1 // Copyright (c) 2019 Google LLC 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #ifndef SOURCE_FUZZ_FUZZER_PASS_OBFUSCATE_CONSTANTS_H_ 16 #define SOURCE_FUZZ_FUZZER_PASS_OBFUSCATE_CONSTANTS_H_ 17 18 #include <vector> 19 20 #include "source/fuzz/fuzzer_pass.h" 21 22 namespace spvtools { 23 namespace fuzz { 24 25 // A fuzzer pass for turning uses of constants into more complex forms. 26 // Examples include replacing 'true' with '42 < 52', and replacing '42' with 27 // 'a.b.c' if 'a.b.c' is known to hold the value '42'. 28 class FuzzerPassObfuscateConstants : public FuzzerPass { 29 public: 30 FuzzerPassObfuscateConstants( 31 opt::IRContext* ir_context, TransformationContext* transformation_context, 32 FuzzerContext* fuzzer_context, 33 protobufs::TransformationSequence* transformations); 34 35 void Apply() override; 36 37 private: 38 // Applies 0 or more transformations to potentially obfuscate the constant 39 // use represented by |constant_use|. The |depth| parameter controls how 40 // deeply obfuscation can recurse. 41 void ObfuscateConstant(uint32_t depth, 42 const protobufs::IdUseDescriptor& constant_use); 43 44 // This method will try to turn |constant_use|, required to be a use of a 45 // boolean constant, into a binary expression on scalar constants, which may 46 // themselves be recursively obfuscated. 47 void ObfuscateBoolConstant(uint32_t depth, 48 const protobufs::IdUseDescriptor& constant_use); 49 50 // This method will try to turn |constant_use|, required to be a use of a 51 // scalar constant, into the value loaded from a uniform known to have the 52 // same value as the constant (if one exists). 53 void ObfuscateScalarConstant(uint32_t depth, 54 const protobufs::IdUseDescriptor& constant_use); 55 56 // Applies a transformation to replace the boolean constant usage represented 57 // by |bool_constant_use| with a binary expression involving 58 // |float_constant_id_1| and |float_constant_id_2|, which must not be equal 59 // to one another. Possibly further obfuscates the uses of these float 60 // constants. The |depth| parameter controls how deeply obfuscation can 61 // recurse. 62 void ObfuscateBoolConstantViaFloatConstantPair( 63 uint32_t depth, const protobufs::IdUseDescriptor& bool_constant_use, 64 uint32_t float_constant_id_1, uint32_t float_constant_id_2); 65 66 // Similar to the above, but for signed int constants. 67 void ObfuscateBoolConstantViaSignedIntConstantPair( 68 uint32_t depth, const protobufs::IdUseDescriptor& bool_constant_use, 69 uint32_t signed_int_constant_id_1, uint32_t signed_int_constant_id_2); 70 71 // Similar to the above, but for unsigned int constants. 72 void ObfuscateBoolConstantViaUnsignedIntConstantPair( 73 uint32_t depth, const protobufs::IdUseDescriptor& bool_constant_use, 74 uint32_t unsigned_int_constant_id_1, uint32_t unsigned_int_constant_id_2); 75 76 // A helper method to capture the common parts of the above methods. 77 // The method is used to obfuscate the boolean constant usage represented by 78 // |bool_constant_use| by replacing it with '|constant_id_1| OP 79 // |constant_id_2|', where 'OP' is chosen from either |greater_than_opcodes| 80 // or |less_than_opcodes|. 81 // 82 // The two constant ids must not represent the same value, and thus 83 // |greater_than_opcodes| may include 'greater than or equal' opcodes 84 // (similar for |less_than_opcodes|). 85 void ObfuscateBoolConstantViaConstantPair( 86 uint32_t depth, const protobufs::IdUseDescriptor& bool_constant_use, 87 const std::vector<SpvOp>& greater_than_opcodes, 88 const std::vector<SpvOp>& less_than_opcodes, uint32_t constant_id_1, 89 uint32_t constant_id_2, bool first_constant_is_larger); 90 91 // A helper method to determine whether input operand |in_operand_index| of 92 // |inst| is the id of a constant, and add an id use descriptor to 93 // |candidate_constant_uses| if so. The other parameters are used for id use 94 // descriptor construction. 95 void MaybeAddConstantIdUse( 96 const opt::Instruction& inst, uint32_t in_operand_index, 97 uint32_t base_instruction_result_id, 98 const std::map<SpvOp, uint32_t>& skipped_opcode_count, 99 std::vector<protobufs::IdUseDescriptor>* constant_uses); 100 101 // Returns a vector of unique words that denote constants. Every such constant 102 // is used in |FactConstantUniform| and has type with id equal to |type_id|. 103 std::vector<std::vector<uint32_t>> GetConstantWordsFromUniformsForType( 104 uint32_t type_id); 105 }; 106 107 } // namespace fuzz 108 } // namespace spvtools 109 110 #endif // SOURCE_FUZZ_FUZZER_PASS_OBFUSCATE_CONSTANTS_H_ 111