diff options
Diffstat (limited to 'test')
| -rwxr-xr-x | test/test.sh | 103 |
1 files changed, 89 insertions, 14 deletions
diff --git a/test/test.sh b/test/test.sh index 679a514e..89f90a29 100755 --- a/test/test.sh +++ b/test/test.sh @@ -64,6 +64,8 @@ RESET="\\033[0m" MEM_LIMIT=150 +export PATH=$PATH:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin + $ECHO "${RESET}${GREY}[*] starting afl++ test framework ..." $ECHO "$BLUE[*] Testing: ${AFL_GCC}, afl-showmap and afl-fuzz" @@ -78,13 +80,25 @@ test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && { diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] ${AFL_GCC} instrumentation should be different on different input but is not" CODE=1 - } || $ECHO "$GREEN[+] ${AFL_GCC} instrumentation present and working correctly" + } || { + $ECHO "$GREEN[+] ${AFL_GCC} instrumentation present and working correctly" + } } || { $ECHO "$RED[!] ${AFL_GCC} instrumentation failed" CODE=1 } rm -f test-instr.plain.0 test-instr.plain.1 - } || $ECHO "$RED[!] ${AFL_GCC} failed" + TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'` + test "$TUPLES" -gt 3 -a "$TUPLES" -lt 7 && { + $ECHO "$GREEN[+] ${AFL_GCC} run reported $TUPLES instrumented locations which is fine" + } || { + $ECHO "$RED[!] ${AFL_GCC} produces weird instrumentation numbers: $TUPLES" + CODE=1 + } + } || { + $ECHO "$RED[!] ${AFL_GCC} failed" + CODE=1 + } test -e test-compcov.harden && { grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && { $ECHO "$GREEN[+] ${AFL_GCC} hardened mode succeeded and is working" @@ -99,7 +113,7 @@ test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && { } # now we want to be sure that afl-fuzz is working # make sure core_pattern is set to core on linux - (test "$(uname -s)" = "Linux" && test "$(/sbin/sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && { + (test "$(uname -s)" = "Linux" && test "$(sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && { $ECHO "$YELLOW[!] we should not run afl-fuzz with enabled core dumps. Run 'sudo sh afl-system-config'.$RESET" true }) || @@ -126,7 +140,9 @@ test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && { rm -rf in out errors } rm -f test-instr.plain -} || $ECHO "$YELLOW[-] afl is not compiled, cannot test" +} || { + $ECHO "$YELLOW[-] afl is not compiled, cannot test" +} $ECHO "$BLUE[*] Testing: llvm_mode" test -e ../afl-clang-fast && { @@ -146,7 +162,16 @@ test -e ../afl-clang-fast && { diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not" CODE=1 - } || $ECHO "$GREEN[+] llvm_mode instrumentation present and working correctly" + } || { + $ECHO "$GREEN[+] llvm_mode instrumentation present and working correctly" + TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'` + test "$TUPLES" -gt 3 -a "$TUPLES" -lt 6 && { + $ECHO "$GREEN[+] llvm_mode run reported $TUPLES instrumented locations which is fine" + } || { + $ECHO "$RED[!] llvm_mode instrumentation produces weird numbers: $TUPLES" + CODE=1 + } + } } || { $ECHO "$RED[!] llvm_mode instrumentation failed" CODE=1 @@ -169,7 +194,7 @@ test -e ../afl-clang-fast && { CODE=1 } # now we want to be sure that afl-fuzz is working - (test "$(uname -s)" = "Linux" && test "$(/sbin/sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && { + (test "$(uname -s)" = "Linux" && test "$(sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && { $ECHO "$YELLOW[!] we should not run afl-fuzz with enabled core dumps. Run 'sudo sh afl-system-config'.$RESET" true }) || @@ -252,7 +277,9 @@ test -e ../afl-clang-fast && { CODE=1 } rm -f test-persistent -} || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test" +} || { + $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test" +} $ECHO "$BLUE[*] Testing: gcc_plugin" export AFL_CC=`which gcc` @@ -269,6 +296,13 @@ test -e ../afl-gcc-fast && { CODE=1 } || { $ECHO "$GREEN[+] gcc_plugin instrumentation present and working correctly" + TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain.gccpi 2>&1 | grep Captur | awk '{print$3}'` + test "$TUPLES" -gt 3 -a "$TUPLES" -lt 7 && { + $ECHO "$GREEN[+] gcc_plugin run reported $TUPLES instrumented locations which is fine" + } || { + $ECHO "$RED[!] gcc_plugin instrumentation produces weird numbers: $TUPLES" + CODE=1 + } } } || { $ECHO "$RED[!] gcc_plugin instrumentation failed" @@ -350,7 +384,9 @@ test -e ../afl-gcc-fast && { CODE=1 } rm -f test-persistent -} || $ECHO "$YELLOW[-] gcc_plugin not compiled, cannot test" +} || { + $ECHO "$YELLOW[-] gcc_plugin not compiled, cannot test" +} $ECHO "$BLUE[*] Testing: shared library extensions" cc -o test-compcov test-compcov.c > /dev/null 2>&1 @@ -363,7 +399,9 @@ test -e ../libtokencap.so && { CODE=1 } rm -f token.out -} || $ECHO "$YELLOW[-] libtokencap is not compiled, cannot test" +} || { + $ECHO "$YELLOW[-] libtokencap is not compiled, cannot test" +} test -e ../libdislocator.so && { { ulimit -c 1 @@ -373,10 +411,41 @@ test -e ../libdislocator.so && { grep -q BUFFEROVERFLOW test.out > /dev/null 2>&1 && { $ECHO "$RED[!] libdislocator did not detect the memory corruption" CODE=1 - } || $ECHO "$GREEN[+] libdislocator did successfully detect the memory corruption" + } || { + $ECHO "$GREEN[+] libdislocator did successfully detect the memory corruption" + } rm -f test.out core test-compcov.core core.test-compcov -} || $ECHO "$YELLOW[-] libdislocator is not compiled, cannot test" +} || { + $ECHO "$YELLOW[-] libdislocator is not compiled, cannot test" +} rm -f test-compcov +test -e ../libradamsa.so && { + test -e test-instr.plain || ../afl-clang-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1 + test -e test-instr.plain || ../afl-gcc-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1 + test -e test-instr.plain || ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1 + test -e test-instr.plain && { + mkdir -p in + echo 0 > in/in + $ECHO "$GREY[*] running afl-fuzz with radamsa, this will take approx 10 seconds" + { + ../afl-fuzz -RR -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain >>errors 2>&1 + } >>errors 2>&1 + test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { + $ECHO "$GREEN[+] libradamsa performs good - and very slow - mutations" + } || { + echo CUT------------------------------------------------------------------CUT + cat errors + echo CUT------------------------------------------------------------------CUT + $ECHO "$RED[!] libradamsa failed" + CODE=1 + } + rm -rf in out errors test-instr.plain + } || { + $ECHO "$YELLOW[-] compilation of test target failed, cannot test libradamsa" + } +} || { + $ECHO "$YELLOW[-] libradamsa is not compiled, cannot test" +} $ECHO "$BLUE[*] Testing: qemu_mode" test -e ../afl-qemu-trace && { @@ -418,7 +487,9 @@ test -e ../afl-qemu-trace && { $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode libcompcov" CODE=1 } - } || $ECHO "$YELLOW[-] we cannot test qemu_mode libcompcov because it is not present" + } || { + $ECHO "$YELLOW[-] we cannot test qemu_mode libcompcov because it is not present" + } rm -f errors $ECHO "$GREY[*] running afl-fuzz for persistent qemu_mode, this will take approx 10 seconds" @@ -458,7 +529,9 @@ test -e ../afl-qemu-trace && { } rm -f test-instr test-compcov -} || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test" +} || { + $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test" +} $ECHO "$BLUE[*] Testing: unicorn_mode" test -d ../unicorn_mode/unicorn && { @@ -509,7 +582,9 @@ test -d ../unicorn_mode/unicorn && { CODE=1 } -} || $ECHO "$YELLOW[-] unicorn_mode is not compiled, cannot test" +} || { + $ECHO "$YELLOW[-] unicorn_mode is not compiled, cannot test" +} $ECHO "$GREY[*] all test cases completed.$RESET" test "$CODE" = "0" && $ECHO "$GREEN[+] all tests were successful :-)$RESET" |