RepairChain

AIxCC: automated vulnerability repair via LLMs, search, and static analysis

Installation

To install the project, you will need to invoke the following:

make install

After running the above, you will need to create files .openapi.key and .anthropic.key at the root of the repository, which should contain your OpenAPI access key and Anthropic key, respectively.

Examples

To install all of the examples:

make examples

To run an end-to-end example of RepairChain, run the following:

./scripts/repair.sh ./examples/mock-cp

To use parallel workers, run the following:

REPAIRCHAIN_WORKERS=8 ./scripts/repair.sh ./examples/nginx

Usage

RepairChain exposes a simple command-line interface with a single verb, repair, which accepts the path to a configuration file as its sole positional argument, along with a mandatory option --save-to-dir, which specifies the absolute path of the directory to which acceptable patches should be written as unified diffs.

Below is an example invocation of the CLI via Poetry:

poetry run repairchain repair my-project-config.json --save-to-dir ./patches --stop-early --log-level TRACE

To find more details about the available options for the repair verb, run the following:

poetry run repairchain repair --help

Environment Variables

Environment Variable	Default	Description
`REPAIRCHAIN_LOG_LEVEL`	`INFO`	controls the verbosity of logging output (options: TRACE, DEBUG, INFO, WARNING, ERROR, CRITICAL)
`REPAIRCHAIN_WORKERS`	`1`	specifies the number of workers that should be used for parallel tasks
`REPAIRCHAIN_STOP_EARLY`	`true`	instructs repair to stop upon discovery of first acceptable patch
`REPAIRCHAIN_MINIMIZE_FAILURE`	`true`	uses delta-debugging to minimize the failing changes
`REPAIRCHAIN_SANITY_CHECK`	`true`	enables (or disables) sanity checking of the program under repair
`REPAIRCHAIN_EVALUATION_CACHE`	``	if specified, saves the results of patch evaluations to the given file
`REPAIRCHAIN_KASKARA_CACHE`	``	if specified, saves the results of Kaskara indexing to the given file
`REPAIRCHAIN_TIME_LIMIT`	`3600`	time limit (in seconds) on the entire repair process
`REPAIRCHAIN_BUILD_TIME_LIMIT`	`120`	time limit (in seconds) on (incremental) builds
`REPAIRCHAIN_REGRESSION_TIME_LIMIT`	`120`	time limit (in seconds) on running regression test suite
`REPAIRCHAIN_POV_TIME_LIMIT`	`60`	time limit (in seconds) on running PoV
`AIXCC_LITELLM_HOSTNAME`	`http://0.0.0.0:4000`	the URL of the LiteLLM server
`LITELLM_KEY`	`sk-1234`	the secret key to use for LiteLLM
`REPAIRCHAIN_ENABLE_KASKARA`	`true`	enables (or disables) the use of Kaskara for indexing
`REPAIRCHAIN_ENABLE_REVERSION_REPAIR`	`true`	enables (or disables) minimal reversation patching strategy
`REPAIRCHAIN_ENABLE_YOLO_REPAIR`	`true`	enables (or disables) LLM-based patching strategies
`REPAIRCHAIN_ENABLE_TEMPLATE_REPAIR`	`true`	enables (or disables) template-based patching strategies
`REPAIRCHAIN_LOG_TO_FILE`	``	if specified, writes a log to a given file
`REPAIRCHAIN_GENERATE_COMPILE_COMMANDS`	`true`	enables (or disables) the generation of compile_commands.json via bear
`LITELLM_MODEL`	`oai-gpt-4o`	specifies the model that should be used by YOLO
`REPAIRCHAIN_KERNEL_BACKTRACE_PATH`	``	optionally specifies the path to a symbolized kernel backtrace

Input Format

Below is an example of a JSON input file that is provided to RepairChain as input.

{
  "project-kind": "c",
  "image": "repairchain/mock-cp",
  "repository-path": {
    "local": "./mock-cp-src/src/samples",
    "docker": "/src/samples"
  },
  "triggering-commit": "11dafa9a5babc127357d710ee090eb4c0c05154f",
  "sanitizer-report-filename": "./sanitizer.txt",
  "pov-payload-filename": "./mock-cp-src/exemplar_only/cpv_1/blobs/sample_solve.bin",
  "commands": {
    "build": "LOCAL_USER=$(id -u) /usr/local/sbin/container_scripts/cmd_harness.sh build",
    "clean": "git clean -xdf",
    "regression-test": "/usr/local/sbin/container_scripts/cp_tests",
    "crash-template": "/usr/local/sbin/container_scripts/cp_pov __PAYLOAD_FILE__ filein_harness"
  }
}

Output Format

RepairChain writes all acceptable patches that it finds to a specified output directory. Each patch is written as a unified diff (the same format that is expected by DARPA). Below is an example of such a patch.

diff --git a/mock_vp.c b/mock_vp.c
index 9dc6bf0..72678be 100644
--- a/mock_vp.c
+++ b/mock_vp.c
@@ -10,7 +10,8 @@ func_a(){
         printf("input item:");
         buff = &items[i][0];
         i++;
-        fgets(buff, 40, stdin);
+        fgets(buff, 9, stdin);
+        if (i==3){buff[0]= 0;}
         buff[strcspn(buff, "\n")] = 0;
     }while(strlen(buff)!=0);
     i--;

ChrisTimperley / RepairChain

readme