[libFuzzer] Portably disassemble and find calls to "sanitizer_cov_trace_pc_guard".

[zturner]

lib/Fuzzer/FuzzerTracePC.cpp

162

Can you put the continue on a new line?

lib/Fuzzer/FuzzerUtilWindows.cpp

182

dumpbin is not guaranteed to be in the user's path. Is this going to cause a problem? Also I believe dumpbin will use Intel syntax for the disassembly. Does objdump use AT&T syntax by default? If so, will this cause a problem?

[mpividori]

lib/Fuzzer/FuzzerTracePC.cpp

162

Ok, I will do that. But, in line 169, the continue is in the same line too. Do you want me to update that too?

lib/Fuzzer/FuzzerUtilWindows.cpp

182

@zturner you are right. I didn't realize of that since I was using a terminal with the VS environment.
We can use : link /dump /disasm , which is included in PATH, but I couldn't find information if the /dump option is a new option or it is also included in old versions.
Also, I think we should consider the case when users only using llvm tools, so in that case we could look for: llvm-objdump

So, I propose to do this:
First: See if dumpbin is present in PATH,
Else: See if link is present in PATH,
Else: See if llvm-objdump is present in PATH,
Else: Fail

Would you agree?

[mpividori]

@zturner , I update diff to include suggestions.

lib/Fuzzer/FuzzerTracePC.cpp

 //===----------------------------------------------------------------------===//
 
 #include "FuzzerCorpus.h"
 #include "FuzzerDefs.h"
 #include "FuzzerDictionary.h"
 #include "FuzzerExtFunctions.h"
 #include "FuzzerIO.h"
 #include "FuzzerTracePC.h"
+#include "FuzzerUtil.h"
 #include "FuzzerValueBitMap.h"
 #include <map>
 #include <sanitizer/coverage_interface.h>
 #include <set>
 #include <sstream>
 
 namespace fuzzer {
 
for (auto &M : CoveredPCsPerModule) {
     std::map<std::string, std::set<int> > UncoveredLines;  // Func+File => lines
     auto &ModuleName = M.first;
     auto &CoveredOffsets = M.second;
     uintptr_t ModuleOffset = ModuleOffsets[ModuleName];
     std::sort(CoveredOffsets.begin(), CoveredOffsets.end());
     Printf("MODULE_WITH_COVERAGE: %s\n", ModuleName.c_str());
     // sancov does not yet fully support DSOs.
     // std::string Cmd = "sancov -print-coverage-pcs " + ModuleName;
-    std::string Cmd = "objdump -d " + ModuleName +
-        " | grep 'call.*__sanitizer_cov_trace_pc_guard' | awk -F: '{print $1}'";
+    std::string Cmd = DisassembleCmd(ModuleName) + " | " +
+        SearchRegexCmd("call.*__sanitizer_cov_trace_pc_guard");
     std::string SanCovOutput;
     if (!ExecuteCommandAndReadOutput(Cmd, &SanCovOutput)) {
       Printf("INFO: Command failed: %s\n", Cmd.c_str());
       continue;
     }
     std::istringstream ISS(SanCovOutput);
     std::string S;
     while (std::getline(ISS, S, '\n')) {
+      size_t PcOffsetEnd = S.find(':');
+      if (PcOffsetEnd == std::string::npos)
+        continue;
+      S.resize(PcOffsetEnd);
       uintptr_t PcOffset = std::stol(S, 0, 16);
       if (!std::binary_search(CoveredOffsets.begin(), CoveredOffsets.end(),
                               PcOffset)) {
         uintptr_t PC = ModuleOffset + PcOffset;
         auto FileStr = DescribePC("%s", PC);
         if (!IsInterestingCoverageFile(FileStr)) continue;
         if (CoveredFiles.count(FileStr) == 0) {
           UncoveredFiles.insert(FileStr);

lib/Fuzzer/FuzzerUtil.h

 std::string CloneArgsWithoutX(const std::vector<std::string> &Args,
                               const char *X1, const char *X2);
 
 inline std::string CloneArgsWithoutX(const std::vector<std::string> &Args,
                                      const char *X) {
   return CloneArgsWithoutX(Args, X, X);
 }
 
+std::string DisassembleCmd(const std::string &FileName);
+
+std::string SearchRegexCmd(const std::string &Regex);
+
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_UTIL_H

lib/Fuzzer/FuzzerUtilPosix.cpp

FILE *OpenProcessPipe(const char *Command, const char *Mode) {
   return popen(Command, Mode);
 }
 
 const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
                          size_t PattLen) {
   return memmem(Data, DataLen, Patt, PattLen);
 }
 
+std::string DisassembleCmd(const std::string &FileName) {
+  return "objdump -d " + FileName;
+}
+
+std::string SearchRegexCmd(const std::string &Regex) {
+  return "grep '" + Regex + "'";
+}
+
 }  // namespace fuzzer
 
 #endif // LIBFUZZER_POSIX

lib/Fuzzer/FuzzerUtilWindows.cpp

const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
 
   for (const char *It = Cdata; It < End; ++It)
     if (It[0] == Cpatt[0] && memcmp(It, Cpatt, PattLen) == 0)
       return It;
 
   return NULL;
 }
 
+std::string DisassembleCmd(const std::string &FileName) {
+  if (ExecuteCommand("dumpbin > nul") == 0)
+    return "dumpbin /disasm " + FileName;
+  if (ExecuteCommand("llvm-objdump > nul") == 0)
+    return "llvm-objdump -d " + FileName;
+  Printf("libFuzzer: couldn't find tool to disassemble (dumpbin, "
+      "llvm-objdump)\n");
+  exit(1);
+}
+
+std::string SearchRegexCmd(const std::string &Regex) {
+  return "findstr /r \"" + Regex + "\"";
+}
+
 } // namespace fuzzer
 
 #endif // LIBFUZZER_WINDOWS