hexhive / hextype Goto Github PK

HexType: Efficient Detection of Type Confusion Errors for C++

Makefile 0.03% Shell 0.28% Python 1.11% C++ 97.37% CMake 0.99% C 0.23%

hextype's Introduction

HexType

Environment

Tested on Ubuntu 16.04.2 LTS

How to build

a. Download HexType source code

git clone [email protected]:HexHive/HexType.git

b. Build HexType

run ./build.sh

How to use

a. Set HexType path

$ $BUILD_DIR/bin/export HEXTYPE_LOG_PATH="/tmp/hextype"

b. Run HexType

Use the create-clang-typeinfo option or copy the pre-made type info (in the HexType/etc/clang_type_info) into the HexType path as typeinfo.txt file name
Use HexType/scripts/remove_duplicated_line.py in order to remove duplicated lines when you create new type information file

$ $BUILD_DIR/bin/clang++ test.cc -fsanitize=hextype

Note that during various application tests, we found in a few cases that some type information was omitted during the transition from source code to LLVM IR (which can cause false positive issue). In order to solve this issue, HexType also relies on clang level type information using -mllvm -create-clang-typeinfo option.

c. Please enable/disable below #define in the lib/hextype/rbtree.h according to your purpose

HEX_LOG: print numerical statistics
PRINT_BAD_CASTING: print type confusion result
PRINT_BAD_CASTING_FILE: print type confusio result into file
PRINT_BAD_CASTING_FATAL : terminate program when HexType detects type confusion

d. Please use below additional options as compile option (with -mllvm option, e.g., -mllvm -statck-opt) according to your purpose

Coverage

handle-reinterpret-cast : handle reinterpret_cast to increase coverage
handle-placement-new : handle placement_new to increase coverage

Optimization
- If you use the cast-obj-opt option, create a type casting related object list using create-cast-related-type-list option or copy the pre-made list (in the HexType/etc/typecasting_releated_type_rule) into the HexType path as casting_obj.txt file name
- Use HexType/scripts/merge_typecasting_related_type.py in order to merge type information when you create new type casting related set

stack-opt : apply stack optimization
safestack-opt : apply stack optimization using safestack
cast-obj-opt : apply only typecasting relate objects tracing optimization
inline-opt : apply inline optimization
compile-time-verify-opt : apply compile time verification optimization
enhance-dynamic-cast : replace dynamic_cast`s type casting verification function

make-loginfo : collect and print numerical statistics
make-typeinfo : print type and hash information
create-cast-releated-type-list : create typecasting related object list
create-clang-typeinfo : create clang level type info

e. HexType`s major changes

Clang

- Handle typecasting (static_cast and C style) and reinterpret_cast
llvm/tools/clang/lib/CodeGen/CGClass.cpp
llvm/tools/clang/lib/CodeGen/CGExpr.cpp
llvm/tools/clang/lib/CodeGen/CGExprScalar.cpp
- Handle dynamic_cast
llvm/tools/clang/lib/CodeGen/ItaniumCXXABI.cpp

LLVM Pass

llvm/lib/Transforms/Instrumentation/HexTypeTreePass.cpp : Heap object tracing and class relationship tree
llvm/lib/Transforms/Instrumentation/HexTypePass.cpp : Stack and global object tracing
llvm/lib/Transforms/Utils/HexTypeUtil.cpp : Common utils

Runtime Library

llvm/projects/compiler-rt/lib/hextype/hextype.cc : Type casting verfication and Object tracing
llvm/projects/compiler-rt/lib/hextype/hextype.h
llvm/projects/compiler-rt/lib/hextype/hextype_rbtree.cc : RB tree implemenation
llvm/projects/compiler-rt/lib/hextype/hextype_rbtree.h
llvm/projects/compiler-rt/lib/hextype/hextype_report.cc : create HexType logs
llvm/projects/compiler-rt/lib/hextype/hextype_report.h

How to test

a. HexType testcase

make test

b. TypeSan testcase

run `test/typesancheck/hextype.py`

hextype's People

Contributors

Stargazers

Watchers

Forkers

juanvazquez ashr darakian ufwt teamvault zenhumany vaiocosl ayrx anselmnicholas fuzzamos nihwkroot stjordanis infernalheaven crackercat ha2san clayne 0xgsmonkey tanhuang01

hextype's Issues

Built ChakraCore with the hextype enabled version of clang from this repo on Ubuntu 16.04 LTS. I actually suspect that this could be a problem with Chakra's build makefiles, but I'd like help diagnosing what is going wrong.

Build succeeds, on attempting to run anything there is a fatal dllopen error.

dlopen() failed; dlerror says '/mnt/f/ChakraHex/ChakraCore/out/Debug/libChakraCore.so: undefined symbol: __update_phantom_info'
FATAL ERROR: Unable to load /mnt/f/ChakraHex/ChakraCore/out/Debug/libChakraCore.so GetLastError=0x7e

This looks like some symbol that should have been compiled in when I included -fsanitize=hextype. Any ideas? I'm digging around trying to find a missing -fsanitize line at the moment. I'd be very happy to get any advice. I guess I'll attempt building the library statically and report back.

How to compile Firefox with HexType?

Hi:
I'm trying to compile the Firefox with the HexType, but have no idea where to add the -fsanitize=hextype option. Could you please give me some documents?

Analysis results do not show lines of the source code.

Hi @jys0710 :

I recently cloned and built HexType from the repository, and everything seemed to go smoothly. Here are the steps I followed:

$ git clone [email protected]:HexHive/HexType.git
$ sudo ./build.sh
$ export HEXTYPE_LOG_PATH="/tmp/hextype"

After setting everything up, I used HexType to compile a test file:

$ BUILD_DIR/bin/clang++ test.cc -fsanitize=hextype

This produced an executable a.out. However, when I ran the executable:

$ ./a.out

The output was different from what I expected, based on the descriptions in your paper. Here's what I got:

== HexType Type Confusion Report ==
3 4695655070575894917 9029972361605578882
./simple.out() [0x4051d9]
./simple.out(__type_casting_verification+0x351) [0x402c81]
./simple.out(main+0x80) [0x405b30]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7fbf0e5bf0b3]
./simple.out(_start+0x2e) [0x4021ee]

I noticed that the output does not include the number of lines from the source file, as mentioned in your paper. Could you please advise if there's something I may have missed, or if there's an additional step I need to take to achieve the expected results?

Thank you very much for your assistance!

running make test failed on a freshly build

[100%] Running HEXTYPE tests
FAIL: CastVerifier :: TestCases/simple_bad_cast.cc (1 of 1)
TEST 'CastVerifier :: TestCases/simple_bad_cast.cc' FAILED
Script:

/home/newdisk/canicula/work/HexType/build/./bin/clang --driver-mode=g++ -fsanitize=hextype /home/newdisk/canicula/work/HexType/compiler-rt/test/hextype/TestCases/simple_bad_cast.cc -O3 -o /home/newdisk/canicula/work/HexType/build/projects/compiler-rt/test/hextype/HEXTYPEConfig/TestCases/Output/simple_bad_cast.cc.tmp
/home/newdisk/canicula/work/HexType/build/projects/compiler-rt/test/hextype/HEXTYPEConfig/TestCases/Output/simple_bad_cast.cc.tmp 2>&1 | FileCheck /home/newdisk/canicula/work/HexType/compiler-rt/test/hextype/TestCases/simple_bad_cast.cc --strict-whitespace

Exit Code: 1

Command Output (stderr):

/home/newdisk/canicula/work/HexType/compiler-rt/test/hextype/TestCases/simple_bad_cast.cc:40:14: error: expected string not found in input
// CHECK:== HexType Type Confusion Report ==
^
:1:1: note: scanning from here
terminate called after throwing an instance of 'std::bad_alloc'
^
:1:15: note: possible intended match here
terminate called after throwing an instance of 'std::bad_alloc'
^

Testing Time: 0.28s

Failing Tests (1):
CastVerifier :: TestCases/simple_bad_cast.cc

Unexpected Failures: 1
projects/compiler-rt/test/hextype/CMakeFiles/check-runtime-hextype.dir/build.make:57: recipe for target 'projects/compiler-rt/test/hextype/CMakeFiles/check-runtime-hextype' failed
make[4]: *** [projects/compiler-rt/test/hextype/CMakeFiles/check-runtime-hextype] Error 1
make[4]: Leaving directory '/home/newdisk/canicula/work/HexType/build'
CMakeFiles/Makefile2:13647: recipe for target 'projects/compiler-rt/test/hextype/CMakeFiles/check-runtime-hextype.dir/all' failed
make[3]: *** [projects/compiler-rt/test/hextype/CMakeFiles/check-runtime-hextype.dir/all] Error 2
make[3]: Leaving directory '/home/newdisk/canicula/work/HexType/build'
CMakeFiles/Makefile2:13654: recipe for target 'projects/compiler-rt/test/hextype/CMakeFiles/check-runtime-hextype.dir/rule' failed
make[2]: *** [projects/compiler-rt/test/hextype/CMakeFiles/check-runtime-hextype.dir/rule] Error 2
make[2]: Leaving directory '/home/newdisk/canicula/work/HexType/build'
Makefile:4112: recipe for target 'check-runtime-hextype' failed
make[1]: *** [check-runtime-hextype] Error 2
make[1]: Leaving directory '/home/newdisk/canicula/work/HexType/build'
Makefile:25: recipe for target 'test' failed
make: *** [test] Error 2

Option to throw SIGABRT on finding a Type Confusion

Is it possible to add an option, possibly hidden behind an #ifdef, where the sanitizer throws a SIGABRT when it discovers a type confusion? This should make it play nice with fuzzers like afl-fuzz.

I managed to patch void printTypeConfusion at src/compiler-rt-files/hextype_report.cc to do this but there probably is a better place to call the abort().

Segmentation fault when running Chrome with hextype

Hi:
I have successfully built the Chrome with HexType's instrumentations, but I met two problems when running the instrumented Chrome:
1.
Program received signal SIGSEGV, Segmentation fault.
0x00005555560ea8b6 in __update_direct_oinfo ()

This happens in hextype.cc, function __update_direct_oinfo (), when checking if (ObjTypeMap[MapIndex].ObjAddr == nullptr), loading from the ObjTypeMap[MapIndex].ObjAddr causes the crash.
2.
Program received signal SIGTRAP, Trace/breakpoint trap.
0x00007ffff7120c20 in base::internal::OnNoMemoryInternal(unsigned long)

This happens in hextype.cc, in function __update_phantom_info () when allocate the ObjTypeMap:
ObjTypeMap = new ObjTypeMapEntry[NUMMAP];

Do you have any suggestions for solving those issues? I upgrade the hextype into llvm-14.0.5.

"create-clang-typeinfo option" unclear in documentation

What is this option? It does not seem to be a valid clang option, if it is, what is the syntax? Please clarify this in the documentation.

Does this work with newer Clangs?

Hey,

Just wanted to check if this has been tested against newer (or other) Clang versions or is there anything specific in the Clang modifications that would prevent this?