1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
/*
american fuzzy lop++ - sample argv fuzzing wrapper
------------------------------------------------
Originally written by Michal Zalewski
Copyright 2015 Google Inc. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0
This file shows a simple way to fuzz command-line parameters with stock
afl-fuzz. To use, add:
#include "/path/to/argv-fuzz-inl.h"
...to the file containing main(), ideally placing it after all the
standard includes. Next, put AFL_INIT_ARGV(); near the very beginning of
main().
This will cause the program to read NUL-delimited input from stdin and
put it in argv[]. Two subsequent NULs terminate the array. Empty
params are encoded as a lone 0x02. Lone 0x02 can't be generated, but
that shouldn't matter in real life.
If you would like to always preserve argv[0], use this instead:
AFL_INIT_SET0("prog_name");
To enable persistent fuzzing, use the AFL_INIT_ARGV_PERSISTENT macro with
buf as argument, or use AFL_INIT_SET0_PERSISTENT("prog_name", buf)
to preserver argv[0]. buf is a pointer to a buffer containing
the input data for the current test case being processed defined as:
unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
*/
#ifndef _HAVE_ARGV_FUZZ_INL
#define _HAVE_ARGV_FUZZ_INL
#include <stdlib.h>
#include <unistd.h>
#define AFL_INIT_ARGV() \
do { \
\
argv = afl_init_argv(&argc); \
\
} while (0)
#define AFL_INIT_SET0(_p) \
do { \
\
argv = afl_init_argv(&argc); \
argv[0] = (_p); \
if (!argc) argc = 1; \
\
} while (0)
#define AFL_INIT_ARGV_PERSISTENT(persistent_buff) \
do { \
\
argv = afl_init_argv_persistent(&argc, persistent_buff); \
\
} while (0)
#define AFL_INIT_SET0_PERSISTENT(_p, persistent_buff) \
do { \
\
argv = afl_init_argv_persistent(&argc, persistent_buff); \
argv[0] = (_p); \
if (!argc) argc = 1; \
\
} while (0)
#define MAX_CMDLINE_LEN 100000
#define MAX_CMDLINE_PAR 50000
static char **afl_init_argv(int *argc) {
static char in_buf[MAX_CMDLINE_LEN];
static char *ret[MAX_CMDLINE_PAR];
char *ptr = in_buf;
int rc = 0;
ssize_t num = read(0, in_buf, MAX_CMDLINE_LEN - 2);
if (num < 1) { _exit(1); }
in_buf[num] = '\0';
in_buf[num + 1] = '\0';
while (*ptr && rc < MAX_CMDLINE_PAR) {
ret[rc] = ptr;
if (ret[rc][0] == 0x02 && !ret[rc][1]) ret[rc]++;
rc++;
while (*ptr)
ptr++;
ptr++;
}
*argc = rc;
return ret;
}
static char **afl_init_argv_persistent(int *argc,
unsigned char *persistent_buff) {
static char *ret[MAX_CMDLINE_PAR];
unsigned char *ptr = persistent_buff;
int rc = 0;
while (*ptr && rc < MAX_CMDLINE_PAR) {
ret[rc] = (char *)ptr;
if (ret[rc][0] == 0x02 && !ret[rc][1]) ret[rc]++;
rc++;
while (*ptr)
ptr++;
ptr++;
}
*argc = rc;
return ret;
}
#undef MAX_CMDLINE_LEN
#undef MAX_CMDLINE_PAR
#endif /* !_HAVE_ARGV_FUZZ_INL */
|
