1#!/usr/bin/python 2 3# Simple fuzzing tool by disassembling random code. By Nguyen Anh Quynh, 2014 4# Syntax: 5# ./suite/fuzz.py --> Fuzz all archs 6# ./suite/fuzz.py x86 --> Fuzz all X86 (all 16bit, 32bit, 64bit) 7# ./suite/fuzz.py x86-16 --> Fuzz X86-32 arch only 8# ./suite/fuzz.py x86-32 --> Fuzz X86-32 arch only 9# ./suite/fuzz.py x86-64 --> Fuzz X86-64 arch only 10# ./suite/fuzz.py arm --> Fuzz all ARM (arm, thumb) 11# ./suite/fuzz.py aarch64 --> Fuzz ARM-64 12# ./suite/fuzz.py mips --> Fuzz all Mips (32bit, 64bit) 13# ./suite/fuzz.py ppc --> Fuzz PPC 14 15from capstone import * 16 17from time import time 18from random import randint 19import sys 20 21 22# file providing code to disassemble 23FILE = '/usr/bin/python' 24 25TIMES = 64 26INTERVALS = (4, 5, 7, 9, 11, 13) 27 28all_tests = ( 29 (CS_ARCH_X86, CS_MODE_16, "X86-16bit (Intel syntax)", 0), 30 (CS_ARCH_X86, CS_MODE_16, "X86-16bit (ATT syntax)", CS_OPT_SYNTAX_ATT), 31 (CS_ARCH_X86, CS_MODE_32, "X86-32 (Intel syntax)", 0), 32 (CS_ARCH_X86, CS_MODE_32, "X86-32 (ATT syntax)", CS_OPT_SYNTAX_ATT), 33 (CS_ARCH_X86, CS_MODE_64, "X86-64 (Intel syntax)", 0), 34 (CS_ARCH_X86, CS_MODE_64, "X86-64 (ATT syntax)", CS_OPT_SYNTAX_ATT), 35 (CS_ARCH_ARM, CS_MODE_ARM, "ARM", 0), 36 (CS_ARCH_ARM, CS_MODE_THUMB, "THUMB (ARM)", 0), 37 (CS_ARCH_MIPS, CS_MODE_MIPS32 + CS_MODE_BIG_ENDIAN, "MIPS-32 (Big-endian)", 0), 38 (CS_ARCH_MIPS, CS_MODE_MIPS64 + CS_MODE_LITTLE_ENDIAN, "MIPS-64-EL (Little-endian)", 0), 39 (CS_ARCH_ARM64, CS_MODE_ARM, "ARM-64 (AArch64)", 0), 40 (CS_ARCH_PPC, CS_MODE_BIG_ENDIAN, "PPC", 0), 41 (CS_ARCH_PPC, CS_MODE_BIG_ENDIAN, "PPC, print register with number only", CS_OPT_SYNTAX_NOREGNAME), 42 (CS_ARCH_SPARC, CS_MODE_BIG_ENDIAN, "Sparc", 0), 43 (CS_ARCH_SYSZ, 0, "SystemZ", 0), 44 (CS_ARCH_XCORE, 0, "XCore", 0), 45 (CS_ARCH_M68K, 0, "M68K", 0), 46 ) 47 48 49# for debugging 50def to_hex(s): 51 return " ".join("0x" + "{0:x}".format(ord(c)).zfill(2) for c in s) # <-- Python 3 is OK 52 53 54# read @size bytes from @f & return data. 55# return None when there is not enough data 56def get_code(f, size): 57 code = f.read(size) 58 if len(code) != size: # reached end-of-file? 59 # then reset file position to begin-of-file 60 f.seek(0) 61 return None 62 63 return code 64 65 66def cs(md, code): 67 insns = md.disasm(code, 0) 68 for i in insns: 69 if i.address == 0x100000: 70 print i 71 72 73def cs_lite(md, code): 74 insns = md.disasm_lite(code, 0) 75 for (addr, size, mnem, ops) in insns: 76 if addr == 0x100000: 77 print i 78 79 80cfile = open(FILE) 81 82for (arch, mode, comment, syntax) in all_tests: 83 try: 84 request = sys.argv[1] 85 if not request in comment.lower(): 86 continue 87 except: 88 pass 89 90 try: 91 md = Cs(arch, mode) 92 md.detail = True 93 94 if syntax != 0: 95 md.syntax = syntax 96 97 # test disasm() 98 print("\nFuzzing disasm() @platform: %s" %comment) 99 for ii in INTERVALS: 100 print("Interval: %u" %ii) 101 for j in xrange(1, TIMES): 102 while (True): 103 code = get_code(cfile, j * ii) 104 if code is None: 105 # EOF? break 106 break 107 #print to_hex(code) 108 cs(md, code) 109 110 # test disasm_lite() 111 print("Fuzzing disasm_lite() @platform: %s" %comment) 112 for ii in INTERVALS: 113 print("Interval: %u" %ii) 114 for j in xrange(1, TIMES): 115 while (True): 116 code = get_code(cfile, j * ii) 117 if code is None: 118 # EOF? break 119 break 120 #print to_hex(code) 121 cs_lite(md, code) 122 123 except CsError as e: 124 print("ERROR: %s" %e) 125