From 7a383342de6687a09b46151c1f3cf0d44810995a Mon Sep 17 00:00:00 2001 From: microsvuln <55649192+Microsvuln@users.noreply.github.com> Date: Sat, 3 Apr 2021 02:07:52 +0400 Subject: rename python file rename python file --- utils/autodict_ql/autodict-ql.py | 188 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 188 insertions(+) create mode 100644 utils/autodict_ql/autodict-ql.py (limited to 'utils/autodict_ql/autodict-ql.py') diff --git a/utils/autodict_ql/autodict-ql.py b/utils/autodict_ql/autodict-ql.py new file mode 100644 index 00000000..69d11f48 --- /dev/null +++ b/utils/autodict_ql/autodict-ql.py @@ -0,0 +1,188 @@ +#!/usr/bin/env python3 +import os +import string +import binascii +import codecs +import errno +import struct +import argparse +import shutil +import subprocess + +from binascii import unhexlify + +def ensure_dir(dir): + try: + os.makedirs(dir) + except OSError as e: + if e.errno != errno.EEXIST: + raise + +def parse_args(): + parser = argparse.ArgumentParser(description=( + "Helper - Specify input file analysis and output folder to save corpus for strings in the overall project --------------------------------------------------------------------------- Example usage : python2 thisfile.py outdir str.txt" )) + + #parser.add_argument("tokenpath", + #help="Destination directory for tokens") + parser.add_argument("cur", + help = "Current Path") + parser.add_argument("db", + help = "CodeQL database Path") + parser.add_argument("tokenpath", + help="Destination directory for tokens") + + return parser.parse_args() + +def static_analysis(file,file2,cur,db) : + with open(cur+"/"+file, "w") as f: + print(cur+"/"+file) + stream = os.popen("codeql query run " + cur +"/"+ file2 + " -d " + db ) + output = stream.read() + f.write(output) + f.close() + +def copy_tokens(cur, tokenpath) : + subprocess.call(["cp " + cur + "/" + "arrays-lits/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["cp " + cur + "/" + "strstr-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["cp " + cur + "/" + "strcmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["cp " + cur + "/" + "strncmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["cp " + cur + "/" + "local-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["cp " + cur + "/" + "memcmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["cp " + cur + "/" + "global-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["cp " + cur + "/" + "lits/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["cp " + cur + "/" + "arrays-lits/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["cp " + cur + "/" + "arrays-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["cp " + cur + "/" + "strtool-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + #strtool-strs + + +def codeql_analysis(cur, db) : + static_analysis("litout.out","litool.ql", cur, db) + static_analysis("strcmp-strings.out","strcmp-str.ql", cur, db) + static_analysis("strncmp-strings.out","strncmp-str.ql", cur, db) + static_analysis("strstr-strings.out","strstr-str.ql", cur, db) + static_analysis("memcmp-strings.out","memcmp-str.ql", cur, db) + static_analysis("global-values-strings.out","globals-values.ql", cur, db) + static_analysis("local-strings.out","locals-strs.ql", cur, db) + static_analysis("strtool-strings.out","strtool.ql", cur, db) + static_analysis("arrays.out","array-literals.ql", cur, db) + start_aflql(0,cur) + #command1 = [ + # 'codeql','query', 'run', + # cur + '/litool.ql', + # '-d', + # db, '>','fff.txt' + # ] + #with open("litool2.log", "w") as f: + # stream = os.popen("codeql query run litool.ql -d " + db ) + # output = stream.read() + # f.write(output) + # f.close() + #worker1 = subprocess.Popen(command1) + #print(worker1.communicate()) + + +def start_aflql(tokenpath, cur): + command = [ + 'python3', + cur + '/litan.py', + cur+'/lits/', + cur+'/litout.out' + ] + worker1 = subprocess.Popen(command) + print(worker1.communicate()) + + command1 = [ + 'python3', + cur + '/strcmp-strings.py', + cur + '/strcmp-strs/', + cur + '/strcmp-strings.out' + ] + worker2 = subprocess.Popen(command1) + print(worker2.communicate()) + + command2 = [ + 'python3', + cur + '/strncmp-strings.py', + cur + '/strncmp-strs/', + cur + '/strncmp-strings.out' + ] + worker3 = subprocess.Popen(command2) + print(worker3.communicate()) + + command3 = [ + 'python3', + cur + '/array-lits.py', + cur + '/arrays-lits/', + cur + '/arrays.out' + ] + worker4 = subprocess.Popen(command3) + print(worker4.communicate()) + + command4 = [ + 'python3', + cur + '/array-strings.py', + cur + '/arrays-strs/', + cur + '/arrays.out' + ] + worker5 = subprocess.Popen(command4) + print(worker5.communicate()) + + + command5 = [ + 'python3', + cur + '/memcmp-strings.py', + cur + '/memcmp-strs/', + cur + '/memcmp-strings.out' + ] + worker6 = subprocess.Popen(command5) + print(worker6.communicate()) + + command6 = [ + 'python3', + cur + '/globals-strings.py', + cur + '/global-strs/', + cur + '/global-values-strings.out' + ] + worker7 = subprocess.Popen(command6) + print(worker7.communicate()) + + command7 = [ + 'python3', + cur + '/strstr-strings.py', + cur + '/strstr-strs/', + cur + '/strstr-strings.out' + ] + worker8 = subprocess.Popen(command7) + print(worker8.communicate()) + + + #strtool-strings.out + + command8 = [ + 'python3', + cur + '/stan-strings.py', + cur + '/strtool-strs/', + cur + '/strtool-strings.out' + ] + worker9 = subprocess.Popen(command8) + print(worker9.communicate()) + + command9 = [ + 'python3', + cur + '/local-strings.py', + cur + '/local-strs/', + cur + '/local-strings.out' + ] + worker10 = subprocess.Popen(command9) + print(worker10.communicate()) + +def main(): + args = parse_args() + ensure_dir(args.tokenpath) + #copy_tokens(args.cur, args.tokenpath) + codeql_analysis(args.cur, args.db) + copy_tokens(args.cur, args.tokenpath) + #start_aflql(args.tokenpath, args.cur) +if __name__ == '__main__': + main() \ No newline at end of file -- cgit 1.4.1 From 4291c3db5dca5082aed123f3a353f8af4a0f4785 Mon Sep 17 00:00:00 2001 From: microsvuln <55649192+Microsvuln@users.noreply.github.com> Date: Sat, 3 Apr 2021 14:04:06 +0400 Subject: finalize 1 commit final things --- utils/autodict_ql/autodict-ql.py | 91 ++++++++-------------------------------- utils/autodict_ql/readme.md | 6 ++- 2 files changed, 22 insertions(+), 75 deletions(-) (limited to 'utils/autodict_ql/autodict-ql.py') diff --git a/utils/autodict_ql/autodict-ql.py b/utils/autodict_ql/autodict-ql.py index 69d11f48..ddc95435 100644 --- a/utils/autodict_ql/autodict-ql.py +++ b/utils/autodict_ql/autodict-ql.py @@ -1,4 +1,14 @@ #!/usr/bin/env python3 +# AutoDict-QL - Optimal Token Generation for Fuzzing +# Part of AFL++ Project +# Developed and Maintained by Arash Ale Ebrahim (@Microsvuln) +# Usage : python3 autodict-ql.py [CURRECT_DIR] [CODEQL_DATABASE_PATH] [TOKEN_PATH] +# CURRENT_DIR = full of your current Dir +# CODEQL_DATABASE_PATH = Full path to your CodeQL database +# TOKEN_PATH = Folder name of the newly generated tokens +# Example : python3 autodict-ql.py /home/user/libxml/automate /home/user/libxml/libxml-db tokens +# Just pass the tokens folder to the -x flag of your fuzzer + import os import string import binascii @@ -42,47 +52,25 @@ def static_analysis(file,file2,cur,db) : f.close() def copy_tokens(cur, tokenpath) : - subprocess.call(["cp " + cur + "/" + "arrays-lits/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) - subprocess.call(["cp " + cur + "/" + "strstr-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) subprocess.call(["cp " + cur + "/" + "strcmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) subprocess.call(["cp " + cur + "/" + "strncmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) - subprocess.call(["cp " + cur + "/" + "local-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) subprocess.call(["cp " + cur + "/" + "memcmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) - subprocess.call(["cp " + cur + "/" + "global-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) subprocess.call(["cp " + cur + "/" + "lits/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) - subprocess.call(["cp " + cur + "/" + "arrays-lits/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) - subprocess.call(["cp " + cur + "/" + "arrays-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) subprocess.call(["cp " + cur + "/" + "strtool-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) - #strtool-strs + def codeql_analysis(cur, db) : static_analysis("litout.out","litool.ql", cur, db) static_analysis("strcmp-strings.out","strcmp-str.ql", cur, db) static_analysis("strncmp-strings.out","strncmp-str.ql", cur, db) - static_analysis("strstr-strings.out","strstr-str.ql", cur, db) static_analysis("memcmp-strings.out","memcmp-str.ql", cur, db) - static_analysis("global-values-strings.out","globals-values.ql", cur, db) - static_analysis("local-strings.out","locals-strs.ql", cur, db) static_analysis("strtool-strings.out","strtool.ql", cur, db) - static_analysis("arrays.out","array-literals.ql", cur, db) - start_aflql(0,cur) - #command1 = [ - # 'codeql','query', 'run', - # cur + '/litool.ql', - # '-d', - # db, '>','fff.txt' - # ] - #with open("litool2.log", "w") as f: - # stream = os.popen("codeql query run litool.ql -d " + db ) - # output = stream.read() - # f.write(output) - # f.close() - #worker1 = subprocess.Popen(command1) - #print(worker1.communicate()) - - -def start_aflql(tokenpath, cur): + start_autodict(0,cur) + + + +def start_autodict(tokenpath, cur): command = [ 'python3', cur + '/litan.py', @@ -110,23 +98,6 @@ def start_aflql(tokenpath, cur): worker3 = subprocess.Popen(command2) print(worker3.communicate()) - command3 = [ - 'python3', - cur + '/array-lits.py', - cur + '/arrays-lits/', - cur + '/arrays.out' - ] - worker4 = subprocess.Popen(command3) - print(worker4.communicate()) - - command4 = [ - 'python3', - cur + '/array-strings.py', - cur + '/arrays-strs/', - cur + '/arrays.out' - ] - worker5 = subprocess.Popen(command4) - print(worker5.communicate()) command5 = [ @@ -138,27 +109,8 @@ def start_aflql(tokenpath, cur): worker6 = subprocess.Popen(command5) print(worker6.communicate()) - command6 = [ - 'python3', - cur + '/globals-strings.py', - cur + '/global-strs/', - cur + '/global-values-strings.out' - ] - worker7 = subprocess.Popen(command6) - print(worker7.communicate()) - - command7 = [ - 'python3', - cur + '/strstr-strings.py', - cur + '/strstr-strs/', - cur + '/strstr-strings.out' - ] - worker8 = subprocess.Popen(command7) - print(worker8.communicate()) - #strtool-strings.out - command8 = [ 'python3', cur + '/stan-strings.py', @@ -168,14 +120,7 @@ def start_aflql(tokenpath, cur): worker9 = subprocess.Popen(command8) print(worker9.communicate()) - command9 = [ - 'python3', - cur + '/local-strings.py', - cur + '/local-strs/', - cur + '/local-strings.out' - ] - worker10 = subprocess.Popen(command9) - print(worker10.communicate()) + def main(): args = parse_args() @@ -183,6 +128,6 @@ def main(): #copy_tokens(args.cur, args.tokenpath) codeql_analysis(args.cur, args.db) copy_tokens(args.cur, args.tokenpath) - #start_aflql(args.tokenpath, args.cur) + #start_autodict(args.tokenpath, args.cur) if __name__ == '__main__': main() \ No newline at end of file diff --git a/utils/autodict_ql/readme.md b/utils/autodict_ql/readme.md index 3e4655c8..f8d23098 100644 --- a/utils/autodict_ql/readme.md +++ b/utils/autodict_ql/readme.md @@ -67,7 +67,7 @@ Commands: github Commands useful for interacting with the GitHub API through CodeQL. ``` -2. Compiler your project with CodeQL: For using the Autodict-QL plugin, you need to compile the source of the target you want to fuzz with CodeQL. This is not something hard . +2. Compile your project with CodeQL: For using the Autodict-QL plugin, you need to compile the source of the target you want to fuzz with CodeQL. This is not something hard . - First you need to create a CodeQL database of the project codebase, suppose we want to compile the libxml with codeql. go to libxml and issue the following commands: - `./configure --disable-shared` - `codeql create database libxml-db --language=cpp --command=make` @@ -87,10 +87,12 @@ Commands: Core developer of the AFL++ project Marc Heuse also developed a similar tool named `dict2file` which is a LLVM pass which can automatically extracts useful tokens, in addition with LTO instrumentation mode, this dict2file is automtically generates token extraction. `Autodict-QL` plugin gives you scripting capability and you can do whatever you want to extract from the Codebase and it's up to you. in addition it's independent from LLVM system. On the other hand, you can also use Google dictionaries which have been made public in May 2020, but the problem of using Google dictionaries is that they are limited to specific file format and speicifications. for example, for testing binutils and ELF file format or AVI in FFMPEG, there are no prebuilt dictionary, so it is highly recommended to use `Autodict-QL` or `Dict2File` features to automatically generating dictionaries based on the target. -I've personally prefer to use `Autodict-QL` or `dict2file` rather than Google dictionaries or any other manully generated dictionaries as `Autodict-QL` is working based on the target. +I've personally prefer to use `Autodict-QL` or `dict2file` rather than Google dictionaries or any other manully generated dictionaries as `Autodict-QL` and `dict2file` is working based on the target. In overall, fuzzing with dictionaries and well-generated tokens will give better results. There are 2 important points to remember : - If you combine `Autodict-QL` with AFL++ cmplog, you will get much better code coverage and hence better chance to discover new bugs. - Do not remember to set the `AFL_MAX_DET_EXTRAS` to the number of generated dictionaries, if you forget to set this environment variable, then AFL++ use just 200 tokens and use the rest of them probablistically. So this will guarantees that your tokens will be used by AFL++. + +Thanks are going to Marc Heuse, the AFL++ main developer, Antonio Morales and Stefan Nagy \ No newline at end of file -- cgit 1.4.1 From 70e975704465672f49273da9f4a8f7e56f745e20 Mon Sep 17 00:00:00 2001 From: microsvuln <55649192+Microsvuln@users.noreply.github.com> Date: Sat, 3 Apr 2021 15:47:22 +0400 Subject: new commit - change strings new commit - change strings --- utils/autodict_ql/autodict-ql.py | 1 + utils/autodict_ql/build-codeql.sh | 4 ++-- utils/autodict_ql/memcmp-strings.py | 3 +-- utils/autodict_ql/readme.md | 11 ++++++++--- utils/autodict_ql/stan-strings.py | 3 +-- utils/autodict_ql/strcmp-strings.py | 3 +-- utils/autodict_ql/strncmp-strings.py | 3 +-- 7 files changed, 15 insertions(+), 13 deletions(-) (limited to 'utils/autodict_ql/autodict-ql.py') diff --git a/utils/autodict_ql/autodict-ql.py b/utils/autodict_ql/autodict-ql.py index ddc95435..7bba57fc 100644 --- a/utils/autodict_ql/autodict-ql.py +++ b/utils/autodict_ql/autodict-ql.py @@ -57,6 +57,7 @@ def copy_tokens(cur, tokenpath) : subprocess.call(["cp " + cur + "/" + "memcmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) subprocess.call(["cp " + cur + "/" + "lits/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) subprocess.call(["cp " + cur + "/" + "strtool-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["find "+tokenpath+" -size 0 -delete"],shell=True) diff --git a/utils/autodict_ql/build-codeql.sh b/utils/autodict_ql/build-codeql.sh index ccff932e..450207f6 100644 --- a/utils/autodict_ql/build-codeql.sh +++ b/utils/autodict_ql/build-codeql.sh @@ -3,7 +3,6 @@ if [ -d "codeql-home" ]; then echo "Exist !" exit 1 fi -sudo apt install build-essential libtool-bin python3-dev automake git vim wget -y mkdir codeql-home cd codeql-home git clone https://github.com/github/codeql.git codeql-repo @@ -12,6 +11,7 @@ wget https://github.com/github/codeql-cli-binaries/releases/download/v2.4.6/code unzip codeql-linux64.zip mv codeql codeql-cli export "PATH=~/codeql-home/codeql-cli/:$PATH" +echo "export PATH=~/codeql-home/codeql-cli/:$PATH" >> ~/.bashrc codeql resolve languages codeql resolve qlpacks -echo "export PATH=~/codeql-home/codeql-cli/:$PATH" >> ~/.bashrc \ No newline at end of file +codeql \ No newline at end of file diff --git a/utils/autodict_ql/memcmp-strings.py b/utils/autodict_ql/memcmp-strings.py index fb892aff..2814da5b 100644 --- a/utils/autodict_ql/memcmp-strings.py +++ b/utils/autodict_ql/memcmp-strings.py @@ -46,9 +46,8 @@ def do_string_analysis(corpdir, infile1): str11 = str11.replace("\n","") str11 = str11.lstrip() str11 = str11.rstrip() - print("all strings : %s" % str11) str11 = str(str11) - if ((" " in str11 ) or (")" in str11) or ("(" in str11)): + if ((" " in str11 ) or (")" in str11) or ("(" in str11) or ("<" in str11) or (">" in str11)) : print("Space / Paranthesis String : %s" % str11) else : with open(corpdir+'/memcmp-str{0}'.format(n), 'w') as file: diff --git a/utils/autodict_ql/readme.md b/utils/autodict_ql/readme.md index 9e6a7292..ccc9b0e3 100644 --- a/utils/autodict_ql/readme.md +++ b/utils/autodict_ql/readme.md @@ -31,13 +31,18 @@ You can write other CodeQL scripts to extract possible effective tokens if you t ## Usage +Before proceed to installation make sure that you have the following packages by installing them : +```shell +sudo apt install build-essential libtool-bin python3-dev python3 automake git vim wget -y +``` The usage of Autodict-QL is pretty easy. But let's describe it as : -1. First of all, you need to have CodeQL installed on the system. we make this possible with `build-codeql.sh` bash script. This script will install CodeQL completety and will set the required environment variables for your system, so : - +1. First of all, you need to have CodeQL installed on the system. we make this possible with `build-codeql.sh` bash script. This script will install CodeQL completety and will set the required environment variables for your system. +Do the following : ```shell # chmod +x codeql-build.sh -# sudo ./codeql-build.sh +# ./codeql-build.sh +# source ~/.bashrc # codeql ``` Then you should get : diff --git a/utils/autodict_ql/stan-strings.py b/utils/autodict_ql/stan-strings.py index e9f6f0d0..5a863f80 100644 --- a/utils/autodict_ql/stan-strings.py +++ b/utils/autodict_ql/stan-strings.py @@ -46,9 +46,8 @@ def do_string_analysis(corpdir, infile1): str11 = str11.replace("\n","") str11 = str11.lstrip() str11 = str11.rstrip() - print("all strings : %s" % str11) str11 = str(str11) - if ((" " in str11 ) or (")" in str11) or ("(" in str11)) or ("<" in str11) or (">" in str11) : + if ((" " in str11 ) or (")" in str11) or ("(" in str11) or ("<" in str11) or (">" in str11)) : print("Space / Paranthesis String : %s" % str11) else : with open(corpdir+'/seed-str{0}'.format(n), 'w') as file: diff --git a/utils/autodict_ql/strcmp-strings.py b/utils/autodict_ql/strcmp-strings.py index a1b7e27c..1852b947 100644 --- a/utils/autodict_ql/strcmp-strings.py +++ b/utils/autodict_ql/strcmp-strings.py @@ -46,9 +46,8 @@ def do_string_analysis(corpdir, infile1): str11 = str11.replace("\n","") str11 = str11.lstrip() str11 = str11.rstrip() - print("all strings : %s" % str11) str11 = str(str11) - if ((" " in str11 ) or (")" in str11) or ("(" in str11)): + if ((" " in str11 ) or (")" in str11) or ("(" in str11) or ("<" in str11) or (">" in str11)) : print("Space / Paranthesis String : %s" % str11) else : with open(corpdir+'/strcmp-str{0}'.format(n), 'w') as file: diff --git a/utils/autodict_ql/strncmp-strings.py b/utils/autodict_ql/strncmp-strings.py index 2652f66e..f00fa3da 100644 --- a/utils/autodict_ql/strncmp-strings.py +++ b/utils/autodict_ql/strncmp-strings.py @@ -46,9 +46,8 @@ def do_string_analysis(corpdir, infile1): str11 = str11.replace("\n","") str11 = str11.lstrip() str11 = str11.rstrip() - print("all strings : %s" % str11) str11 = str(str11) - if ((" " in str11 ) or (")" in str11) or ("(" in str11)): + if ((" " in str11 ) or (")" in str11) or ("(" in str11) or ("<" in str11) or (">" in str11)) : print("Space / Paranthesis String : %s" % str11) else : with open(corpdir+'/strncmp-str{0}'.format(n), 'w') as file: -- cgit 1.4.1 From 050f331c54a7af2fdb2eb1ca33e9dacd9257dbb0 Mon Sep 17 00:00:00 2001 From: microsvuln <55649192+Microsvuln@users.noreply.github.com> Date: Sat, 3 Apr 2021 16:04:14 +0400 Subject: remove unessential things remove unessential things from scripts --- utils/autodict_ql/autodict-ql.py | 10 +++++----- utils/autodict_ql/memcmp-strings.py | 2 +- utils/autodict_ql/stan-strings.py | 2 +- utils/autodict_ql/strcmp-strings.py | 2 +- utils/autodict_ql/strncmp-strings.py | 2 +- 5 files changed, 9 insertions(+), 9 deletions(-) (limited to 'utils/autodict_ql/autodict-ql.py') diff --git a/utils/autodict_ql/autodict-ql.py b/utils/autodict_ql/autodict-ql.py index 7bba57fc..b51fbb90 100644 --- a/utils/autodict_ql/autodict-ql.py +++ b/utils/autodict_ql/autodict-ql.py @@ -52,11 +52,11 @@ def static_analysis(file,file2,cur,db) : f.close() def copy_tokens(cur, tokenpath) : - subprocess.call(["cp " + cur + "/" + "strcmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) - subprocess.call(["cp " + cur + "/" + "strncmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) - subprocess.call(["cp " + cur + "/" + "memcmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) - subprocess.call(["cp " + cur + "/" + "lits/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) - subprocess.call(["cp " + cur + "/" + "strtool-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["mv " + cur + "/" + "strcmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["mv " + cur + "/" + "strncmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["mv " + cur + "/" + "memcmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["mv " + cur + "/" + "lits/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["mv " + cur + "/" + "strtool-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) subprocess.call(["find "+tokenpath+" -size 0 -delete"],shell=True) diff --git a/utils/autodict_ql/memcmp-strings.py b/utils/autodict_ql/memcmp-strings.py index 2814da5b..d1047caa 100644 --- a/utils/autodict_ql/memcmp-strings.py +++ b/utils/autodict_ql/memcmp-strings.py @@ -40,7 +40,7 @@ def do_string_analysis(corpdir, infile1): for i, num1 in enumerate(lines): if i != 0: new_lst1.append(num1) - print("num : %s" % num1) + #print("num : %s" % num1) str11 = str(num1) str11 = str11.replace("|","") str11 = str11.replace("\n","") diff --git a/utils/autodict_ql/stan-strings.py b/utils/autodict_ql/stan-strings.py index 5a863f80..65d08c97 100644 --- a/utils/autodict_ql/stan-strings.py +++ b/utils/autodict_ql/stan-strings.py @@ -40,7 +40,7 @@ def do_string_analysis(corpdir, infile1): for i, num1 in enumerate(lines): if i != 0: new_lst1.append(num1) - print("num : %s" % num1) + #print("num : %s" % num1) str11 = str(num1) str11 = str11.replace("|","") str11 = str11.replace("\n","") diff --git a/utils/autodict_ql/strcmp-strings.py b/utils/autodict_ql/strcmp-strings.py index 1852b947..88128dbb 100644 --- a/utils/autodict_ql/strcmp-strings.py +++ b/utils/autodict_ql/strcmp-strings.py @@ -40,7 +40,7 @@ def do_string_analysis(corpdir, infile1): for i, num1 in enumerate(lines): if i != 0: new_lst1.append(num1) - print("num : %s" % num1) + #print("num : %s" % num1) str11 = str(num1) str11 = str11.replace("|","") str11 = str11.replace("\n","") diff --git a/utils/autodict_ql/strncmp-strings.py b/utils/autodict_ql/strncmp-strings.py index f00fa3da..0ad0e697 100644 --- a/utils/autodict_ql/strncmp-strings.py +++ b/utils/autodict_ql/strncmp-strings.py @@ -40,7 +40,7 @@ def do_string_analysis(corpdir, infile1): for i, num1 in enumerate(lines): if i != 0: new_lst1.append(num1) - print("num : %s" % num1) + #print("num : %s" % num1) str11 = str(num1) str11 = str11.replace("|","") str11 = str11.replace("\n","") -- cgit 1.4.1 From 05c13588d7f6a0c8e34623eeed0b2920737ba377 Mon Sep 17 00:00:00 2001 From: microsvuln <55649192+Microsvuln@users.noreply.github.com> Date: Sat, 3 Apr 2021 16:22:51 +0400 Subject: remove dirs remove dirs --- utils/autodict_ql/autodict-ql.py | 2 ++ utils/autodict_ql/readme.md | 3 +-- 2 files changed, 3 insertions(+), 2 deletions(-) (limited to 'utils/autodict_ql/autodict-ql.py') diff --git a/utils/autodict_ql/autodict-ql.py b/utils/autodict_ql/autodict-ql.py index b51fbb90..0fe7eabf 100644 --- a/utils/autodict_ql/autodict-ql.py +++ b/utils/autodict_ql/autodict-ql.py @@ -57,6 +57,8 @@ def copy_tokens(cur, tokenpath) : subprocess.call(["mv " + cur + "/" + "memcmp-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) subprocess.call(["mv " + cur + "/" + "lits/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) subprocess.call(["mv " + cur + "/" + "strtool-strs/*" + " " + cur + "/" + tokenpath + "/."] ,shell=True) + subprocess.call(["rm -rf strcmp-strs memcmp-strs strncmp-strs lits strtool-strs"],shell=True) + subprocess.call(["rm *.out"],shell=True) subprocess.call(["find "+tokenpath+" -size 0 -delete"],shell=True) diff --git a/utils/autodict_ql/readme.md b/utils/autodict_ql/readme.md index ccc9b0e3..16a2a20b 100644 --- a/utils/autodict_ql/readme.md +++ b/utils/autodict_ql/readme.md @@ -93,7 +93,7 @@ Commands: Core developer of the AFL++ project Marc Heuse also developed a similar tool named `dict2file` which is a LLVM pass which can automatically extracts useful tokens, in addition with LTO instrumentation mode, this dict2file is automtically generates token extraction. `Autodict-QL` plugin gives you scripting capability and you can do whatever you want to extract from the Codebase and it's up to you. in addition it's independent from LLVM system. On the other hand, you can also use Google dictionaries which have been made public in May 2020, but the problem of using Google dictionaries is that they are limited to specific file format and speicifications. for example, for testing binutils and ELF file format or AVI in FFMPEG, there are no prebuilt dictionary, so it is highly recommended to use `Autodict-QL` or `Dict2File` features to automatically generating dictionaries based on the target. -I've personally prefer to use `Autodict-QL` or `dict2file` rather than Google dictionaries or any other manully generated dictionaries as `Autodict-QL` and `dict2file` is working based on the target. +I've personally prefer to use `Autodict-QL` or `dict2file` rather than Google dictionaries or any other manully generated dictionaries as `Autodict-QL` and `dict2file` are working based on the target. In overall, fuzzing with dictionaries and well-generated tokens will give better results. There are 2 important points to remember : @@ -101,4 +101,3 @@ There are 2 important points to remember : - If you combine `Autodict-QL` with AFL++ cmplog, you will get much better code coverage and hence better chance to discover new bugs. - Do not remember to set the `AFL_MAX_DET_EXTRAS` to the number of generated dictionaries, if you forget to set this environment variable, then AFL++ use just 200 tokens and use the rest of them probablistically. So this will guarantees that your tokens will be used by AFL++. -Thanks are going to Marc Heuse, the AFL++ main developer, Antonio Morales and Stefan Nagy \ No newline at end of file -- cgit 1.4.1