Documentation ¶
Index ¶
- Constants
- func CallSet(data []byte) (map[string]struct{}, error)
- func Debug()
- func DecodeFallbackSignal(s uint32) (callID, errno int)
- func EncodeData(buf *bytes.Buffer, data []byte, readable bool)
- func ForeachArg(c *Call, f func(Arg, *ArgCtx))
- func ForeachSubArg(arg Arg, f func(Arg, *ArgCtx))
- func ForeachType(meta *Syscall, f func(Type))
- func IsPad(t Type) bool
- func RegisterTarget(target *Target, initArch func(target *Target))
- func RequiredFeatures(p *Prog) (bitmasks, csums bool)
- func RestoreLinks(syscalls []*Syscall, resources []*ResourceDesc, structs []*KeyedStruct)
- type Arg
- type ArgCommon
- type ArgCtx
- type ArrayKind
- type ArrayType
- type BinaryFormat
- type BufferKind
- type BufferType
- type Builder
- type Call
- type CallFlags
- type CallInfo
- type ChoiceTable
- type CompMap
- type ConstArg
- type ConstType
- type ConstValue
- type CsumChunk
- type CsumChunkKind
- type CsumInfo
- type CsumKind
- type CsumType
- type DataArg
- type DeserializeMode
- type Dir
- type ExecArg
- type ExecArgConst
- type ExecArgCsum
- type ExecArgData
- type ExecArgResult
- type ExecCall
- type ExecCopyin
- type ExecCopyout
- type ExecCsumChunk
- type ExecProg
- type FlagsType
- type Gen
- func (g *Gen) Alloc(ptrType Type, data Arg) (Arg, []*Call)
- func (g *Gen) GenerateArg(typ Type, pcalls *[]*Call) Arg
- func (g *Gen) GenerateSpecialArg(typ Type, pcalls *[]*Call) Arg
- func (g *Gen) MutateArg(arg0 Arg) (calls []*Call)
- func (g *Gen) NOutOf(n, outOf int) bool
- func (g *Gen) Rand() *rand.Rand
- func (g *Gen) Target() *Target
- type GroupArg
- type IntKind
- type IntType
- type IntTypeCommon
- func (t *IntTypeCommon) BitfieldLength() uint64
- func (t *IntTypeCommon) BitfieldOffset() uint64
- func (t *IntTypeCommon) Format() BinaryFormat
- func (t *IntTypeCommon) IsBitfield() bool
- func (t *IntTypeCommon) String() string
- func (t *IntTypeCommon) TypeBitSize() uint64
- func (t *IntTypeCommon) UnitOffset() uint64
- func (t *IntTypeCommon) UnitSize() uint64
- type KeyedStruct
- type LenType
- type LogEntry
- type PointerArg
- type ProcType
- type Prog
- func (p *Prog) Clone() *Prog
- func (p *Prog) FallbackSignal(info []CallInfo)
- func (p *Prog) Mutate(rs rand.Source, ncalls int, ct *ChoiceTable, corpus []*Prog)
- func (p *Prog) MutateWithHints(callIndex int, comps CompMap, exec func(p *Prog))
- func (p *Prog) ResetMAB()
- func (p *Prog) Serialize() []byte
- func (p *Prog) SerializeForExec(buffer []byte) (int, error)
- func (p *Prog) SerializeVerbose() []byte
- func (p *Prog) String() string
- type PtrType
- type ResourceCtor
- type ResourceDesc
- type ResourceType
- type ResultArg
- type Rotator
- type StructDesc
- type StructKey
- type StructType
- type Syscall
- type Target
- func (target *Target) ArgContainsAny(arg0 Arg) (res bool)
- func (target *Target) BuildChoiceTable(prios [][]float32, enabled map[*Syscall]bool) *ChoiceTable
- func (target *Target) CalculatePriorities(corpus []*Prog) [][]float32
- func (target *Target) CallContainsAny(c *Call) (res bool)
- func (target *Target) Deserialize(data []byte, mode DeserializeMode) (*Prog, error)
- func (target *Target) DeserializeExec(exec []byte) (ExecProg, error)
- func (target *Target) Generate(rs rand.Source, ncalls int, ct *ChoiceTable) *Prog
- func (target *Target) GenerateAllSyzProg(rs rand.Source) *Prog
- func (target *Target) GenerateSimpleProg() *Prog
- func (target *Target) GenerateUberMmapProg() *Prog
- func (target *Target) GetConst(name string) uint64
- func (target *Target) ParseLog(data []byte) []*LogEntry
- func (target *Target) PhysicalAddr(arg *PointerArg) uint64
- func (target *Target) TransitivelyEnabledCalls(enabled map[*Syscall]bool) (map[*Syscall]bool, map[*Syscall]string)
- type TextKind
- type Type
- type TypeCommon
- func (t *TypeCommon) BitfieldLength() uint64
- func (t *TypeCommon) BitfieldOffset() uint64
- func (t TypeCommon) Dir() Dir
- func (t *TypeCommon) FieldName() string
- func (t *TypeCommon) Format() BinaryFormat
- func (t *TypeCommon) IsBitfield() bool
- func (t *TypeCommon) Name() string
- func (t *TypeCommon) Optional() bool
- func (t *TypeCommon) Size() uint64
- func (t *TypeCommon) TemplateName() string
- func (t *TypeCommon) TypeBitSize() uint64
- func (t *TypeCommon) UnitOffset() uint64
- func (t *TypeCommon) UnitSize() uint64
- func (t *TypeCommon) Varlen() bool
- type UnionArg
- type UnionType
- type VmaType
Constants ¶
const ( ExecArgCsumChunkData = uint64(iota) ExecArgCsumChunkConst )
const ( ExecBufferSize = 2 << 20 ExecNoCopyout = ^uint64(0) )
const ( // Special reference to the outer struct used in len targets. ParentRef = "parent" // Special reference directly to syscall arguments used in len targets. SyscallRef = "syscall" )
const (
ExecArgCsumInet = uint64(iota)
)
const (
MaxPids = 32
)
Variables ¶
This section is empty.
Functions ¶
func CallSet ¶
CallSet returns a set of all calls in the program. It does very conservative parsing and is intended to parse past/future serialization formats.
func DecodeFallbackSignal ¶
func ForeachArg ¶
func ForeachSubArg ¶
func ForeachType ¶
func RegisterTarget ¶
func RequiredFeatures ¶
func RestoreLinks ¶
func RestoreLinks(syscalls []*Syscall, resources []*ResourceDesc, structs []*KeyedStruct)
Types ¶
type ArgCtx ¶
type ArgCtx struct { Parent *[]Arg // GroupArg.Inner (for structs) or Call.Args containing this arg Base *PointerArg // pointer to the base of the heap object containing this arg Offset uint64 // offset of this arg from the base Stop bool // if set by the callback, subargs of this arg are not visited }
type ArrayType ¶
type ArrayType struct { TypeCommon Type Type Kind ArrayKind RangeBegin uint64 RangeEnd uint64 }
func (*ArrayType) DefaultArg ¶
type BinaryFormat ¶
type BinaryFormat int
const ( FormatNative BinaryFormat = iota FormatBigEndian FormatStrDec FormatStrHex FormatStrOct )
type BufferKind ¶
type BufferKind int
const ( BufferBlobRand BufferKind = iota BufferBlobRange BufferString BufferFilename BufferText )
type BufferType ¶
type BufferType struct { TypeCommon Kind BufferKind RangeBegin uint64 // for BufferBlobRange kind RangeEnd uint64 // for BufferBlobRange kind Text TextKind // for BufferText SubKind string Values []string // possible values for BufferString kind NoZ bool // non-zero terminated BufferString/BufferFilename }
func (*BufferType) DefaultArg ¶
func (t *BufferType) DefaultArg() Arg
func (*BufferType) String ¶
func (t *BufferType) String() string
type Builder ¶
type Builder struct {
// contains filtered or unexported fields
}
func MakeProgGen ¶
func (*Builder) AllocateVMA ¶
type ChoiceTable ¶
type ChoiceTable struct {
// contains filtered or unexported fields
}
ChooseTable allows to do a weighted choice of a syscall for a given syscall based on call-to-call priorities and a set of enabled syscalls.
type CompMap ¶
Example: for comparisons {(op1, op2), (op1, op3), (op1, op4), (op2, op1)} this map will store the following:
m = { op1: {map[op2]: true, map[op3]: true, map[op4]: true}, op2: {map[op1]: true} }.
type ConstArg ¶
Used for ConstType, IntType, FlagsType, LenType, ProcType and CsumType.
func MakeConstArg ¶
type ConstType ¶
type ConstType struct { IntTypeCommon Val uint64 IsPad bool }
func (*ConstType) DefaultArg ¶
type ConstValue ¶
type CsumChunk ¶
type CsumChunk struct { Kind CsumChunkKind Arg Arg // for CsumChunkArg Value uint64 // for CsumChunkConst Size uint64 // for CsumChunkConst }
type CsumChunkKind ¶
type CsumChunkKind int
const ( CsumChunkArg CsumChunkKind = iota CsumChunkConst )
type CsumType ¶
type CsumType struct { IntTypeCommon Kind CsumKind Buf string Protocol uint64 // for CsumPseudo }
func (*CsumType) DefaultArg ¶
type DataArg ¶
type DataArg struct { ArgCommon // contains filtered or unexported fields }
Used for BufferType.
func MakeDataArg ¶
func MakeOutDataArg ¶
type DeserializeMode ¶
type DeserializeMode int
const ( Strict DeserializeMode = iota NonStrict DeserializeMode = iota )
type ExecArgConst ¶
type ExecArgCsum ¶
type ExecArgCsum struct { Size uint64 Kind uint64 Chunks []ExecCsumChunk }
type ExecArgData ¶
type ExecArgResult ¶
type ExecCall ¶
type ExecCall struct { Meta *Syscall Index uint64 Args []ExecArg Copyin []ExecCopyin Copyout []ExecCopyout }
type ExecCopyin ¶
type ExecCopyout ¶
type ExecCsumChunk ¶
type FlagsType ¶
type FlagsType struct { IntTypeCommon Vals []uint64 BitMask bool }
func (*FlagsType) DefaultArg ¶
type GroupArg ¶
Used for StructType and ArrayType. Logical group of args (struct or array).
func MakeGroupArg ¶
type IntType ¶
type IntType struct { IntTypeCommon Kind IntKind RangeBegin uint64 RangeEnd uint64 Align uint64 }
func (*IntType) DefaultArg ¶
type IntTypeCommon ¶
type IntTypeCommon struct { TypeCommon ArgFormat BinaryFormat BitfieldOff uint64 BitfieldLen uint64 BitfieldUnit uint64 BitfieldUnitOff uint64 }
func (*IntTypeCommon) BitfieldLength ¶
func (t *IntTypeCommon) BitfieldLength() uint64
func (*IntTypeCommon) BitfieldOffset ¶
func (t *IntTypeCommon) BitfieldOffset() uint64
func (*IntTypeCommon) Format ¶
func (t *IntTypeCommon) Format() BinaryFormat
func (*IntTypeCommon) IsBitfield ¶
func (t *IntTypeCommon) IsBitfield() bool
func (*IntTypeCommon) String ¶
func (t *IntTypeCommon) String() string
func (*IntTypeCommon) TypeBitSize ¶
func (t *IntTypeCommon) TypeBitSize() uint64
Returns the size in bits for integers in binary format or 64 for string-formatted integers. The return value is used in computing limits and truncating other values.
func (*IntTypeCommon) UnitOffset ¶
func (t *IntTypeCommon) UnitOffset() uint64
func (*IntTypeCommon) UnitSize ¶
func (t *IntTypeCommon) UnitSize() uint64
type KeyedStruct ¶
type KeyedStruct struct { Key StructKey Desc *StructDesc }
type LenType ¶
type LenType struct { IntTypeCommon BitSize uint64 // want size in multiple of bits instead of array size Offset bool // offset from the beginning of the parent struct or base object Path []string }
func (*LenType) DefaultArg ¶
type LogEntry ¶
type LogEntry struct { P *Prog Proc int // index of parallel proc Start int // start offset in log End int // end offset in log Fault bool // program was executed with fault injection in FaultCall/FaultNth FaultCall int FaultNth int }
LogEntry describes one program in execution log.
type PointerArg ¶
type PointerArg struct { ArgCommon Address uint64 VmaSize uint64 // size of the referenced region for vma args Res Arg // pointee (nil for vma) }
Used for PtrType and VmaType.
func MakePointerArg ¶
func MakePointerArg(t Type, addr uint64, data Arg) *PointerArg
func MakeSpecialPointerArg ¶
func MakeSpecialPointerArg(t Type, index uint64) *PointerArg
func MakeVmaPointerArg ¶
func MakeVmaPointerArg(t Type, addr, size uint64) *PointerArg
func (*PointerArg) IsSpecial ¶
func (arg *PointerArg) IsSpecial() bool
func (*PointerArg) Size ¶
func (arg *PointerArg) Size() uint64
type ProcType ¶
type ProcType struct { IntTypeCommon ValuesStart uint64 ValuesPerProc uint64 }
func (*ProcType) DefaultArg ¶
type Prog ¶
type Prog struct { Target *Target Calls []*Call Comments []string Source int // Gen: 0, Mut: 1, Tri: 2 CorpusGLC glc.CorpusGLC }
func Minimize ¶
Minimize minimizes program p into an equivalent program using the equivalence predicate pred. It iteratively generates simpler programs and asks pred whether it is equal to the original program or not. If it is equivalent then the simplification attempt is committed and the process continues.
func (*Prog) FallbackSignal ¶
func (*Prog) Mutate ¶
Mutate program p.
p: The program to mutate. rs: Random source. ncalls: The allowed maximum calls in mutated program. ct: ChoiceTable for syscalls. corpus: The entire corpus, including original program p.
func (*Prog) MutateWithHints ¶
Mutates the program using the comparison operands stored in compMaps. For each of the mutants executes the exec callback.
func (*Prog) SerializeForExec ¶
SerializeForExec serializes program p for execution by process pid into the provided buffer. Returns number of bytes written to the buffer. If the provided buffer is too small for the program an error is returned.
func (*Prog) SerializeVerbose ¶
type ResourceCtor ¶
type ResourceDesc ¶
type ResourceDesc struct { Name string Type Type Kind []string Values []uint64 Ctors []ResourceCtor }
type ResourceType ¶
type ResourceType struct { TypeCommon ArgFormat BinaryFormat Desc *ResourceDesc }
func (*ResourceType) Default ¶
func (t *ResourceType) Default() uint64
func (*ResourceType) DefaultArg ¶
func (t *ResourceType) DefaultArg() Arg
func (*ResourceType) Format ¶
func (t *ResourceType) Format() BinaryFormat
func (*ResourceType) SpecialValues ¶
func (t *ResourceType) SpecialValues() []uint64
func (*ResourceType) String ¶
func (t *ResourceType) String() string
type ResultArg ¶
type ResultArg struct { ArgCommon Res *ResultArg // reference to arg which we use OpDiv uint64 // divide result (executed before OpAdd) OpAdd uint64 // add to result Val uint64 // value used if Res is nil // contains filtered or unexported fields }
Used for ResourceType. This is the only argument that can be used as syscall return value. Either holds constant value or reference another ResultArg.
func MakeReturnArg ¶
type Rotator ¶
type Rotator struct {
// contains filtered or unexported fields
}
Rotator selects a random subset of syscalls for corpus rotation.
func MakeRotator ¶
type StructDesc ¶
type StructDesc struct { TypeCommon Fields []Type AlignAttr uint64 }
func (*StructDesc) FieldName ¶
func (t *StructDesc) FieldName() string
type StructType ¶
type StructType struct { Key StructKey FldName string *StructDesc }
func (*StructType) DefaultArg ¶
func (t *StructType) DefaultArg() Arg
func (*StructType) FieldName ¶
func (t *StructType) FieldName() string
func (*StructType) String ¶
func (t *StructType) String() string
type Target ¶
type Target struct { OS string Arch string Revision string // unique hash representing revision of the descriptions PtrSize uint64 PageSize uint64 NumPages uint64 DataOffset uint64 Syscalls []*Syscall Resources []*ResourceDesc Structs []*KeyedStruct Consts []ConstValue // MakeMmap creates call that maps [addr, addr+size) memory range. MakeMmap func(addr, size uint64) *Call // SanitizeCall neutralizes harmful calls. SanitizeCall func(c *Call) // AnnotateCall annotates a syscall invocation in C reproducers. // The returned string will be placed inside a comment except for the // empty string which will omit the comment. AnnotateCall func(c ExecCall) string // SpecialTypes allows target to do custom generation/mutation for some struct's and union's. // Map key is struct/union name for which custom generation/mutation is required. // Map value is custom generation/mutation function that will be called // for the corresponding type. g is helper object that allows generate random numbers, // allocate memory, etc. typ is the struct/union type. old is the old value of the struct/union // for mutation, or nil for generation. The function returns a new value of the struct/union, // and optionally any calls that need to be inserted before the arg reference. SpecialTypes map[string]func(g *Gen, typ Type, old Arg) (Arg, []*Call) // Special strings that can matter for the target. // Used as fallback when string type does not have own dictionary. StringDictionary []string // Resources that play auxiliary role, but widely used throughout all syscalls (e.g. pid/uid). AuxResources map[string]bool // Additional special invalid pointer values besides NULL to use. SpecialPointers []uint64 SyscallMap map[string]*Syscall ConstMap map[string]uint64 // contains filtered or unexported fields }
Target describes target OS/arch pair.
func AllTargets ¶
func AllTargets() []*Target
func (*Target) ArgContainsAny ¶
func (*Target) BuildChoiceTable ¶
func (target *Target) BuildChoiceTable(prios [][]float32, enabled map[*Syscall]bool) *ChoiceTable
func (*Target) CalculatePriorities ¶
func (*Target) CallContainsAny ¶
func (*Target) Deserialize ¶
func (target *Target) Deserialize(data []byte, mode DeserializeMode) (*Prog, error)
func (*Target) DeserializeExec ¶
func (*Target) Generate ¶
Generate generates a random program of length ~ncalls. calls is a set of allowed syscalls, if nil all syscalls are used.
func (*Target) GenerateAllSyzProg ¶
GenerateAllSyzProg generates a program that contains all pseudo syz_ calls for testing.
func (*Target) GenerateSimpleProg ¶
GenerateSimpleProg generates the simplest non-empty program for testing (e.g. containing a single mmap).
func (*Target) GenerateUberMmapProg ¶
func (*Target) PhysicalAddr ¶
func (target *Target) PhysicalAddr(arg *PointerArg) uint64
type Type ¶
type Type interface { String() string Name() string FieldName() string TemplateName() string // for template structs name without arguments Dir() Dir Optional() bool Varlen() bool Size() uint64 TypeBitSize() uint64 Format() BinaryFormat BitfieldOffset() uint64 BitfieldLength() uint64 IsBitfield() bool // For most of the types UnitSize is equal to Size. // These are different only for all but last bitfield in the group, // where Size == 0 and UnitSize equals to the underlying bitfield type size. UnitSize() uint64 UnitOffset() uint64 DefaultArg() Arg // contains filtered or unexported methods }
type TypeCommon ¶
type TypeCommon struct { TypeName string FldName string // for struct fields and named args // Static size of the type, or 0 for variable size types and all but last bitfields in the group. TypeSize uint64 ArgDir Dir IsOptional bool IsVarlen bool }
func (*TypeCommon) BitfieldLength ¶
func (t *TypeCommon) BitfieldLength() uint64
func (*TypeCommon) BitfieldOffset ¶
func (t *TypeCommon) BitfieldOffset() uint64
func (TypeCommon) Dir ¶
func (t TypeCommon) Dir() Dir
func (*TypeCommon) FieldName ¶
func (t *TypeCommon) FieldName() string
func (*TypeCommon) Format ¶
func (t *TypeCommon) Format() BinaryFormat
func (*TypeCommon) IsBitfield ¶
func (t *TypeCommon) IsBitfield() bool
func (*TypeCommon) Name ¶
func (t *TypeCommon) Name() string
func (*TypeCommon) Optional ¶
func (t *TypeCommon) Optional() bool
func (*TypeCommon) Size ¶
func (t *TypeCommon) Size() uint64
func (*TypeCommon) TemplateName ¶
func (t *TypeCommon) TemplateName() string
func (*TypeCommon) TypeBitSize ¶
func (t *TypeCommon) TypeBitSize() uint64
func (*TypeCommon) UnitOffset ¶
func (t *TypeCommon) UnitOffset() uint64
func (*TypeCommon) UnitSize ¶
func (t *TypeCommon) UnitSize() uint64
func (*TypeCommon) Varlen ¶
func (t *TypeCommon) Varlen() bool
type UnionType ¶
type UnionType struct { Key StructKey FldName string *StructDesc }