Newer
Older
export AFL_TIMEOUT=15
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$SECURITY_TRANSFORMS_HOME/lib/:.
session=/tmp/tmp.zafl.strings.$$.$(whoami)
rm -fr /tmp/tmp.zafl.strings.*.$(whoami)
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
}
log_error()
{
echo "TEST FAIL: $1"
exit 1
}
log_message()
{
echo "TEST MSG: $1"
}
log_success()
{
echo "TEST PASS: $1"
}
fuzz_with_zafl()
{
strings_zafl=$1
# setup AFL directories
mkdir zafl_in
echo "1" > zafl_in/1
if [ -d zafl_out ]; then
rm -fr zafl_out
fi
# run for 30 seconds
timeout $AFL_TIMEOUT afl-fuzz -i zafl_in -o zafl_out -- $strings_zafl
if [ $? -eq 124 ]; then
if [ ! -e zafl_out/fuzzer_stats ]; then
log_error "$strings_zafl: something went wrong with afl -- no fuzzer stats file"
fi
cat zafl_out/fuzzer_stats
execs_per_sec=$( grep execs_per_sec zafl_out/fuzzer_stats )
log_success "$strings_zafl: $execs_per_sec"
else
log_error "$strings_zafl: unable to run with afl"
fi
}
mkdir $session
pushd $session
# build ZAFL version of strings executable
zafl.sh `which strings` strings.zafl --tempdir analysis.strings.zafl
if [ $? -eq 0 ]; then
log_success "build strings.zafl"
else
log_error "build strings.zafl"
fi
grep ATTR analysis.strings.zafl/logs/zafl.log
log_message "Fuzz for $AFL_TIMEOUT secs"
fuzz_with_zafl $(realpath ./strings.zafl)
cleanup
popd