diff options
Diffstat (limited to 'unicorn_mode')
| -rwxr-xr-x | unicorn_mode/build_unicorn_support.sh | 8 | ||||
| -rw-r--r-- | unicorn_mode/samples/compcov_x64/compcov_test_harness.py | 27 | ||||
| -rw-r--r-- | unicorn_mode/samples/simple/simple_test_harness.py | 31 | ||||
| m--------- | unicorn_mode/unicorn | 0 |
4 files changed, 11 insertions, 55 deletions
diff --git a/unicorn_mode/build_unicorn_support.sh b/unicorn_mode/build_unicorn_support.sh index 707e47bb..1c176bca 100755 --- a/unicorn_mode/build_unicorn_support.sh +++ b/unicorn_mode/build_unicorn_support.sh @@ -89,7 +89,7 @@ if [ "$PLT" = "NetBSD" ] || [ "$PLT" = "OpenBSD" ]; then TARCMD=gtar fi -for i in wget $PYTHONBIN automake autoconf $MAKECMD $TARCMD; do +for i in wget $PYTHONBIN automake autoconf git $MAKECMD $TARCMD; do T=`which "$i" 2>/dev/null` @@ -124,8 +124,10 @@ fi echo "[+] All checks passed!" echo "[*] Making sure unicornafl is checked out" -git submodule init || exit 1 -git submodule update || exit 1 +rm -rf unicorn # workaround for travis ... sadly ... +#test -d unicorn && { cd unicorn && { git stash ; git pull ; cd .. ; } } +test -d unicorn || git clone https://github.com/vanhauser-thc/unicorn +test -d unicorn || { echo "[-] not checked out, please install git or check your internet connection." ; exit 1 ; } echo "[+] Got unicornafl." echo "[*] making sure config.h matches" diff --git a/unicorn_mode/samples/compcov_x64/compcov_test_harness.py b/unicorn_mode/samples/compcov_x64/compcov_test_harness.py index 9a5da520..3861f205 100644 --- a/unicorn_mode/samples/compcov_x64/compcov_test_harness.py +++ b/unicorn_mode/samples/compcov_x64/compcov_test_harness.py @@ -59,35 +59,17 @@ def unicorn_debug_mem_invalid_access(uc, access, address, size, value, user_data else: print(" >>> INVALID Read: addr=0x{0:016x} size={1}".format(address, size)) -def force_crash(uc_error): - # This function should be called to indicate to AFL that a crash occurred during emulation. - # Pass in the exception received from Uc.emu_start() - mem_errors = [ - UC_ERR_READ_UNMAPPED, UC_ERR_READ_PROT, UC_ERR_READ_UNALIGNED, - UC_ERR_WRITE_UNMAPPED, UC_ERR_WRITE_PROT, UC_ERR_WRITE_UNALIGNED, - UC_ERR_FETCH_UNMAPPED, UC_ERR_FETCH_PROT, UC_ERR_FETCH_UNALIGNED, - ] - if uc_error.errno in mem_errors: - # Memory error - throw SIGSEGV - os.kill(os.getpid(), signal.SIGSEGV) - elif uc_error.errno == UC_ERR_INSN_INVALID: - # Invalid instruction - throw SIGILL - os.kill(os.getpid(), signal.SIGILL) - else: - # Not sure what happened - throw SIGABRT - os.kill(os.getpid(), signal.SIGABRT) - def main(): parser = argparse.ArgumentParser(description="Test harness for compcov_target.bin") parser.add_argument('input_file', type=str, help="Path to the file containing the mutated input to load") - parser.add_argument('-d', '--debug', default=False, action="store_true", help="Enables debug tracing") + parser.add_argument('-t', '--trace', default=False, action="store_true", help="Enables debug tracing") args = parser.parse_args() # Instantiate a MIPS32 big endian Unicorn Engine instance uc = Uc(UC_ARCH_X86, UC_MODE_64) - if args.debug: + if args.trace: uc.hook_add(UC_HOOK_BLOCK, unicorn_debug_block) uc.hook_add(UC_HOOK_CODE, unicorn_debug_instruction) uc.hook_add(UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, unicorn_debug_mem_access) @@ -132,11 +114,6 @@ def main(): """ Callback that loads the mutated input into memory. """ - # Load the mutated input from disk - input_file = open(args.input_file, 'rb') - input = input_file.read() - input_file.close() - # Apply constraints to the mutated input if len(input) > DATA_SIZE_MAX: return diff --git a/unicorn_mode/samples/simple/simple_test_harness.py b/unicorn_mode/samples/simple/simple_test_harness.py index d85ec9f5..f4002ca8 100644 --- a/unicorn_mode/samples/simple/simple_test_harness.py +++ b/unicorn_mode/samples/simple/simple_test_harness.py @@ -5,8 +5,8 @@ This loads the simple_target.bin binary (precompiled as MIPS code) into Unicorn's memory map for emulation, places the specified input into simple_target's buffer (hardcoded to be at 0x300000), and executes 'main()'. - If any crashes occur during emulation, this script throws a matching signal - to tell AFL that a crash occurred. + If any crashes occur during emulation, unicornafl will + tell AFL that a crash occurred. Run under AFL as follows: @@ -59,35 +59,17 @@ def unicorn_debug_mem_invalid_access(uc, access, address, size, value, user_data else: print(" >>> INVALID Read: addr=0x{0:016x} size={1}".format(address, size)) -def force_crash(uc_error): - # This function should be called to indicate to AFL that a crash occurred during emulation. - # Pass in the exception received from Uc.emu_start() - mem_errors = [ - UC_ERR_READ_UNMAPPED, UC_ERR_READ_PROT, UC_ERR_READ_UNALIGNED, - UC_ERR_WRITE_UNMAPPED, UC_ERR_WRITE_PROT, UC_ERR_WRITE_UNALIGNED, - UC_ERR_FETCH_UNMAPPED, UC_ERR_FETCH_PROT, UC_ERR_FETCH_UNALIGNED, - ] - if uc_error.errno in mem_errors: - # Memory error - throw SIGSEGV - os.kill(os.getpid(), signal.SIGSEGV) - elif uc_error.errno == UC_ERR_INSN_INVALID: - # Invalid instruction - throw SIGILL - os.kill(os.getpid(), signal.SIGILL) - else: - # Not sure what happened - throw SIGABRT - os.kill(os.getpid(), signal.SIGABRT) - def main(): parser = argparse.ArgumentParser(description="Test harness for simple_target.bin") parser.add_argument('input_file', type=str, help="Path to the file containing the mutated input to load") - parser.add_argument('-d', '--debug', default=False, action="store_true", help="Enables debug tracing") + parser.add_argument('-t', '--trace', default=False, action="store_true", help="Enables debug tracing") args = parser.parse_args() # Instantiate a MIPS32 big endian Unicorn Engine instance uc = Uc(UC_ARCH_MIPS, UC_MODE_MIPS32 + UC_MODE_BIG_ENDIAN) - if args.debug: + if args.trace: uc.hook_add(UC_HOOK_BLOCK, unicorn_debug_block) uc.hook_add(UC_HOOK_CODE, unicorn_debug_instruction) uc.hook_add(UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, unicorn_debug_mem_access) @@ -129,11 +111,6 @@ def main(): # We did not pass in any data and don't use persistent mode, so we can ignore these params. # Be sure to check out the docstrings for the uc.afl_* functions. def place_input_callback(uc, input, persistent_round, data): - # Load the mutated input from disk - input_file = open(args.input_file, 'rb') - input = input_file.read() - input_file.close() - # Apply constraints to the mutated input if len(input) > DATA_SIZE_MAX: #print("Test input is too long (> {} bytes)") diff --git a/unicorn_mode/unicorn b/unicorn_mode/unicorn -Subproject aa5ebf5e16f4f5781cfe94229b41eee7ff93b35 +Subproject db248c8d8167e47ee07943961d1ce6244d57602 |