diff options
| -rw-r--r-- | libtokencap/Makefile | 5 | ||||
| -rw-r--r-- | qemu_mode/README.md | 2 | ||||
| -rwxr-xr-x | test/test.sh | 100 |
3 files changed, 74 insertions, 33 deletions
diff --git a/libtokencap/Makefile b/libtokencap/Makefile index 0faad511..3fd01b2c 100644 --- a/libtokencap/Makefile +++ b/libtokencap/Makefile @@ -21,7 +21,10 @@ VERSION = $(shell grep '^\#define VERSION ' ../config.h | cut -d '"' -f2) CFLAGS ?= -O3 -funroll-loops -I ../include/ CFLAGS += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -all: libtokencap.so +ifeq "$(shell uname)" "Linux" + TARGETS = libtokencap.so +endif +all: $(TARGETS) libtokencap.so: libtokencap.so.c ../config.h $(CC) $(CFLAGS) -shared -fPIC $< -o ../$@ $(LDFLAGS) diff --git a/qemu_mode/README.md b/qemu_mode/README.md index 5406371e..81e91854 100644 --- a/qemu_mode/README.md +++ b/qemu_mode/README.md @@ -99,7 +99,7 @@ on the x86 and x86_64 targets. Highly recommended. -## 6) Bonus feature #3: Wine mode +## 6) Bonus feature #4: Wine mode AFL++ QEMU can use Wine to fuzz WIn32 PE binaries. Use the -W flag of afl-fuzz. diff --git a/test/test.sh b/test/test.sh index d230cf71..00509c8e 100755 --- a/test/test.sh +++ b/test/test.sh @@ -1,11 +1,10 @@ -#!/bin/bash +#!/bin/sh # -# Ensure we have: test, type, diff -q, echo -e, grep -aqE, timeout +# Ensure we have: test, type, diff -q, grep -aqE # test -z "" 2> /dev/null || { echo Error: test command not found ; exit 1 ; } GREP=`type grep > /dev/null 2>&1 && echo OK` -TIMEOUT=`type timeout > /dev/null 2>&1 && echo OK` test "$GREP" = OK || { echo Error: grep command not found ; exit 1 ; } echo foobar | grep -aqE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q, -a and/or -E option ; exit 1 ; } echo 1 > test.1 @@ -15,15 +14,15 @@ diff -q test.1 test.2 >/dev/null 2>&1 || OK= rm -f test.1 test.2 test -z "$OK" && { echo Error: diff -q is not working ; exit 1 ; } -ECHO="echo -e" -$ECHO '\x41' 2>&1 | grep -qE '^A' || { +ECHO="printf %b\\n" +$ECHO \\101 2>&1 | grep -qE '^A' || { ECHO= - test -e /bin/echo && { - ECHO="/bin/echo -e" - $ECHO '\x41' 2>&1 | grep -qE '^A' || ECHO= + test -e /bin/printf && { + ECHO="/bin/printf %b\\n" + $ECHO '\\101' 2>&1 | grep -qE '^A' || ECHO= } } -test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit 1 ; } +test -z "$ECHO" && { printf Error: printf command does not support octal character codes ; exit 1 ; } export AFL_EXIT_WHEN_DONE=1 export AFL_SKIP_CPUFREQ=1 @@ -40,12 +39,14 @@ unset AFL_LLVM_LAF_SPLIT_SWITCHES unset AFL_LLVM_LAF_TRANSFORM_COMPARES unset AFL_LLVM_LAF_SPLIT_COMPARES -GREY="\\x1b[1;90m" -BLUE="\\x1b[1;94m" -GREEN="\\x1b[0;32m" -RED="\\x1b[0;31m" -YELLOW="\\x1b[1;93m" -RESET="\\x1b[0m" +GREY="\\033[1;90m" +BLUE="\\033[1;94m" +GREEN="\\033[0;32m" +RED="\\033[0;31m" +YELLOW="\\033[1;93m" +RESET="\\033[0m" + +MEM_LIMIT=150 $ECHO "${RESET}${GREY}[*] starting afl++ test framework ..." @@ -55,8 +56,8 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && { AFL_HARDEN=1 ../afl-gcc -o test-instr.harden ../test-instr.c > /dev/null 2>&1 test -e test-instr.plain && { $ECHO "$GREEN[+] afl-gcc compilation succeeded" - echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 - ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 + echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 + ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] afl-gcc instrumentation should be different on different input but is not" @@ -71,18 +72,18 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && { rm -f test-instr.harden } || $ECHO "$RED[!] afl-gcc hardened mode compilation failed" # now we want to be sure that afl-fuzz is working - test -n "$TIMEOUT" && { + { mkdir -p in echo 0 > in/in $ECHO "$GREY[*] running afl-fuzz for afl-gcc, this will take approx 10 seconds" { - timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1 + ../afl-fuzz -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain > /dev/null 2>&1 } > /dev/null 2>&1 test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { $ECHO "$GREEN[+] afl-fuzz is working correctly with afl-gcc" } || $ECHO "$RED[!] afl-fuzz is not working correctly with afl-gcc" rm -rf in out - } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command" + } rm -f test-instr.plain } || $ECHO "$YELLOW[-] afl is not compiled, cannot test" @@ -92,8 +93,8 @@ test -e ../afl-clang-fast && { AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1 test -e test-instr.plain && { $ECHO "$GREEN[+] llvm_mode compilation succeeded" - echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 - ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 + echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 + ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not" @@ -108,18 +109,18 @@ test -e ../afl-clang-fast && { rm -f test-compcov.harden } || $ECHO "$RED[!] llvm_mode hardened mode compilation failed" # now we want to be sure that afl-fuzz is working - test -n "$TIMEOUT" && { + { mkdir -p in echo 0 > in/in $ECHO "$GREY[*] running afl-fuzz for llvm_mode, this will take approx 10 seconds" { - timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1 + ../afl-fuzz -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain > /dev/null 2>&1 } > /dev/null 2>&1 test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { $ECHO "$GREEN[+] afl-fuzz is working correctly with llvm_mode" } || $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode" rm -rf in out - } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command" + } rm -f test-instr.plain # now for the special llvm_mode things @@ -177,15 +178,15 @@ rm -f test-compcov $ECHO "$BLUE[*] Testing: qemu_mode" test -e ../afl-qemu-trace && { - gcc -o test-instr ../test-instr.c + gcc -no-pie -o test-instr ../test-instr.c gcc -o test-compcov test-compcov.c test -e test-instr -a -e test-compcov && { - test -n "$TIMEOUT" && { + { mkdir -p in echo 0 > in/in $ECHO "$GREY[*] running afl-fuzz for qemu_mode, this will take approx 10 seconds" { - timeout -s KILL 10 ../afl-fuzz -Q -i in -o out -- ./test-instr > /dev/null 2>&1 + ../afl-fuzz -V10 -Q -i in -o out -- ./test-instr > /dev/null 2>&1 } > /dev/null 2>&1 test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { $ECHO "$GREEN[+] afl-fuzz is working correctly with qemu_mode" @@ -196,21 +197,58 @@ test -e ../afl-qemu-trace && { { export AFL_PRELOAD=../libcompcov.so export AFL_COMPCOV_LEVEL=2 - timeout -s KILL 10 ../afl-fuzz -Q -i in -o out -- ./test-compcov > /dev/null 2>&1 + ../afl-fuzz -V10 -Q -i in -o out -- ./test-compcov > /dev/null 2>&1 } > /dev/null 2>&1 test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { $ECHO "$GREEN[+] afl-fuzz is working correctly with qemu_mode libcompcov" } || $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode libcompcov" } || $ECHO "$YELLOW[-] we cannot test qemu_mode libcompcov because it is not present" rm -rf in out - } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command" + } } || $ECHO "$RED[-] gcc compilation of test targets failed - what is going on??" $ECHO "$YELLOW[?] we need a test case for qemu_mode persistent mode" + # This works but there are already problems with persistent (e.g. stability) + #$ECHO "$GREY[*] running afl-fuzz for persistent qemu_mode, this will take approx 10 seconds" + #{ + # export AFL_QEMU_PERSISTENT_ADDR=0x$(nm test-instr | grep "T main" | awk '{ print $1 }') + # export AFL_QEMU_PERSISTENT_GPR=1 + # ../afl-fuzz -V10 -Q -i in -o out -- ./test-instr > /dev/null 2>&1 + #} > /dev/null 2>&1 + #test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { + # $ECHO "$GREEN[+] afl-fuzz is working correctly with persistent qemu_mode" + #} || $ECHO "$RED[!] afl-fuzz is not working correctly with persistent qemu_mode" rm -f test-instr test-compcov } || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test" +$ECHO "$BLUE[*] Testing: unicorn_mode" +test -d ../unicorn_mode/unicorn && { + test -e ../unicorn_mode/samples/simple/simple_target.bin -a -e ../unicorn_mode/samples/compcov_x64/compcov_target.bin && { + { + mkdir -p in + echo 0 > in/in + $ECHO "$GREY[*] running afl-fuzz for unicorn_mode, this will take approx 15 seconds" + { + ../afl-fuzz -V15 -U -i in -o out -d -- python ../unicorn_mode/samples/simple/simple_test_harness.py @@ > /dev/null 2>&1 + } > /dev/null 2>&1 + test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { + $ECHO "$GREEN[+] afl-fuzz is working correctly with unicorn_mode" + } || $ECHO "$RED[!] afl-fuzz is not working correctly with unicorn_mode" + + $ECHO "$GREY[*] running afl-fuzz for unicorn_mode compcov, this will take approx 15 seconds" + { + export AFL_COMPCOV_LEVEL=2 + ../afl-fuzz -V15 -U -i in -o out -d -- python ../unicorn_mode/samples/compcov_x64/compcov_test_harness.py @@ > /dev/null 2>&1 + } > /dev/null 2>&1 + test -n "$( ls out/queue/id:000001* 2> /dev/null )" && { + $ECHO "$GREEN[+] afl-fuzz is working correctly with unicorn_mode compcov" + } || $ECHO "$RED[!] afl-fuzz is not working correctly with unicorn_mode compcov" + rm -rf in out + } + } || $ECHO "$RED[-] missing sample binaries in unicorn_mode/samples/ - what is going on??" + +} || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test" + $ECHO "$GREY[*] all test cases completed.$RESET" -# unicorn_mode ? |