1#!/bin/sh 2 3. ./test-pre.sh 4 5OS=$(uname -s) 6 7AFL_GCC=afl-gcc 8$ECHO "$BLUE[*] Testing: ${AFL_GCC}, afl-showmap, afl-fuzz, afl-cmin and afl-tmin" 9test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc" -o "$SYS" = "i386" && { 10 test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && { 11 ../${AFL_GCC} -v 2>&1 | grep -qi "gcc version" && { 12 ../${AFL_GCC} -o test-instr.plain -O0 ../test-instr.c > /dev/null 2>&1 13 AFL_HARDEN=1 ../${AFL_GCC} -o test-compcov.harden test-compcov.c > /dev/null 2>&1 14 test -e test-instr.plain && { 15 $ECHO "$GREEN[+] ${AFL_GCC} compilation succeeded" 16 echo 0 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 17 AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 18 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { 19 diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { 20 $ECHO "$RED[!] ${AFL_GCC} instrumentation should be different on different input but is not" 21 CODE=1 22 } || { 23 $ECHO "$GREEN[+] ${AFL_GCC} instrumentation present and working correctly" 24 } 25 } || { 26 $ECHO "$RED[!] ${AFL_GCC} instrumentation failed" 27 CODE=1 28 } 29 rm -f test-instr.plain.0 test-instr.plain.1 30 SKIP= 31 TUPLES=`echo 1|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'` 32 test "$TUPLES" -gt 1 -a "$TUPLES" -lt 22 && { 33 $ECHO "$GREEN[+] ${AFL_GCC} run reported $TUPLES instrumented locations which is fine" 34 } || { 35 $ECHO "$RED[!] ${AFL_GCC} instrumentation produces weird numbers: $TUPLES" 36 CODE=1 37 } 38 test "$TUPLES" -lt 3 && SKIP=1 39 true # this is needed because of the test above 40 } || { 41 $ECHO "$RED[!] ${AFL_GCC} failed" 42 echo CUT------------------------------------------------------------------CUT 43 uname -a 44 ../${AFL_GCC} -o test-instr.plain -O0 ../test-instr.c 45 echo CUT------------------------------------------------------------------CUT 46 CODE=1 47 } 48 test -e test-compcov.harden && { 49 nm test-compcov.harden | grep -Eq 'stack_chk_fail|fstack-protector-all|fortified' > /dev/null 2>&1 && { 50 $ECHO "$GREEN[+] ${AFL_GCC} hardened mode succeeded and is working" 51 } || { 52 $ECHO "$RED[!] ${AFL_GCC} hardened mode is not hardened" 53 env | grep -E 'AFL|PATH|LLVM' 54 AFL_DEBUG=1 AFL_HARDEN=1 ../${AFL_GCC} -o test-compcov.harden test-compcov.c 55 nm test-compcov.harden 56 CODE=1 57 } 58 rm -f test-compcov.harden 59 } || { 60 $ECHO "$RED[!] ${AFL_GCC} hardened mode compilation failed" 61 CODE=1 62 } 63 # now we want to be sure that afl-fuzz is working 64 # make sure crash reporter is disabled on Mac OS X 65 (test "$OS" = "Darwin" && test $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') && { 66 $ECHO "$RED[!] we cannot run afl-fuzz with enabled crash reporter. Run 'sudo sh afl-system-config'.$RESET" 67 true 68 }) || { 69 mkdir -p in 70 echo 0 > in/in 71 test -z "$SKIP" && { 72 $ECHO "$GREY[*] running afl-fuzz for ${AFL_GCC}, this will take approx 10 seconds" 73 { 74 ../afl-fuzz -V07 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain >>errors 2>&1 75 } >>errors 2>&1 76 test -n "$( ls out/default/queue/id:000002* 2>/dev/null )" && { 77 $ECHO "$GREEN[+] afl-fuzz is working correctly with ${AFL_GCC}" 78 } || { 79 echo CUT------------------------------------------------------------------CUT 80 cat errors 81 echo CUT------------------------------------------------------------------CUT 82 $ECHO "$RED[!] afl-fuzz is not working correctly with ${AFL_GCC}" 83 CODE=1 84 } 85 } 86 echo 000000000000000000000000 > in/in2 87 echo 111 > in/in3 88 test "$OS" = "Darwin" && { 89 $ECHO "$GREY[*] afl-cmin not available on macOS, cannot test afl-cmin" 90 } || { 91 mkdir -p in2 92 ../afl-cmin -m ${MEM_LIMIT} -i in -o in2 -- ./test-instr.plain >/dev/null 2>&1 # why is afl-forkserver writing to stderr? 93 CNT=`ls in2/* 2>/dev/null | wc -l` 94 case "$CNT" in 95 *2) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; 96 *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases ($CNT)" 97 CODE=1 98 ;; 99 esac 100 rm -f in2/in* 101 } 102 export AFL_QUIET=1 103 if command -v bash >/dev/null ; then { 104 ../afl-cmin.bash -m ${MEM_LIMIT} -i in -o in2 -- ./test-instr.plain >/dev/null 105 CNT=`ls in2/* 2>/dev/null | wc -l` 106 case "$CNT" in 107 *2) $ECHO "$GREEN[+] afl-cmin.bash correctly minimized the number of testcases" ;; 108 *) $ECHO "$RED[!] afl-cmin.bash did not correctly minimize the number of testcases ($CNT)" 109 CODE=1 110 ;; 111 esac 112 } else { 113 $ECHO "$GREY[*] no bash available, cannot test afl-cmin.bash" 114 } 115 fi 116 ../afl-tmin -m ${MEM_LIMIT} -i in/in2 -o in2/in2 -- ./test-instr.plain > /dev/null 2>&1 117 SIZE=`ls -l in2/in2 2>/dev/null | awk '{print$5}'` 118 test "$SIZE" = 1 && $ECHO "$GREEN[+] afl-tmin correctly minimized the testcase" 119 test "$SIZE" = 1 || { 120 $ECHO "$RED[!] afl-tmin did incorrectly minimize the testcase to $SIZE" 121 CODE=1 122 } 123 rm -rf in out errors in2 124 unset AFL_QUIET 125 } 126 rm -f test-instr.plain 127 } || { 128 $ECHO "$YELLOW[-] afl-gcc executes clang, cannot test!" 129 INCOMPLETE=1 130 } 131 } || { 132 $ECHO "$YELLOW[-] afl is not compiled, cannot test" 133 INCOMPLETE=1 134 } 135 136 AFL_CLANG=afl-clang 137 $ECHO "$BLUE[*] Testing: ${AFL_CLANG}, afl-showmap, afl-fuzz, afl-cmin and afl-tmin" 138 SKIP= 139 test -e ../${AFL_CLANG} -a -e ../afl-showmap -a -e ../afl-fuzz && { 140 ../${AFL_CLANG} -v 2>&1 | grep -qi "clang version" && { 141 ../${AFL_CLANG} -O0 -o test-instr.plain ../test-instr.c > /dev/null 2>&1 142 AFL_HARDEN=1 ../${AFL_CLANG} -o test-compcov.harden test-compcov.c > /dev/null 2>&1 143 test -e test-instr.plain && { 144 $ECHO "$GREEN[+] ${AFL_CLANG} compilation succeeded" 145 echo 0 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 146 AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 147 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { 148 diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { 149 $ECHO "$RED[!] ${AFL_CLANG} instrumentation should be different on different input but is not" 150 CODE=1 151 } || { 152 $ECHO "$GREEN[+] ${AFL_CLANG} instrumentation present and working correctly" 153 } 154 } || { 155 $ECHO "$RED[!] ${AFL_CLANG} instrumentation failed" 156 CODE=1 157 } 158 rm -f test-instr.plain.0 test-instr.plain.1 159 TUPLES=`echo 1|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'` 160 test "$TUPLES" -gt 1 -a "$TUPLES" -lt 22 && { 161 $ECHO "$GREEN[+] ${AFL_CLANG} run reported $TUPLES instrumented locations which is fine" 162 } || { 163 $ECHO "$RED[!] ${AFL_CLANG} instrumentation produces weird numbers: $TUPLES" 164 CODE=1 165 } 166 test "$TUPLES" -lt 3 && SKIP=1 167 true # this is needed because of the test above 168 } || { 169 $ECHO "$RED[!] ${AFL_CLANG} failed" 170 echo CUT------------------------------------------------------------------CUT 171 uname -a 172 ../${AFL_CLANG} -o test-instr.plain ../test-instr.c 173 echo CUT------------------------------------------------------------------CUT 174 CODE=1 175 } 176 test -e test-compcov.harden && { 177 nm test-compcov.harden | grep -Eq 'stack_chk_fail|fstack-protector-all|fortified' > /dev/null 2>&1 && { 178 $ECHO "$GREEN[+] ${AFL_CLANG} hardened mode succeeded and is working" 179 } || { 180 $ECHO "$RED[!] ${AFL_CLANG} hardened mode is not hardened" 181 CODE=1 182 } 183 rm -f test-compcov.harden 184 } || { 185 $ECHO "$RED[!] ${AFL_CLANG} hardened mode compilation failed" 186 CODE=1 187 } 188 # now we want to be sure that afl-fuzz is working 189 # make sure crash reporter is disabled on Mac OS X 190 (test "$OS" = "Darwin" && test $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') && { 191 $ECHO "$RED[!] we cannot run afl-fuzz with enabled crash reporter. Run 'sudo sh afl-system-config'.$RESET" 192 true 193 }) || { 194 mkdir -p in 195 echo 0 > in/in 196 test -z "$SKIP" && { 197 $ECHO "$GREY[*] running afl-fuzz for ${AFL_CLANG}, this will take approx 10 seconds" 198 { 199 ../afl-fuzz -V07 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain >>errors 2>&1 200 } >>errors 2>&1 201 test -n "$( ls out/default/queue/id:000002* 2>/dev/null )" && { 202 $ECHO "$GREEN[+] afl-fuzz is working correctly with ${AFL_CLANG}" 203 } || { 204 echo CUT------------------------------------------------------------------CUT 205 cat errors 206 echo CUT------------------------------------------------------------------CUT 207 $ECHO "$RED[!] afl-fuzz is not working correctly with ${AFL_CLANG}" 208 CODE=1 209 } 210 } 211 echo 000000000000000000000000 > in/in2 212 echo AAA > in/in2 213 test "$OS" = "Darwin" && { 214 $ECHO "$GREY[*] afl-cmin not available on macOS, cannot test afl-cmin" 215 } || { 216 mkdir -p in2 217 ../afl-cmin -m ${MEM_LIMIT} -i in -o in2 -- ./test-instr.plain >/dev/null 2>&1 # why is afl-forkserver writing to stderr? 218 CNT=`ls in2/* 2>/dev/null | wc -l` 219 case "$CNT" in 220 *2) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; 221 \ *1|1) { # allow leading whitecase for portability 222 test -s in2/* && $ECHO "$YELLOW[?] afl-cmin did minimize to one testcase. This can be a bug or due compiler optimization." 223 test -s in2/* || { 224 $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases ($CNT)" 225 CODE=1 226 } 227 } 228 ;; 229 *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases ($CNT)" 230 CODE=1 231 ;; 232 esac 233 rm -f in2/in* 234 } 235 export AFL_QUIET=1 236 if command -v bash >/dev/null ; then { 237 ../afl-cmin.bash -m ${MEM_LIMIT} -i in -o in2 -- ./test-instr.plain >/dev/null 238 CNT=`ls in2/* 2>/dev/null | wc -l` 239 case "$CNT" in 240 *2) $ECHO "$GREEN[+] afl-cmin.bash correctly minimized the number of testcases" ;; 241 \ *1|1) { # allow leading whitecase for portability 242 test -s in2/* && $ECHO "$YELLOW[?] afl-cmin.bash did minimize to one testcase. This can be a bug or due compiler optimization." 243 test -s in2/* || { 244 $ECHO "$RED[!] afl-cmin.bash did not correctly minimize the number of testcases ($CNT)" 245 CODE=1 246 } 247 } 248 ;; 249 *) $ECHO "$RED[!] afl-cmin.bash did not correctly minimize the number of testcases ($CNT)" 250 CODE=1 251 ;; 252 esac 253 } else { 254 $ECHO "$GREY[*] no bash available, cannot test afl-cmin.bash" 255 } 256 fi 257 ../afl-tmin -m ${MEM_LIMIT} -i in/in2 -o in2/in2 -- ./test-instr.plain > /dev/null 2>&1 258 SIZE=`ls -l in2/in2 2>/dev/null | awk '{print$5}'` 259 test "$SIZE" = 1 && $ECHO "$GREEN[+] afl-tmin correctly minimized the testcase" 260 test "$SIZE" = 1 || { 261 $ECHO "$RED[!] afl-tmin did incorrectly minimize the testcase to $SIZE" 262 CODE=1 263 } 264 rm -rf in out errors in2 265 unset AFL_QUIET 266 } 267 rm -f test-instr.plain 268 } || { 269 $ECHO "$YELLOW[-] afl-clang executes gcc, cannot test" 270 INCOMPLETE=1 271 } 272 } || { 273 $ECHO "$YELLOW[-] afl is not compiled, cannot test" 274 INCOMPLETE=1 275 } 276} || { 277 $ECHO "$GREY[*] not an intel platform, skipped tests of afl-gcc" 278 #this is not incomplete as this feature doesnt exist, so all good 279 AFL_TEST_COUNT=$((AFL_TEST_COUNT-1)) 280} 281 282. ./test-post.sh 283