test_gzip.sh

AFL_TIMEOUT=30
session=/tmp/tmp.gzip.$$
TMP_FILE_1="${session}/gzip.tmp.$$"
TMP_FILE_2="${session}/gzip.tmp.$$"

mkdir -p $session

cleanup()
{
	rm -fr /tmp/gzip.tmp* gzip*.zafl peasoup_exec*.gzip* zafl_in zafl_out ${session}
}

log_error()
{
	echo "TEST FAIL: $1"
	exit 1
}

log_message()
{
	echo "TEST  MSG: $1"
}

log_success()
{
	echo "TEST PASS: $1"
}

setup()
{
	echo "hello" > $TMP_FILE_1
	echo "hello" > $TMP_FILE_2
}

build_zafl()
{
	gzip_zafl=$1
	shift
	$PSZ `which gzip` $gzip_zafl -c move_globals=on -c zafl=on -o move_globals:--elftables -o zipr:--traceplacement:on -o zipr:true $*
	if [ ! $? -eq 0 ]; then
		log_error "$gzip_zafl: unable to generate zafl version"	
	else
		log_message "$gzip_zafl: built successfully"
	fi
}

test_zafl()
{
	gzip_zafl=$( realpath $1 )
	shift

	LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$SECURITY_TRANSFORMS_HOME/lib/ $gzip_zafl $* $TMP_FILE_1
	if [ ! $? -eq 0 ]; then
		log_error "$gzip_zafl $*: unable to gzip file using zafl version"
	fi

	LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$SECURITY_TRANSFORMS_HOME/lib/ $gzip_zafl -d ${TMP_FILE_1}.gz
	diff $TMP_FILE_1 $TMP_FILE_2
	if [ $? -eq 0 ]; then
		log_success "$gzip_zafl $*: after zipping and unzipping, we get the same file back. yeah!"
	else
		log_error "$gzip_zafl $*: after zipping and unzipping, we get a diferent file"
	fi
}

fuzz_with_zafl()
{
	gzip_zafl=$1

	# setup AFL directories
	mkdir zafl_in
	echo "1" > zafl_in/1

	# run for 30 seconds
	LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$SECURITY_TRANSFORMS_HOME/lib/ timeout $AFL_TIMEOUT afl-fuzz -i zafl_in -o zafl_out -- $gzip_zafl -f
	if [ $? -eq 124 ]; then
		if [ ! -e zafl_out/fuzzer_stats ]; then
			log_error "$gzip_zafl: something went wrong with afl -- no fuzzer stats file"
		fi

		cat zafl_out/fuzzer_stats
		execs_per_sec=$( grep execs_per_sec zafl_out/fuzzer_stats )
		log_success "$gzip_zafl: $execs_per_sec"
	else
		log_error "$gzip_zafl: unable to run with afl"
	fi

}

pushd ${session}
setup


# test setting of entry point via address
ep=$( objdump -Mintel -d /bin/gzip | grep text | grep -v -i disassembly | cut -d' ' -f1 | sed 's/^00000000//g' )
build_zafl gzip.stars.entrypoint.${ep}.zafl -o zafl:--stars -o "zafl:--entrypoint=$ep"
test_zafl ./gzip.stars.entrypoint.${ep}.zafl --fast

# test setting of entry point via function name
build_zafl gzip.entrypoint.zafl -o "zafl:--entrypoint=main"
test_zafl ./gzip.entrypoint.zafl --best

# test non-STARS version
build_zafl gzip.nostars.zafl
test_zafl ./gzip.nostars.zafl
test_zafl ./gzip.nostars.zafl --fast
test_zafl ./gzip.nostars.zafl --best

# test STARS version
build_zafl gzip.stars.zafl -o zafl:--stars
test_zafl ./gzip.stars.zafl
test_zafl ./gzip.stars.zafl --fast
test_zafl ./gzip.stars.zafl --best

# test STARS version on AFL
log_message "Fuzz for $AFL_TIMEOUT seconds"
fuzz_with_zafl ./gzip.stars.zafl

log_success "all tests passed: zafl instrumentation operational on gzip"

cleanup
popd