Repository navigation
Deleting C++ FBI! - #117
Open
AndrewQuijano wants to merge 4 commits into
Open
AndrewQuijano wants to merge 4 commits into
AndrewQuijano wants to merge 4 commits into
Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Your checklist for this pull request
Detailed description
Replace the C++ FBI miner with the Python mining and bug-generation pipeline. Consolidating this logic in Python simplifies maintenance and provides the foundation for experimenting with candidate ranking and off-main-path bug placement.
OpenSSL produces the same 234,295 bug identities and counts, with different selections in 471 bugs (~0.2%), confined to CHAFF_STACK_CONST, CHAFF_HEAP_CONST, and CHAFF_DIVZERO.
The discrepancy was traced to query ordering: C++ generates chaff after each individual lval query, while Python updates all DUAs sharing an instruction before generating chaff. This can change the selected extra DUA and consequently the trigger bytes and recorded liveness.
We accept this known chaff selection discrepancy as trying to fix this might end up causing more problems in our Python implementation. Exact historical selection parity is not a requirement for this transition; as the LAVA 1.0 exploitable bugs parity is enforced, which is the most important part for the first paper in deeper bug injection.
I should note, curtail for 5000 DUAs was used in all targets to ensure a quick completion of mining to not be blocked on other LAVA improvements before deprecating the C++ code.
...
Test plan
Confirm CI/CD passes, which it should look identical to C++ on toy.
...
Closing issues
...