Skip to content

Latest commit

 

History

History
156 lines (112 loc) · 6.71 KB

README.md

File metadata and controls

156 lines (112 loc) · 6.71 KB

To replicate the experimental results on APIMU4C, we provide the pre-built files for the whole APIMU4C benchmark (APIMU4C-project-case and APIMU4C-single-file-case) so that we can directly run APICAD. Besides, in order to facilitate reproduction, we also provide instructions to build the benchmark and real-world projects.

How to build the packages

For the current .bc files, we can directly do the evaluation on them.

Certainly, we can download the programs from the website, then build them and generate .bc files for them by apicad build and apicad generate-bc etc.

Follow APISAN's instructions. we can also obtain the .as files generated by APISAN in the same manner (except for Linux 5.15, since compiling it needs the version of Clang >= 10.0.1, but APISAN is developed on the version of Clang 3.6).

Get the packages

APIMU4C Single-File-Case

Because the items in this benchmark are single-crafted files, we can go to the folder of the APIMU4C dataset and then run the command below to build them along with the evaluation, for example:

compsac19/APIMU4C/API_Misuse_Benchmark$ cd CWE252_Unchecked_Return_Value/
compsac19/APIMU4C/API_Misuse_Benchmark/CWE252_Unchecked_Return_Value$ apicad evaluate

APIMU4C Project-Case

This benchmark contains three old version projects (Curl, Httpd, OpenSSL). In general, the building process is similar to the process of these same three real-world projects. Therefore, the general instructions can refer to the real-world part of this README. Because some bugs in the benchmark need to be compiled with specific options, here we focus on explaining how to handle such situations.

For Curl, there are bugs that need to be compiled with polarssl, mbedtls and openssl enabled. By default, openssl should be compiled with. Install openssl by package management: apt-get install libssl-dev. For the other two sources:

  • polarssl

    install pre-dependencies:

    $ apt-get install wget
$ wget http://launchpadlibrarian.net/195987839/libpolarssl7_1.3.9-2.1_amd64.deb
$ wget http://launchpadlibrarian.net/195987837/libpolarssl-dev_1.3.9-2.1_amd64.deb
$ dpkg -i libpolarssl7_1.3.9-2.1_amd64.deb
$ dpkg -i libpolarssl-dev_1.3.9-2.1_amd64.deb

    compile with the option: --without-ssl --with-polarssl

  • mbedTLS

    install pre-dependencies:

    $ apt install libmbedtls-dev

    compile with the option: --without-ssl --with-mbedtls

For Httpd, be sure to enable mod-lua & mod_heartmonitor during config by the command like apicad build ./configure --with-apr-util=/usr/local/apr/bin/apu-1-config --enable-lua --enable-heartmonitor.

No special additional option is needed for OpenSSL, so just compile it with APICAD to build it.

Real-world projects

Curl

In the docker of this artifact (base path is /apicad/database/real-world/):

# Pre-Dependencies
$ apt-get install libssl-dev cmake # May have options to confirm
$ unzip curl-c40914db.zip
$ cd curl-c40914db
# Build
curl-c40914db$ mkdir build
curl-c40914db$ cd build
curl-c40914db$ apicad build cmake ..
curl-c40914db$ apicad build make
curl-c40914db$ apicad generate-bc -target curl
curl-c40914db$ apicad generate-bc

Httpd

In the docker of this artifact (base path is /apicad/database/real-world/):

# Pre-Dependencies (see https://httpd.apache.org/docs/current/install.html#requirements)
$ tar -xvf httpd-2.4.51.tar.gz
$ curl https://dlcdn.apache.org//apr/apr-1.7.0.tar.gz > apr-1.7.0.tar.gz
$ curl https://dlcdn.apache.org//apr/apr-util-1.6.1.tar.gz > apr-util-1.6.1.tar.gz
$ curl https://nchc.dl.sourceforge.net/project/pcre/pcre/8.45/pcre-8.45.tar.gz > pcre-8.45.tar.gz
$ tar -xvf apr-1.7.0.tar.gz
$ tar -xvf apr-util-1.6.1.tar.gz
$ tar -xvf pcre-8.45.tar.gz
$ cd apr-1.7.0
apr-1.7.0$ ./configure --prefix=/usr/local/apr
apr-1.7.0$ make && make install && cd ../apr-util-1.6.1
apr-util-1.6.1$ ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr 
apr-util-1.6.1$ make && make install && cd ../pcre-8.45
pcre-8.45$ ./configure && make && make install && cd ../httpd-2.4.51
# Build
httpd-2.4.51$ apicad build ./configure --with-apr-util=/usr/local/apr-util/bin/apu-1-config
httpd-2.4.51$ apicad build make
httpd-2.4.51$ apicad generate-bc -target httpd
httpd-2.4.51$ apicad generate-bc

OpenSSL

In the docker of this artifact (base path is /apicad/database/real-world/):

# Pre-Dependencies
$ unzip openssl-0299094c.zip
$ cd openssl-0299094c
# Build
openssl-0299094c$ chmod 744 ./Configure # May need to change the permission
openssl-0299094c$ apicad build ./Configure
openssl-0299094c$ apicad build make
openssl-0299094c$ apicad generate-bc -target openssl
openssl-0299094c$ apicad generate-bc [-obj]

Linux

To compile Linux kernel 5.15, the version of Clang should >= 10.0.1 according to the documentation linux/Documentation/Changes#Current Minimal Requirements of the Linux 5.15 package. The default version of Clang is 12.0.0, so it is satisfied the basic condition.

In general, to normally compile the kernel:

# Pre-Dependencies
$ apt-get install build-essential libncurses-dev bison flex libssl-dev libelf-dev
# Build
$ export LLVM_COMPILER=clang
$ make CC=wllvm HOSTCC=wllvm allyesconfig # Just do this or make a .config file by other ways
# Note: may need to manually add -g to KBUILD_USERCFLAGS & KBUILD_USERCXXFLAGS & KBUILD_CFLAGS in Makefile
$ make CC=wllvm HOSTCC=wllvm
$ apicad generate-bc --target vmlinux # If the memory is big enough, we can just generate .bc for vmlinux. Otherwise, may resulting in out of memory and be killed.
# Other ways:
$ apicad generate-bc -linux # Generate for each built-in.a in subfolders (only collect for the file in the top hier of subfolder such as fs/built-in.a).
# For sure, we can just generate .bc files for all object files
$ apicad generate-bc -obj

For the targets in different hardware architectures, cross-compile is required. We can refer to Clang_CrossCompilation and cross_compile_linux_with_llvm to see more details.