aboutsummaryrefslogtreecommitdiff
path: root/unicorn_mode/samples/simple
diff options
context:
space:
mode:
authorDominik Maier <domenukk@gmail.com>2021-02-15 13:52:23 +0100
committerDominik Maier <domenukk@gmail.com>2021-02-15 13:52:23 +0100
commitcebde1f9e69170a27aacfed8befe8b62ac8c6858 (patch)
tree0771da70340bb0458186261af65f8fc10dcd6c35 /unicorn_mode/samples/simple
parent0298ae82b06c9776294c1da15ec278ef35dfa770 (diff)
downloadafl++-cebde1f9e69170a27aacfed8befe8b62ac8c6858.tar.gz
ran black on python scripts
Diffstat (limited to 'unicorn_mode/samples/simple')
-rw-r--r--unicorn_mode/samples/simple/simple_test_harness.py79
-rw-r--r--unicorn_mode/samples/simple/simple_test_harness_alt.py100
2 files changed, 130 insertions, 49 deletions
diff --git a/unicorn_mode/samples/simple/simple_test_harness.py b/unicorn_mode/samples/simple/simple_test_harness.py
index 4a673daf..cd04ad3a 100644
--- a/unicorn_mode/samples/simple/simple_test_harness.py
+++ b/unicorn_mode/samples/simple/simple_test_harness.py
@@ -22,48 +22,81 @@ from unicornafl import *
from unicornafl.mips_const import *
# Path to the file containing the binary to emulate
-BINARY_FILE = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'simple_target.bin')
+BINARY_FILE = os.path.join(
+ os.path.dirname(os.path.abspath(__file__)), "simple_target.bin"
+)
# Memory map for the code to be tested
-CODE_ADDRESS = 0x00100000 # Arbitrary address where code to test will be loaded
+CODE_ADDRESS = 0x00100000 # Arbitrary address where code to test will be loaded
CODE_SIZE_MAX = 0x00010000 # Max size for the code (64kb)
STACK_ADDRESS = 0x00200000 # Address of the stack (arbitrarily chosen)
-STACK_SIZE = 0x00010000 # Size of the stack (arbitrarily chosen)
-DATA_ADDRESS = 0x00300000 # Address where mutated data will be placed
+STACK_SIZE = 0x00010000 # Size of the stack (arbitrarily chosen)
+DATA_ADDRESS = 0x00300000 # Address where mutated data will be placed
DATA_SIZE_MAX = 0x00010000 # Maximum allowable size of mutated data
try:
# If Capstone is installed then we'll dump disassembly, otherwise just dump the binary.
from capstone import *
+
cs = Cs(CS_ARCH_MIPS, CS_MODE_MIPS32 + CS_MODE_BIG_ENDIAN)
+
def unicorn_debug_instruction(uc, address, size, user_data):
mem = uc.mem_read(address, size)
- for (cs_address, cs_size, cs_mnemonic, cs_opstr) in cs.disasm_lite(bytes(mem), size):
+ for (cs_address, cs_size, cs_mnemonic, cs_opstr) in cs.disasm_lite(
+ bytes(mem), size
+ ):
print(" Instr: {:#016x}:\t{}\t{}".format(address, cs_mnemonic, cs_opstr))
+
+
except ImportError:
+
def unicorn_debug_instruction(uc, address, size, user_data):
- print(" Instr: addr=0x{0:016x}, size=0x{1:016x}".format(address, size))
+ print(" Instr: addr=0x{0:016x}, size=0x{1:016x}".format(address, size))
+
def unicorn_debug_block(uc, address, size, user_data):
print("Basic Block: addr=0x{0:016x}, size=0x{1:016x}".format(address, size))
-
+
+
def unicorn_debug_mem_access(uc, access, address, size, value, user_data):
if access == UC_MEM_WRITE:
- print(" >>> Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(address, size, value))
+ print(
+ " >>> Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(
+ address, size, value
+ )
+ )
else:
- print(" >>> Read: addr=0x{0:016x} size={1}".format(address, size))
+ print(" >>> Read: addr=0x{0:016x} size={1}".format(address, size))
+
def unicorn_debug_mem_invalid_access(uc, access, address, size, value, user_data):
if access == UC_MEM_WRITE_UNMAPPED:
- print(" >>> INVALID Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(address, size, value))
+ print(
+ " >>> INVALID Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(
+ address, size, value
+ )
+ )
else:
- print(" >>> INVALID Read: addr=0x{0:016x} size={1}".format(address, size))
+ print(
+ " >>> INVALID Read: addr=0x{0:016x} size={1}".format(address, size)
+ )
+
def main():
parser = argparse.ArgumentParser(description="Test harness for simple_target.bin")
- parser.add_argument('input_file', type=str, help="Path to the file containing the mutated input to load")
- parser.add_argument('-t', '--trace', default=False, action="store_true", help="Enables debug tracing")
+ parser.add_argument(
+ "input_file",
+ type=str,
+ help="Path to the file containing the mutated input to load",
+ )
+ parser.add_argument(
+ "-t",
+ "--trace",
+ default=False,
+ action="store_true",
+ help="Enables debug tracing",
+ )
args = parser.parse_args()
# Instantiate a MIPS32 big endian Unicorn Engine instance
@@ -73,13 +106,16 @@ def main():
uc.hook_add(UC_HOOK_BLOCK, unicorn_debug_block)
uc.hook_add(UC_HOOK_CODE, unicorn_debug_instruction)
uc.hook_add(UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, unicorn_debug_mem_access)
- uc.hook_add(UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_READ_INVALID, unicorn_debug_mem_invalid_access)
+ uc.hook_add(
+ UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_READ_INVALID,
+ unicorn_debug_mem_invalid_access,
+ )
- #---------------------------------------------------
+ # ---------------------------------------------------
# Load the binary to emulate and map it into memory
print("Loading data input from {}".format(args.input_file))
- binary_file = open(BINARY_FILE, 'rb')
+ binary_file = open(BINARY_FILE, "rb")
binary_code = binary_file.read()
binary_file.close()
@@ -93,11 +129,11 @@ def main():
uc.mem_write(CODE_ADDRESS, binary_code)
# Set the program counter to the start of the code
- start_address = CODE_ADDRESS # Address of entry point of main()
- end_address = CODE_ADDRESS + 0xf4 # Address of last instruction in main()
+ start_address = CODE_ADDRESS # Address of entry point of main()
+ end_address = CODE_ADDRESS + 0xF4 # Address of last instruction in main()
uc.reg_write(UC_MIPS_REG_PC, start_address)
- #-----------------
+ # -----------------
# Setup the stack
uc.mem_map(STACK_ADDRESS, STACK_SIZE)
@@ -106,14 +142,14 @@ def main():
# reserve some space for data
uc.mem_map(DATA_ADDRESS, DATA_SIZE_MAX)
- #-----------------------------------------------------
+ # -----------------------------------------------------
# Set up a callback to place input data (do little work here, it's called for every single iteration)
# We did not pass in any data and don't use persistent mode, so we can ignore these params.
# Be sure to check out the docstrings for the uc.afl_* functions.
def place_input_callback(uc, input, persistent_round, data):
# Apply constraints to the mutated input
if len(input) > DATA_SIZE_MAX:
- #print("Test input is too long (> {} bytes)")
+ # print("Test input is too long (> {} bytes)")
return False
# Write the mutated command into the data buffer
@@ -122,5 +158,6 @@ def main():
# Start the fuzzer.
uc.afl_fuzz(args.input_file, place_input_callback, [end_address])
+
if __name__ == "__main__":
main()
diff --git a/unicorn_mode/samples/simple/simple_test_harness_alt.py b/unicorn_mode/samples/simple/simple_test_harness_alt.py
index 9c3dbc93..3249b13d 100644
--- a/unicorn_mode/samples/simple/simple_test_harness_alt.py
+++ b/unicorn_mode/samples/simple/simple_test_harness_alt.py
@@ -25,50 +25,79 @@ from unicornafl import *
from unicornafl.mips_const import *
# Path to the file containing the binary to emulate
-BINARY_FILE = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'simple_target.bin')
+BINARY_FILE = os.path.join(
+ os.path.dirname(os.path.abspath(__file__)), "simple_target.bin"
+)
# Memory map for the code to be tested
-CODE_ADDRESS = 0x00100000 # Arbitrary address where code to test will be loaded
+CODE_ADDRESS = 0x00100000 # Arbitrary address where code to test will be loaded
CODE_SIZE_MAX = 0x00010000 # Max size for the code (64kb)
STACK_ADDRESS = 0x00200000 # Address of the stack (arbitrarily chosen)
-STACK_SIZE = 0x00010000 # Size of the stack (arbitrarily chosen)
-DATA_ADDRESS = 0x00300000 # Address where mutated data will be placed
+STACK_SIZE = 0x00010000 # Size of the stack (arbitrarily chosen)
+DATA_ADDRESS = 0x00300000 # Address where mutated data will be placed
DATA_SIZE_MAX = 0x00010000 # Maximum allowable size of mutated data
try:
# If Capstone is installed then we'll dump disassembly, otherwise just dump the binary.
from capstone import *
+
cs = Cs(CS_ARCH_MIPS, CS_MODE_MIPS32 + CS_MODE_BIG_ENDIAN)
+
def unicorn_debug_instruction(uc, address, size, user_data):
mem = uc.mem_read(address, size)
- for (cs_address, cs_size, cs_mnemonic, cs_opstr) in cs.disasm_lite(bytes(mem), size):
+ for (cs_address, cs_size, cs_mnemonic, cs_opstr) in cs.disasm_lite(
+ bytes(mem), size
+ ):
print(" Instr: {:#016x}:\t{}\t{}".format(address, cs_mnemonic, cs_opstr))
+
+
except ImportError:
+
def unicorn_debug_instruction(uc, address, size, user_data):
- print(" Instr: addr=0x{0:016x}, size=0x{1:016x}".format(address, size))
+ print(" Instr: addr=0x{0:016x}, size=0x{1:016x}".format(address, size))
+
def unicorn_debug_block(uc, address, size, user_data):
print("Basic Block: addr=0x{0:016x}, size=0x{1:016x}".format(address, size))
-
+
+
def unicorn_debug_mem_access(uc, access, address, size, value, user_data):
if access == UC_MEM_WRITE:
- print(" >>> Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(address, size, value))
+ print(
+ " >>> Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(
+ address, size, value
+ )
+ )
else:
- print(" >>> Read: addr=0x{0:016x} size={1}".format(address, size))
+ print(" >>> Read: addr=0x{0:016x} size={1}".format(address, size))
+
def unicorn_debug_mem_invalid_access(uc, access, address, size, value, user_data):
if access == UC_MEM_WRITE_UNMAPPED:
- print(" >>> INVALID Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(address, size, value))
+ print(
+ " >>> INVALID Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(
+ address, size, value
+ )
+ )
else:
- print(" >>> INVALID Read: addr=0x{0:016x} size={1}".format(address, size))
+ print(
+ " >>> INVALID Read: addr=0x{0:016x} size={1}".format(address, size)
+ )
+
def force_crash(uc_error):
# This function should be called to indicate to AFL that a crash occurred during emulation.
# Pass in the exception received from Uc.emu_start()
mem_errors = [
- UC_ERR_READ_UNMAPPED, UC_ERR_READ_PROT, UC_ERR_READ_UNALIGNED,
- UC_ERR_WRITE_UNMAPPED, UC_ERR_WRITE_PROT, UC_ERR_WRITE_UNALIGNED,
- UC_ERR_FETCH_UNMAPPED, UC_ERR_FETCH_PROT, UC_ERR_FETCH_UNALIGNED,
+ UC_ERR_READ_UNMAPPED,
+ UC_ERR_READ_PROT,
+ UC_ERR_READ_UNALIGNED,
+ UC_ERR_WRITE_UNMAPPED,
+ UC_ERR_WRITE_PROT,
+ UC_ERR_WRITE_UNALIGNED,
+ UC_ERR_FETCH_UNMAPPED,
+ UC_ERR_FETCH_PROT,
+ UC_ERR_FETCH_UNALIGNED,
]
if uc_error.errno in mem_errors:
# Memory error - throw SIGSEGV
@@ -80,11 +109,22 @@ def force_crash(uc_error):
# Not sure what happened - throw SIGABRT
os.kill(os.getpid(), signal.SIGABRT)
+
def main():
parser = argparse.ArgumentParser(description="Test harness for simple_target.bin")
- parser.add_argument('input_file', type=str, help="Path to the file containing the mutated input to load")
- parser.add_argument('-d', '--debug', default=False, action="store_true", help="Enables debug tracing")
+ parser.add_argument(
+ "input_file",
+ type=str,
+ help="Path to the file containing the mutated input to load",
+ )
+ parser.add_argument(
+ "-d",
+ "--debug",
+ default=False,
+ action="store_true",
+ help="Enables debug tracing",
+ )
args = parser.parse_args()
# Instantiate a MIPS32 big endian Unicorn Engine instance
@@ -94,13 +134,16 @@ def main():
uc.hook_add(UC_HOOK_BLOCK, unicorn_debug_block)
uc.hook_add(UC_HOOK_CODE, unicorn_debug_instruction)
uc.hook_add(UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, unicorn_debug_mem_access)
- uc.hook_add(UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_READ_INVALID, unicorn_debug_mem_invalid_access)
+ uc.hook_add(
+ UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_READ_INVALID,
+ unicorn_debug_mem_invalid_access,
+ )
- #---------------------------------------------------
+ # ---------------------------------------------------
# Load the binary to emulate and map it into memory
print("Loading data input from {}".format(args.input_file))
- binary_file = open(BINARY_FILE, 'rb')
+ binary_file = open(BINARY_FILE, "rb")
binary_code = binary_file.read()
binary_file.close()
@@ -114,11 +157,11 @@ def main():
uc.mem_write(CODE_ADDRESS, binary_code)
# Set the program counter to the start of the code
- start_address = CODE_ADDRESS # Address of entry point of main()
- end_address = CODE_ADDRESS + 0xf4 # Address of last instruction in main()
+ start_address = CODE_ADDRESS # Address of entry point of main()
+ end_address = CODE_ADDRESS + 0xF4 # Address of last instruction in main()
uc.reg_write(UC_MIPS_REG_PC, start_address)
- #-----------------
+ # -----------------
# Setup the stack
uc.mem_map(STACK_ADDRESS, STACK_SIZE)
@@ -127,10 +170,10 @@ def main():
# reserve some space for data
uc.mem_map(DATA_ADDRESS, DATA_SIZE_MAX)
- #-----------------------------------------------------
+ # -----------------------------------------------------
# Kick off AFL's fork server
- # THIS MUST BE DONE BEFORE LOADING USER DATA!
- # If this isn't done every single run, the AFL fork server
+ # THIS MUST BE DONE BEFORE LOADING USER DATA!
+ # If this isn't done every single run, the AFL fork server
# will not be started appropriately and you'll get erratic results!
print("Starting the AFL forkserver")
@@ -142,12 +185,12 @@ def main():
else:
out = lambda x, y: print(x.format(y))
- #-----------------------------------------------
+ # -----------------------------------------------
# Load the mutated input and map it into memory
# Load the mutated input from disk
out("Loading data input from {}", args.input_file)
- input_file = open(args.input_file, 'rb')
+ input_file = open(args.input_file, "rb")
input = input_file.read()
input_file.close()
@@ -159,7 +202,7 @@ def main():
# Write the mutated command into the data buffer
uc.mem_write(DATA_ADDRESS, input)
- #------------------------------------------------------------
+ # ------------------------------------------------------------
# Emulate the code, allowing it to process the mutated input
out("Executing until a crash or execution reaches 0x{0:016x}", end_address)
@@ -175,5 +218,6 @@ def main():
# UC_AFL_RET_FINISHED = 3
out("Done. AFL Mode is {}", afl_mode)
+
if __name__ == "__main__":
main()