prog

Documentation

Index

• Constants
• func CalculatePriorities(corpus []*Prog) [][]float32
• func CallSet(data []byte) (map[string]struct{}, error)
• type Arg
  • func (a *Arg) InnerArg() *Arg
  • func (a *Arg) Size() uintptr
  • func (a *Arg) Value(pid int) uintptr
• type ArgKind
• type Args
  • func (s Args) Len() int
  • func (s Args) Swap(i, j int)
• type ByPhysicalAddr
  • func (s ByPhysicalAddr) Less(i, j int) bool
• type Call
• type ChoiceTable
  • func BuildChoiceTable(prios [][]float32, enabled map[*sys.Call]bool) *ChoiceTable
  • func (ct *ChoiceTable) Choose(r *rand.Rand, call int) int
• type CsumChunk
• type CsumChunkKind
• type CsumInfo
• type CsumKind
• type LogEntry
  • func ParseLog(data []byte) []*LogEntry
• type Prog
  • func Deserialize(data []byte) (prog *Prog, err error)
  • func Generate(rs rand.Source, ncalls int, ct *ChoiceTable) *Prog
  • func GenerateAllSyzProg(rs rand.Source) *Prog
  • func Minimize(p0 *Prog, callIndex0 int, pred func(*Prog, int) bool, crash bool) (*Prog, int)
  • func (p *Prog) Clone() *Prog
  • func (p *Prog) Mutate(rs rand.Source, ncalls int, ct *ChoiceTable, corpus []*Prog)
  • func (p *Prog) Serialize() []byte
  • func (p *Prog) SerializeForExec(buffer []byte, pid int) error
  • func (p *Prog) String() string
  • func (p *Prog) TrimAfter(idx int)

Constants

const (
	ExecInstrEOF = ^uintptr(iota)
	ExecInstrCopyin
	ExecInstrCopyout
)

const (
	ExecArgConst = uintptr(iota)
	ExecArgResult
	ExecArgData
	ExecArgCsum
)

const (
	ExecArgCsumChunkData = uintptr(iota)
	ExecArgCsumChunkConst
)

const (
	ExecArgCsumInet = uintptr(iota)
)

const (
	ExecBufferSize = 2 << 20
)

Functions

func CalculatePriorities

func CalculatePriorities(corpus []*Prog) [][]float32

func CallSet

func CallSet(data []byte) (map[string]struct{}, error)

CallSet returns a set of all calls in the program. It does very conservative parsing and is intended to parse paste/future serialization formats.

Types

type Arg

type Arg struct {
	Type         sys.Type
	Kind         ArgKind
	Val          uintptr       // value of ArgConst
	AddrPage     uintptr       // page index for ArgPointer address, page count for ArgPageSize
	AddrOffset   int           // page offset for ArgPointer address
	AddrPagesNum uintptr       // number of available pages for ArgPointer
	Data         []byte        // data of ArgData
	Inner        []*Arg        // subargs of ArgGroup
	Res          *Arg          // target of ArgResult, pointee for ArgPointer
	Uses         map[*Arg]bool // this arg is used by those ArgResult args
	OpDiv        uintptr       // divide result for ArgResult (executed before OpAdd)
	OpAdd        uintptr       // add to result for ArgResult

	// ArgUnion/UnionType
	Option     *Arg
	OptionType sys.Type
}

func (*Arg) InnerArg

func (a *Arg) InnerArg() *Arg

Returns inner arg for PtrType args

func (*Arg) Size

func (a *Arg) Size() uintptr

func (*Arg) Value

func (a *Arg) Value(pid int) uintptr

Returns value taking endianness into consideration.

type ArgKind

type ArgKind int

const (
	ArgConst ArgKind = iota
	ArgResult
	ArgPointer  // even if these are always constant (for reproducibility), we use a separate type because they are represented in an abstract (base+page+offset) form
	ArgPageSize // same as ArgPointer but base is not added, so it represents "lengths" in pages
	ArgData
	ArgGroup // logical group of args (struct or array)
	ArgUnion
	ArgReturn // fake value denoting syscall return value
)

type Args

type Args []*Arg

func (Args) Len

func (s Args) Len() int

func (Args) Swap

func (s Args) Swap(i, j int)

type ByPhysicalAddr

type ByPhysicalAddr struct {
	Args
	Context *execContext
}

func (ByPhysicalAddr) Less

func (s ByPhysicalAddr) Less(i, j int) bool

type Call

type Call struct {
	Meta *sys.Call
	Args []*Arg
	Ret  *Arg
}

type ChoiceTable

type ChoiceTable struct {
	// contains filtered or unexported fields
}

ChooseTable allows to do a weighted choice of a syscall for a given syscall based on call-to-call priorities and a set of enabled syscalls.

func BuildChoiceTable

func BuildChoiceTable(prios [][]float32, enabled map[*sys.Call]bool) *ChoiceTable

func (*ChoiceTable) Choose

func (ct *ChoiceTable) Choose(r *rand.Rand, call int) int

type CsumChunk

type CsumChunk struct {
	Kind  CsumChunkKind
	Arg   *Arg    // for CsumChunkArg
	Value uintptr // for CsumChunkConst
	Size  uintptr // for CsumChunkConst
}

type CsumChunkKind

type CsumChunkKind int

const (
	CsumChunkArg CsumChunkKind = iota
	CsumChunkConst
)

type CsumInfo

type CsumInfo struct {
	Kind   CsumKind
	Chunks []CsumChunk
}

type CsumKind

type CsumKind int

const (
	CsumInet CsumKind = iota
)

type LogEntry

type LogEntry struct {
	P         *Prog
	Proc      int  // index of parallel proc
	Start     int  // start offset in log
	End       int  // end offset in log
	Fault     bool // program was executed with fault injection in FaultCall/FaultNth
	FaultCall int
	FaultNth  int
}

LogEntry describes one program in execution log.

func ParseLog

func ParseLog(data []byte) []*LogEntry

type Prog

type Prog struct {
	Calls []*Call
}

func Deserialize

func Deserialize(data []byte) (prog *Prog, err error)

func Generate

func Generate(rs rand.Source, ncalls int, ct *ChoiceTable) *Prog

Generate generates a random program of length ~ncalls. calls is a set of allowed syscalls, if nil all syscalls are used.

func GenerateAllSyzProg

func GenerateAllSyzProg(rs rand.Source) *Prog

GenerateAllSyzProg generates a program that contains all pseudo syz_ calls for testing.

func Minimize

func Minimize(p0 *Prog, callIndex0 int, pred func(*Prog, int) bool, crash bool) (*Prog, int)

Minimize minimizes program p into an equivalent program using the equivalence predicate pred. It iteratively generates simpler programs and asks pred whether it is equal to the orginal program or not. If it is equivalent then the simplification attempt is committed and the process continues.

func (*Prog) Clone

func (p *Prog) Clone() *Prog

func (*Prog) Mutate

func (p *Prog) Mutate(rs rand.Source, ncalls int, ct *ChoiceTable, corpus []*Prog)

func (*Prog) Serialize

func (p *Prog) Serialize() []byte

func (*Prog) SerializeForExec

func (p *Prog) SerializeForExec(buffer []byte, pid int) error

SerializeForExec serializes program p for execution by process pid into the provided buffer. If the provided buffer is too small for the program an error is returned.

func (*Prog) String

func (p *Prog) String() string

String generates a very compact program description (mostly for debug output).

func (*Prog) TrimAfter

func (p *Prog) TrimAfter(idx int)