GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → mustakimur → CFI-LB

mustakimur / CFI-LB

Licence: GPL-2.0 license
Adaptive Callsite-sensitive Control Flow Integrity - EuroS&P'19

Programming Languages

C++
36643 projects - #6 most used programming language
LLVM
166 projects
c
50402 projects - #5 most used programming language
assembly
5116 projects
objective c
16641 projects - #2 most used programming language
python
139335 projects - #7 most used programming language

Labels

llvmclangsymbolic-executiontritoncontrol-flow-integrity

Projects that are alternatives of or similar to CFI-LB

OS-CFI
Origin-sensitive Control Flow Integrity (OS-CFI) - USENIX Security 2019
Stars: ✭ 27 (+107.69%)
Mutual labels:  llvm, clang, control-flow-integrity
dumb-obfuscator
Tutorial on how to write the dumbest obfuscator I could think of.
Stars: ✭ 147 (+1030.77%)
Mutual labels:  llvm, clang
MetaCG
MetaCG offers an annotated whole program call-graph tool for Clang/LLVM.
Stars: ✭ 21 (+61.54%)
Mutual labels:  llvm, clang
FPChecker
A dynamic analysis tool to detect floating-point errors in HPC applications.
Stars: ✭ 26 (+100%)
Mutual labels:  llvm, clang
clangbuilder
Building Clang ♡ Utility and Environment
Stars: ✭ 101 (+676.92%)
Mutual labels:  llvm, clang
vuo
A realtime visual programming language for interactive media.
Stars: ✭ 103 (+692.31%)
Mutual labels:  llvm, clang
sycl
SYCL for Vitis: Experimental fusion of triSYCL with Intel SYCL oneAPI DPC++ up-streaming effort into Clang/LLVM
Stars: ✭ 80 (+515.38%)
Mutual labels:  llvm, clang
Checkedc
Checked C is an extension to C that lets programmers write C code that is guaranteed by the compiler to be type-safe. The goal is to let people easily make their existing C code type-safe and eliminate entire classes of errors. Checked C does not address use-after-free errors. This repo has a wiki for Checked C, sample code, the specification, a…
Stars: ✭ 2,692 (+20607.69%)
Mutual labels:  llvm, clang
los
Los是一个c/c++语言编译型的虚拟机。它使用llvm/clang作为其前端，losld做后端对源代码进行编译，生成los指令文件。Los is a c/c++-compiled virtual machine. It uses llvm/clang as its front end, losld does the backend to compile the source code, and generates the los directive file.
Stars: ✭ 46 (+253.85%)
Mutual labels:  llvm, clang
Chromium Clang
Chromium browser compiled with the Clang/LLVM compiler.
Stars: ✭ 77 (+492.31%)
Mutual labels:  llvm, clang
CMLFS
Clang-Built Musl Linux From Scratch
Stars: ✭ 51 (+292.31%)
Mutual labels:  llvm, clang
linux
Linux kernel source tree
Stars: ✭ 234 (+1700%)
Mutual labels:  llvm, clang
TON-Compiler
Clang compiler for Free TON Virtual Machine
Stars: ✭ 56 (+330.77%)
Mutual labels:  llvm, clang
EmbedSanitizer
EmbedSantizer is a runtime race detection tool which extends ThreadSanitizer to detect data races in 32-bit ARM applications.
Stars: ✭ 16 (+23.08%)
Mutual labels:  llvm, clang
codebrowser
Woboq CodeBrowser
Stars: ✭ 985 (+7476.92%)
Mutual labels:  llvm, clang
flextool
C++ compile-time programming (serialization, reflection, code modification, enum to string, better enum, enum to json, extend or parse language, etc.)
Stars: ✭ 32 (+146.15%)
Mutual labels:  llvm, clang
Cmake Scripts
A selection of useful scripts for use in CMake projects, include code coverage, sanitizers, and dependency graph generation.
Stars: ✭ 202 (+1453.85%)
Mutual labels:  llvm, clang
Symbiotic
Symbiotic is a tool for finding bugs in computer programs based on instrumentation, program slicing and KLEE
Stars: ✭ 212 (+1530.77%)
Mutual labels:  llvm, symbolic-execution
adorad
Fast, Expressive, & High-Performance Programming Language for those who dare
Stars: ✭ 54 (+315.38%)
Mutual labels:  llvm, clang
systemc-compiler
This tool translates synthesizable SystemC code to synthesizable SystemVerilog.
Stars: ✭ 128 (+884.62%)
Mutual labels:  llvm, clang
View All Similar Projects ➔

CFI-LB: Adaptive Call-site Sensitive Control Flow Integrity

CFI-LB: Adaptive Call-site Sensitive Control Flow Integrity will publish in EuroS&P' 2019. The source code is available here. The protoype is build with Clang/LLVM, Intel pin, Radare2, and Triton (Symbolic Execution Engine)(each of them have multiple dependencies). To build Clang/LLVM, it requires 20GB memory along, so please make sure your machine can support that load. The run.sh may ask for sudo permission to install dependent library and enable/disable ASLR for process memory dump to use in concolic process.

Join us in the slack

IMPORTANT: Licensing

This project is licensed in GPLv3 with the following additional conditions:

  1. If you plan to benchmark, compare, evaluate this project with intention to publish the results (including in a paper), you must contact us with your real identity, affiliation, and advisors, and a short description of how you will use our source code before using and/or downloading this project. In addition, you will provide an opportunity for us to comment on and help with technical and other issues related to this project you have during the development. Examples include but are not limited to failure to compile or incomplete protection.

  2. If you use any part of this project (excluding third-party software) and published a paper about it, you agree to open-source your project within one month of the official paper publication.

If you do not agree to these conditions, please do not use our source code.

Justfication: this is a research prototype. Its sole purpose is to demonstrate that the original idea works. It is expected to have implementation flaws. We welcome efforts to re-produce/evaluate our results but request an opportunity to fix implementation flaws. Generally speaking, we value design flaws more but will try to fix implementation issues. If you plan to use this project in production, we would love to hear about it and provide help if needed.

Project Structure

CFILB reference monitor implementation: cfilbLibs/

Reference monitor instrumentation: llvm-project/clang/lib/CodeGen/CGCall.cpp

Clang libtool to prepare the source: llvm-project/clang/tools/clangCodePrep/

Intel pin dynamic CFG generator: dCFG/

Intel pin process memory dump: cHelper/

LLVM static CFG generator: llvm-project/llvm/lib/Transforms/sCFG/

LLVM instrument CFG: llvm-project/llvm/lib/Transforms/instCFG

Symbol table extraction: utils/extract.py

Adaptive filter algorithm: utils/filter.py

Concolic process helper: utils/symHelper.py

Concolic CFG generator: cCFG/src/examples/symCFG

Run script to execute the CFILB process: run.sh

Makefile for CPU2006 Spec Benchmark: spec2006-cfilb.cfg

Overall Process

Step 1: A clang libtool will prepare the target code base.

Step 2: Copy the CFILB runtime library to the source directory.

Step 3: Build the source with clang (with reference monitor instrumentation) and generate the bitcode.

Step 4: Run a LLVM Pass analysis to calculate the static CFG and instrument the table back to bitcode.

Step 5: Build the binary from the step 4 bitcode. (This binary is protected with static CFG)

Step 6: Extract symbol table from the elf binary.

Step 7: Execute the binary with seed input using intel pin tool to generate dynamic CFG.

Step 8: Execute the binary with seed input using intel pin tool to dump memory for concolic process. (ASLR Disabled) [slow process]

Step 9: Run a radare2 python script to collect point of interest (POI) for concolic process.

Step 10: Run the concolic CFG generator (for each POI from step 9) with dump info from step 8. [can have crash issue, please report]

Step 11: Run a python script to apply the adaptive algorithm.

Step 12: Run another LLVM Pass to instrument the adaptive dynamic CFG table in the bitcode.

Step 13: Build the final binary from the step 12 bitcode. The binary will be named as: benchmarkname_cfg

Optional: Due to instrument CFG the code instruction address can be changed from concolic CFG, so there may be a repeat of step 11-13 with an additional check using a python script.

Installation Guideline

  1. Install required binary:
sudo apt install wget clang cmake subversion g++ gcc bash git python-pip libcapstone-dev libboost-all-dev libz3-dev
pip install pyelftools
pip install r2pipe
  1. Git clone the project:
git clone [email protected]:mustakcsecuet/CFI-LB.git
cd CFILB
# copy the project path and save it
EDITOR ~/.profile
export CFILB_PATH="$HOME/../CFI-LB"

Note: You can skip step 2, 3, 4, 6, and 7 if you have already configured Gold plugin for another compiler.

  1. Install required library for Gold plugin:
sudo apt-get install linux-headers-$(uname -r) csh gawk automake libtool bison flex libncurses5-dev
# Check 'makeinfo -v'. If 'makeinfo' does not exist
sudo apt-get install apt-file texinfo texi2html
sudo apt-file update
sudo apt-file search makeinfo
  1. Download binutils source code:
cd ~
git clone --depth 1 git://sourceware.org/git/binutils-gdb.git binutils
  1. Build binutils:
mkdir build
cd build
../binutils/configure --enable-gold --enable-plugins --disable-werror
make
  1. Build the compiler (use the binutils directory if you already have one):
cd $CFILB_PATH/llvm-project
mkdir build
cmake -DLLVM_BINUTILS_INCDIR="path_to_binutils/include"  -DLLVM_ENABLE_PROJECTS=clang -G "Unix Makefiles" ../llvm
make -j8
  1. Backup ar, nm, ld and ranlib:
cd ~
mkdir backup
cd /usr/bin/
cp ar ~/backup/
cp nm ~/backup/
cp ld ~/backup/
cp ranlib ~/backup/
  1. Replace ar, nm, ld and ranlib:
cd /usr/bin/
sudo cp ~/build/binutils/ar ./
sudo rm nm
sudo cp ~/build/binutils/nm-new ./nm
sudo cp ~/build/binutils/ranlib ./
sudo cp ~/build/gold/ld-new ./ld
  1. install LLVMgold.so to /usr/lib/bfd-plugins:
cd /usr/lib
sudo mkdir bfd-plugins
cd bfd-plugins
sudo cp $CFILB_PATH/llvm_project/build/lib/LLVMgold.so ./
sudo cp $CFILB_PATH/llvm_project/build/lib/libLTO.* ./
  1. Download intel-pin-3.5 source:
cd $CFILB_PATH
wget http://software.intel.com/sites/landingpage/pintool/downloads/pin-3.5-97503-gac534ca30-gcc-linux.tar.gz
tar -xvzf pin-3.5-97503-gac534ca30-gcc-linux.tar.gz
rm pin-3.5-97503-gac534ca30-gcc-linux.tar.gz
mv pin-3.5-97503-gac534ca30-gcc-linux intel-pin
  1. Build the dynamic CFG generation pin:
cd $CFILB_PATH/dCFG
make PIN_ROOT=../intel-pin/
make PIN_ROOT=../intel-pin/ obj-intel64/dCFG.so
  1. Build the dynamic process memory dump for concolic process:
cd $CFILB_PATH/cHelper
make PIN_ROOT=../intel-pin/
make PIN_ROOT=../intel-pin/ obj-intel64/sym-dump.so
  1. Build z3 solver from the source:
cd $CFILB
git clone https://github.com/Z3Prover/z3.git
cd z3
python scripts/mk_make.py
cd build
make
sudo make install
  1. Build the concolic system with Triton:
cd $CFILB_PATH/cCFG
mkdir build
cd build
cmake ..
sudo make -j2 install

Spec Benchmark Build Guideline

  1. Put spec2006-cfilb.cfg file into folder $CPU2006_HOME/config and analyze CPU2006 to generate bc files
cd $CPU2000_HOME
. ./shrc
rm -rf benchspec/CPU2006/*/exe/
runspec  --action=run --config=spec2006-cfilb.cfg --tune=base --size=test --iterations=1 --noreportable all
  1. Change the Makefile.spec in the build directory of the benchmark (e.g. ~/spec/benchspec/CPU2006/456.hmmer/build/build_base_amd64-m64-softbound-nn.0000/Makefile.spec):
# add cfilb.c in the source list, keep others same
SOURCES=cfilb.c ...
  1. Use the run.sh to start the system. It is a long process and will ask for user input.
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].