>>> from fuzzingbook.FuzzingInTheLarge import <identifier>


# ignore
from graphviz import Digraph


# ignore
g = Digraph()
server = 'Crash Server'
g.node('Crash Database', shape='cylinder')
for i in range(1, 7):
    g.edge('Fuzzer ' + repr(i), server)
g.edge(server, 'Crash Database')
g


fuzzmanager_url = "http://127.0.0.1:8000"


gui_driver = start_webdriver(headless=True, zoom=1.2)


gui_driver.set_window_size(1400, 600)


gui_driver.get(fuzzmanager_url)


# ignore
Image(gui_driver.get_screenshot_as_png())


# ignore
from selenium.webdriver.common.by import By


# ignore
username = gui_driver.find_element(By.NAME, "username")
username.send_keys("demo")


# ignore
password = gui_driver.find_element(By.NAME, "password")
password.send_keys("demo")


# ignore
login = gui_driver.find_element(By.TAG_NAME, "button")
login.click()
time.sleep(DELAY_AFTER_CLICK)


# ignore
Image(gui_driver.get_screenshot_as_png())


!git clone https://github.com/uds-se/simply-buggy

Cloning into 'simply-buggy'...
remote: Enumerating objects: 22, done.
remote: Total 22 (delta 0), reused 0 (delta 0), pack-reused 22 (from 1)
Receiving objects: 100% (22/22), 4.90 KiB | 4.90 MiB/s, done.
Resolving deltas: 100% (9/9), done.


!(cd simply-buggy && make)

clang++ -fsanitize=address -g -o maze maze.cpp
clang++ -fsanitize=address -g -o out-of-bounds out-of-bounds.cpp
clang++ -fsanitize=address -g -o simple-crash simple-crash.cpp


# ignore
from bookutils import print_file


# ignore
print_file("simply-buggy/simple-crash.cpp")

/*
 * simple-crash - A simple NULL crash.
 *
 * WARNING: This program neither makes sense nor should you code like it is
 *          done in this program. It is purely for demo purposes and uses
 *          bad and meaningless coding habits on purpose.
 */

int crash() {
  int* p = (int*)0x1;
  *p = 0xDEADBEEF;
  return *p;
}

int main(int argc, char** argv) {
  return crash();
}


# ignore
print_file("simply-buggy/simple-crash.fuzzmanagerconf", lexer=IniLexer())

[Main]
platform = x86-64
product = simple-crash-simple-crash
product_version = 83038f74e812529d0fc172a718946fbec385403e
os = linux

[Metadata]
pathPrefix = /Users/zeller/Projects/fuzzingbook/notebooks/simply-buggy/
buildFlags = -fsanitize=address -g


!simply-buggy/simple-crash

simple-crash(47892,0x1fd223840) malloc: nano zone abandoned due to inability to reserve vm space.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==47892==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x0001005c3e0c bp 0x00016f83ea10 sp 0x00016f83e9d0 T0)
==47892==The signal is caused by a WRITE memory access.
==47892==Hint: address points to the zero page.
    #0 0x1005c3e0c in crash() simple-crash.cpp:11
    #1 0x1005c3e94 in main simple-crash.cpp:16
    #2 0x197d8c270  (<unknown module>)

==47892==Register values:
 x[0] = 0x0000000000000001   x[1] = 0x000000016f83ec98   x[2] = 0x000000016f83eca8   x[3] = 0x000000016f83ef08  
 x[4] = 0x0000000000000001   x[5] = 0x0000000000000000   x[6] = 0x0000000000000000   x[7] = 0x00000000000004a0  
 x[8] = 0x0000007000020000   x[9] = 0x00000000deadbeef  x[10] = 0x0000000000000001  x[11] = 0x000000016f83e9d0  
x[12] = 0x0000000000001170  x[13] = 0x0000000100008000  x[14] = 0x0000000000004000  x[15] = 0x00000001a5bcef55  
x[16] = 0x0000000198141344  x[17] = 0x0000000205482578  x[18] = 0x0000000000000000  x[19] = 0x00000001fcf8c050  
x[20] = 0x00000001fcf8c0a0  x[21] = 0x00000001fcf8c050  x[22] = 0x000000016f83eb28  x[23] = 0x000000016f83eb28  
x[24] = 0x0000000197d86000  x[25] = 0x0000000000000000  x[26] = 0x0000000000000000  x[27] = 0x0000000000000000  
x[28] = 0x0000000000000000     fp = 0x000000016f83ea10     lr = 0x00000001005c3e98     sp = 0x000000016f83e9d0  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV simple-crash.cpp:11 in crash()
==47892==ABORTING


cmd = ["simply-buggy/simple-crash"]


result = subprocess.run(cmd, stderr=subprocess.PIPE)
stderr = result.stderr.decode().splitlines()
crashed = False

for line in stderr:
    if "ERROR: AddressSanitizer" in line:
        crashed = True
        break

if crashed:
    print("Yay, we crashed!")
else:
    print("Move along, nothing to see...")

Yay, we crashed!


sys.path.append('FuzzManager')


configuration = ProgramConfiguration.fromBinary('simply-buggy/simple-crash')
(configuration.product, configuration.platform)

('simple-crash-simple-crash', 'x86-64')


cmd = ["simply-buggy/simple-crash"]
result = subprocess.run(cmd, stderr=subprocess.PIPE, stdout=subprocess.PIPE)


stderr = result.stderr.decode().splitlines()
stderr[0:3]

['AddressSanitizer:DEADLYSIGNAL',
 '=================================================================',
 '==47914==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x000102897e0c bp 0x00016d56aab0 sp 0x00016d56aa70 T0)']


stdout = result.stdout.decode().splitlines()
stdout

[]


crashInfo = CrashInfo.fromRawCrashData(stdout, stderr, configuration)
print(crashInfo)

Crash trace:

# 00    crash
# 01    main
# 02    <unknow

Crash address: 0x1

Last 5 lines on stderr:
x[24] = 0x0000000197d86000  x[25] = 0x0000000000000000  x[26] = 0x0000000000000000  x[27] = 0x0000000000000000  
x[28] = 0x0000000000000000     fp = 0x000000016d56aab0     lr = 0x0000000102897e98     sp = 0x000000016d56aa70  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV simple-crash.cpp:11 in crash()
==47914==ABORTING


collector = Collector()


collector.submit(crashInfo)

{'rawStdout': '',
 'rawStderr': 'AddressSanitizer:DEADLYSIGNAL\n=================================================================\n==47914==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x000102897e0c bp 0x00016d56aab0 sp 0x00016d56aa70 T0)\n==47914==The signal is caused by a WRITE memory access.\n==47914==Hint: address points to the zero page.\n    #0 0x102897e0c in crash() simple-crash.cpp:11\n    #1 0x102897e94 in main simple-crash.cpp:16\n    #2 0x197d8c270  (<unknown module>)\n\n==47914==Register values:\n x[0] = 0x0000000000000001   x[1] = 0x000000016d56ad30   x[2] = 0x000000016d56ad40   x[3] = 0x000000016d56af90  \n x[4] = 0x0000000000000001   x[5] = 0x0000000000000000   x[6] = 0x0000000000000000   x[7] = 0x00000000000004a0  \n x[8] = 0x0000007000020000   x[9] = 0x00000000deadbeef  x[10] = 0x0000000000000001  x[11] = 0x000000016d56aa70  \nx[12] = 0x0000000000001170  x[13] = 0x0000000100008000  x[14] = 0x0000000000004000  x[15] = 0x00000001a5bcef55  \nx[16] = 0x0000000198141344  x[17] = 0x0000000205482578  x[18] = 0x0000000000000000  x[19] = 0x00000001fcf8c050  \nx[20] = 0x00000001fcf8c0a0  x[21] = 0x00000001fcf8c050  x[22] = 0x000000016d56abc8  x[23] = 0x000000016d56abc8  \nx[24] = 0x0000000197d86000  x[25] = 0x0000000000000000  x[26] = 0x0000000000000000  x[27] = 0x0000000000000000  \nx[28] = 0x0000000000000000     fp = 0x000000016d56aab0     lr = 0x0000000102897e98     sp = 0x000000016d56aa70  \nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV simple-crash.cpp:11 in crash()\n==47914==ABORTING',
 'rawCrashData': '',
 'metadata': '{"pathPrefix": "/Users/zeller/Projects/fuzzingbook/notebooks/simply-buggy/", "buildFlags": "-fsanitize=address -g"}',
 'testcase_size': 0,
 'testcase_quality': 0,
 'testcase_isbinary': False,
 'platform': 'x86-64',
 'product': 'simple-crash-simple-crash',
 'product_version': '83038f74e812529d0fc172a718946fbec385403e',
 'os': 'linux',
 'client': 'Braeburn.fritz.box',
 'tool': 'fuzzingbook',
 'env': '',
 'args': '',
 'bucket': None,
 'id': 1,
 'shortSignature': '[@ crash]',
 'crashAddress': '0x1'}


# ignore
gui_driver.refresh()


# ignore
Image(gui_driver.get_screenshot_as_png())


# ignore
crash = gui_driver.find_element(By.XPATH, '//td/a[contains(@href,"/crashmanager/crashes/")]')
crash.click()
time.sleep(DELAY_AFTER_CLICK)


# ignore
Image(gui_driver.get_screenshot_as_png())


# ignore
Image(gui_driver.get_screenshot_as_png())


# ignore
create = gui_driver.find_element(By.XPATH, '//a[contains(@href,"/signatures/new/")]')
create.click()
time.sleep(DELAY_AFTER_CLICK)


# ignore
gui_driver.set_window_size(1400, 1200)


# ignore
Image(gui_driver.get_screenshot_as_png())


# ignore
save = gui_driver.find_element(By.NAME, "submit_save")
save.click()
time.sleep(DELAY_AFTER_CLICK)


# ignore
gui_driver.set_window_size(1400, 800)
Image(gui_driver.get_screenshot_as_png())


# ignore
print_file("simply-buggy/out-of-bounds.cpp")

/*
 * out-of-bounds - A simple multi-signature out-of-bounds demo.
 *
 * WARNING: This program neither makes sense nor should you code like it is
 *          done in this program. It is purely for demo purposes and uses
 *          bad and meaningless coding habits on purpose.
 */
#include <cstring>
#include <fstream>
#include <iostream>

void printFirst(char* data, size_t count) {
  std::string first(data, count);
  std::cout << first << std::endl;
}

void printLast(char* data, size_t count) {
  std::string last(data + strlen(data) - count, count);
  std::cout << last << std::endl;
}

int validateAndPerformAction(char* buffer, size_t size) {
  if (size < 2) {
    std::cerr << "Buffer is too short." << std::endl;
    return 1;
  }

  uint8_t action = buffer[0];
  uint8_t count = buffer[1];
  char* data = buffer + 2;

  if (!count) {
    std::cerr << "count must be non-zero." << std::endl;
    return 1;
  }

  // Forgot to check count vs. the length of data here, doh!

  if (!action) {
    std::cerr << "Action can't be zero." << std::endl;
    return 1;
  } else if (action >= 128) {
    printLast(data, count);
    return 0;
  } else {
    printFirst(data, count);
    return 0;
  }
}

int main(int argc, char** argv) {
  if (argc < 2) {
    std::cerr << "Usage is: " << argv[0] << " <file>" << std::endl;
    exit(1);
  }

  std::ifstream input(argv[1], std::ifstream::binary);
  if (!input) {
    std::cerr << "Error opening file." << std::endl;
    exit(1);
  }

  input.seekg(0, input.end);
  int size = input.tellg();
  input.seekg(0, input.beg);

  if (size < 0) {
    std::cerr << "Error seeking in file." << std::endl;
    exit(1);
  }

  char* buffer = new char[size];
  input.read(buffer, size);

  if (!input) {
    std::cerr << "Error while reading file." << std::endl;
    exit(1);
  }

  int ret = validateAndPerformAction(buffer, size);

  delete[] buffer;
  return ret;
}


# ignore
import os
import random
import subprocess
import tempfile
import sys


cmd = ["simply-buggy/out-of-bounds"]

# Connect to crash server
collector = Collector()

random.seed(2048)

crash_count = 0
TRIALS = 20

for itnum in range(0, TRIALS):
    rand_len = random.randint(1, 1024)
    rand_data = bytes([random.randrange(0, 256) for i in range(rand_len)])

    (fd, current_file) = tempfile.mkstemp(prefix="fuzztest", text=True)
    os.write(fd, rand_data)
    os.close(fd)

    current_cmd = []
    current_cmd.extend(cmd)
    current_cmd.append(current_file)

    result = subprocess.run(current_cmd,
                            stdout=subprocess.PIPE,
                            stderr=subprocess.PIPE)
    stdout = []   # escapelines(result.stdout)
    stderr = escapelines(result.stderr)
    crashed = False

    for line in stderr:
        if "ERROR: AddressSanitizer" in line:
            crashed = True
            break

    print(itnum, end=" ")

    if crashed:
        sys.stdout.write("(Crash) ")

        # This reads the simple-crash.fuzzmanagerconf file
        configuration = ProgramConfiguration.fromBinary(cmd[0])

        # This reads and parses our ASan trace into a more generic format,
        # returning us a generic "CrashInfo" object that we can inspect
        # and/or submit to the server.
        crashInfo = CrashInfo.fromRawCrashData(stdout, stderr, configuration)

        # Submit the crash
        collector.submit(crashInfo, testCase = current_file)

        crash_count += 1

    os.remove(current_file)

print("")
print("Done, submitted %d crashes after %d runs." % (crash_count, TRIALS))

0 (Crash) 1 2 (Crash) 3 4 5 6 7 8 (Crash) 9 10 11 12 (Crash) 13 14 (Crash) 15 16 17 18 19 
Done, submitted 5 crashes after 20 runs.


# ignore
gui_driver.get(fuzzmanager_url + "/crashmanager/crashes")


# ignore
Image(gui_driver.get_screenshot_as_png())

{
  "symptoms": [
    {
      "type": "output",
      "src": "stderr",
      "value": "/ERROR: AddressSanitizer: heap-buffer-overflow/"
    },
    {
      "type": "stackFrames",
      "functionNames": [
        "?",
        "?",
        "?",
        "validateAndPerformAction",
        "main",
        "__libc_start_main",
        "_start"
      ]
    },
    {
      "type": "crashAddress",
      "address": "> 0xFF"
    }
  ]
}


# ignore
print_file("simply-buggy/maze.cpp")

/*
 * maze - A simple constant maze that crashes at some point.
 *
 * WARNING: This program neither makes sense nor should you code like it is
 *          done in this program. It is purely for demo purposes and uses
 *          bad and meaningless coding habits on purpose.
 */

#include <cstdlib>
#include <iostream>

int boom() {
  int* p = (int*)0x1;
  *p = 0xDEADBEEF;
  return *p;
}

int main(int argc, char** argv) {
  if (argc != 5) {
    std::cerr << "All I'm asking for is four numbers..." << std::endl;
    return 1;
  }

  int num1 = atoi(argv[1]);
  if (num1 > 0) {
    int num2 = atoi(argv[2]);
    if (num1 > 2040109464) {
      if (num2 < 0) {
        std::cerr << "You found secret 1" << std::endl;
        return 0;
      }
    } else {
      if ((unsigned int)num2 == 3735928559) {
        unsigned int num3 = atoi(argv[3]);
        if (num3 == 3405695742) {
          int num4 = atoi(argv[4]);
          if (num4 == 1111638594) {
            std::cerr << "You found secret 2" << std::endl;
            boom();
            return 0;
          }
        }
      }
    }
  }

  return 0;
}


!(cd simply-buggy && make clean && make coverage)

rm -f ./maze ./out-of-bounds ./simple-crash
clang++ -fsanitize=address -g --coverage -o maze maze.cpp
clang++ -fsanitize=address -g --coverage -o out-of-bounds out-of-bounds.cpp
clang++ -fsanitize=address -g --coverage -o simple-crash simple-crash.cpp


!git clone https://github.com/uds-se/simply-buggy simply-buggy-server

Cloning into 'simply-buggy-server'...
remote: Enumerating objects: 22, done.
remote: Total 22 (delta 0), reused 0 (delta 0), pack-reused 22 (from 1)
Receiving objects: 100% (22/22), 4.90 KiB | 4.90 MiB/s, done.
Resolving deltas: 100% (9/9), done.


!cd FuzzManager; {sys.executable} server/manage.py setup_repository simply-buggy GITSourceCodeProvider ../simply-buggy-server

Successfully created repository 'simply-buggy' with provider 'GITSourceCodeProvider' located at ../simply-buggy-server


random.seed(0)
cmd = ["simply-buggy/maze"]

constants = [3735928559, 1111638594]

TRIALS = 1000

for itnum in range(0, TRIALS):
    current_cmd = []
    current_cmd.extend(cmd)

    for _ in range(0, 4):
        if random.randint(0, 9) < 3:
            current_cmd.append(str(constants[
                random.randint(0, len(constants) - 1)]))
        else:
            current_cmd.append(str(random.randint(-2147483647, 2147483647)))

    result = subprocess.run(current_cmd, stderr=subprocess.PIPE)
    stderr = result.stderr.decode().splitlines()
    crashed = False

    if stderr and "secret" in stderr[0]:
        print(stderr[0])

    for line in stderr:
        if "ERROR: AddressSanitizer" in line:
            crashed = True
            break

    if crashed:
        print("Found the bug!")
        break

print("Done!")

You found secret 1
You found secret 1
You found secret 1
You found secret 1
You found secret 1
Done!


# ignore
# !brew install rust
# !cargo install grcov


!export PATH=$HOME/.cargo/bin:$PATH; grcov simply-buggy/ -t coveralls+ --commit-sha $(cd simply-buggy && git rev-parse HEAD) --token NONE -p `pwd`/simply-buggy/ > coverage.json


!cd FuzzManager; {sys.executable} -mCovReporter --repository simply-buggy --description "Test1" --submit ../coverage.json


# ignore
gui_driver.get(fuzzmanager_url + "/covmanager")


# ignore
Image(gui_driver.get_screenshot_as_png())


# ignore
first_id = gui_driver.find_element(By.XPATH, '//td/a[contains(@href,"/browse")]')
first_id.click()
time.sleep(DELAY_AFTER_CLICK)


# ignore
Image(gui_driver.get_screenshot_as_png())


# ignore
maze_cpp = gui_driver.find_element(By.XPATH, "//*[contains(text(), 'maze.cpp')]")
maze_cpp.click()
time.sleep(DELAY_AFTER_CLICK)


# ignore
gui_driver.set_window_size(1400, 1400)
Image(gui_driver.get_screenshot_as_png())


random.seed(0)
cmd = ["simply-buggy/maze"]

# Added the missing constant here
constants = [3735928559, 1111638594, 3405695742]

for itnum in range(0,1000):
    current_cmd = []
    current_cmd.extend(cmd)

    for _ in range(0,4):
        if random.randint(0, 9) < 3:
            current_cmd.append(str(
                constants[random.randint(0, len(constants) - 1)]))
        else:
            current_cmd.append(str(random.randint(-2147483647, 2147483647)))

    result = subprocess.run(current_cmd, stderr=subprocess.PIPE)
    stderr = result.stderr.decode().splitlines()
    crashed = False

    if stderr:
        print(stderr[0])

    for line in stderr:
        if "ERROR: AddressSanitizer" in line:
            crashed = True
            break

    if crashed:
        print("Found the bug!")
        break

print("Done!")

You found secret 1
You found secret 2
Found the bug!
Done!


# ignore
# We're done, so we clean up
fuzzmanager_process.terminate()


# ignore
gui_driver.quit()


# ignore
import shutil


# ignore
for temp_file in ['coverage.json', 'geckodriver.log', 'ghostdriver.log']:
    if os.path.exists(temp_file):
        os.remove(temp_file)


# ignore
home = os.path.expanduser("~")
for temp_dir in ['coverage', 'simply-buggy', 'simply-buggy-server',
                 'simply-buggy-server',
                 'FuzzManager']:
    if os.path.exists(temp_dir):
        shutil.rmtree(temp_dir)

Fuzzing in the Large¶

Synopsis¶

Collecting Crashes from Multiple Fuzzers¶

Running a Crash Server¶

Logging In¶

Collecting Crashes¶

Program Configurations¶

Crash Info¶

Collector¶

Inspecting Crashes¶

Crash Buckets¶

Crash Signatures¶

Coarse-Grained Signatures¶

Collecting Code Coverage¶

Synopsis¶

Lessons Learned¶

Next Steps¶

Background¶

Exercises¶

Exercise 1: Automatic Crash Reporting¶