Best Practices for Updating Shared Map on Control Flow Instructions

[kevin-valerio]

Hello,

I am making some experimentations with WASMI. My goal is to update a shared map whenever a new control flow instruction is hit, so that I could use that map in my fuzzer to fetch the coverage.

I am uncertain about the optimal location to update this map. One potential spot I identified is push_frame, but I would appreciate any opinions or recommendations on this approach.

Thanks! :)

[Robbepop]

Hi @kevin-valerio , what exactly do you mean with "shared map"? Translation? Execution? Anything else?
And what exactly do you mean with "a new control flow instruction is hit"?

[kevin-valerio]

I see. I wasn't aware of this.

But even if those instructions are lost, it doesn't matter, I would just need to detect when WASMI engine is entering a new branch, right, and then update my map from there. The point is only to track the WASM coverage, even if those specific instructions aren't there after translation.

[Robbepop]

As I have previously mentioned, not only the instructions are lost but all information associated to Wasm control flow is lost. So you need to preserve it if you want to use this information during Wasm execution. Wasmi bytecode only has low-level branching instructions such as br, br_le etc.

[kevin-valerio]

As far as I understand, any branch redirection will ultimately call branch_to, why couldn't that be used a hook to track branch flow?

[Robbepop]

It could technically be used but you wouldnt know if you came or exited from a Wasm if, block or loop control flow construct. If that suffices your needs you should be fine.

[kevin-valerio]

Thanks for your help :)