r-fuzz/symsan

A LLVM Sanitizer for Symbolic Tracing

SymSan: Time and Space Efficient Concolic Execution via Dynamic Data-Flow Analysis

SymSan (Symbolic Sanitizer) is an efficient concolic execution engine based on the Data-Floow Sanitizer (DFSan) framework. By modeling forward symbolic execution as a dynamic data-flow analysis and leveraging the time and space efficient data-flow tracking infrastructure from DFSan, SymSan imposes much lower runtime overhead than previous symbolic execution engines.

Similar to other compilation-based symbolic executor like SymCC, SymSan uses compile-time instrumentation to insert symbolic execution logic into the target program, and a runtime supporting library to maintain symbolic states during execution.

To learn more, checkout our paper at USENIX Security 2022.

Building

Because SymSan leverages the shadow memory implementation from LLVM's sanitizers, it has more strict dependency on the LLVM version. Right now only LLVM 12 is tested.

Build Requirements

• Linux-amd64 (Tested on Ubuntu 20.04)
• LLVM 12.0.1: clang, libc++, libc++abi

Compilation

Create a build directory and execute the following commands in it:

$ CC=clang-12 CXX=clang-12 cmake -DCMAKE_INSTALL_PREFIX=/path/to/install -DCMAKE_BUILD_TYPE=Release /path/to/symsan/source
$ make
$ make install

Build in Docker

docker build -t symsan .

LIBCXX

The repo contains instrumented libc++ and libc++abi to support C++ programs. To rebuild these libraries from source, execute the rebuild.sh script in the libcxx directory.

NOTE: because the in-process solving module (solver/z3.cpp) uses Z3's C++ API and STL containers, so itself depends on the C++ libs. Due to such dependencies, you'll see linking errors when building C++ targets when using this module. Though it's possible to resolve these errors by not instrumenting the dependencies (adding them to the ABIList, then rebuild the C++ libs), we don't recommend using it for C++ targets. Instead, it's much cleaner to use ann out-of-process solving module like Fastgen.

Test

To verify the code works, try some simple tests (forked from Angora, adapted by @insuyun to lit):

$ pip install lit
$ cd your_build_dir
$ lit tests

Environment Options

• KO_CC specifies the clang to invoke, if the default version isn't clang-12, set this variable to allow the compiler wrapper to find the correct clang.

• KO_CXX specifies the clang++ to invoke, if the default version isn't clang++-12, set this variable to allow the compiler wrapper to find the correct clang++.

• KO_USE_Z3 enables the in-process Z3-based solver. By default, it is disabled, so SymSan will only perform symbolic constraint collection without solving. SymSan also supports out-of-process solving, which provides better compatiblility. Check FastGen.

• KO_USE_NATIVE_LIBCXX enables using the native uninstrumented libc++ and libc++abi.

• KO_DONT_OPTIMIZE don't override the optimization level to O3.

Hybrid Fuzzing

SymSan needs a driver to perform hybrid fuzzing, like FastGen. It could also be used as a custom mutator for AFL++ (check the plugin readme).

Documentation

Still under construction, unfortunately.

Reference

To cite SymSan in scientific work, please use the following BibTeX:

@inproceedings {chen2022symsan,
  author =       {Ju Chen and Wookhyun Han and Mingjun Yin and Haochen Zeng and
                  Chengyu Song and Byoungyong Lee and Heng Yin and Insik Shin},
  title =        {SymSan: Time and Space Efficient Concolic Execution via Dynamic Data-Flow Analysis},
  booktitle =    {{USENIX} Security Symposium (Security)},
  year =         2022,
  url =          {https://www.usenix.org/conference/usenixsecurity22/presentation/chen-ju},
  publisher =    {{USENIX} Association},
  month =        aug,
}

symsan's Issues

test failed

I have configured the symsan environment in two virtual machines. When I conducted the final test, all test cases in one of the virtual machines failed, while only three of them passed in the other. I don't know if this is a normal phenomenon.


If this is abnormal, where should I check?

dfsan_label problem

Hello, I've tried to dump dfsan_label when tracing to see it's 0 or not.
I've modified the code __taint_trace_cmp@fastgen as follows:

__taint_trace_cmp(dfsan_label op1, dfsan_label op2, uint32_t size, uint32_t predicate,
                  uint64_t c1, uint64_t c2, uint32_t cid) {
  printf("op1: %d\top2: %d\n", op1, op2);
  if ((op1 == 0 && op2 == 0))
...

Also, I modified code in taint pass to see whether getShadow return a zero shadow when instrumenting switchinst. It seems it's not zero shadow.
However, when I run the instrumented prog, the result show all of labels are 0, I don't know what happen, should I set some envs else?
(I've set KO_USE_FASTGEN=1)

$ ./1 1.txt
op1: 0  op2: 0
op1: 0  op2: 0
op1: 0  op2: 0
op1: 0  op2: 0

I've post my test file here, looking forward to your reply, thanks.
1.zip

Assertion failure in __dfsw_mbrtowc

In __dfsw_mbrtowc, we have the following code (link):

__dfsw_mbrtowc(wchar_t *pwc, const char *s, size_t n, mbstate_t *ps,
               dfsan_label pwc_label, dfsan_label s_label, dfsan_label
               n_label, dfsan_label ps_label, dfsan_label *ret_label) {
  *ret_label = 0;
  size_t ret = mbrtowc(pwc, s, n, ps);
  if (ret == (size_t)-1 || ret == (size_t)-2) return ret;
  else if (pwc != 0) {
    dfsan_label multibyte = dfsan_read_label(s, ret);
    assert(false);
    dfsan_store_label(multibyte, (void *)pwc, sizeof(wchar_t));
  }
  return ret;
}

Why putting assert(false); in the else if branch? This assertion can be triggered if we use symsan to instrument freetype and run it on the seeds for fuzzing.

C++ target with Z3 solver

During the building C++ target with Z3 solver I have a linking problem:

relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'

What is the status of C++ support? With KO_USE_FASTGEN=1 there is no issues.
I used the default docker environment and default build steps. The whole output:

root@28f36c4a75e2:/workdir/symsan# KO_CC=clang-12 KO_CXX=clang++-12 KO_USE_Z3=1 build/bin/ko-clang++ -v tests/cpp_fstream.cpp -o /tmp/cpp_fstream.symsan
Ubuntu clang version 12.0.0-3ubuntu1~20.04.5
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
Found candidate GCC installation: /usr/bin/../lib/gcc/x86_64-linux-gnu/9
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/9
Selected GCC installation: /usr/bin/../lib/gcc/x86_64-linux-gnu/9
Candidate multilib: .;@m64
Selected multilib: .;@m64
 "/usr/lib/llvm-12/bin/clang" -cc1 -triple x86_64-pc-linux-gnu -emit-obj --mrelax-relocations -disable-free -disable-llvm-verifier -discard-value-names -main-file-name cpp_fstream.cpp -mrelocation-model pic -pic-level 1 -fhalf-no-semantic-interposition -mframe-pointer=none -fmath-errno -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -fno-split-dwarf-inlining -debug-info-kind=limited -dwarf-version=4 -debugger-tuning=gdb -v -resource-dir /usr/lib/llvm-12/lib/clang/12.0.0 -internal-isystem /usr/lib/llvm-12/bin/../include/c++/v1 -internal-isystem /usr/local/include -internal-isystem /usr/lib/llvm-12/lib/clang/12.0.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -fdeprecated-macro -fdebug-compilation-dir /workdir/symsan -ferror-limit 19 -funroll-loops -fgnuc-version=4.2.1 -fcxx-exceptions -fexceptions -fcolor-diagnostics -vectorize-loops -vectorize-slp -load /workdir/symsan/build/bin/../lib/symsan/libTaintPass.so -mllvm -taint-abilist=/workdir/symsan/build/bin/../lib/symsan/dfsan_abilist.txt -mllvm -taint-abilist=/workdir/symsan/build/bin/../lib/symsan/zlib_abilist.txt -faddrsig -o /tmp/cpp_fstream-962f23.o -x c++ tests/cpp_fstream.cpp
clang -cc1 version 12.0.0 based upon LLVM 12.0.0 default target x86_64-pc-linux-gnu
ignoring nonexistent directory "/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/lib/llvm-12/bin/../include/c++/v1
 /usr/local/include
 /usr/lib/llvm-12/lib/clang/12.0.0/include
 /usr/include/x86_64-linux-gnu
 /usr/include
End of search list.
 "/usr/bin/ld" -pie -z relro --hash-style=gnu --build-id --eh-frame-hdr -m elf_x86_64 -dynamic-linker /lib64/ld-linux-x86-64.so.2 -o /tmp/cpp_fstream.symsan /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../x86_64-linux-gnu/Scrt1.o /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../x86_64-linux-gnu/crti.o /usr/bin/../lib/gcc/x86_64-linux-gnu/9/crtbeginS.o -L/usr/bin/../lib/gcc/x86_64-linux-gnu/9 -L/usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../x86_64-linux-gnu -L/usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../lib64 -L/lib/x86_64-linux-gnu -L/lib/../lib64 -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib64 -L/usr/lib/x86_64-linux-gnu/../../lib64 -L/usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../.. -L/usr/lib/llvm-12/bin/../lib -L/lib -L/usr/lib /tmp/cpp_fstream-962f23.o --whole-archive /workdir/symsan/build/bin/../lib/symsan/libdfsan_rt-x86_64.a --no-whole-archive --dynamic-list=/workdir/symsan/build/bin/../lib/symsan/libdfsan_rt-x86_64.a.syms -T/workdir/symsan/build/bin/../lib/symsan/taint.ld --whole-archive /workdir/symsan/build/bin/../lib/symsan/libc++.a /workdir/symsan/build/bin/../lib/symsan/libc++abi.a /workdir/symsan/build/bin/../lib/symsan/libunwind.a --no-whole-archive -lrt --no-as-needed --gc-sections -ldl -lpthread -lm -lz --whole-archive /workdir/symsan/build/bin/../lib/symsan/libZ3Solver.a --no-whole-archive -lz3 -lc++ -lm -lgcc_s -lgcc -lc -lgcc_s -lgcc /usr/bin/../lib/gcc/x86_64-linux-gnu/9/crtendS.o /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../x86_64-linux-gnu/crtn.o
/workdir/symsan/build/bin/../lib/symsan/libZ3Solver.a(z3.cpp.o): in function `std::__1::allocator<unsigned int>::allocate(unsigned long)':
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text+0xbcf): relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text+0x1e71): relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text._ZNSt3__16vectorIjNS_9allocatorIjEEE6insertINS_21__hash_const_iteratorIPNS_11__hash_nodeIjPvEEEEEENS_9enable_ifIXaasr27__is_cpp17_forward_iteratorIT_EE5valuesr16is_constructibleIjNS_15iterator_traitsISC_E9referenceEEE5valueENS_11__wrap_iterIPjEEE4typeENSG_IPKjEESC_SC_[_ZNSt3__16vectorIjNS_9allocatorIjEEE6insertINS_21__hash_const_iteratorIPNS_11__hash_nodeIjPvEEEEEENS_9enable_ifIXaasr27__is_cpp17_forward_iteratorIT_EE5valuesr16is_constructibleIjNS_15iterator_traitsISC_E9referenceEEE5valueENS_11__wrap_iterIPjEEE4typeENSG_IPKjEESC_SC_]+0x801): relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'
/workdir/symsan/build/bin/../lib/symsan/libZ3Solver.a(z3.cpp.o): in function `std::__1::allocator<std::__1::__hash_node_base<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, unsigned int>, void*>*>*>::allocate(unsigned long)':
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text._ZNSt3__112__hash_tableINS_17__hash_value_typeIjjEENS_22__unordered_map_hasherIjS2_NS_4hashIjEENS_8equal_toIjEELb1EEENS_21__unordered_map_equalIjS2_S7_S5_Lb1EEENS_9allocatorIS2_EEE8__rehashEm[_ZNSt3__112__hash_tableINS_17__hash_value_typeIjjEENS_22__unordered_map_hasherIjS2_NS_4hashIjEENS_8equal_toIjEELb1EEENS_21__unordered_map_equalIjS2_S7_S5_Lb1EEENS_9allocatorIS2_EEE8__rehashEm]+0x2bb): relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'
/workdir/symsan/build/bin/../lib/symsan/libZ3Solver.a(z3.cpp.o): in function `std::__1::allocator<std::__1::__hash_node_base<std::__1::__hash_node<unsigned int, void*>*>*>::allocate(unsigned long)':
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text._ZNSt3__112__hash_tableIjNS_4hashIjEENS_8equal_toIjEENS_9allocatorIjEEE8__rehashEm[_ZNSt3__112__hash_tableIjNS_4hashIjEENS_8equal_toIjEENS_9allocatorIjEEE8__rehashEm]+0x2bb): relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'
/workdir/symsan/build/bin/../lib/symsan/libZ3Solver.a(z3.cpp.o): in function `std::__1::allocator<std::__1::__hash_node_base<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, z3::expr>, void*>*>*>::allocate(unsigned long)':
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text._ZNSt3__112__hash_tableINS_17__hash_value_typeIjN2z34exprEEENS_22__unordered_map_hasherIjS4_NS_4hashIjEENS_8equal_toIjEELb1EEENS_21__unordered_map_equalIjS4_S9_S7_Lb1EEENS_9allocatorIS4_EEE8__rehashEm[_ZNSt3__112__hash_tableINS_17__hash_value_typeIjN2z34exprEEENS_22__unordered_map_hasherIjS4_NS_4hashIjEENS_8equal_toIjEELb1EEENS_21__unordered_map_equalIjS4_S9_S7_Lb1EEENS_9allocatorIS4_EEE8__rehashEm]+0x2bb): relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'
/workdir/symsan/build/bin/../lib/symsan/libZ3Solver.a(z3.cpp.o): in function `std::__1::allocator<std::__1::__hash_node_base<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, std::__1::unordered_set<unsigned int, std::__1::hash<unsigned int>, std::__1::equal_to<unsigned int>, std::__1::allocator<unsigned int> > >, void*>*>*>::allocate(unsigned long)':
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text._ZNSt3__112__hash_tableINS_17__hash_value_typeIjNS_13unordered_setIjNS_4hashIjEENS_8equal_toIjEENS_9allocatorIjEEEEEENS_22__unordered_map_hasherIjSA_S4_S6_Lb1EEENS_21__unordered_map_equalIjSA_S6_S4_Lb1EEENS7_ISA_EEE8__rehashEm[_ZNSt3__112__hash_tableINS_17__hash_value_typeIjNS_13unordered_setIjNS_4hashIjEENS_8equal_toIjEENS_9allocatorIjEEEEEENS_22__unordered_map_hasherIjSA_S4_S6_Lb1EEENS_21__unordered_map_equalIjSA_S6_S4_Lb1EEENS7_ISA_EEE8__rehashEm]+0x2bb): relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'
/workdir/symsan/build/bin/../lib/symsan/libZ3Solver.a(z3.cpp.o): in function `std::__1::allocator<branch_dep_t*>::allocate(unsigned long)':
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text._ZNSt3__16vectorIP12branch_dep_tNS_9allocatorIS2_EEE8__appendEm[_ZNSt3__16vectorIP12branch_dep_tNS_9allocatorIS2_EEE8__appendEm]+0x144): relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'
/workdir/symsan/build/bin/../lib/symsan/libZ3Solver.a(z3.cpp.o): in function `std::__1::allocator<std::__1::__hash_node_base<std::__1::__hash_node<z3::expr, void*>*>*>::allocate(unsigned long)':
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text._ZNSt3__112__hash_tableIN2z34exprE9expr_hash10expr_equalNS_9allocatorIS2_EEE8__rehashEm[_ZNSt3__112__hash_tableIN2z34exprE9expr_hash10expr_equalNS_9allocatorIS2_EEE8__rehashEm]+0x3a9): relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'
/workdir/symsan/build/bin/../lib/symsan/libZ3Solver.a(z3.cpp.o): in function `std::__1::allocator<std::__1::__hash_node_base<std::__1::__hash_node<std::__1::__hash_value_type<std::__1::pair<unsigned int, void*>, unsigned short>, void*>*>*>::allocate(unsigned long)':
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text._ZNSt3__112__hash_tableINS_17__hash_value_typeINS_4pairIjPvEEtEENS_22__unordered_map_hasherIS4_S5_12context_hashNS_8equal_toIS4_EELb1EEENS_21__unordered_map_equalIS4_S5_S9_S7_Lb1EEENS_9allocatorIS5_EEE8__rehashEm[_ZNSt3__112__hash_tableINS_17__hash_value_typeINS_4pairIjPvEEtEENS_22__unordered_map_hasherIS4_S5_12context_hashNS_8equal_toIS4_EELb1EEENS_21__unordered_map_equalIS4_S5_S9_S7_Lb1EEENS_9allocatorIS5_EEE8__rehashEm]+0x2d5): relocation truncated to fit: R_X86_64_PLT32 against undefined symbol `std::__1::__throw_length_error(char const*)'
/workdir/symsan/build/bin/../lib/symsan/libZ3Solver.a(z3.cpp.o): in function `std::__1::allocator<std::__1::__hash_node_base<std::__1::__hash_node<unsigned long, void*>*>*>::allocate(unsigned long)':
/usr/lib/llvm-12/bin/../include/c++/v1/memory:835:(.text._ZNSt3__112__hash_tableImNS_4hashImEENS_8equal_toImEENS_9allocatorImEEE8__rehashEm[_ZNSt3__112__hash_tableImNS_4hashImEENS_8equal_toImEENS_9allocatorImEEE8__rehashEm]+0x2bd): additional relocation overflows omitted from the output
clang: error: linker command failed with exit code 1 (use -v to see invocation)

make failed

when i make，it shows：
/usr/bin/ld: CMakeFiles/FGTest.dir/fgtest.cpp.o: undefined reference to symbol '_ZNSt11logic_errorC2EPKc@@GLIBCXX_3.4.21'
/usr/bin/ld: /lib/x86_64-linux-gnu/libstdc++.so.6: error adding symbols: DSO missing from command line
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[2]: *** [driver/CMakeFiles/FGTest.dir/build.make:84：driver/fgtest] erro 1
make[1]: *** [CMakeFiles/Makefile2:1155：driver/CMakeFiles/FGTest.dir/all] erro 2
make: *** [Makefile:130：all] erro 2

please help me with this。

Add support for strlen

Without support for strlen, comparison of std::string will not work.

Is symsan in this repository compatible with R-Fuzz/fastgen?

Hi, according to my understanding, the code in R-Fuzz/symsan is only for the concolic executor (based on LLVM-12), while R-Fuzz/fastgen contains a fuzzer bundled with a concolic executor (based on LLVM-6).

My questions is, can I use R-Fuzz/fastgen to run binary programs that are instrumented by R-Fuzz/symsan? It seems like they are not compatible. For instance, R-Fuzz/fastgen uses shmid and pipeid (see here) for inter-process communication in out-of-process solving, while R-Fuzz/symsan has changed to use shm_fd and pipe_fd (see here).

How can the current symsan in R-Fuzz/symsan be integrated into a fuzzer like fastgen? Any plan to do the migration? Hope for your help and suggestions.

symbolic constraint collection

How to collect the symbolic constraint? The execution result of the program seems to have nothing to do with whether KO_USE_Z3=0 is set.

SymSan Failed to Compile Objdump

Hi there!

I was trying to use SymSan to compile Binutils to try out the execution details of SymSan. However, SymSan failed to compile one of the tools objdump. Here is the stack dump:

Stack dump:
0.      Program arguments: clang-12 -DHAVE_CONFIG_H -I. -I../../binutils -I. -I../../binutils -I../bfd -I../../binutils/../bfd -I../../binutils/../include -DLOCALEDIR=\"/usr/local/share/locale\" -Dbin_dummy_emulation=bin_vanilla_emulation -W -Wall -Wstrict-prototypes -Wmissing-prototypes -Wshadow -Werror -I../../binutils/../zlib -g -O2 -MT objdump.o -MD -MP -MF .deps/objdump.Tpo -c -o objdump.o -DOBJDUMP_PRIVATE_VECTORS= ../../binutils/objdump.c -Xclang -load -Xclang /home1/qy/symsan/install/bin/../lib/symsan/libTaintPass.so -mllvm -taint-abilist=/home1/qy/symsan/install/bin/../lib/symsan/dfsan_abilist.txt -mllvm -taint-abilist=/home1/qy/symsan/install/bin/../lib/symsan/zlib_abilist.txt -pie -fpic -Qunused-arguments -fno-vectorize -fno-slp-vectorize -g -O3 -funroll-loops
1.      <eof> parser at end of file
2.      Per-module optimization passes
3.      Running pass 'Taint Pass' on module '../../binutils/objdump.c'.
 #0 0x000055d93372a4e0 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home1/qy/llvm_12.0.0/llvm/lib/Support/Unix/Signals.inc:565:22
 #1 0x000055d93372a59b PrintStackTraceSignalHandler(void*) /home1/qy/llvm_12.0.0/llvm/lib/Support/Unix/Signals.inc:632:1
 #2 0x000055d933728211 llvm::sys::RunSignalHandlers() /home1/qy/llvm_12.0.0/llvm/lib/Support/Signals.cpp:71:20
 #3 0x000055d933729d01 llvm::sys::CleanupOnSignal(unsigned long) /home1/qy/llvm_12.0.0/llvm/lib/Support/Unix/Signals.inc:361:31
 #4 0x000055d93365a910 (anonymous namespace)::CrashRecoveryContextImpl::HandleCrash(int, unsigned long) /home1/qy/llvm_12.0.0/llvm/lib/Support/CrashRecoveryContext.cpp:75:5
 #5 0x000055d93365ae49 CrashRecoverySignalHandler(int) /home1/qy/llvm_12.0.0/llvm/lib/Support/CrashRecoveryContext.cpp:389:1
 #6 0x00007f5064a40420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #7 0x00007f50644dd00b raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #8 0x00007f50644bc859 abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:81:7
 #9 0x00007f50644bc729 get_sysdep_segment_value /build/glibc-SzIz7B/glibc-2.31/intl/loadmsgcat.c:509:8
#10 0x00007f50644bc729 _nl_load_domain /build/glibc-SzIz7B/glibc-2.31/intl/loadmsgcat.c:970:34
#11 0x00007f50644cdfd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
#12 0x000055d932b6e02a llvm::CallInst::init(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::ArrayRef<llvm::OperandBundleDefT<llvm::Value*> >, llvm::Twine const&) /home1/qy/llvm_12.0.0/llvm/lib/IR/Instructions.cpp:444:5
#13 0x00007f506445a9aa llvm::CallInst::CallInst(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::ArrayRef<llvm::OperandBundleDefT<llvm::Value*> >, llvm::Twine const&, llvm::Instruction*) /home1/qy/llvm-project/llvm/include/llvm/IR/Instructions.h:1716:3
#14 0x00007f506445a6ed llvm::CallInst::Create(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::ArrayRef<llvm::OperandBundleDefT<llvm::Value*> >, llvm::Twine const&, llvm::Instruction*) /home1/qy/llvm-project/llvm/include/llvm/IR/Instructions.h:1514:9
#15 0x00007f5064453fec llvm::IRBuilderBase::CreateCall(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::Twine const&, llvm::MDNode*) /home1/qy/llvm-project/llvm/include/llvm/IR/IRBuilder.h:2437:20
#16 0x00007f506443e746 llvm::IRBuilderBase::CreateCall(llvm::FunctionCallee, llvm::ArrayRef<llvm::Value*>, llvm::Twine const&, llvm::MDNode*) /home1/qy/llvm-project/llvm/include/llvm/IR/IRBuilder.h:2458:5
#17 0x00007f5064434957 (anonymous namespace)::TaintFunction::visitGEPInst(llvm::GetElementPtrInst*) /home1/qy/symsan/instrumentation/TaintPass.cpp:1757:15
#18 0x00007f5064433f9b (anonymous namespace)::TaintVisitor::visitGetElementPtrInst(llvm::GetElementPtrInst&) /home1/qy/symsan/instrumentation/TaintPass.cpp:1775:1
#19 0x00007f506442bb2d llvm::InstVisitor<(anonymous namespace)::TaintVisitor, void>::visitGetElementPtr(llvm::GetElementPtrInst&) /home1/qy/llvm-project/llvm/include/llvm/IR/Instruction.def:174:1
#20 0x00007f506442b27e llvm::InstVisitor<(anonymous namespace)::TaintVisitor, void>::visit(llvm::Instruction&) /home1/qy/llvm-project/llvm/include/llvm/IR/Instruction.def:174:1
#21 0x00007f506442a26d llvm::InstVisitor<(anonymous namespace)::TaintVisitor, void>::visit(llvm::Instruction*) /home1/qy/llvm-project/llvm/include/llvm/IR/InstVisitor.h:112:34
#22 0x00007f5064426b18 (anonymous namespace)::Taint::runOnModule(llvm::Module&) /home1/qy/symsan/instrumentation/TaintPass.cpp:1255:28
#23 0x000055d932bb78ff (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) /home1/qy/llvm_12.0.0/llvm/lib/IR/LegacyPassManager.cpp:1550:20
#24 0x000055d932bb29fa llvm::legacy::PassManagerImpl::run(llvm::Module&) /home1/qy/llvm_12.0.0/llvm/lib/IR/LegacyPassManager.cpp:541:13
#25 0x000055d932bb81d5 llvm::legacy::PassManager::run(llvm::Module&) /home1/qy/llvm_12.0.0/llvm/lib/IR/LegacyPassManager.cpp:1678:1
#26 0x000055d933b124e7 (anonymous namespace)::EmitAssemblyHelper::EmitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >) /home1/qy/llvm_12.0.0/clang/lib/CodeGen/BackendUtil.cpp:1014:53
#27 0x000055d933b166bb clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::DataLayout const&, llvm::Module*, clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >) /home1/qy/llvm_12.0.0/clang/lib/CodeGen/BackendUtil.cpp:1598:27
#28 0x000055d934df9796 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) /home1/qy/llvm_12.0.0/clang/lib/CodeGen/CodeGenAction.cpp:344:24
#29 0x000055d9368c1e93 clang::ParseAST(clang::Sema&, bool, bool) /home1/qy/llvm_12.0.0/clang/lib/Parse/ParseAST.cpp:178:14
#30 0x000055d9344203cd clang::ASTFrontendAction::ExecuteAction() /home1/qy/llvm_12.0.0/clang/lib/Frontend/FrontendAction.cpp:1056:11
#31 0x000055d934df6102 clang::CodeGenAction::ExecuteAction() /home1/qy/llvm_12.0.0/clang/lib/CodeGen/CodeGenAction.cpp:1083:5
#32 0x000055d93441fc8c clang::FrontendAction::Execute() /home1/qy/llvm_12.0.0/clang/lib/Frontend/FrontendAction.cpp:953:38
#33 0x000055d93437543a clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /home1/qy/llvm_12.0.0/clang/lib/Frontend/CompilerInstance.cpp:949:42
#34 0x000055d9345b8ca7 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /home1/qy/llvm_12.0.0/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:278:38
#35 0x000055d93063cae5 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /home1/qy/llvm_12.0.0/clang/tools/driver/cc1_main.cpp:240:40
#36 0x000055d93063091e ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&) /home1/qy/llvm_12.0.0/clang/tools/driver/driver.cpp:330:20
#37 0x000055d934261a21 clang::driver::CC1Command::Execute(llvm::ArrayRef<llvm::Optional<llvm::StringRef> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, bool*) const::'lambda'()::operator()() const /home1/qy/llvm_12.0.0/clang/lib/Driver/Job.cpp:404:32
#38 0x000055d9342622e4 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<llvm::Optional<llvm::StringRef> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, bool*) const::'lambda'()>(long) /home1/qy/llvm_12.0.0/llvm/include/llvm/ADT/STLExtras.h:186:40
#39 0x000055d93364df1c llvm::function_ref<void ()>::operator()() const /home1/qy/llvm_12.0.0/llvm/include/llvm/ADT/STLExtras.h:209:62
#40 0x000055d93365b05c llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) /home1/qy/llvm_12.0.0/llvm/lib/Support/CrashRecoveryContext.cpp:425:10
#41 0x000055d934261c30 clang::driver::CC1Command::Execute(llvm::ArrayRef<llvm::Optional<llvm::StringRef> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, bool*) const /home1/qy/llvm_12.0.0/clang/lib/Driver/Job.cpp:404:7
#42 0x000055d934211ee2 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&) const /home1/qy/llvm_12.0.0/clang/lib/Driver/Compilation.cpp:195:22
#43 0x000055d93421226a clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&) const /home1/qy/llvm_12.0.0/clang/lib/Driver/Compilation.cpp:248:53
#44 0x000055d934222040 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&) /home1/qy/llvm_12.0.0/clang/lib/Driver/Driver.cpp:1517:28
#45 0x000055d93063193f main /home1/qy/llvm_12.0.0/clang/tools/driver/driver.cpp:502:39
#46 0x00007f50644be083 __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:342:3
#47 0x000055d93062efbe _start (/home1/qy/llvm_12.0.0/install_12_0_0/bin/clang-12+0x2e03fbe)
clang-12: error: clang frontend command failed with exit code 134 (use -v to see invocation)
clang version 12.0.0 (https://github.com/llvm/llvm-project.git d28af7c654d8db0b68c175db5ce212d74fb5e9bc)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home1/qy/llvm_12.0.0/install_12_0_0/bin
clang-12: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-12: note: diagnostic msg: /tmp/objdump-ac190e.c
clang-12: note: diagnostic msg: /tmp/objdump-ac190e.sh
clang-12: note: diagnostic msg:

********************

Here is my compilation environment:

• LLVM 12.0.0
• SymSan 7fe0ff4
• Binutils binutils-2_39-branch

The crash is thrown in libTaintPass.so, which is caused by an inconsistency between function definition and usage. In TaintFunction::visitGEPInst, it tries to create a call instruction to ​___taint_trace_gep_, the fourth parameter of which (i.e., Index) should be a 64-bits integer. However, when compiling objdump, Index is created as a <2 x i64> type, and the pass module fails in further CreateCall.

How to reproduce

export KO_CC=clang-12 && export KO_CXX=clang++-12 && export KO_USE_NATIVE_LIBCXX=1
git clone -b binutils-2_39-branch https://github.com/bminor/binutils-gdb.git
cd binutils-gdb
mkdir build_symsan
cd build_symsan
CC=ko-clang CXX=ko-clang++ ../configure
cd binutils
ko-clang -I. -I../../binutils -I. -I../../binutils -I../bfd -I../../binutils/../bfd -I../../binutils/../include -DLOCALEDIR=\"/usr/local/share/locale\" -I../../binutils/../zlib objdump.o -c -o objdump.o -DOBJDUMP_PRIVATE_VECTORS= ../../binutils/objdump.c

BTW, if the compile options "-O3" of ko-clang is disabled, the crash will not occur. It seems to have something to do with the optimization of LLVM.

Some questions about code modification

We want to use deep learning methods to speed up the solution of constraints on symsan, so there are some implementation-related issues.
1.What are the differences between the code structure of symsan compiled in the fastgen repository and that in the symsan repository?
2.How to obtain the constraints collected by symsan? What are the related APIs?
3.Can I choose to concretize variables during symbolic execution, and what are the related APIs? Would this violate consistency?
4.If we only focus on the part of the code related to constraints and execution paths during symbolic execution, which part should we specifically pay attention to?

tests fail in Docker on M3

Hello, I was trying to install using Dockerfile. After some fixes, it was built successfully on my machine (Apple M3), but all 25 tests are failing.

-- Testing: 25 tests, 14 workers --
FAIL: SymSan :: bitflip.c (1 of 25)
FAIL: SymSan :: if_eq.c (2 of 25)
FAIL: SymSan :: infer_type.c (3 of 25)
FAIL: SymSan :: context.c (4 of 25)
FAIL: SymSan :: call_fn2.c (5 of 25)
FAIL: SymSan :: aggregate.c (6 of 25)
FAIL: SymSan :: bool.c (7 of 25)
FAIL: SymSan :: call_fn.c (8 of 25)
FAIL: SymSan :: gep.c (9 of 25)
FAIL: SymSan :: cf1.c (10 of 25)
FAIL: SymSan :: call_fn3.c (11 of 25)
FAIL: SymSan :: memcmp.c (12 of 25)
FAIL: SymSan :: shift_and.c (13 of 25)
FAIL: SymSan :: partial_concrete.c (14 of 25)
FAIL: SymSan :: pointer.c (15 of 25)
FAIL: SymSan :: mini2.c (16 of 25)
FAIL: SymSan :: mini.c (17 of 25)
FAIL: SymSan :: strcmp.c (18 of 25)
FAIL: SymSan :: strcmp2.c (19 of 25)
FAIL: SymSan :: sign.c (20 of 25)
FAIL: SymSan :: unaligned_load.c (21 of 25)
FAIL: SymSan :: switch.c (22 of 25)
FAIL: SymSan :: cpp_string.cpp (23 of 25)
FAIL: SymSan :: cpp_map.cpp (24 of 25)
FAIL: SymSan :: cpp_fstream.cpp (25 of 25)
********************
Failed Tests (25):
SymSan :: aggregate.c
SymSan :: bitflip.c
SymSan :: bool.c
SymSan :: call_fn.c
SymSan :: call_fn2.c
SymSan :: call_fn3.c
SymSan :: cf1.c
SymSan :: context.c
SymSan :: cpp_fstream.cpp
SymSan :: cpp_map.cpp
SymSan :: cpp_string.cpp
SymSan :: gep.c
SymSan :: if_eq.c
SymSan :: infer_type.c
SymSan :: memcmp.c
SymSan :: mini.c
SymSan :: mini2.c
SymSan :: partial_concrete.c
SymSan :: pointer.c
SymSan :: shift_and.c
SymSan :: sign.c
SymSan :: strcmp.c
SymSan :: strcmp2.c
SymSan :: switch.c
SymSan :: unaligned_load.c


Testing Time: 0.57s

Total Discovered Tests: 25
Failed: 25 (100.00%)```

You can see my changes on [my fork](https://github.com/imranur-rahman/symsan).

Do you have any idea what might be the issue? Thank you very much!