diff options
Diffstat (limited to 'test')
| -rwxr-xr-x | test/test.sh | 160 |
1 files changed, 114 insertions, 46 deletions
diff --git a/test/test.sh b/test/test.sh index d230cf71..0aa37c87 100755 --- a/test/test.sh +++ b/test/test.sh @@ -1,11 +1,10 @@ -#!/bin/bash +#!/bin/sh # -# Ensure we have: test, type, diff -q, echo -e, grep -aqE, timeout +# Ensure we have: test, type, diff -q, grep -aqE # test -z "" 2> /dev/null || { echo Error: test command not found ; exit 1 ; } GREP=`type grep > /dev/null 2>&1 && echo OK` -TIMEOUT=`type timeout > /dev/null 2>&1 && echo OK` test "$GREP" = OK || { echo Error: grep command not found ; exit 1 ; } echo foobar | grep -aqE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q, -a and/or -E option ; exit 1 ; } echo 1 > test.1 @@ -15,15 +14,15 @@ diff -q test.1 test.2 >/dev/null 2>&1 || OK= rm -f test.1 test.2 test -z "$OK" && { echo Error: diff -q is not working ; exit 1 ; } -ECHO="echo -e" -$ECHO '\x41' 2>&1 | grep -qE '^A' || { +ECHO="printf %b\\n" +$ECHO \\101 2>&1 | grep -qE '^A' || { ECHO= - test -e /bin/echo && { - ECHO="/bin/echo -e" - $ECHO '\x41' 2>&1 | grep -qE '^A' || ECHO= + test -e /bin/printf && { + ECHO="/bin/printf %b\\n" + $ECHO '\\101' 2>&1 | grep -qE '^A' || ECHO= } } -test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit 1 ; } +test -z "$ECHO" && { printf Error: printf command does not support octal character codes ; exit 1 ; } export AFL_EXIT_WHEN_DONE=1 export AFL_SKIP_CPUFREQ=1 @@ -40,60 +39,84 @@ unset AFL_LLVM_LAF_SPLIT_SWITCHES unset AFL_LLVM_LAF_TRANSFORM_COMPARES unset AFL_LLVM_LAF_SPLIT_COMPARES -GREY="\\x1b[1;90m" -BLUE="\\x1b[1;94m" -GREEN="\\x1b[0;32m" -RED="\\x1b[0;31m" -YELLOW="\\x1b[1;93m" -RESET="\\x1b[0m" +# on OpenBSD we need to work with llvm from /usr/local/bin +test -e /usr/local/bin/opt && { + export PATH=/usr/local/bin:${PATH} +} +# on MacOS X we prefer afl-clang over afl-gcc, because +# afl-gcc does not work there +test `uname -s` = 'Darwin' -o `uname -s` = 'FreeBSD' && { +AFL_GCC=afl-clang +} || { +AFL_GCC=afl-gcc +} +GREY="\\033[1;90m" +BLUE="\\033[1;94m" +GREEN="\\033[0;32m" +RED="\\033[0;31m" +YELLOW="\\033[1;93m" +RESET="\\033[0m" + +MEM_LIMIT=150 $ECHO "${RESET}${GREY}[*] starting afl++ test framework ..." -$ECHO "$BLUE[*] Testing: afl-gcc, afl-showmap and afl-fuzz" -test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && { - ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1 - AFL_HARDEN=1 ../afl-gcc -o test-instr.harden ../test-instr.c > /dev/null 2>&1 +$ECHO "$BLUE[*] Testing: ${AFL_GCC}, afl-showmap and afl-fuzz" +test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && { + ../${AFL_GCC} -o test-instr.plain ../test-instr.c > /dev/null 2>&1 + AFL_HARDEN=1 ../${AFL_GCC} -o test-instr.harden ../test-instr.c > /dev/null 2>&1 test -e test-instr.plain && { - $ECHO "$GREEN[+] afl-gcc compilation succeeded" - echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 - ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 + $ECHO "$GREEN[+] ${AFL_GCC} compilation succeeded" + echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 + ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { - $ECHO "$RED[!] afl-gcc instrumentation should be different on different input but is not" - } || $ECHO "$GREEN[+] afl-gcc instrumentation present and working correctly" - } || $ECHO "$RED[!] afl-gcc instrumentation failed" + $ECHO "$RED[!] ${AFL_GCC} instrumentation should be different on different input but is not" + } || $ECHO "$GREEN[+] ${AFL_GCC} instrumentation present and working correctly" + } || $ECHO "$RED[!] ${AFL_GCC} instrumentation failed" rm -f test-instr.plain.0 test-instr.plain.1 - } || $ECHO "$RED[!] afl-gcc failed" + } || $ECHO "$RED[!] ${AFL_GCC} failed" test -e test-instr.harden && { grep -qa fstack-protector-all test-instr.harden > /dev/null 2>&1 && { - $ECHO "$GREEN[+] afl-gcc hardened mode succeeded and is working" - } || $ECHO "$RED[!] afl-gcc hardened mode is not hardened" + $ECHO "$GREEN[+] ${AFL_GCC} hardened mode succeeded and is working" + } || $ECHO "$RED[!] ${AFL_GCC} hardened mode is not hardened" rm -f test-instr.harden - } || $ECHO "$RED[!] afl-gcc hardened mode compilation failed" + } || $ECHO "$RED[!] ${AFL_GCC} hardened mode compilation failed" # now we want to be sure that afl-fuzz is working - test -n "$TIMEOUT" && { + # make sure core_pattern is set to core on linux + (test "$(uname -s)" = "Linux" && test "$(sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && { + $ECHO "$RED[!] we cannot run afl-fuzz with enabled core dumps. Run 'sudo sh afl-system-config'.$RESET" + true + }) || + # make sure crash reporter is disabled on Mac OS X + (test "$(uname -s)" = "Darwin" && test $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') && { + $ECHO "$RED[!] we cannot run afl-fuzz with enabled crash reporter. Run 'sudo sh afl-system-config'.$RESET" + true + }) || { mkdir -p in echo 0 > in/in - $ECHO "$GREY[*] running afl-fuzz for afl-gcc, this will take approx 10 seconds" + $ECHO "$GREY[*] running afl-fuzz for ${AFL_GCC}, this will take approx 10 seconds" { - timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1 + ../afl-fuzz -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain > /dev/null 2>&1 } > /dev/null 2>&1 test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { - $ECHO "$GREEN[+] afl-fuzz is working correctly with afl-gcc" - } || $ECHO "$RED[!] afl-fuzz is not working correctly with afl-gcc" + $ECHO "$GREEN[+] afl-fuzz is working correctly with ${AFL_GCC}" + } || $ECHO "$RED[!] afl-fuzz is not working correctly with ${AFL_GCC}" rm -rf in out - } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command" + } rm -f test-instr.plain } || $ECHO "$YELLOW[-] afl is not compiled, cannot test" $ECHO "$BLUE[*] Testing: llvm_mode" test -e ../afl-clang-fast && { + # on FreeBSD need to set AFL_CC + export AFL_CC=`llvm-config --bindir`/clang ../afl-clang-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1 AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1 test -e test-instr.plain && { $ECHO "$GREEN[+] llvm_mode compilation succeeded" - echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 - ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 + echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 + ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not" @@ -108,18 +131,26 @@ test -e ../afl-clang-fast && { rm -f test-compcov.harden } || $ECHO "$RED[!] llvm_mode hardened mode compilation failed" # now we want to be sure that afl-fuzz is working - test -n "$TIMEOUT" && { + (test "$(uname -s)" = "Linux" && test "$(sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && { + $ECHO "$RED[!] we cannot run afl-fuzz with enabled core dumps. Run 'sudo sh afl-system-config'.$RESET" + true + }) || + # make sure crash reporter is disabled on Mac OS X + (test "$(uname -s)" = "Darwin" && test $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') && { + $ECHO "$RED[!] we cannot run afl-fuzz with enabled crash reporter. Run 'sudo sh afl-system-config'.$RESET" + true + }) || { mkdir -p in echo 0 > in/in $ECHO "$GREY[*] running afl-fuzz for llvm_mode, this will take approx 10 seconds" { - timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1 + ../afl-fuzz -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain > /dev/null 2>&1 } > /dev/null 2>&1 test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { $ECHO "$GREEN[+] afl-fuzz is working correctly with llvm_mode" } || $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode" rm -rf in out - } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command" + } rm -f test-instr.plain # now for the special llvm_mode things @@ -177,15 +208,15 @@ rm -f test-compcov $ECHO "$BLUE[*] Testing: qemu_mode" test -e ../afl-qemu-trace && { - gcc -o test-instr ../test-instr.c + gcc -no-pie -o test-instr ../test-instr.c gcc -o test-compcov test-compcov.c test -e test-instr -a -e test-compcov && { - test -n "$TIMEOUT" && { + { mkdir -p in echo 0 > in/in $ECHO "$GREY[*] running afl-fuzz for qemu_mode, this will take approx 10 seconds" { - timeout -s KILL 10 ../afl-fuzz -Q -i in -o out -- ./test-instr > /dev/null 2>&1 + ../afl-fuzz -V10 -Q -i in -o out -- ./test-instr > /dev/null 2>&1 } > /dev/null 2>&1 test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { $ECHO "$GREEN[+] afl-fuzz is working correctly with qemu_mode" @@ -196,21 +227,58 @@ test -e ../afl-qemu-trace && { { export AFL_PRELOAD=../libcompcov.so export AFL_COMPCOV_LEVEL=2 - timeout -s KILL 10 ../afl-fuzz -Q -i in -o out -- ./test-compcov > /dev/null 2>&1 + ../afl-fuzz -V10 -Q -i in -o out -- ./test-compcov > /dev/null 2>&1 } > /dev/null 2>&1 test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { $ECHO "$GREEN[+] afl-fuzz is working correctly with qemu_mode libcompcov" } || $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode libcompcov" } || $ECHO "$YELLOW[-] we cannot test qemu_mode libcompcov because it is not present" rm -rf in out - } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command" + } } || $ECHO "$RED[-] gcc compilation of test targets failed - what is going on??" $ECHO "$YELLOW[?] we need a test case for qemu_mode persistent mode" + # This works but there are already problems with persistent (e.g. stability) + #$ECHO "$GREY[*] running afl-fuzz for persistent qemu_mode, this will take approx 10 seconds" + #{ + # export AFL_QEMU_PERSISTENT_ADDR=0x$(nm test-instr | grep "T main" | awk '{ print $1 }') + # export AFL_QEMU_PERSISTENT_GPR=1 + # ../afl-fuzz -V10 -Q -i in -o out -- ./test-instr > /dev/null 2>&1 + #} > /dev/null 2>&1 + #test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { + # $ECHO "$GREEN[+] afl-fuzz is working correctly with persistent qemu_mode" + #} || $ECHO "$RED[!] afl-fuzz is not working correctly with persistent qemu_mode" rm -f test-instr test-compcov } || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test" +$ECHO "$BLUE[*] Testing: unicorn_mode" +test -d ../unicorn_mode/unicorn && { + test -e ../unicorn_mode/samples/simple/simple_target.bin -a -e ../unicorn_mode/samples/compcov_x64/compcov_target.bin && { + { + mkdir -p in + echo 0 > in/in + $ECHO "$GREY[*] running afl-fuzz for unicorn_mode, this will take approx 15 seconds" + { + ../afl-fuzz -V15 -U -i in -o out -d -- python ../unicorn_mode/samples/simple/simple_test_harness.py @@ > /dev/null 2>&1 + } > /dev/null 2>&1 + test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { + $ECHO "$GREEN[+] afl-fuzz is working correctly with unicorn_mode" + } || $ECHO "$RED[!] afl-fuzz is not working correctly with unicorn_mode" + + $ECHO "$GREY[*] running afl-fuzz for unicorn_mode compcov, this will take approx 15 seconds" + { + export AFL_COMPCOV_LEVEL=2 + ../afl-fuzz -V15 -U -i in -o out -d -- python ../unicorn_mode/samples/compcov_x64/compcov_test_harness.py @@ > /dev/null 2>&1 + } > /dev/null 2>&1 + test -n "$( ls out/queue/id:000001* 2> /dev/null )" && { + $ECHO "$GREEN[+] afl-fuzz is working correctly with unicorn_mode compcov" + } || $ECHO "$RED[!] afl-fuzz is not working correctly with unicorn_mode compcov" + rm -rf in out + } + } || $ECHO "$RED[-] missing sample binaries in unicorn_mode/samples/ - what is going on??" + +} || $ECHO "$YELLOW[-] unicorn_mode is not compiled, cannot test" + $ECHO "$GREY[*] all test cases completed.$RESET" -# unicorn_mode ? |