eurecom-s3 / symcc

SymCC: efficient compiler-based symbolic execution
http://www.s3.eurecom.fr/tools/symbolic_execution/symcc.html
GNU General Public License v3.0
773 stars 135 forks source link

Libc wrapper fail to hook when there is a wrapper on it #66

Closed tiedaoxiaotubie closed 3 years ago

tiedaoxiaotubie commented 3 years ago

When I collect the constraints of libtiff, SymCC always lost constraints. So I use gdb to debug it, after which I realized that SymCC failed to hook some critical libc functions, including memcpy and memset, because in libtiff, they use _TIFFmemcpy and _TIFFmemset (see the definition: https://gitlab.com/libtiff/libtiff/-/blob/master/libtiff/tif_unix.c#L338), instead of the original name. (see https://gitlab.com/libtiff/libtiff/-/blob/master/libtiff/tif_dirread.c#L6466).

I think this is a bug, because SymCC can hook these functions successfully as long as I use memset to replace _TIFFmemset.