Cyber Security Forum (X-code) - PT. Teknologi Server Indonesia

Code: Select all

#!/usr/bin/python

'''
FuzzDiff
Written by: Dan Rosenberg

This is a simple tool designed to help out with crash analysis during fuzz
testing.  It selectively "un-fuzzes" portions of a fuzzed file that is known to
cause a crash, re-launches the targeted application, and sees if it still
crashes.  Eventually, this will yield a file that still causes the crash, but
contains a minimum set of changes from the original un-fuzzed file.

Copyright (C) 2010 Virtual Security Research, LLC. - All rights reserved

This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free Software
Foundation, either version 3 of the License, or (at your option) any later
version.

This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along
with this program.  If not, see <http://www.gnu.org/licenses/>.

'''

import sys
import os
import random
import shutil
import subprocess
import time

# Probability a fuzzed byte will be reverted
THRESHOLD = .5

# Number of iterations before stopping
ITER = 6000

# Temporary output
TMPFILE = "/tmp/fuzz123"

# Time to wait before killing target program
WAIT = 2

def unfuzz(orig, fuzz, out):

	origstat = os.stat(orig)
	fuzzstat = os.stat(fuzz)

	if(origstat.st_size != fuzzstat.st_size):
		print "[*] Files are not the same size."
		term(-1)

	try:
		origfd = open(orig, "r")
		fuzzfd = open(fuzz, "r")
		outfd = open(out, "w")
	except:
		print "[*] Error opening file - bad arguments"
		term(-1)

	diff = 0
	unchanged = 0

	while(1):
		c = origfd.read(1)
		if not c: break
		d = fuzzfd.read(1)

		# If there's a diff...
		if(c != d):
			diff += 1
			# With some probability, revert it
			if(random.random() > THRESHOLD):
				outfd.write(c)				
			else:
				unchanged += 1
				outfd.write(d)
		else:
			outfd.write(c)

	return (diff, unchanged)

def term(ret):
	print "[*] Terminating..."
	try:
		os.remove(TMPFILE)
	finally:
		sys.exit(ret)

#######################
# Program entry point #
#######################

if(len(sys.argv) < 4):
	print "[*] Usage: fuzzdiff [orig] [fuzzed] [program] [args]"
	sys.exit(-1)

progargs = sys.argv[3:]
orig = sys.argv[1]
best = "fuzz.out" 

try:
	shutil.copy(sys.argv[2], best)
except:
	print "[*] Error opening file - bad fuzzfile argument"
	term(-1)

null = open("/dev/null", "rw")

# Main loop
for i in range(ITER):
	
	(diff, unchanged) = unfuzz(orig, best, TMPFILE)

	# Only bother if we actually reduced the number of diffs
	if(unchanged < diff):

		# Test if the result still crashes the target
		try:
			p = subprocess.Popen(progargs + [TMPFILE], stdout=null, stderr=null)
		except:
			print "[*] Error running program"
			term(-1)

		# Give the program some time to start...
		time.sleep(WAIT)

		# If it segfaulted, keep the changes
		if (p.poll() == -11):
			shutil.copy(TMPFILE, best)
			print "[*] Reduced diffs from", diff, "to", unchanged
			if(unchanged == 1):
				break

		# If the program hasn't terminated, kill it
		elif(p.returncode == None):
			p.terminate()

print "[*] Output written to fuzz.out"
term(1)

Code: Select all

http://vsecurity.com/download/tools/fuzzdiff.py