SLUMPs

Research repository on randomization and superoptimization for WebAssembly/WASM. Corresponding papers:

Superoptimization of WebAssembly Bytecode (MoreVM 2020)

Intro to superoptimization

Given a C program compiled to WASM, SLUMPs generates a new WASM program which is smaller in size, and potentially faster, as we show in the image below.

Prerequisites

Python version 3.7
Download our changed version of Souper. The main reason behind is that we include some extra options to be able of working together with the SLUMPs core. After downloading all the submodules in SLUMPs, build every one of them following the respective instructions in the original repos.

Inside the souper folder:
```
./build_deps.sh
mkdir build
cd build
cmake  ../
make
```
Build wabt toolkit to provide the WASM to WAT conversion for debugging reasons.

Follow this instructions inside the wabt folder:
```
git submodule update --init
mkdir build
cd build
cmake ..
cmake --build .
```
Install the python requirements: pip3 install -r src/requirements.txt

Troubleshooting

SLUMPs shows a fail in the CLANG step: Install emscripten and run it as follows emcc -v <file>.c. Then copy all the include files in the include configuration for SLUMPs.
SLUMPs shows a fail connecting to REDIS: Install Redis in your local pc and ensure that its running, or change the usage of external cache in the Souper config.
SLUMPs doesn't find the souper folder: Check the path in the settings file
SLUMPs fails in the souper opt pass: Check the name for the souper pass (for instance, the extension for Ubuntu can be different to the Mac one).

Config options

Optimization subset strategy: generator-method = subset | onexone | all
Output only different binaries: prune-equal, we calculate the sha256 value for evey WASM program, then we keep only the programs with different sha values.

Change the remaining values to get different results, for instance, add extra arguments to the CLANG step.

How to use it

Run python3 src/slumps.py <file.c> or run it directly on LLVM IR (the 'wasm32-unknown-unknown' target needs to be used during compilation) python3 src/slumps.py <file.ll>

Docker images

To run slumps in an easy way, we provide a Docker image which contains the plumping to work with Souper (our modest changed version), binaryen and wabt. To build it, run: docker build -t slumps:backend -m 8g -f Dockerfile inside the docker_images folder.

If the LLVM build takes to long or fails due to memory lack in the image building: > Increase memory and/or CPU ressources in the docker engine configuration

Slumps dockerized app

Bothg images are avaiable in the docker Hub

The application can be ported to a docker container too. To execute SLUMPs, enter in the src file and build the docker image. Run the following command to start the application docker run -it -v $(pwd)/<logs>:/slumps/src/logs -v $(pwd)/<out folder>:/slumps/src/out jacarte/slumps:app <url to download the program code> <config-options> . Slumps will process the fetched code from the arguments, exporting the results to the out folder volumen. You can specify the config parameters, specify the values of <config-options> as -<namespace>.key <value>. For example, to change the timeout per program use <docker_run> -DEFAULT.timeout 3600 <program_url>, this example changes the timeout to 3600 seconds. The other available options and possible values are listed below.

Namespace	Key	Default value	Comments
DEFAULT	slumpspath	/slumps
	debugfile	/slumps/src/slumps.debug.txt
	outfolder	/slumps/src/out
	print-sha	True
	prune-equal	True
	exit-on-find	False
	generator-method	subset	`all` to superoptimize :)
	candidates-threshold	1
	fail-silently	True
	timeout	3600
	link-wasi	False	Add WASI std lib to create WASM binaries
clang	command	-S -O3 --target=wasm32-unknown-unknown -emit-llvm	You can append extra includess
wasm-ld	command	--no-entry --export-all --allow-undefined -o %s
wabt	path	/slumps/wabt/bin
	wasm2wat	/slumps/wabt/bin/wasm2wat
souper	solver	-z3-path=/slumps/souper/third_party/z3/build/z3
	passname	libsouperPass.so
	souper-debug-level	2
	souper-common	-solver-timeout=1800

Study of memory disclosure vulnerabilities

Slides

Souper new features

We added some features/options to Souper:

souper-subset: Based on the candidate indexes, specify the candidates to be applied, for example -souper-subset=1,2,3,4 or -souper-subset=0,3
souper-valid-count: Search for successful optimizations without replacing
souper-redis-host: Host for redis
souper-redis-pass: Password for redis connection

Issues

Candidates overlapping. For example, in the bitwise_IO problem there are only 36 different programs: Total number of programs 2048. Different sha count 36. Pruned count 2012
LLVM frontend for WASM: This will provide the WASM -> WASM behavior in SLUMPs

olapiv / slumps