Source Code Analysis for Security through LLVM Lu Zhao HP Fortify - - PowerPoint PPT Presentation

▶
source code analysis for security through llvm
SMART_READER_LITE
LIVE PREVIEW

Source Code Analysis for Security through LLVM Lu Zhao HP Fortify - - PowerPoint PPT Presentation

Sep 11, 2022 15 likes •337 views

Source Code Analysis for Security through LLVM Lu Zhao HP Fortify lu.zhao@hp.com Static Code Analyzer for Security Static Code Analyzer for Security (HP Fortify SCA) C/C++ Java Vulnerabilities LLVM Language independent Services C/C++ Swift

slide-1
SLIDE 1

Source Code Analysis for Security through LLVM

Lu Zhao HP Fortify lu.zhao@hp.com

slide-2
SLIDE 2

Static Code Analyzer for Security

slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7

Static Code Analyzer for Security (HP Fortify SCA)

C/C++ Vulnerabilities Java

slide-8
SLIDE 8

LLVM Language‐independent Services

C/C++ Objective‐C Swift 22nd

slide-9
SLIDE 9

Bitcode for Source Analysis?

C/C++ Objective‐C Swift 22nd Vulns

slide-10
SLIDE 10

Bitcode for Source Analysis?

C/C++ Objective‐C Swift 22nd Vulns

slide-11
SLIDE 11

HP Fortify SCA for Objective‐C

C/C++ Objective‐C Swift 22nd Vulns clang -gsrc clang -g

slide-12
SLIDE 12

Bitcode with Enhanced Source Info

C/C++ Objective‐C Swift Vulns clang -g clang -gsrc swift -gsrc frontend -gsrc

slide-13
SLIDE 13

Bitcode with Enhanced Source Info

C/C++ Objective‐C Swift Vulns clang -g clang -gsrc swift -gsrc frontend -gsrc cross‐language analysis

slide-14
SLIDE 14

Why we cannot do this today?

C/C++ Objective‐C Swift Vulns clang -g

slide-15
SLIDE 15

Objective‐C Static Taint Analyzer

@implementation HtmlViewController

  • (void)viewDidLoad {

if (_content) { … } else { // Display the "About iGoat" splash screen as a default. …

NSString *fileContents = [[NSString alloc] initWithContentsOfFile:filePath encoding:NSUTF8StringEncoding error:&error];

NSString *version = [[[NSBundle mainBundle] infoDictionary]

  • bjectForKey:@"CFBundleShortVersionString"];

[self.webView loadHTMLString:[NSString stringWithFormat:fileContents, version] baseURL:baseURL];

} } … @end

15

slide-16
SLIDE 16

Objective‐C Static Taint Analyzer

@implementation HtmlViewController

  • (void)viewDidLoad {

if (_content) { … } else { // Display the "About iGoat" splash screen as a default. …

NSString *fileContents = [[NSString alloc] initWithContentsOfFile:filePath encoding:NSUTF8StringEncoding error:&error];

NSString *version = [[[NSBundle mainBundle] infoDictionary]

  • bjectForKey:@"CFBundleShortVersionString"];

[self.webView loadHTMLString:[NSString stringWithFormat:fileContents, version] baseURL:baseURL];

} } … @end

16

taint source by API doc

slide-17
SLIDE 17

Objective‐C Static Taint Analyzer

@implementation HtmlViewController

  • (void)viewDidLoad {

if (_content) { … } else { // Display the "About iGoat" splash screen as a default. …

NSString *fileContents = [[NSString alloc] initWithContentsOfFile:filePath encoding:NSUTF8StringEncoding error:&error];

NSString *version = [[[NSBundle mainBundle] infoDictionary]

  • bjectForKey:@"CFBundleShortVersionString"];

[self.webView loadHTMLString:[NSString stringWithFormat:fileContents, version] baseURL:baseURL];

} } … @end

17

taint sink by API doc

slide-18
SLIDE 18

Objective‐C Static Taint Analyzer

@implementation HtmlViewController

  • (void)viewDidLoad {

if (_content) { … } else { // Display the "About iGoat" splash screen as a default. …

NSString *fileContents = [[NSString alloc] initWithContentsOfFile:filePath encoding:NSUTF8StringEncoding error:&error];

NSString *version = [[[NSBundle mainBundle] infoDictionary]

  • bjectForKey:@"CFBundleShortVersionString"];

[self.webView loadHTMLString:[NSString stringWithFormat:fileContents, version] baseURL:baseURL];

} } … @end

18

taint source taint sink

slide-19
SLIDE 19

Objective‐C Static Taint Analyzer

19

  • Our taint source or taint sink is written in a declarative

fashion, which is matched by the analyzer against its method signature.

NodeType: TaintSource ClassName: NSArray | NSString | NSData | NSConstantString MethodSig: arrayWithContentsOfFile: | (string|init)WithContentsOfFile:(usedE|e)ncoding:err

  • r: |initWithContentsOfFile: |

(data|init)WithContentsOfFile:(options:error:)? Output: return TaintFlags: FILE_SYSTEM,XSS

slide-20
SLIDE 20

A Source‐friendly IR

20

  • A method signature

public class NSString extends NSObject { public virtual NSString* initWithContentsOfFile$encoding$error$( NSString* this, …); }

slide-21
SLIDE 21

From Bitcode to Source

int convert(unsigned u) { return 0; }

21

define i32 @convert(i32 %u) #0 { entry: ret i32 0 } !4 = metadata !{i32 786478, metadata !1, metadata !5, metadata !"convert", metadata !"convert“,...} ; [ DW_TAG_subprogram ] [line 25] [def] [convert]

slide-22
SLIDE 22

From Bitcode to Source

NamedMDNode *M_Nodes = M->getNamedMetadata("llvm.dbg.cu"); DIArray SPs = CU.getSubprograms(); for (unsigned i2 = 1, e2 = SPs.getNumElements(); i2 != e2; ++i2) { DISubprogram DISP(SPs.getElement(i2)); DICompositeType DIC(DISP.getType()); DIArray Tys = DIC.getTypeArray(); // Tys[0] return type // others are parameter types }

22

slide-23
SLIDE 23

No Metadata for Declarations

extern int convert(unsigned u);

23

declare i32 @convert(i32 %u) #2;

No metadata describing @convert.

slide-24
SLIDE 24

No Metadata for Declarations

extern int convert(unsigned u);

24

declare i32 @convert(i32 %u) #2;

Metadata emission is a subprocess during code

  • emission. No code generation, no metadata.
slide-25
SLIDE 25

Generate Bitcode with Rich Source Info

25

  • Decouple metadata emission and code

generation.

  • Control rich metadata emission by using ‐gsrc

$ clang –gsrc –O0 –c –emit-llvm –S HtmlViewController.m

slide-26
SLIDE 26

Bitcode with Rich Source Info

declare extern_weak i8* @"-[NSString initWithContentsOfFile:encoding:error:]" (%1*, i8*, %1*, i64, %3**) !1538 = metadata !{i32 786478, metadata !4, metadata !302, metadata !"-[NSString initWithContentsOfFile:encoding:error:]" ,...} ; [ DW_TAG_subprogram ]...

26

slide-27
SLIDE 27

Bitcode with Rich Source Info

Type signature: (NSString*,

  • bjc_selector*, NSString*,

NSStringEncoding, NSError**) -> NSString* typedef: NSStringEncoding, NSUInteger, long unsigned int

27

slide-28
SLIDE 28

A Source‐friendly IR

28

public class NSString extends NSObject { public virtual NSString* initWithContentsOfFile$encoding$error$( NSString* this, …); }

  • NST
slide-29
SLIDE 29

Bitcode with Enhanced Source Info

C/C++ Swift clang -gsrc clang Vulns taint analysis Objective‐C

slide-30
SLIDE 30

Small Modification Big Opportunity

  • Entire patch to Clang/LLVM has 543 lines for

3.3 (git diff)

  • Upgrading to 3.5

30

slide-31
SLIDE 31

Small Modification Big Opportunity

  • All frontends should implement this feature

31

C/C++ Swift Vulns taint analysis Objective‐C clang -gsrc swift -gsrc frontend -gsrc