./SanitizerCoveragePCGUARD.so: instrumentation/SanitizerCoveragePCGUARD.so.cc instrumentation/afl-llvm-common.o | test_deps

ifeq "$(LLVM_10_OK)" "1"

-$(CXX) $(CLANG_CPPFL) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) -Wno-deprecated-copy-with-dtor -Wdeprecated instrumentation/afl-llvm-common.o

-$(CXX) $(CLANG_CPPFL) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) -Wno-deprecated-copy-dtor -Wdeprecated instrumentation/afl-llvm-common.o

endif

./afl-llvm-lto-instrumentlist.so: instrumentation/afl-llvm-lto-instrumentlist.so.cc instrumentation/afl-llvm-common.o

possible in the target (for afl-gcc-fast/afl-clang-fast/

afl-clang-lto)

- afl-cc:

! llvm15-dev with LTO and extra features (LAF/CMPLOG etc.) might have

issues at the moment

- converted all passed to use the new llvm pass manager for llvm 11+

- AFL++ PCGUARD mode is not available for 10.0.1 anymore (11+ only)

- frida_mode:

#include"llvm/IR/Instructions.h"

#include"llvm/IR/IntrinsicInst.h"

#include"llvm/IR/Intrinsics.h"

#include"llvm/IR/LegacyPassManager.h"

#include"llvm/IR/LLVMContext.h"

#include"llvm/IR/MDBuilder.h"

#include"llvm/IR/Mangler.h"

#include"llvm/Transforms/Utils/BasicBlockUtils.h"

#include"llvm/Transforms/Utils/BasicBlockUtils.h"

#include"llvm/Transforms/Utils/ModuleUtils.h"

#include"llvm/Passes/PassPlugin.h"

#include"llvm/Passes/PassBuilder.h"

#include"llvm/IR/PassManager.h"

#include"config.h"

#include"debug.h"

using PostDomTreeCallback =

function_ref<const PostDominatorTree *(Function &F)>;

classModuleSanitizerCoverage {

: public PassInfoMixin<ModuleSanitizerCoverageLTO> {

ModuleSanitizerCoverage(

ModuleSanitizerCoverageLTO(

const SanitizerCoverageOptions &Options = SanitizerCoverageOptions())

: Options(OverrideFromCL(Options)) {

}

boolinstrumentModule(Module &M, DomTreeCallback DTCallback,

PostDomTreeCallback PDTCallback);

PreservedAnalysesrun(Module &M, ModuleAnalysisManager &MAM);

voidinstrumentFunction(Function &F, DomTreeCallback DTCallback,

PostDomTreeCallback PDTCallback);

const SanitizerCoverageOptions &Options = SanitizerCoverageOptions())

: ModulePass(ID), Options(Options) {

initializeModuleSanitizerCoverageLegacyPassPass(

*PassRegistry::getPassRegistry());

}

boolrunOnModule(Module &M)override {

ModuleSanitizerCoverageModuleSancov(Options);

ModuleSanitizerCoverageLTOModuleSancov(Options);

auto DTCallback = [this](Function &F) ->const DominatorTree * {

return &this->getAnalysis<DominatorTreeWrapperPass>(F).getDomTree();

SanitizerCoverageOptions Options;

};

}// namespace

PreservedAnalysesModuleSanitizerCoveragePass::run(Module & M,

ModuleAnalysisManager &MAM) {

extern"C" ::llvm::PassPluginLibraryInfo LLVM_ATTRIBUTE_WEAK

llvmGetPassPluginInfo() {

return {LLVM_PLUGIN_API_VERSION,"SanitizerCoverageLTO","v0.1",

[](PassBuilder &PB) {

#if LLVM_VERSION_MAJOR <= 13

using OptimizationLevel =typename PassBuilder::OptimizationLevel;

#endif

PB.registerOptimizerLastEPCallback(

[](ModulePassManager &MPM, OptimizationLevel OL) {

MPM.addPass(ModuleSanitizerCoverageLTO());

});

}};

}

PreservedAnalysesModuleSanitizerCoverageLTO::run(Module & M,

ModuleAnalysisManager &MAM) {

ModuleSanitizerCoverageModuleSancov(Options);

ModuleSanitizerCoverageLTOModuleSancov(Options);

auto &FAM = MAM.getResult<FunctionAnalysisManagerModuleProxy>(M).getManager();

auto DTCallback = [&FAM](Function &F) ->const DominatorTree * {

}

boolModuleSanitizerCoverage::instrumentModule(

boolModuleSanitizerCoverageLTO::instrumentModule(

Module &M, DomTreeCallback DTCallback, PostDomTreeCallback PDTCallback) {

if (Options.CoverageType == SanitizerCoverageOptions::SCK_None)returnfalse;

M, Int64Tyi,true, GlobalValue::ExternalLinkage,0,"__afl_map_addr");

ConstantInt *MapAddr =ConstantInt::get(Int64Tyi, map_addr);

StoreInst * StoreMapAddr = IRB.CreateStore(MapAddr, AFLMapAddrFixed);

ModuleSanitizerCoverage::SetNoSanitizeMetadata(StoreMapAddr);

ModuleSanitizerCoverageLTO::SetNoSanitizeMetadata(StoreMapAddr);

}

"__afl_final_loc");

ConstantInt *const_loc =ConstantInt::get(Int32Tyi, write_loc);

StoreInst * StoreFinalLoc = IRB.CreateStore(const_loc, AFLFinalLoc);

ModuleSanitizerCoverage::SetNoSanitizeMetadata(StoreFinalLoc);

ModuleSanitizerCoverageLTO::SetNoSanitizeMetadata(StoreFinalLoc);

}

0,"__afl_dictionary_len");

ConstantInt *const_len =ConstantInt::get(Int32Tyi, offset);

StoreInst *StoreDictLen = IRB.CreateStore(const_len, AFLDictionaryLen);

ModuleSanitizerCoverage::SetNoSanitizeMetadata(StoreDictLen);

ModuleSanitizerCoverageLTO::SetNoSanitizeMetadata(StoreDictLen);

ArrayType *ArrayTy =ArrayType::get(IntegerType::get(Ctx,8), offset);

GlobalVariable *AFLInternalDictionary =newGlobalVariable(

Value *AFLDictPtr =

IRB.CreatePointerCast(AFLDictOff,PointerType::get(Int8Tyi,0));

StoreInst *StoreDict = IRB.CreateStore(AFLDictPtr, AFLDictionary);

ModuleSanitizerCoverage::SetNoSanitizeMetadata(StoreDict);

ModuleSanitizerCoverageLTO::SetNoSanitizeMetadata(StoreDict);

}

}

voidModuleSanitizerCoverage::instrumentFunction(

voidModuleSanitizerCoverageLTO::instrumentFunction(

Function &F, DomTreeCallback DTCallback, PostDomTreeCallback PDTCallback) {

if (F.empty())return;

LoadInst *MapPtr =

IRB.CreateLoad(PointerType::get(Int8Ty,0), AFLMapPtr);

ModuleSanitizerCoverage::SetNoSanitizeMetadata(MapPtr);

ModuleSanitizerCoverageLTO::SetNoSanitizeMetadata(MapPtr);

while (1) {

}else {

LoadInst *Counter = IRB.CreateLoad(IRB.getInt8Ty(), MapPtrIdx);

ModuleSanitizerCoverage::SetNoSanitizeMetadata(Counter);

ModuleSanitizerCoverageLTO::SetNoSanitizeMetadata(Counter);

}

auto nosan = IRB.CreateStore(Incr, MapPtrIdx);

ModuleSanitizerCoverage::SetNoSanitizeMetadata(nosan);

ModuleSanitizerCoverageLTO::SetNoSanitizeMetadata(nosan);

}

}

GlobalVariable *ModuleSanitizerCoverage::CreateFunctionLocalArrayInSection(

GlobalVariable *ModuleSanitizerCoverageLTO::CreateFunctionLocalArrayInSection(

size_t NumElements, Function &F, Type *Ty,constchar *Section) {

ArrayType *ArrayTy =ArrayType::get(Ty, NumElements);

}

GlobalVariable *ModuleSanitizerCoverage::CreatePCArray(

GlobalVariable *ModuleSanitizerCoverageLTO::CreatePCArray(

Function &F, ArrayRef<BasicBlock *> AllBlocks) {

size_t N = AllBlocks.size();

}

voidModuleSanitizerCoverage::CreateFunctionLocalArrays(

voidModuleSanitizerCoverageLTO::CreateFunctionLocalArrays(

Function &F, ArrayRef<BasicBlock *> AllBlocks) {

if (Options.TracePCGuard)

}

boolModuleSanitizerCoverage::InjectCoverage(Function & F,

ArrayRef<BasicBlock *> AllBlocks,

bool IsLeafFunc) {

boolModuleSanitizerCoverageLTO::InjectCoverage(

Function &F, ArrayRef<BasicBlock *> AllBlocks,bool IsLeafFunc) {

if (AllBlocks.empty())returnfalse;

CreateFunctionLocalArrays(F, AllBlocks);

voidModuleSanitizerCoverage::InjectCoverageForIndirectCalls(

voidModuleSanitizerCoverageLTO::InjectCoverageForIndirectCalls(

Function &F, ArrayRef<Instruction *> IndirCalls) {

if (IndirCalls.empty())return;

}

voidModuleSanitizerCoverage::InjectCoverageAtBlock(Function &F, BasicBlock &BB,

size_t Idx,

bool IsLeafFunc) {

voidModuleSanitizerCoverageLTO::InjectCoverageAtBlock(Function & F,

BasicBlock &BB,

size_t Idx,

bool IsLeafFunc) {

BasicBlock::iterator IP = BB.getFirstInsertionPt();

bool IsEntryBB = &BB == &F.getEntryBlock();

}else {

LoadInst *MapPtr = IRB.CreateLoad(PointerType::get(Int8Ty,0), AFLMapPtr);

ModuleSanitizerCoverage::SetNoSanitizeMetadata(MapPtr);

ModuleSanitizerCoverageLTO::SetNoSanitizeMetadata(MapPtr);

MapPtrIdx = IRB.CreateGEP(Int8Ty, MapPtr, CurLoc);

}

}else {

LoadInst *Counter = IRB.CreateLoad(IRB.getInt8Ty(), MapPtrIdx);

ModuleSanitizerCoverage::SetNoSanitizeMetadata(Counter);

ModuleSanitizerCoverageLTO::SetNoSanitizeMetadata(Counter);

Value *Incr = IRB.CreateAdd(Counter, One);

}

auto nosan = IRB.CreateStore(Incr, MapPtrIdx);

ModuleSanitizerCoverage::SetNoSanitizeMetadata(nosan);

ModuleSanitizerCoverageLTO::SetNoSanitizeMetadata(nosan);

}

}

std::stringModuleSanitizerCoverage::getSectionName(

std::stringModuleSanitizerCoverageLTO::getSectionName(

const std::string &Section)const {

if (TargetTriple.isOSBinFormatCOFF()) {

}

char ModuleSanitizerCoverageLegacyPass::ID =0;

INITIALIZE_PASS_BEGIN(ModuleSanitizerCoverageLegacyPass,"sancov",

const std::vector<std::string> &BlocklistFiles) {

returnnewModuleSanitizerCoverageLegacyPass(Options);

}