search

draperlaboratory / cbat_tools

Program analysis tools developed at Draper on the CBAT project.
MIT License
102 stars 14 forks source link

Batch Running Scripts #249

Closed philzook58 closed 3 years ago

philzook58 commented 4 years ago

We have some batch running scripts, but it might be nice to consolidate them into something easy for users.

Currently, I run a batch script for all functions in a program via

# prime the cache
echo tar_dirname | parallel --eta --joblog ./results/log --timeout 3000 -j 6 './run_single.sh {} > results/{}' 
cat names.txt | parallel --eta --joblog ./results/log --timeout 1000 -j 6 './run_single.sh {} > results/{}'

Where names.txt is a file with all the function names I want to check and run_single.sh contains

bap wp \
  --function=$1 \
  --num-unroll=0 \
  --no-byteweight \
  --mem-offset \
  --show=bir,paths \
  --compare-post-reg-values=R12,R13,R14,R15,RBX,RSP,RBP,RAX \
  ../binaries/tar_amd64_linux_gcc_o0_dynamic \
  ../binaries/tar_amd64_linux_gcc_o0_dynamic-rewritten

We should have some kind of script that generalizes out these various parameters and passes them through. Also names.txt should be generated easily.

fortunac commented 4 years ago

names.txt can be generated with bap --no-byteweight -dsymbols <binary-name>

fortunac commented 4 years ago

The script should encompasses all of the iterations of running wp on our example binary:

  1. bap -dsymbols --no-byteweight orig > names.txt to get all subroutines
  2. run all subs with mem-offset turned on
  3. grab the sats, and run with mem-offset flag off
  4. grab the sats, and run with all registers specified in the pointer-reg flag
  5. parse the results from the results directory into a giant csv that shows: sub name, z3 result, time, (possibly line count)
fortunac commented 3 years ago

Fixed in #292.