On tisdag 9 oktober 2018 kl. 14:01:55 CEST Joachim Strömbergson wrote:
...
> Start fuzzing at all is really what I think we should aim for at this
> point. I've used AFL before and will look at using it for cryptech. The
> big benifit of OSS-Fuzz as I see it is the significant amount of
> non-artificial intelligence doing analysis of findings.
Great initiative! I did AFL fuzzing of the CLI and HSM (device side of the RPC
code) some years ago. I used the attached program to expose the RPC code to
AFL - you might want to use it as a starting point.
It seems I put it in libhal/utils/ and hacked the GNUMakefile to build it, and
started AFL like this:
afl-fuzz -i ../in/ -o ../out/ -M fuzzer1 -m none -- ./utils/afl-run @@
I'm attaching what I used to generate the corpus (the '../in/' directory) too.
This was quite some time ago, so I guess some RPCs might have changed. I also
think I compiled libhal with an in-memory keystore which we had back in the
day, don't know if that is still available.
/Fredrik
#include <stdint.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <fcntl.h>
#include "hal.h"
int uart_send_char(uint8_t ch)
{
return 0;
}
int uart_recv_char(uint8_t *cp)
{
return 0;
}
int main(int argc, char *argv[])
{
int fd, res;
size_t ilen, olen;
uint8_t ibuf[4096] = {0};
uint8_t obuf[4096] = {0};
if (argc != 2) {
fprintf(stderr, "No args\n");
exit(1);
}
fd = open(argv[1], 0, O_RDONLY);
if (fd == -1) {
fprintf(stderr, "Open '%s' failed\n", argv[1]);
exit(1);
}
ilen = read(fd, ibuf, sizeof(ibuf));
close(fd);
hal_rpc_server_dispatch((const unsigned char *) ibuf, ilen,
(const unsigned char *) obuf, &olen);
//printf("hal_rpc_server_dispatch result: %i bytes\n", olen);
res = write(fileno(stderr), &obuf, olen);
/*
if (res != olen) {
printf("write() failed, res %i : %i, %s\n", res, errno, strerror(errno));
}
*/
exit(0);
}
#!/usr/bin/python
import xdrlib
client_handle = 1
user = 2
alg = 1
len_max = 4096
hash_handle = 1
session_handle = 9
pkey_type = 4
pkey_curve = 5
pkey_flags = 0
rsa_key_len = 2048
rsa_exp = 3
pkey_handle = 4
sig_len = 512
data = [('get_version', []),
('get_random', [8]),
('set_pin', [client_handle, user, 'secret pin']),
('login', [client_handle, user, 'secret pin']),
('logout', [client_handle]),
('logout_all', []),
('is_logged_in', [client_handle, user]),
('hash_get_digest_len', [alg]),
('hash_get_digest_algorithm_id', [alg, len_max]),
('get_algorithm', [hash_handle]),
('hash_initialize', [client_handle, session_handle, alg, 'key']),
('hash_update', [hash_handle, 'data']),
('hash_finalize', [hash_handle, len_max]), # len_max might be digest size?
('pkey_load', [client_handle, session_handle, pkey_type, pkey_curve, 'name', 'pkey_der', pkey_flags]),
('pkey_find', [client_handle, session_handle, pkey_type, 'name', pkey_flags]),
('pkey_generate_rsa', [client_handle, session_handle, 'name', rsa_key_len, rsa_exp, pkey_flags]),
('pkey_generate_ec', [client_handle, session_handle, 'name', pkey_curve, pkey_flags]),
('pkey_close', [pkey_handle]),
('pkey_delete', [pkey_handle]),
('pkey_get_key_type', [pkey_handle]),
('pkey_get_key_flags', [pkey_handle]),
('pkey_get_public_key_len', [pkey_handle]),
('pkey_get_public_key', [pkey_handle, len_max]),
('pkey_remote_sign', [session_handle, pkey_handle, hash_handle, 'input', sig_len]),
('pkey_remote_verify', [session_handle, pkey_handle, hash_handle, 'input', 'sig']),
('pkey_list', [len_max, pkey_flags]),
('pkey_rename', [pkey_handle, 'new_name']),
]
idx = 0
for name, params in data:
p = xdrlib.Packer()
p.pack_int(idx)
for this in params:
if type(this) == int:
p.pack_int(this)
else:
p.pack_bytes(this)
buf = p.get_buffer()
print('{!s} {!s}: {!s}'.format(idx, name, buf.encode('hex')))
f = open('in/{!s}_{!s}'.format(idx, name), 'wb')
f.write(buf)
f.close()
idx += 1
_______________________________________________
Tech mailing list
[email protected]
https://lists.cryptech.is/listinfo/tech
