froz42 / funcheck

A tool for checking functions calls return protections

A tool for checking functions calls return protections. Report Bug · Request Feature

Table of Contents

1. About The Project
2. Getting Started
   • Run requirements
   • Quick install
   • Build instructions
3. Usage
   • Basic usage
   • Options
4. Contributing
5. License

About The Project

Funcheck is a tool for checking functions calls return protections. It check if it is protected at runtime by making each call fail one by one and check if the program doesn't crash and handle the errors. This tool only works on Linux for now. *this tool can have undefined behavior on threaded programs (WIP)

You can see the list of handled functions and how to add new ones here: Hooked functions

Getting Started

Run requirements

• A GNU/Linux distribution
• addr2line or llvm-symbolizer for getting symbolized stack traces (we advise you to use llvm-symbolizer since it gives more information)

Quick install

bash -c 'bash <(curl -s https://raw.githubusercontent.com/tmatis/funcheck/main/scripts/install.sh)'

You can choose to install temporarily, permanently or uninstall the tool. If you you want to update the tool, you can run the same command.

You can now use the funcheck command. (run funcheck --help for more information how to use it)

Build instructions

Requirements

• A modern version of gcc
• make

Build

You need to build both the funcheck binary and the libfuncheck.so library.

Clone the repository

git clone https://github.com/tmatis/funcheck.git
cd funcheck

Build the libfuncheck.so library

cd library
make

Build the funcheck binary

cd ../host
make

You now have the funcheck binary in the host directory and the libfuncheck.so library in the library directory.

You can launch ./funcheck --help to see how to use it.

You can add the host directory to your PATH to be able to use the funcheck command from anywhere.

(back to top)

Usage

Basic usage

funcheck [OPTIONS] ./program [PROGRAM PARAMETERS]

Options

• -h, --help : Display the help message
• -v, --version : Display the version
• -t, --test-functions : Specify the functions to test --test-functions='malloc, calloc, realloc'
• -i, --ignore-functions : Specify the functions to ignore --ignore-functions='malloc, calloc, realloc'
• -j, --json-output : Output the result in json format
• -a, --track-allocations: Track memory allocations
• -o, --all-output : Output stdout and stderr of every test
• -c, --abort-as-crash : Treat abort() as a crash
• -b, --complete-backtrace : Keep unknowns functions and utils functions in backtrace
• -s --show-current-test : Show the current actually processed by funcheck

(back to top)

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement". Don't forget to give the project a star! Thanks again!

1. Fork the Project
2. Create your Feature Branch (git checkout -b yourlogin/amazingfeature)
3. Commit your Changes (git commit -m '<gitmoji> Add some AmazingFeature')
4. Push to the Branch (git push origin yourlogin/amazingfeature)
5. Open a Pull Request

(back to top)

License

Funcheck - A tool for checking functions calls return protections Copyright (C) 2023 Theo Matis

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.

(back to top)

funcheck's Issues

Get started / readme

`pthread.h`

--help -h

test second iteration of function in a loop

Is your feature request related to a problem? Please describe.
If an allocation in used more that one time in a loop for example the program will not detect the probleme in the second iteration

Describe the solution you'd like
will test second iteration if the usage count is > 1

Additional context
It should detect the memory leak in this code:

char *malloc_function(void)
{
	return (malloc(1000));
}

int main(void)
{
	void *ptr = malloc_function();
	if (ptr == NULL)
		return (1);
	free(ptr);

	void *array[10];

	for (int i = 0; i < 10; i++)
	{
		array[i] = malloc(1000);
		if (array[i] == NULL)
		{
			printf("it fail %i\n", i);
			return (0);
		}
		memset(array[i], 0, 1000);
	}
	
	for (int i = 0; i < 10; i++)
		free(array[i]);

	ptr = malloc_function();
	memset(ptr, 0, 1000);
	free(ptr);
}

Code cleaning

• clean library
• #67

`sys/epoll.h`

--all-stdout -a

Write json tests

Fix wrong backtrace

`fcntl.h`

--version -v

bash script

Options

• #14
• #15
• #16
• #17
• #18
• #19
• #20
• #21
• #22

Handle library errors

check if every function in library is protected and write a colored error message if not,
I think to avoid a complex mutex system we can write the message on library side as well as warning

not working

Ubuntu clang version 12.0.0-3ubuntu1~20.04.5
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
Found candidate GCC installation: /usr/bin/../lib/gcc/x86_64-linux-gnu/10
Found candidate GCC installation: /usr/bin/../lib/gcc/x86_64-linux-gnu/9
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/10
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/9
Selected GCC installation: /usr/bin/../lib/gcc/x86_64-linux-gnu/10
Candidate multilib: .;@m64
Selected multilib: .;@m64

Crash with no test SIGFPE

No test ran
Time: 0 ms
fish: Job 1, './funcheck ./a.out' terminated by signal SIGFPE (Floating point exception)

fix crash type detection

`stdlib.h`

42 Paris MLX lib not working

Describe the bug
The tool is stuck on function fetching when using it on a program that use the MLX

To Reproduce
Steps to reproduce the behavior:

• Use on any MLX project

Expected behavior
Should work like every other program

Add option --show-current-test -s

Is your feature request related to a problem? Please describe.
When a infinite loop occur we don't know where the problem is

Describe the solution you'd like
Add an option --show-current-test -s that show the backtrace of the tested test.

remove all reference to leaks (replace it by allocation)

Leaks is not a good term for allocation, since we do not check if the memory keep growing or if a reference to a pointer is lost, it is better to rename all reference

tech documentation

Create an help message with all options

option to track leaks or not

--ignore-functions='malloc calloc' -i

Test json output

behavior when program not found

./funcheck -t 'malloc' lsmake
-------------------- funcheck v2 indev --------------------
Command line: lsmake

[Warning] llvm-symbolizer not found, falling back to addr2line
[ERROR] execvpe failed: No such file or directory
addr2line: '(null)': No such file

option to treat abort as a crash (disabled by default)

license

Deadlock on threaded programs

node -h for example

I think we must implement a queue system

• #79

--test-functions='malloc calloc' -t

--track-leaks -L

Rework the record of fd

If we keep this system the memeory could keep growing if the program output or input massive amount of char

Release pipeline

Automated build pipeline

--json-output -j

⭐ Better end of program

Introduction

Until now when a program failed or run successfully we had only those output:

OR

it's a bit disappointing, we could have a better output a bit like jest:

Proposition

I imagine the output like this:

Success case

Function tests:  20 passed, 20 in total
Time:            5 min 1 sec
Success rate:    100 % 
Ran all test

Failed case

Function tests:  5 failed,  20 passed, 25 in total
Time:            5 min 1 sec
Success rate:    80 % 
Ran all test

no test ran because of crash in function fetch

No test ran because of a crash in functions fetching

Put colors where it is useful !

Tech

Tools you will probably need:

You can do all this work by using

• <stdio.h>: for printf or fprintf or snprintf
• "time/time.h": for recording the time elapsed and the time string
• "utils/color.h": defines for the colors

Noticeable points

• Be sure to create one or more sub-file in the output folder to handle the output
• Remove the old output at the end of the program
• Be careful to not break the JSON output (must be only displayed in pretty output)
• Write Doxygen doc
• Make non exposed function static

commits

All commit must have this format:
<gitmoji> message why you modified

Add more symbolizer

multiple version of clang-symbolizer

rename test_allocation and allocation fetch

`sys/socket.h`

Allocation tracking in tested function

When malloc is called inside hooked function the allocation in not tracked

clean host

`sys/select.h`

options params

parse arguments:
--verbose
--check-leaks
--version
--show-all-stdout
--raw-stdin

fix potential race condition

Implement functions hook

• unistd.h
• stdio.h
• #53
• #55
• #57
• poll.h
• #59
• #61
• #64
• signal.h
• string.h
• sys/wait.h
• sys/stat.h
• sys/mman.h
• semaphore.h

Tutorial

--simple-output -o

Colorful output

Log levels:

• FATAL: an error from the program happened
• ERROR: an error from the user happened
• WARNING: an problem that does not force the program to quit

I want to inspire myself from serve logs:

We need reflexion for backtrace output

Installation script

Provide a little installation script (with pretty colors !) that will install the latest stable tag version built from the pipeline

• #73
• #74