driverbin.c File Reference

#include <stdint.h>
#include <stdlib.h>
#include <stdio.h>
#include <dirent.h>
#include <unistd.h>

Go to the source code of this file.

Functions
int	LLVMFuzzerTestOneInput (const uint8_t *Data, size_t Size)
const char *	cs_fuzz_arch (uint8_t arch)
int	main (int argc, char **argv)

Function Documentation

cs_fuzz_arch()

const char * cs_fuzz_arch

(

uint8_t

arch

)

Definition at line 217 of file fuzz_disasm.c.

                                        {
    return platforms[arch % sizeof(platforms)/sizeof(platforms[0])].cstoolname;
}

References arch, platform::cstoolname, and platforms.

Referenced by main().

LLVMFuzzerTestOneInput()

int LLVMFuzzerTestOneInput	(	const uint8_t *	data,
		size_t	size
	)

This fuzz target attempts to compress the fuzzed data with the simple compression function with an output buffer that may be too small to ensure that the compressor never crashes.

This fuzz target attempts to decompress the fuzzed data with the simple decompression function to ensure the decompressor never crashes.

This fuzz target performs a lz4 round-trip test (compress & decompress), compares the result with the original, and calls abort() on corruption.

Definition at line 221 of file fuzz_disasm.c.

                                                             {
    csh handle;
    cs_insn *all_insn;
    cs_detail *detail;
    cs_err err;
 
    if (Size < 1) {
        // 1 byte for arch choice
        return 0;
    } else if (Size > 0x1000) {
        //limit input to 4kb
        Size = 0x1000;
    }
    if (outfile == NULL) {
        // we compute the output
        outfile = fopen("/dev/null", "w");
        if (outfile == NULL) {
            return 0;
        }
    }
 
    int platforms_len = sizeof(platforms)/sizeof(platforms[0]);
    int i = (int)Data[0] % platforms_len;
 
    err = cs_open(platforms[i].arch, platforms[i].mode, &handle);
    if (err) {
        return 0;
    }
    cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);
 
    uint64_t address = 0x1000;
    size_t count = cs_disasm(handle, Data+1, Size-1, address, 0, &all_insn);
 
    if (count) {
        size_t j;
        int n;
 
        for (j = 0; j < count; j++) {
            cs_insn *i = &(all_insn[j]);
            fprintf(outfile, "0x%"PRIx64":\t%s\t\t%s // insn-ID: %u, insn-mnem: %s\n",
                   i->address, i->mnemonic, i->op_str,
                   i->id, cs_insn_name(handle, i->id));
 
            detail = i->detail;
 
            if (detail->regs_read_count > 0) {
                fprintf(outfile, "\tImplicit registers read: ");
                for (n = 0; n < detail->regs_read_count; n++) {
                    fprintf(outfile, "%s ", cs_reg_name(handle, detail->regs_read[n]));
                }
            }
 
            if (detail->regs_write_count > 0) {
                fprintf(outfile, "\tImplicit registers modified: ");
                for (n = 0; n < detail->regs_write_count; n++) {
                    fprintf(outfile, "%s ", cs_reg_name(handle, detail->regs_write[n]));
                }
            }
 
            if (detail->groups_count > 0) {
                fprintf(outfile, "\tThis instruction belongs to groups: ");
                for (n = 0; n < detail->groups_count; n++) {
                    fprintf(outfile, "%s ", cs_group_name(handle, detail->groups[n]));
                }
            }
        }
        fprintf(outfile, "0x%"PRIx64":\n", all_insn[j-1].address + all_insn[j-1].size);
        cs_free(all_insn, count);
    }
 
    cs_close(&handle);
 
    return 0;
}

References arch, count, cs_close(), cs_disasm(), cs_free(), cs_group_name(), cs_insn_name(), cs_open(), CS_OPT_DETAIL, CS_OPT_ON, cs_option(), cs_reg_name(), test_evm::detail, err, handle, i, int, n, NULL, outfile, platforms, and PRIx64.

Referenced by main().

main()

int main	(	int	argc,
		char **	argv
	)

Definition at line 10 of file driverbin.c.

{
    FILE * fp;
    uint8_t Data[0x1000];
    size_t Size;
    DIR *d;
    struct dirent *dir;
    int r = 0;
    int i;
 
    if (argc != 2) {
        return 1;
    }
 
    d = opendir(argv[1]);
    if (d == NULL) {
        printf("Invalid directory\n");
        return 2;
    }
    if (chdir(argv[1]) != 0) {
        closedir(d);
        printf("Invalid directory\n");
        return 2;
    }
 
    while((dir = readdir(d)) != NULL) {
        //opens the file, get its size, and reads it into a buffer
        if (dir->d_type != DT_REG) {
            continue;
        }
 
        printf("Running %s\n", dir->d_name);
        fflush(stdout);
 
        fp = fopen(dir->d_name, "rb");
        if (fp == NULL) {
            r = 3;
            break;
        }
        if (fseek(fp, 0L, SEEK_END) != 0) {
            fclose(fp);
            r = 4;
            break;
        }
        Size = ftell(fp);
        if (Size == (size_t) -1) {
            fclose(fp);
            r = 5;
            break;
        } else if (Size > 0x1000) {
            fclose(fp);
            continue;
        }
        if (fseek(fp, 0L, SEEK_SET) != 0) {
            fclose(fp);
            r = 7;
            break;
        }
        if (fread(Data, Size, 1, fp) != 1) {
            fclose(fp);
            r = 8;
            break;
        }
        if (Size > 0) {
            printf("command cstool %s\n", cs_fuzz_arch(Data[0]));
        }
        for (i=0; i<Size; i++) {
            printf("%02x", Data[i]);
        }
        printf("\n");
 
        //lauch fuzzer
        LLVMFuzzerTestOneInput(Data, Size);
        fclose(fp);
    }
    closedir(d);
    printf("Ok : whole directory finished\n");
    return r;
}

References argv, chdir, cs_fuzz_arch(), d, dirent::d_name, benchmark::FILE, i, L, LLVMFuzzerTestOneInput(), NULL, printf(), r, readdir, SEEK_END, and SEEK_SET.