Changeset 1720Tweet

Timestamp:

Jan 27, 2007, 8:05:46 PM (16 years ago)

Author:

Sam Hocevar

Message:

• Implemented -f/--fuzzing (fuzzing mode).

Location:

zzuf/trunk

Files:

• doc/zzuf.1 (modified) (2 diffs)
• src/fuzz.c (modified) (4 diffs)
• src/fuzz.h (modified) (1 diff)
• src/opts.c (modified) (1 diff)
• src/opts.h (modified) (1 diff)
• src/zzuf.c (modified) (8 diffs)

zzuf/trunk/doc/zzuf.1

@@ -5 +5 @@
 \fBzzuf\fR [\fB\-AcdimnqSvx\fR] [\fB\-s\fR \fIseed\fR|\fB\-s\fR \fIstart:stop\fR] [\fB\-r\fR \fIratio\fR|\fB\-r\fR \fImin:max\fR]
 .br
-           [\fB\-D\fR \fIdelay\fR] [\fB\-F\fR \fIforks\fR] [\fB\-C\fR \fIcrashes\fR] [\fB\-B\fR \fIbytes\fR] [\fB\-T\fR \fIseconds\fR]
-.br
-           [\fB\-M\fR \fImegabytes\fR] [\fB\-b\fR \fIranges\fR] [\fB\-P\fR \fIprotect\fR] [\fB\-R\fR \fIrefuse\fR]
-.br
-           [\fB\-I\fR \fIinclude\fR] [\fB\-E\fR \fIexclude\fR] [\fIPROGRAM\fR [\fB\-\-\fR] [\fIARGS\fR]...]
+       [\fB\-f\fR \fIfuzzing\fR] [\fB\-D\fR \fIdelay\fR] [\fB\-F\fR \fIforks\fR] [\fB\-C\fR \fIcrashes\fR] [\fB\-B\fR \fIbytes\fR]
+.br
+       [\fB\-T\fR \fIseconds\fR] [\fB\-M\fR \fImegabytes\fR] [\fB\-P\fR \fIprotect\fR] [\fB\-R\fR \fIrefuse\fR]
+.br
+       [\fB\-b\fR \fIranges\fR] [\fB\-I\fR \fIinclude\fR] [\fB\-E\fR \fIexclude\fR] [\fIPROGRAM\fR [\fB\-\-\fR] [\fIARGS\fR]...]
 .br
 \fBzzuf \-h\fR | \fB\-\-help\fR
@@ -98 +98 @@
 Multiple \fB\-E\fR flags can be specified, in which case files matching any one
 of the regular expressions will be ignored.
+.TP
+\fB\-f\fR, \fB\-\-fuzzing\fR=\fImode\fR
+Select how the input is fuzzed. Valid values for \fImode\fR are:
+.RS
+.TP
+\fBxor\fR
+randomly set and unset bits
+.TP
+\fBset\fR
+only set bits
+.TP
+\fBunset\fR
+only unset bits
+.RE
+.IP
+The default value for \fImode\fR is \fBxor\fR.
 .TP
 \fB\-F\fR, \fB\-\-max\-forks\fR=\fIforks\fR

zzuf/trunk/src/fuzz.c

@@ -37 +37 @@
 #define MAGIC2 0x783bc31f
 
+/* Fuzzing mode */
+static enum fuzzing
+{
+    FUZZING_XOR = 0, FUZZING_SET, FUZZING_UNSET
+}
+fuzzing;
+
 /* Per-offset byte protection */
 static unsigned int *ranges = NULL;
@@ -47 +54 @@
 /* Local prototypes */
 static void readchars(int *, char const *);
+
+extern void _zz_fuzzing(char const *mode)
+{
+    if(!strcmp(mode, "xor"))
+        fuzzing = FUZZING_XOR;
+    else if(!strcmp(mode, "set"))
+        fuzzing = FUZZING_SET;
+    else if(!strcmp(mode, "unset"))
+        fuzzing = FUZZING_UNSET;
+}
 
 void _zz_bytes(char const *list)
@@ -144 +161 @@
         {
             unsigned int *r;
-            uint8_t byte;
+            uint8_t byte, fuzzbyte;
 
             if(!ranges)
@@ -161 +178 @@
                 continue;
 
-            byte ^= fuzz->data[j % CHUNKBYTES];
+            fuzzbyte = fuzz->data[j % CHUNKBYTES];
+
+            if(!fuzzbyte)
+                continue;
+
+            switch(fuzzing)
+            {
+            case FUZZING_XOR:
+                byte ^= fuzzbyte;
+                break;
+            case FUZZING_SET:
+                byte |= fuzzbyte;
+                break;
+            case FUZZING_UNSET:
+                byte &= ~fuzzbyte;
+                break;
+            }
 
             if(refuse[byte])

zzuf/trunk/src/fuzz.h

@@ -17 +17 @@
  */
 
+extern void _zz_fuzzing(char const *);
 extern void _zz_bytes(char const *);
 extern void _zz_protect(char const *);

zzuf/trunk/src/opts.c

@@ -34 +34 @@
 void _zz_opts_init(struct opts *opts)
 {
-    opts->bytes = opts->protect = opts->refuse = NULL;
+    opts->fuzzing = opts->bytes = opts->protect = opts->refuse = NULL;
     opts->seed = DEFAULT_SEED;
     opts->endseed = DEFAULT_SEED + 1;

zzuf/trunk/src/opts.h

@@ -21 +21 @@
     char **oldargv;
     char **newargv;
-    char *bytes, *protect, *refuse;
+    char *fuzzing, *bytes, *protect, *refuse;
     uint32_t seed;
     uint32_t endseed;

zzuf/trunk/src/zzuf.c

@@ -131 +131 @@
     {
 #   if defined HAVE_REGEX_H
-#       define OPTSTR "Ab:B:cC:dD:E:F:iI:mM:nP:qr:R:s:ST:vxhV"
+#       define OPTSTR "Ab:B:cC:dD:E:f:F:iI:mM:nP:qr:R:s:ST:vxhV"
 #   else
-#       define OPTSTR "Ab:B:C:dD:F:imM:nP:qr:R:s:ST:vxhV"
+#       define OPTSTR "Ab:B:C:dD:f:F:imM:nP:qr:R:s:ST:vxhV"
 #   endif
 #   if defined HAVE_GETOPT_LONG
@@ -153 +153 @@
             { "exclude",     1, NULL, 'E' },
 #endif
+            { "fuzzing",     1, NULL, 'f' },
             { "max-forks",   1, NULL, 'F' },
             { "stdin",       0, NULL, 'i' },
@@ -220 +221 @@
             break;
 #endif
+        case 'f': /* --fuzzing */
+            opts->fuzzing = optarg;
+            break;
         case 'F': /* --max-forks */
             opts->maxchild = atoi(optarg) > 1 ? atoi(optarg) : 1;
@@ -344 +348 @@
 #endif
 
+    if(opts->fuzzing)
+        setenv("ZZUF_FUZZING", opts->fuzzing, 1);
     if(opts->bytes)
         setenv("ZZUF_BYTES", opts->bytes, 1);
@@ -394 +400 @@
         ctx = _zz_md5_init();
 
+    if(opts->fuzzing)
+        _zz_fuzzing(opts->fuzzing);
     if(opts->bytes)
         _zz_bytes(opts->bytes);
@@ -1049 +1057 @@
     printf("Usage: zzuf [-AdimnqSvx] [-s seed|-s start:stop] [-r ratio|-r min:max]\n");
 #endif
-    printf("                  [-D delay] [-F forks] [-C crashes] [-B bytes] [-T seconds]\n");
-    printf("                  [-M bytes] [-b ranges] [-P protect] [-R refuse]\n");
-#if defined HAVE_REGEX_H
-    printf("                  [-I include] [-E exclude] [PROGRAM [--] [ARGS]...]\n");
+    printf("              [-f fuzzing] [-D delay] [-F forks] [-C crashes] [-B bytes]\n");
+    printf("              [-T seconds] [-M bytes] [-b ranges] [-P protect] [-R refuse]\n");
+#if defined HAVE_REGEX_H
+    printf("              [-I include] [-E exclude] [PROGRAM [--] [ARGS]...]\n");
 #else
-    printf("                  [PROGRAM [--] [ARGS]...]\n");
+    printf("              [PROGRAM [--] [ARGS]...]\n");
 #endif
 #   if defined HAVE_GETOPT_LONG
@@ -1079 +1087 @@
     printf("  -E, --exclude <regex>     do not fuzz files matching <regex>\n");
 #endif
+    printf("  -f, --fuzzing <mode>      use fuzzing mode <mode> ([xor] set unset)\n");
     printf("  -F, --max-forks <n>       number of concurrent children (default 1)\n");
     printf("  -i, --stdin               fuzz standard input\n");
@@ -1115 +1124 @@
     printf("  -E <regex>       do not fuzz files matching <regex>\n");
 #endif
+    printf("  -f <mode>        use fuzzing mode <mode>\n");
     printf("  -F <n>           number of concurrent forks (default 1)\n");
     printf("  -i               fuzz standard input\n");