adding ctor function skipping in LTO fixed map mode
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -30,6 +30,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
reporting)
- LTO: switch default to the dynamic memory map, set AFL_LLVM_MAP_ADDR
for a fixed map address (eg. 0x10000)
+ - LTO: skipping ctors and ifuncs in fix map address instrumentation
- LTO: autodictionary mode is a default
- LTO: instrim instrumentation disabled, only classic support used
as it is always better

MODIFY
llvm_mode/afl-llvm-lto-instrumentation.so.cc
llvm_mode/afl-llvm-lto-instrumentation.so.cc
@@ -229,17 +229,65 @@ bool AFLLTOPass::runOnModule(Module &M) {
Constant *r = IF.getResolver();
StringRef r_name = cast<Function>(r->getOperand(0))->getName();
if (!be_quiet)
- fprintf(stderr, "Found an ifunc with name %s that points to resolver function %s, we cannot instrument this, putting it into a block list.\n",
+ fprintf(stderr,
+ "Warning: Found an ifunc with name %s that points to resolver "
+ "function %s, we cannot instrument this, putting it into a "
+ "block list.\n",
ifunc_name.str().c_str(), r_name.str().c_str());
-
module_block_list.push_back(r_name.str());
}
- // next up: ctors run before __afl_init()
+ GlobalVariable *GV = M.getNamedGlobal("llvm.global_ctors");
+ if (GV && !GV->isDeclaration() && !GV->hasLocalLinkage()) {
+
+ ConstantArray *InitList = dyn_cast<ConstantArray>(GV->getInitializer());
+
+ if (InitList) {
+
+ for (unsigned i = 0, e = InitList->getNumOperands(); i != e; ++i) {
+
+ if (ConstantStruct *CS =
+ dyn_cast<ConstantStruct>(InitList->getOperand(i))) {
+
+ if (CS->getNumOperands() >= 2) {
- // TODO
+ if (CS->getOperand(1)->isNullValue())
+ break; // Found a null terminator, stop here.
+ ConstantInt *CI = dyn_cast<ConstantInt>(CS->getOperand(0));
+ int Priority = CI ? CI->getSExtValue() : 0;
+
+ Constant *FP = CS->getOperand(1);
+ if (ConstantExpr *CE = dyn_cast<ConstantExpr>(FP))
+ if (CE->isCast()) FP = CE->getOperand(0);
+ if (Function *F = dyn_cast<Function>(FP)) {
+
+ if (!F->isDeclaration() &&
+ strncmp(F->getName().str().c_str(), "__afl", 5) != 0 &&
+ Priority <= 5) {
+
+ if (!be_quiet)
+ fprintf(stderr,
+ "Warning: Found constructor function %s with prio "
+ "%u, we cannot instrument this, putting it into a "
+ "block list.\n",
+ F->getName().str().c_str(), Priority);
+ module_block_list.push_back(F->getName().str());
+
+ }
+
+ }
+
+ }
+
+ }
+
+ }
+
+ }
+
+ }
}
@@ -268,7 +316,9 @@ bool AFLLTOPass::runOnModule(Module &M) {
if (fname.compare(bname) == 0) {
if (!be_quiet)
- WARNF("Skipping instrumentation of ifunc resolver function %s",
+ WARNF(
+ "Skipping instrumentation of dangerous early running function "
+ "%s",
fname.c_str());
}

adding ctor function skipping in LTO fixed map mode