diff options
| -rw-r--r-- | test/test-compcov.c | 29 | ||||
| -rwxr-xr-x | test/test.sh | 66 |
2 files changed, 82 insertions, 13 deletions
diff --git a/test/test-compcov.c b/test/test-compcov.c new file mode 100644 index 00000000..bbad3aed --- /dev/null +++ b/test/test-compcov.c @@ -0,0 +1,29 @@ +#include <stdio.h> +#include <stdlib.h> +#include <unistd.h> +#include <string.h> + +int main(int argc, char** argv) { + + char *buf; + + if (argc > 1) { + + if (strcmp(argv[1], "LIBTOKENCAP") == 0) + printf("your string was libtokencap\n"); + else if (strcmp(argv[1], "BUGMENOT") == 0) + printf("your string was bugmenot\n"); + else if (strcmp(argv[1], "BUFFEROVERFLOW") == 0) { + buf = malloc(16); + strcpy(buf, "TEST"); + strcat(buf, argv[1]); + printf("This will only crash with libdislocator: %s\n", buf); + return 0; + } else + printf("I do not know your string\n"); + + } + + return 0; + +} diff --git a/test/test.sh b/test/test.sh index 3b70509a..0e2ba52b 100755 --- a/test/test.sh +++ b/test/test.sh @@ -1,10 +1,11 @@ #!/bin/bash # -# Ensure we have: test, type, diff -q, echo -e, grep -qE +# Ensure we have: test, type, diff -q, echo -e, grep -aqE, timeout # test -z "" 2> /dev/null || { echo Error: test command not found ; exit 1 ; } GREP=`type grep > /dev/null 2>&1 && echo OK` +TIMEOUT=`type timeout > /dev/null 2>&1 && echo OK` test "$GREP" = OK || { echo Error: grep command not found ; exit 1 ; } echo foobar | grep -aqE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q, -a and/or -E option ; exit 1 ; } echo 1 > test.1 @@ -24,6 +25,9 @@ $ECHO '\x41' 2>&1 | grep -qE '^A' || { } test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit 1 ; } +export AFL_EXIT_WHEN_DONE=1 +export AFL_SKIP_CPUFREQ=1 + GREY="\\x1b[1;90m" GREEN="\\x1b[0;32m" RED="\\x1b[0;31m" @@ -36,39 +40,75 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && { ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1 AFL_HARDEN=1 ../afl-gcc -o test-instr.harden ../test-instr.c > /dev/null 2>&1 test -e test-instr.plain && { - $ECHO "$GREEN[*] afl-gcc compilation succeeded" + $ECHO "$GREEN[+] afl-gcc compilation succeeded" echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] afl-gcc instrumentation should be different on different input but is not" - } || $ECHO "$GREEN[*] afl-gcc instrumentation present and working correctly" + } || $ECHO "$GREEN[+] afl-gcc instrumentation present and working correctly" } || $ECHO "$RED[!] afl-gcc instrumentation failed" - rm -f test-instr.plain test-instr.plain.0 test-instr.plain.1 + rm -f test-instr.plain.0 test-instr.plain.1 } || $ECHO "$RED[!] afl-gcc failed" test -e test-instr.harden && { grep -qa fstack-protector-all test-instr.harden > /dev/null 2>&1 && { - $ECHO "$GREEN[*] afl-gcc hardened mode succeeded and is working" + $ECHO "$GREEN[+] afl-gcc hardened mode succeeded and is working" } || $ECHO "$RED[!] hardened mode is not hardened" rm -f test-instr.harden } || $ECHO "$RED[!] afl-gcc hardened mode compilation failed" - - + # now we want to be sure that afl-fuzz is working + test -n "$TIMEOUT" && { + mkdir -p in + echo 0 > in/in + $ECHO "$GREY[*] running afl-fuzz, this will take approx 10 seconds" + { + timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1 + } > /dev/null 2>&1 + test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { + $ECHO "$GREEN[+] afl-fuzz is working correctly" + } || $ECHO "$RED[!] afl-fuzz is not working correctly" + rm -rf in out + } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command" + rm -f test-instr.plain } || $ECHO "$YELLOW[-] afl is not compiled, cannot test" test -e ../afl-clang-fast && { - echo todo: llvm_mode + echo todo: llvm_mode } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test" -test -e ../libtokencap.so && { - echo todo: libtokencap +gcc -o test-compcov test-compcov.c > /dev/null 2>&1 +test -e ../libtokencap.so && { + AFL_TOKEN_FILE=token.out LD_PRELOAD=../libtokencap.so ./test-compcov foobar > /dev/null 2>&1 + grep -q BUGMENOT token.out > /dev/null 2>&1 && { + $ECHO "$GREEN[+] libtokencap did successfully capture tokens" + } || $ECHO "$RED[!] libtokencap did not capture tokens" + rm -f token.out } || $ECHO "$YELLOW[-] libtokencap is not compiled, cannot test" +test -e ../libdislocator.so && { + { + ulimit -c 1 + LD_PRELOAD=../libdislocator.so ./test-compcov BUFFEROVERFLOW > test.out 2> /dev/null + } > /dev/null 2>&1 + grep -q BUFFEROVERFLOW test.out > /dev/null 2>&1 && { + $ECHO "$RED[!] libdislocator did not detect the memory corruption" + } || $ECHO "$GREEN[+] libdislocator did successfully detect the memory corruption" + rm -f test.out core test-compcov.core core.test-compcov +} || $ECHO "$YELLOW[-] libdislocator is not compiled, cannot test" + +test -e ../afl-qemu-trace && { + + echo todo: qemu_mode + # we will use test-compcov for testing libcompcov + +} || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test" + +rm -f test-compcov + +$ECHO "$GREY[*] all tests completed!" $ECHO "$RESET" -# libdislocator -# unicorn -# qemu \ No newline at end of file +# unicorn_mode ? |