Merge branch 'master' of https://github.com/vanhauser-thc/AFLplusplus

4 files changed, 148 insertions, 1 deletions

diff --git a/Makefile b/Makefile
index 0a654db7..5d9a55a6 100644
--- a/Makefile
+++ b/Makefile
@@ -80,6 +80,8 @@ endif
 
 all:	test_x86 test_shm test_python27 ready $(PROGS) afl-as test_build all_done
 
+tests:
+	@cd test ; ./test.sh
 
 help:
 	@echo "HELP --- the following make targets exist:"
@@ -296,7 +298,7 @@ endif
 	cp -r testcases/ $${DESTDIR}$(MISC_PATH)
 	cp -r dictionaries/ $${DESTDIR}$(MISC_PATH)
 
-publish: clean
+#publish: clean
 #	test "`basename $$PWD`" = "afl" || exit 1
 #	test -f ~/www/afl/releases/$(PROGNAME)-$(VERSION).tgz; if [ "$$?" = "0" ]; then echo; echo "Change program version in config.h, mmkay?"; echo; exit 1; fi
 #	cd ..; rm -rf $(PROGNAME)-$(VERSION); cp -pr $(PROGNAME) $(PROGNAME)-$(VERSION); \
diff --git a/docs/ChangeLog b/docs/ChangeLog
index fdf6422a..7beb32c3 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -25,6 +25,8 @@ Version ++2.54d (dev):
   - setting LLVM_CONFIG for llvm_mode will now again switch to the selected
     llvm version. If you setup is correct.
   - fuzzing strategy yields for custom mutator were missing from the UI, added them :)
+  - added "make tests" which will perform checks to see that all functionality
+    is working as expected. this is currently the starting point, its not complete :)
   - libtokencap and libdislocator now compile to the afl_root directory and are
     installed to the .../lib/afl directory when present during make install
   - reducing duplicate code in afl-fuzz
diff --git a/test/test-compcov.c b/test/test-compcov.c
new file mode 100644
index 00000000..bbad3aed
--- /dev/null
+++ b/test/test-compcov.c
@@ -0,0 +1,29 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+
+int main(int argc, char** argv) {
+
+  char *buf;
+
+  if (argc > 1) {
+  
+    if (strcmp(argv[1], "LIBTOKENCAP") == 0)
+      printf("your string was libtokencap\n");
+    else if (strcmp(argv[1], "BUGMENOT") == 0)
+      printf("your string was bugmenot\n");
+    else if (strcmp(argv[1], "BUFFEROVERFLOW") == 0) {
+      buf = malloc(16);
+      strcpy(buf, "TEST");
+      strcat(buf, argv[1]);
+      printf("This will only crash with libdislocator: %s\n", buf);
+      return 0;
+    } else
+      printf("I do not know your string\n");
+  
+  }
+
+  return 0;
+
+}
diff --git a/test/test.sh b/test/test.sh
new file mode 100755
index 00000000..0e2ba52b
--- /dev/null
+++ b/test/test.sh
@@ -0,0 +1,114 @@
+#!/bin/bash
+
+#
+# Ensure we have: test, type, diff -q, echo -e, grep -aqE, timeout
+#
+test -z "" 2> /dev/null || { echo Error: test command not found ; exit 1 ; }
+GREP=`type grep > /dev/null 2>&1 && echo OK`
+TIMEOUT=`type timeout > /dev/null 2>&1 && echo OK`
+test "$GREP" = OK || { echo Error: grep command not found ; exit 1 ; }
+echo foobar | grep -aqE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q, -a and/or -E option ; exit 1 ; }
+echo 1 > test.1
+echo 1 > test.2
+OK=OK
+diff -q test.1 test.2 >/dev/null 2>&1 || OK=
+rm -f test.1 test.2
+test -z "$OK" && { echo Error: diff -q is not working ; exit 1 ; }
+
+ECHO="echo -e"
+$ECHO '\x41' 2>&1 | grep -qE '^A' || {
+  ECHO=
+  test -e /bin/echo && {
+    ECHO="/bin/echo -e"
+    $ECHO '\x41' 2>&1 | grep -qE '^A' || ECHO=
+  }
+}
+test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit 1 ; }
+
+export AFL_EXIT_WHEN_DONE=1
+export AFL_SKIP_CPUFREQ=1
+
+GREY="\\x1b[1;90m"
+GREEN="\\x1b[0;32m"
+RED="\\x1b[0;31m"
+YELLOW="\\x1b[1;93m"
+RESET="\\x1b[0m"
+
+$ECHO "$RESET"
+
+test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
+  ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1
+  AFL_HARDEN=1 ../afl-gcc -o test-instr.harden ../test-instr.c > /dev/null 2>&1
+  test -e test-instr.plain && {
+    $ECHO "$GREEN[+] afl-gcc compilation succeeded"
+    echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
+      diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
+        $ECHO "$RED[!] afl-gcc instrumentation should be different on different input but is not"
+      } || $ECHO "$GREEN[+] afl-gcc instrumentation present and working correctly"
+    } || $ECHO "$RED[!] afl-gcc instrumentation failed"
+    rm -f test-instr.plain.0 test-instr.plain.1
+  } || $ECHO "$RED[!] afl-gcc failed"
+  test -e test-instr.harden && {
+    grep -qa fstack-protector-all test-instr.harden > /dev/null 2>&1 && {
+      $ECHO "$GREEN[+] afl-gcc hardened mode succeeded and is working"
+    } || $ECHO "$RED[!] hardened mode is not hardened"
+    rm -f test-instr.harden
+  } || $ECHO "$RED[!] afl-gcc hardened mode compilation failed"
+  # now we want to be sure that afl-fuzz is working  
+  test -n "$TIMEOUT" && {
+    mkdir -p in
+    echo 0 > in/in
+    $ECHO "$GREY[*] running afl-fuzz, this will take approx 10 seconds"
+    {
+      timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
+    } > /dev/null 2>&1
+    test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
+      $ECHO "$GREEN[+] afl-fuzz is working correctly"
+    } || $ECHO "$RED[!] afl-fuzz is not working correctly"
+    rm -rf in out
+  } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
+  rm -f test-instr.plain
+} || $ECHO "$YELLOW[-] afl is not compiled, cannot test"
+
+test -e ../afl-clang-fast && {
+
+  echo todo: llvm_mode
+
+} || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
+
+gcc -o test-compcov test-compcov.c > /dev/null 2>&1
+
+test -e ../libtokencap.so && {
+  AFL_TOKEN_FILE=token.out LD_PRELOAD=../libtokencap.so ./test-compcov foobar > /dev/null 2>&1
+  grep -q BUGMENOT token.out > /dev/null 2>&1 && {
+    $ECHO "$GREEN[+] libtokencap did successfully capture tokens"
+  } || $ECHO "$RED[!] libtokencap did not capture tokens"
+  rm -f token.out
+} || $ECHO "$YELLOW[-] libtokencap is not compiled, cannot test"
+
+test -e ../libdislocator.so && {
+  {
+    ulimit -c 1
+    LD_PRELOAD=../libdislocator.so ./test-compcov BUFFEROVERFLOW > test.out 2> /dev/null
+  } > /dev/null 2>&1
+  grep -q BUFFEROVERFLOW test.out > /dev/null 2>&1 && {
+    $ECHO "$RED[!] libdislocator did not detect the memory corruption"
+  } || $ECHO "$GREEN[+] libdislocator did successfully detect the memory corruption" 
+  rm -f test.out core test-compcov.core core.test-compcov
+} || $ECHO "$YELLOW[-] libdislocator is not compiled, cannot test"
+
+test -e ../afl-qemu-trace && {
+
+  echo todo: qemu_mode
+  # we will use test-compcov for testing libcompcov
+
+} || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test"
+
+rm -f test-compcov
+
+$ECHO "$GREY[*] all tests completed!"
+$ECHO "$RESET"
+
+# unicorn_mode ?