mc-imperial / jfs

Constraint solver based on coverage-guided fuzzing

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Experiment with comparison branch splitting LLVM pass

jryans opened this issue · comments

Based on this article we could implement a LLVM pass that breaks up comparison instructions into byte comparison instructions.

The difficulty here is how to get this pass into JFS's compilation pipeline. I don't really want to use a modified version of LLVM so ideally we'd build this as a clang or opt plug-in. If we do this we can either

  • Have Clang run the pass before coverage instrumentation is added but as late as possible.
  • Just emit LLVM IR with clang, run the passes we want using the opt tool and then run clang again on the object file to link everything together.

... or another idea?

A question is also whether we want to perform transformation to the runtime library too.