add inst_ratio

Author: spinpx

docs/environment_variables.md

@@ -8,6 +8,7 @@
 - `ANGORA_OUTPUT_COND_LOC=1` : (Debug option) Output the location of each predicate during compiling.
 - `ANGORA_TAINT_CUSTOM_RULE=/path/to/object` : object contains those proxy function (how to propagate taints), e.g. `ANGORA_TAINT_CUSTOM_RULE=~/angora/bin/lib/zlib-func.o` . You should add it as custom type in the file passed by `ANGORA_TAINT_RULE_LIST` first.
 - `ANGORA_TAINT_RULE_LIST=/path/to/list` : DataFlowSanitizer’s [ABI list](https://clang.llvm.org/docs/DataFlowSanitizer.html), e.g. `ANGORA_TAINT_RULE_LIST=~/angora/bin/rules/zlib_abilist.txt`.
+- `ANGORA_INST_RATIO`: 
 
 # Environment variables for running
 

llvm_mode/pass/AngoraPass.cc

@@ -63,6 +63,7 @@ class AngoraLLVMPass : public ModulePass {
   u32 CidCounter;
   unsigned long int RandSeed = 1;
   bool is_bc;
+  unsigned int inst_ratio = 100;
 
   // Const Variables
   DenseSet<u32> UniqCidSet;
@@ -117,6 +118,7 @@ class AngoraLLVMPass : public ModulePass {
   bool runOnModule(Module &M) override;
   u32 getInstructionId(Instruction *Inst);
   u32 getRandomBasicBlockId();
+  bool skipBasicBlock();
   u32 getRandomNum();
   void setRandomNumSeed(u32 seed);
   u32 getRandomContextId();
@@ -145,6 +147,8 @@ char AngoraLLVMPass::ID = 0;
 
 u32 AngoraLLVMPass::getRandomBasicBlockId() { return random() % MAP_SIZE; }
 
+bool AngoraLLVMPass::skipBasicBlock() { return (random() % 100) >= inst_ratio; }
+
 // http://pubs.opengroup.org/onlinepubs/009695399/functions/rand.html
 u32 AngoraLLVMPass::getRandomNum() {
   RandSeed = RandSeed * 1103515245 + 12345;
@@ -222,6 +226,14 @@ void AngoraLLVMPass::initVariables(Module &M) {
     errs() << "Input is LLVM bitcode\n";
   }
 
+  char* inst_ratio_str = getenv("ANGORA_INST_RATIO");
+  if (inst_ratio_str) {
+    if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || !inst_ratio ||
+        inst_ratio > 100)
+      FATAL("Bad value of ANGORA_INST_RATIO (must be between 1 and 100)");
+  }
+  errs() << "inst_ratio: " << inst_ratio << "\n";
+
   // set seed
   srandom(ModId);
   setRandomNumSeed(ModId);
@@ -365,9 +377,9 @@ void AngoraLLVMPass::initVariables(Module &M) {
 // Coverage statistics: AFL's Branch count
 // Angora enable function-call context.
 void AngoraLLVMPass::countEdge(Module &M, BasicBlock &BB) {
-  if (!FastMode)
+  if (!FastMode || skipBasicBlock())
     return;
-
+  
   // LLVMContext &C = M.getContext();
   unsigned int cur_loc = getRandomBasicBlockId();
   ConstantInt *CurLoc = ConstantInt::get(Int32Ty, cur_loc);