llvm-security

# LLVM Security Skill This skill covers LLVM-based security features, sanitizers, hardening mechanisms, and secure software development practices. ## Sanitizers ### AddressSanitizer (ASan) Detects memory errors: buffer overflow, use-after-free, use-after-scope. ```bash # Compile with ASan clang -fsanitize=address -g program.c -o program # Key features # - Stack buffer overflow detection # - Heap buffer overflow detection # - Use-after-free detection # - Memory leak detection ``` ### MemorySanitizer (MSan) Detects uninitialized memory reads. ```bash clang -fsanitize=memory -g program.c -o program ``` ### ThreadSanitizer (TSan) Detects data races in multithreaded programs. ```bash clang -fsanitize=thread -g program.c -o program ``` ### UndefinedBehaviorSanitizer (UBSan) Detects undefined behavior at runtime. ```bash clang -fsanitize=undefined -g program.c -o program # Specific checks clang -fsanitize=signed-integer-overflow,null program.c ``` ### Custom Sanitizer Development ```cpp // Implementing custom memory tracking extern "C" void __asan_poison_memory_region(void const volatile *addr, size_t size); extern "C" void __asan_unpoison_memory_region(void const volatile *addr, size_t size); class SecureAllocator { public: void* allocate(size_t size) { // Add red zones around allocation void* ptr = malloc(size + 2 * REDZONE_SIZE); __asan_poison_memory_region(ptr, REDZONE_SIZE); __asan_poison_memory_region((char*)ptr + REDZONE_SIZE + size, REDZONE_SIZE); return (char*)ptr + REDZONE_SIZE; } }; ``` ## Hardening Techniques ### Stack Protection ```bash # Stack canaries clang -fstack-protector-strong program.c # Stack clash protection clang -fstack-clash-protection program.c # Safe stack (separate stacks for safe/unsafe data) clang -fsanitize=safe-stack program.c ``` ### Control Flow Integrity (CFI) ```bash # Forward-edge CFI clang -fsanitize=cfi -flto program.c # Specific CFI schemes clang -fsanitize=cfi-vcall # Virtual call checks clang -fsanitize=cfi-nvcall # Non-virtual member call checks clang -fsanitize=cfi-icall # Indirect call checks ``` ### Shadow Call Stack ```bash # Backward-edge protection (return address protection) clang -fsanitize=shadow-call-stack program.c ``` ### Position Independent Executables ```bash # Full ASLR support clang -fPIE -pie program.c # Position independent code for shared libraries clang -fPIC -shared library.c -o library.so ``` ## Symbolic Execution ### Integration with KLEE ```cpp // Mark symbolic inputs #include <klee/klee.h> int main() { int input; klee_make_symbolic(&input, sizeof(input), "input"); if (input > 0) { // Path 1 } else { // Path 2 } return 0; } ``` ### SymCC (Symbolic Execution via Compilation) Compile-time instrumentation for symbolic execution: - Faster than IR interpretation - Supports complex real-world programs - Integrates with fuzzing workflows ### Symbolic Analysis Tools - **Caffeine**: LLVM-based symbolic executor - **SymSan**: Symbolic execution + sanitizers - **Haybale**: Rust-based LLVM symbolic executor ## Security-Focused Analysis ### Type Checking at Runtime ```cpp // LLVM TypeSanitizer concepts // Track type information through allocations struct TypeInfo { const char* typeName; size_t typeSize; uint64_t typeHash; }; void checkType(void* ptr, TypeInfo expected) { TypeInfo* actual = getTypeInfo(ptr); if (actual->typeHash != expected.typeHash) { reportTypeMismatch(ptr, actual, expected); } } ``` ### Memory Leak Detection ```cpp // LeakSanitizer integration extern "C" void __lsan_do_leak_check(); extern "C" void __lsan_disable(); extern "C" void __lsan_enable(); // Custom leak tracking class PreciseLeakSanitizer { std::unordered_map<void*, AllocationInfo> allocations; public: void recordAlloc(void* ptr, size_t size, const char* file, int line) { allocations[ptr] = {size, file, line, getStackTrace()}; } void recordFree(void* ptr) { allocations.erase(ptr); } void reportLeaks() { for (auto& [ptr, info] : allocations) { fprintf(stderr, "Leak: %zu bytes at %s:%d\n", info.size, info.file, info.line); } } }; ``` ## Exploit Mitigation Implementation ### Return Address Protection ```llvm ; Shadow stack concept in LLVM IR define void @protected_function() { entry: %return_addr = call ptr @llvm.returnaddress(i32 0) call void @shadow_stack_push(ptr %return_addr) ; Function body... %saved_addr = call ptr @shadow_stack_pop() %current_addr = call ptr @llvm.returnaddress(i32 0) %match = icmp eq ptr %saved_addr, %current_addr br i1 %match, label %safe_return, label %attack_detected safe_return: ret void attack_detected: call void @abort() unreachable } ``` ### Pointer Authentication (ARM) ```cpp // Using pointer authentication on ARM64 __attribute__((target("sign-return-address"))) void signed_function() { // Return address is cryptographically signed } ``` ## Secure Compilation Pipeline ### Build Flags Checklist ```bash # Comprehensive hardening CFLAGS="-O2 \ -fstack-protector-strong \ -fstack-clash-protection \ -fcf-protection=full \ -fPIE \ -D_FORTIFY_SOURCE=2 \ -Wformat -Wformat-security \ -fsanitize=cfi -flto" LDFLAGS="-pie \ -Wl,-z,relro \ -Wl,-z,now \ -Wl,-z,noexecstack" ``` ### Compiler Security Checks - `-Wformat-security`: Format string vulnerabilities - `-Warray-bounds`: Array bounds violations - `-Wshift-overflow`: Shift operation overflows - `-Wnull-dereference`: Null pointer dereferences ## Fuzzing Integration ### libFuzzer ```cpp // Fuzz target template extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { // Parse/process Data processInput(Data, Size); return 0; } ``` ### Sanitizer + Fuzzer Combination ```bash # Comprehensive fuzzing setup clang -fsanitize=fuzzer,address,undefined \ -fno-omit-frame-pointer \ -g fuzz_target.c -o fuzzer ``` ## Windows-Specific Security ### Control Flow Guard (CFG) ```bash clang-cl /guard:cf program.c ``` ### SEH (Structured Exception Handling) - LLVM supports Windows SEH - Use for secure exception handling - Integrate with security monitoring ## Resources See Security Features, Sanitizer, and Symbolic Execution sections in README.md for comprehensive tool listings. ## Getting Detailed Information When you need detailed and up-to-date resource links, tool lists, or project references, fetch the latest data from: ``` https://raw.githubusercontent.com/gmh5225/awesome-llvm-security/refs/heads/main/README.md ``` This README contains comprehensive curated lists of: - Security features and hardening (Security Features section) - Sanitizers and memory safety tools (Sanitizer section) - Symbolic execution frameworks (Symbolic Execution section) - Memory leak detectors and runtime checkers