ Google Sanitizers (dynamic bug detectors) AddressSanitizer (ASan) + LeakSanitizer (LSan) ThreadSanitizer (TSan) MemorySanitizer (MSan)
A Translation Framework for Automatic Translation of Annotated LLVM IR into OpenCL Kernel Function
A Translation Framework for Automatic Translation of Annotated LLVM IR into OpenCL Kernel Function Chen-Ting Chang, Yu-Sheng Chen, I-Wei Wu, and Jyh-Jiun Shann Dept. of Computer Science, National Chiao
LLVM and IR Construction
LLVM and IR Construction Fabian Ritter based on slides by Christoph Mallon and Johannes Doerfert http://compilers.cs.uni-saarland.de Compiler Design Lab Saarland University 1 Project Progress source code
Tutorial: Building a backend in 24 hours. Anton Korobeynikov
Tutorial: Building a backend in 24 hours Anton Korobeynikov anton@korobeynikov.info Outline 1. Codegen phases and parts 2. The Target 3. First steps 4. Custom lowering 5. Next steps Codegen Phases Preparation
Fuzzing AOSP. AOSP for the Masses. Attack Android Right Out of the Box Dan Austin, Google. Dan Austin Google Android SDL Research Team
Fuzzing AOSP For the Masses AOSP for the Masses Attack Android Right Out of the Box Dan Austin, Google Dan Austin Google Android SDL Research Team Exploitation: Find the Needle Needles are Interesting
Getting started. Roel Jordans
Getting started Roel Jordans Goal Translate a program from a high level language into something the processor can execute efficiently So before we start we need to know how this processor executes a program
Lecture 3 Overview of the LLVM Compiler
Lecture 3 Overview of the LLVM Compiler Jonathan Burket Special thanks to Deby Katz, Gennady Pekhimenko, Olatunji Ruwase, Chris Lattner, Vikram Adve, and David Koes for their slides The LLVM Compiler Infrastructure
LLVM & LLVM Bitcode Introduction
LLVM & LLVM Bitcode Introduction What is LLVM? (1/2) LLVM (Low Level Virtual Machine) is a compiler infrastructure Written by C++ & STL History The LLVM project started in 2000 at the University of Illinois
Assignment 1c: Compiler organization and backend programming
Assignment 1c: Compiler organization and backend programming Roel Jordans 2016 Organization Welcome to the third and final part of assignment 1. This time we will try to further improve the code generation
LDC: The LLVM-based D Compiler
LDC: The LLVM-based D Compiler Using LLVM as backend for a D compiler Kai Nacke 02/02/14 LLVM devroom @ FOSDEM 14 Agenda Brief introduction to D Internals of the LDC compiler Used LLVM features Possible
A Brief Introduction to Using LLVM. Nick Sumner
A Brief Introduction to Using LLVM Nick Sumner What is LLVM? A compiler? (clang) What is LLVM? A compiler? (clang) A set of formats, libraries, and tools. What is LLVM? A compiler? (clang) A set of formats,
ECE 5775 (Fall 17) High-Level Digital Design Automation. Static Single Assignment
ECE 5775 (Fall 17) High-Level Digital Design Automation Static Single Assignment Announcements HW 1 released (due Friday) Student-led discussions on Tuesday 9/26 Sign up on Piazza: 3 students / group Meet
Getting started with LLVM using Swift. Alex Denisov,
Getting started with LLVM using Swift Alex Denisov, http://lowlevelbits.org whoami ios Apps Developer Compiler Hobbyist Internet User: https://twitter.com/1101_debian https://github.com/alexdenisov http://lowlevelbits.org
Lecture 2 Overview of the LLVM Compiler
Lecture 2 Overview of the LLVM Compiler Abhilasha Jain Thanks to: VikramAdve, Jonathan Burket, DebyKatz, David Koes, Chris Lattner, Gennady Pekhimenko, and Olatunji Ruwase, for their slides The LLVM Compiler
It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to
1 2 It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to keep putting garbage characters into the command
Lecture 3 Overview of the LLVM Compiler
LLVM Compiler System Lecture 3 Overview of the LLVM Compiler The LLVM Compiler Infrastructure - Provides reusable components for building compilers - Reduce the time/cost to build a new compiler - Build
Hardening the C++ Standard Template Library
Hardening the C++ Standard Template Library Marshall Clow Qualcomm Euro LLVM, April 17, 2018 Marshall Clow (Qualcomm) Hardening the C++ Standard Template Library Euro LLVM, April 17, 2018 1 / 16 About
Introduction to LLVM. UG3 Compiling Techniques Autumn 2018
Introduction to LLVM UG3 Compiling Techniques Autumn 2018 Contact Information Instructor: Aaron Smith Email: aaron.l.smith@ed.ac.uk Office: IF 1.29 TA for LLVM: Andrej Ivanis Email: andrej.ivanis@ed.ac.uk
Getting Started with LLVM The TL;DR Version. Diana Picus
Getting Started with LLVM The TL;DR Version Diana Picus Please read the docs! http://llvm.org/docs/ 2 What This Talk Is About The LLVM IR(s) The LLVM codebase The LLVM community Committing patches LLVM
Writing a fuzzer. for any language with american fuzzy lop. Ariel Twistlock Labs
Writing a fuzzer for any language with american fuzzy lop Ariel Zelivansky @ Twistlock Labs What is fuzzing? Technique for testing software by providing it with random, unexpected or invalid input Dumb
PTX Back-End: GPU Programming with LLVM
PTX Back-End: GPU Programming with LLVM Justin Holewinski The Ohio State University LLVM Developer's Meeting November 18, 2011 Justin Holewinski (Ohio State) PTX Back-End Nov. 18, 2011 1 / 37 Outline PTX
数理 計算科学特論 C プログラミング言語処理系の最先端実装技術 LLVM Compiler Framework
数理 計算科学特論 C プログラミング言語処理系の最先端実装技術 LLVM Compiler Framework What is LLVM? LLVM is an open-source compiler infrastructure (e.g. COINS, Eclipse OMR): Its official page says: The LLVM Project is a collection
Plan for Today. Concepts. Next Time. Some slides are from Calvin Lin s grad compiler slides. CS553 Lecture 2 Optimizations and LLVM 1
Plan for Today Quiz 2 How to automate the process of performance optimization LLVM: Intro to Intermediate Representation Loops as iteration spaces Data-flow Analysis Intro Control-flow graph terminology
Welcome to the Back End: The LLVM Machine Representation. Matthias Braun, Apple
Welcome to the Back End: The LLVM Machine Representation Matthias Braun, Apple Program Representations Source Code AST Front-end LLVM IR Machine Independent Optimization Selection DAG Instruction Selection
OptiCode: Machine Code Deobfuscation for Malware Analysis
OptiCode: Machine Code Deobfuscation for Malware Analysis NGUYEN Anh Quynh, COSEINC CONFidence, Krakow - Poland 2013, May 28th 1 / 47 Agenda 1 Obfuscation problem in malware analysis
Constant-time programming in C
Constant-time programming in C What s our goal? Goal: Write C programs that don t leak sensitive data Assumption: no explicit leaks E.g., writing secret data to public location Approach: constant-time
Secure Software Development: Theory and Practice
Secure Software Development: Theory and Practice Suman Jana MW 2:40-3:55pm 415 Schapiro [SCEP] *Some slides are borrowed from Dan Boneh and John Mitchell Software Security is a major problem! Why writing
Copyright 2015 MathEmbedded Ltd.r. Finding security vulnerabilities by fuzzing and dynamic code analysis
Finding security vulnerabilities by fuzzing and dynamic code analysis Security Vulnerabilities Top code security vulnerabilities don t change much: Security Vulnerabilities Top code security vulnerabilities
VUzzer: Application-Aware Evolutionary Fuzzing
VUzzer: Application-Aware Evolutionary Fuzzing Sanjay Rawat, Vivek Jain, Ashish Kumar, Lucian Cocojar, Cristiano Giuffrida, Herbert Bos (Presenter: Dennis Andriesse ) Vrije Universiteit Amsterdam IIIT
Targeting LLVM IR. LLVM IR, code emission, assignment 4
Targeting LLVM IR LLVM IR, code emission, assignment 4 LLVM Overview Common set of tools & optimizations for compiling many languages to many architectures (x86, ARM, PPC, ASM.js). Integrates AOT & JIT
Testing, Fuzzing, & Symbolic Execution
Testing, Fuzzing, & Symbolic Execution Software Testing The most common way of measuring & ensuring correctness Input 2 Software Testing The most common way of measuring & ensuring correctness Input Observed
The structure of LLVM backends
The structure of LLVM backends Dr. Norman A. Rink Tenise Universität Dresden, Germany norman.rink@tu-dresden.de Bloomberg Clang/LLVM Sprint Weekend 6-7 February 2016 London, England Introduction int kernel(int
LLVM IR Code Generations Inside YACC. Li-Wei Kuo
LLVM IR Code Generations Inside YACC Li-Wei Kuo LLVM IR LLVM code representation In memory compiler IR (Intermediate Representation) On-disk bitcode representation (*.bc) Human readable assembly language
An LLVM Back-end for MLton
An LLVM Back-end for MLton by Brian Andrew Leibig A Project Report Submitted in Partial Fulfillment of the Requirements for the Degree of Master of Science in Computer Science Supervised by Dr. Matthew
Inception: System-Wide Security Testing of Real- World Embedded Systems Software Nassim Corteggiani (Maxim Integrated / EURECOM) Giovanni Camurati
Inception: System-Wide Security Testing of Real- World Embedded Systems Software Nassim Corteggiani (Maxim Integrated / EURECOM) Giovanni Camurati (EURECOM) Aurélien Francillon (EURECOM) 08/15/18 Embedded
3.Constructors and Destructors. Develop cpp program to implement constructor and destructor.
3.Constructors and Destructors Develop cpp program to implement constructor and destructor. Constructors A constructor is a special member function whose task is to initialize the objects of its class.
CHANDLER CARRUTH LLVM DEVMTG 2014 THE LLVM PASS MANAGER PART 2
CHANDLER CARRUTH LLVM DEVMTG 2014 THE LLVM PASS MANAGER PART 2 FROM THE PREVIOUS TALK: A pass operates on some unit of IR (Function, Module, ) Generally to transform it from one form to another Alternatively
Lecture 6 More on the LLVM Compiler
Lecture 6 More on the LLVM Compiler Jonathan Burket Special thanks to Deby Katz, Luke Zarko, and Gabe Weisz for their slides Visualizing the LLVM Compiler System C C++ Java Source Code Clang (Front End)
Expressing high level optimizations within LLVM. Artur Pilipenko
Expressing high level optimizations within LLVM Artur Pilipenko artur.pilipenko@azul.com This presentation describes advanced development work at Azul Systems and is for informational purposes only. Any
Introduction to LLVM compiler framework
Introduction to LLVM compiler framework Michele Scandale Politecnico di Milano April 8, 2015 This material is strongly based on Ettore Speziale s material for the previous year course. Michele Scandale
Head First into GlobalISel
Head First into GlobalISel Or: How to delete SelectionDAG in 100* easy commits 1 LLVM Dev Meeting 2017 Justin Bogner, Aditya Nandakumar, Daniel Sanders Apple Porting to GlobalISel What is the structure
Fuzzing. compass-security.com 1
Fuzzing compass-security.com 1 Fuzzing Finding bugs by bombarding target with nonconform data Think: Flip a few bits in a PDF, then start Acrobat with that PDF Just more automated Steps: Create input corpus
Automatic program generation for detecting vulnerabilities and errors in compilers and interpreters
Automatic program generation for detecting vulnerabilities and errors in compilers and interpreters 0368-3500 Nurit Dor Shir Landau-Feibish Noam Rinetzky Preliminaries Students will group in teams of 2-3
Mutation Testing. How good your tests are
Mutation Testing How good your tests are 2017 whoami ios Developer by day compiler hacker by night https://twitter.com/1101_debian https://lowlevelbits.org https://systemundertest.org Mars Climate Orbiter
Dmitry Denisenko Intel Programmable Solutions Group. November 13, 2016, LLVM-HPC3 SC 16, Salt Lake City, UT
Dmitry Denisenko Intel November 13, 2016, LLVM-HPC3 SC 16, Salt Lake City, UT FPGs are Everywhere! Consumer utomotive Test, Measurement, & Medical Communications Broadcast Military & Industrial Computer
Compile-Time Function Call Interception to Mock Functions in C/C++
Compile-Time Function Call Interception to Mock Functions in C/C++ Gábor Márton, Zoltán Porkoláb Ericsson Hungary Ltd., Eötvös Loránd University, Budapest martongabesz@gmail.com, zoltan.porkolab@ericsson.com,
COMP 2355 Introduction to Systems Programming
COMP 2355 Introduction to Systems Programming Christian Grothoff christian@grothoff.org http://grothoff.org/christian/ 1 Pointers Pointers denote addresses in memory In C types, the * represents the use
Introduction to Symbolic Execution
Introduction to Symbolic Execution Classic Symbolic Execution 1 Problem 1: Infinite execution path Problem 2: Unsolvable formulas 2 Problem 3: symbolic modeling External function calls and system calls
MoviCompile : An LLVM based compiler for heterogeneous SIMD code generation Diken, E.; Jordans, R.; O'Riordan, M.
MoviCompile : An LLVM based compiler for heterogeneous SIMD code generation Diken, E.; Jordans, R.; O'Riordan, M. Published in: FOSDEM 2015, 31 January- 1 February 2015, Brussels, Belgium Published: 01/01/2015
KOTLIN/NATIVE + CLANG, TRAVEL NOTES NIKOLAY IGOTTI, JETBRAINS
KOTLIN/NATIVE + CLANG, TRAVEL NOTES NIKOLAY IGOTTI, JETBRAINS KOTLIN IS NOT JUST AN ISLAND KOTLIN LANGUAGE FP and OOP language Type inference, smart casts, nullability checks Generics (erased, with reification
Hardening LLVM with Random Testing
Hardening LLVM with Random Testing Xuejun Yang, Yang Chen Eric Eide, John Regehr {jxyang, chenyang, eeide, regehr}@cs.utah.edu University of Utah 11/3/2010 1 A LLVM Crash Bug int * p[2]; int i; for (...)
Guy Blank Intel Corporation, Israel March 27-28, 2017 European LLVM Developers Meeting Saarland Informatics Campus, Saarbrücken, Germany
Guy Blank Intel Corporation, Israel March 27-28, 2017 European LLVM Developers Meeting Saarland Informatics Campus, Saarbrücken, Germany Motivation C AVX2 AVX512 New instructions utilized! Scalar performance
CS 426 Fall Machine Problem 4. Machine Problem 4. CS 426 Compiler Construction Fall Semester 2017
CS 426 Fall 2017 1 Machine Problem 4 Machine Problem 4 CS 426 Compiler Construction Fall Semester 2017 Handed out: November 16, 2017. Due: December 7, 2017, 5:00 p.m. This assignment deals with implementing
https://github.com/aguinet/dragon EuroLLVM Adrien Guinet 2018/04/17
DragonFFI Foreign Function Interface and JIT for C code https://github.com/aguinet/dragon EuroLLVM 2018 - Adrien Guinet (@adriengnt) 2018/04/17 Content of this talk whoami FFI? (and related work) FFI for
DDMD AND AUTOMATED CONVERSION FROM C++ TO D
1 DDMD AND AUTOMATED CONVERSION FROM C++ TO D Daniel Murphy (aka yebblies ) ABOUT ME Using D since 2009 Compiler contributor since 2011 2 OVERVIEW Why convert the frontend to D What s so hard about it
Armide Documentation. Release Kyle Mayes
Armide Documentation Release 0.3.1 Kyle Mayes December 19, 2014 Contents 1 Introduction 1 1.1 Features.................................................. 1 1.2 License..................................................
This time. Defenses and other memory safety vulnerabilities. Everything you ve always wanted to know about gdb but were too afraid to ask
This time We will continue Buffer overflows By looking at Overflow Defenses and other memory safety vulnerabilities Everything you ve always wanted to know about gdb but were too afraid to ask Overflow
Super-optimizing LLVM IR
Super-optimizing LLVM IR Duncan Sands DeepBlueCapital / CNRS Thanks to Google for sponsorship Super optimization Optimization Improve code Super optimization Optimization Improve code Super-optimization
Introduction to LLVM compiler framework
Introduction to LLVM compiler framework Stefano Cherubin Politecnico di Milano 12-04-2017 This material is strongly based on material produced by Michele Scandale and Ettore Speziale for the course `Code
Qemu code fault automatic discovery with symbolic search. Paul Marinescu, Cristian Cadar, Chunjie Zhu, Philippe Gabriel
Qemu code fault automatic discovery with symbolic search Paul Marinescu, Cristian Cadar, Chunjie Zhu, Philippe Gabriel Goals of this presentation Introduction of KLEE (symbolic execution tool) Qemu fault/patch
GraphicsFuzz. Secure and Robust Graphics Rendering. Hugues Evrard Paul Thomson
GraphicsFuzz Secure and Robust Graphics Rendering Hugues Evrard h.evrard@imperial.ac.uk, Paul Thomson paul.thomson11@imperial.ac.uk Problem: defective drivers We are here to help! How: automatic generation
Dynamic Binary Instrumentation: Introduction to Pin
Dynamic Binary Instrumentation: Introduction to Pin Instrumentation A technique that injects instrumentation code into a binary to collect run-time information 2 Instrumentation A technique that injects
Targeting XCore Resources from LLVM. Richard Osborne
Targeting XCore Resources from LLVM Richard Osborne Introduction XMOS UK fabless semiconductor Company XCore processor Aimed at embedded market Hardware interfaces in software Ethernet, USB 2.0, SPDIF,
Black Hat Webcast Series. C/C++ AppSec in 2014
Black Hat Webcast Series C/C++ AppSec in 2014 Who Am I Chris Rohlf Leaf SR (Security Research) - Founder / Consultant BlackHat Speaker { 2009, 2011, 2012 } BlackHat Review Board Member http://leafsr.com
Baggy bounds with LLVM
Baggy bounds with LLVM Anton Anastasov Chirantan Ekbote Travis Hance 6.858 Project Final Report 1 Introduction Buffer overflows are a well-known security problem; a simple buffer-overflow bug can often
CSC 405 Introduction to Computer Security Fuzzing
CSC 405 Introduction to Computer Security Fuzzing Alexandros Kapravelos akaprav@ncsu.edu Let s find some bugs (again) We have a potentially vulnerable program The program has some inputs which can be controlled
LLVM for a Managed Language What we've learned
LLVM for a Managed Language What we've learned Sanjoy Das, Philip Reames {sanjoy,preames}@azulsystems.com LLVM Developers Meeting Oct 30, 2015 This presentation describes advanced development work at Azul
McSema: Static Translation of X86 Instructions to LLVM
McSema: Static Translation of X86 Instructions to LLVM ARTEM DINABURG, ARTEM@TRAILOFBITS.COM ANDREW RUEF, ANDREW@TRAILOFBITS.COM About Us Artem Security Researcher blog.dinaburg.org Andrew PhD Student,
MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation. Shankara Pailoor, Andrew Aday, Suman Jana Columbia University
MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation Shankara Pailoor, Andrew Aday, Suman Jana Columbia University 1 OS Fuzzing Popular technique to find OS vulnerabilities Primarily
Unleashing D* on Android Kernel Drivers. Aravind Machiry
Unleashing D* on Android Kernel Drivers Aravind Machiry (@machiry_msidc) $ whoami Fourth year P.h.D Student at University of California, Santa Barbara. Vulnerability Detection in System software. machiry.github.io
Advancing Clangd. Bringing persisted indexing to Clang tooling. Marc-André Laperle, Ericsson
Advancing Clangd Bringing persisted indexing to Clang tooling Marc-André Laperle, Ericsson AGENDA 1 Introductions 2 3 The road to persisted indexing 4 Current state 5 What s new in Clangd Future and challenges
Lecture Notes: FIE on Firmware: Finding Vulnerabilities in Embedded Systems using Symbolic Execution
Lecture Notes: FIE on Firmware: Finding Vulnerabilities in Embedded Systems using Symbolic Execution Rui Zhang March 6, 2017 1 Embedded microprocessors, Firmware Typical low-power embedded systems combine
Coverage-guided fuzzing using LLVM on Postgres code to find security issues in database functions and operators.
Coverage-guided fuzzing using LLVM on Postgres code to find security issues in database functions and operators. Or. What I did for fun during my summer vacation! What is fuzzing? Issues Fuzzing Postgres
Nail. A Practical Tool for Parsing and Generating Data Formats. Julian Bangert, Nickolai Zeldovich MIT CSAIL. OSDI 14 October 2014
Nail A Practical Tool for Parsing and Generating Data Formats Julian Bangert, Nickolai Zeldovich MIT CSAIL OSDI 14 October 2014 1 / 12 Motivation Parsing Vulnerabilities hand-crafted input parsing and
LLVM Language Reference Manual
LLVM Language Reference Manual Introduction Well-Formedness Identifiers High Level Structure Module Structure Linkage Types Calling Conventions Named Types Global Variables Functions Parameter Attributes
Types, Variables, and Constants
, Variables, and Constants What is a Type The space in which a value is defined Space All possible allowed values All defined operations Integer Space whole numbers +, -, x No divide 2 tj Why Types No
Advanced Compiler Construction
CS 526 Advanced Compiler Construction http://misailo.cs.illinois.edu/courses/cs526 Goals of the Course Develop a fundamental understanding of the major approaches to program analysis and optimization Understand
Putting the Checks into Checked C. Archibald Samuel Elliott Quals - 31st Oct 2017
Putting the Checks into Checked C Archibald Samuel Elliott Quals - 31st Oct 2017 Added Runtime Bounds Checks to the Checked C Compiler 2 C Extension for Spatial Memory Safety Added Runtime Bounds Checks
LLVM Tutorial. John Criswell University of Rochester
LLVM Tutorial John Criswell University of Rochester 1 Overview 2 History of LLVM Developed by Chris Lattner and Vikram Adve at the University of Illinois at Urbana-Champaign Released open-source in October
Accelerating Stateflow With LLVM
Accelerating Stateflow With LLVM By Dale Martin Dale.Martin@mathworks.com 2015 The MathWorks, Inc. 1 What is Stateflow? A block in Simulink, which is a graphical language for modeling algorithms 2 What
CIS 341 Final Examination 4 May 2017
CIS 341 Final Examination 4 May 2017 1 /14 2 /15 3 /12 4 /14 5 /34 6 /21 7 /10 Total /120 Do not begin the exam until you are told to do so. You have 120 minutes to complete the exam. There are 14 pages
API 퍼징을통한취약점탐지 카이스트 차상길
API 퍼징을통한취약점탐지 카이스트 차상길 API Fuzzing? void foo(int x) // This is an API function { // (side-effect-free) //... } void fuzz() { while (1) { foo(rand()); } } // Fuzzer MAIN Found a crash in foo when x = 42
Lecture 4 More on the LLVM Compiler
Lecture 4 More on the LLVM Compiler Abhilasha Jain Thanks to: Jonathan Burket, Deby Katz, Gabe Weisz, Luke Zarko, and Dominic Chen for their slides Visualizing the LLVM Compiler System C C++ Java Source
Shalva Kohen Arunavha Chanda Kai-Zhan Lee Emma Etherington
Shalva Kohen Arunavha Chanda Kai-Zhan Lee Emma Etherington The problem: FSMs Basis of CS and CE Current standard for representation: Unintuitive interface Very long descriptions Redundant behavior commands
A hybrid approach to application instrumentation
A hybrid approach to application instrumentation Ashay Rane, Leo Fialho and James Browne 4 th August, 2014 Petascale Tools Workshop 1 Program Instrumentation What is instrumentation? Addition of statements
Rabbit in the Loop. A primer on feedback directed fuzzing using American Fuzzy Lop. by Kevin Läufer
Rabbit in the Loop A primer on feedback directed fuzzing using American Fuzzy Lop Abstract by Kevin Läufer This guide aims to provide the reader with a good intuition about the
DEVIRTUALIZATION IN LLVM
DEVIRTUALIZATION IN LLVM Piotr Padlewski piotr.padlewski@gmail.com University of Warsaw IIIT @PiotrPadlewski CURRENT DEVIRTUALIZATION IN THE FRONTEND struct A { ; virtual void foo(); void f() { A a; a.foo();
LLVM code generation and implementation of nested functions for the SimpliC language
LLVM code generation and implementation of nested functions for the SimpliC language Oscar Legetth Lunds University dat12ole@student.lth.se Gustav Svensson Lunds University dat12gs1@student.lth.se Abstract
Red Hat Developer Tools
Red Hat Developer Tools 2018.2 Using Clang and LLVM Toolset Installing and Using Clang and LLVM Toolset Last Updated: 2018-04-26 Red Hat Developer Tools 2018.2 Using Clang and LLVM Toolset Installing
Pointer Analysis for C/C++ with cclyzer. George Balatsouras University of Athens
Pointer Analysis for C/C++ with cclyzer George Balatsouras University of Athens Analyzes C/C++ programs translated to LLVM Bitcode Declarative framework Analyzes written in Datalog
CIS 341 Final Examination 4 May 2018
CIS 341 Final Examination 4 May 2018 1 /21 2 /25 3 /30 4 /16 5 /15 6 /13 Total /120 Do not begin the exam until you are told to do so. You have 120 minutes to complete the exam. There are 16 pages in this