Changeset 1720 for zzuf/trunk


Ignore:
Timestamp:
Jan 27, 2007, 8:05:46 PM (13 years ago)
Author:
Sam Hocevar
Message:
  • Implemented -f/--fuzzing (fuzzing mode).
Location:
zzuf/trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed
  • zzuf/trunk/doc/zzuf.1

    r1708 r1720  
    55\fBzzuf\fR [\fB\-AcdimnqSvx\fR] [\fB\-s\fR \fIseed\fR|\fB\-s\fR \fIstart:stop\fR] [\fB\-r\fR \fIratio\fR|\fB\-r\fR \fImin:max\fR]
    66.br
    7            [\fB\-D\fR \fIdelay\fR] [\fB\-F\fR \fIforks\fR] [\fB\-C\fR \fIcrashes\fR] [\fB\-B\fR \fIbytes\fR] [\fB\-T\fR \fIseconds\fR]
    8 .br
    9            [\fB\-M\fR \fImegabytes\fR] [\fB\-b\fR \fIranges\fR] [\fB\-P\fR \fIprotect\fR] [\fB\-R\fR \fIrefuse\fR]
    10 .br
    11            [\fB\-I\fR \fIinclude\fR] [\fB\-E\fR \fIexclude\fR] [\fIPROGRAM\fR [\fB\-\-\fR] [\fIARGS\fR]...]
     7       [\fB\-f\fR \fIfuzzing\fR] [\fB\-D\fR \fIdelay\fR] [\fB\-F\fR \fIforks\fR] [\fB\-C\fR \fIcrashes\fR] [\fB\-B\fR \fIbytes\fR]
     8.br
     9       [\fB\-T\fR \fIseconds\fR] [\fB\-M\fR \fImegabytes\fR] [\fB\-P\fR \fIprotect\fR] [\fB\-R\fR \fIrefuse\fR]
     10.br
     11       [\fB\-b\fR \fIranges\fR] [\fB\-I\fR \fIinclude\fR] [\fB\-E\fR \fIexclude\fR] [\fIPROGRAM\fR [\fB\-\-\fR] [\fIARGS\fR]...]
    1212.br
    1313\fBzzuf \-h\fR | \fB\-\-help\fR
     
    9898Multiple \fB\-E\fR flags can be specified, in which case files matching any one
    9999of the regular expressions will be ignored.
     100.TP
     101\fB\-f\fR, \fB\-\-fuzzing\fR=\fImode\fR
     102Select how the input is fuzzed. Valid values for \fImode\fR are:
     103.RS
     104.TP
     105\fBxor\fR
     106randomly set and unset bits
     107.TP
     108\fBset\fR
     109only set bits
     110.TP
     111\fBunset\fR
     112only unset bits
     113.RE
     114.IP
     115The default value for \fImode\fR is \fBxor\fR.
    100116.TP
    101117\fB\-F\fR, \fB\-\-max\-forks\fR=\fIforks\fR
  • zzuf/trunk/src/fuzz.c

    r1719 r1720  
    3737#define MAGIC2 0x783bc31f
    3838
     39/* Fuzzing mode */
     40static enum fuzzing
     41{
     42    FUZZING_XOR = 0, FUZZING_SET, FUZZING_UNSET
     43}
     44fuzzing;
     45
    3946/* Per-offset byte protection */
    4047static unsigned int *ranges = NULL;
     
    4754/* Local prototypes */
    4855static void readchars(int *, char const *);
     56
     57extern void _zz_fuzzing(char const *mode)
     58{
     59    if(!strcmp(mode, "xor"))
     60        fuzzing = FUZZING_XOR;
     61    else if(!strcmp(mode, "set"))
     62        fuzzing = FUZZING_SET;
     63    else if(!strcmp(mode, "unset"))
     64        fuzzing = FUZZING_UNSET;
     65}
    4966
    5067void _zz_bytes(char const *list)
     
    144161        {
    145162            unsigned int *r;
    146             uint8_t byte;
     163            uint8_t byte, fuzzbyte;
    147164
    148165            if(!ranges)
     
    161178                continue;
    162179
    163             byte ^= fuzz->data[j % CHUNKBYTES];
     180            fuzzbyte = fuzz->data[j % CHUNKBYTES];
     181
     182            if(!fuzzbyte)
     183                continue;
     184
     185            switch(fuzzing)
     186            {
     187            case FUZZING_XOR:
     188                byte ^= fuzzbyte;
     189                break;
     190            case FUZZING_SET:
     191                byte |= fuzzbyte;
     192                break;
     193            case FUZZING_UNSET:
     194                byte &= ~fuzzbyte;
     195                break;
     196            }
    164197
    165198            if(refuse[byte])
  • zzuf/trunk/src/fuzz.h

    r1705 r1720  
    1717 */
    1818
     19extern void _zz_fuzzing(char const *);
    1920extern void _zz_bytes(char const *);
    2021extern void _zz_protect(char const *);
  • zzuf/trunk/src/opts.c

    r1705 r1720  
    3434void _zz_opts_init(struct opts *opts)
    3535{
    36     opts->bytes = opts->protect = opts->refuse = NULL;
     36    opts->fuzzing = opts->bytes = opts->protect = opts->refuse = NULL;
    3737    opts->seed = DEFAULT_SEED;
    3838    opts->endseed = DEFAULT_SEED + 1;
  • zzuf/trunk/src/opts.h

    r1707 r1720  
    2121    char **oldargv;
    2222    char **newargv;
    23     char *bytes, *protect, *refuse;
     23    char *fuzzing, *bytes, *protect, *refuse;
    2424    uint32_t seed;
    2525    uint32_t endseed;
  • zzuf/trunk/src/zzuf.c

    r1718 r1720  
    131131    {
    132132#   if defined HAVE_REGEX_H
    133 #       define OPTSTR "Ab:B:cC:dD:E:F:iI:mM:nP:qr:R:s:ST:vxhV"
     133#       define OPTSTR "Ab:B:cC:dD:E:f:F:iI:mM:nP:qr:R:s:ST:vxhV"
    134134#   else
    135 #       define OPTSTR "Ab:B:C:dD:F:imM:nP:qr:R:s:ST:vxhV"
     135#       define OPTSTR "Ab:B:C:dD:f:F:imM:nP:qr:R:s:ST:vxhV"
    136136#   endif
    137137#   if defined HAVE_GETOPT_LONG
     
    153153            { "exclude",     1, NULL, 'E' },
    154154#endif
     155            { "fuzzing",     1, NULL, 'f' },
    155156            { "max-forks",   1, NULL, 'F' },
    156157            { "stdin",       0, NULL, 'i' },
     
    220221            break;
    221222#endif
     223        case 'f': /* --fuzzing */
     224            opts->fuzzing = optarg;
     225            break;
    222226        case 'F': /* --max-forks */
    223227            opts->maxchild = atoi(optarg) > 1 ? atoi(optarg) : 1;
     
    344348#endif
    345349
     350    if(opts->fuzzing)
     351        setenv("ZZUF_FUZZING", opts->fuzzing, 1);
    346352    if(opts->bytes)
    347353        setenv("ZZUF_BYTES", opts->bytes, 1);
     
    394400        ctx = _zz_md5_init();
    395401
     402    if(opts->fuzzing)
     403        _zz_fuzzing(opts->fuzzing);
    396404    if(opts->bytes)
    397405        _zz_bytes(opts->bytes);
     
    10491057    printf("Usage: zzuf [-AdimnqSvx] [-s seed|-s start:stop] [-r ratio|-r min:max]\n");
    10501058#endif
    1051     printf("                  [-D delay] [-F forks] [-C crashes] [-B bytes] [-T seconds]\n");
    1052     printf("                  [-M bytes] [-b ranges] [-P protect] [-R refuse]\n");
    1053 #if defined HAVE_REGEX_H
    1054     printf("                  [-I include] [-E exclude] [PROGRAM [--] [ARGS]...]\n");
     1059    printf("              [-f fuzzing] [-D delay] [-F forks] [-C crashes] [-B bytes]\n");
     1060    printf("              [-T seconds] [-M bytes] [-b ranges] [-P protect] [-R refuse]\n");
     1061#if defined HAVE_REGEX_H
     1062    printf("              [-I include] [-E exclude] [PROGRAM [--] [ARGS]...]\n");
    10551063#else
    1056     printf("                  [PROGRAM [--] [ARGS]...]\n");
     1064    printf("              [PROGRAM [--] [ARGS]...]\n");
    10571065#endif
    10581066#   if defined HAVE_GETOPT_LONG
     
    10791087    printf("  -E, --exclude <regex>     do not fuzz files matching <regex>\n");
    10801088#endif
     1089    printf("  -f, --fuzzing <mode>      use fuzzing mode <mode> ([xor] set unset)\n");
    10811090    printf("  -F, --max-forks <n>       number of concurrent children (default 1)\n");
    10821091    printf("  -i, --stdin               fuzz standard input\n");
     
    11151124    printf("  -E <regex>       do not fuzz files matching <regex>\n");
    11161125#endif
     1126    printf("  -f <mode>        use fuzzing mode <mode>\n");
    11171127    printf("  -F <n>           number of concurrent forks (default 1)\n");
    11181128    printf("  -i               fuzz standard input\n");
Note: See TracChangeset for help on using the changeset viewer.