| 136 | return new_deserializer_found |
| 137 | |
| 138 | def enumerate_cmd_ids(self): |
| 139 | # run fuzzer in cmd id enumeration mode |
| 140 | cmd_id_out = os.path.join(self.out_path, PREPOCESS_CMDID_DIR) |
| 141 | if not os.path.exists(cmd_id_out): |
| 142 | run_cmd(f'mkdir -p {cmd_id_out}') |
| 143 | self.log('starting the orchestrator fuzzing for cmd id enumeration') |
| 144 | fuzz_out_dir = nass_api.orchestrate_fuzz( |
| 145 | self.service_name, |
| 146 | self.device_id, |
| 147 | fuzz_code=True, |
| 148 | cov_rate=True |
| 149 | ) |
| 150 | self.log('finished orchestrator fuzzing for cmd id enumeration') |
| 151 | # move resulting seeds to cmdids folder |
| 152 | gen_seed_dir = os.path.join(fuzz_out_dir, "data") |
| 153 | run_cmd(f'cp {gen_seed_dir}/* {cmd_id_out}/') |
| 154 | self.move_fuzz_out(fuzz_out_dir) |
| 155 | # print results |
| 156 | cmd_ids = set() |
| 157 | for f in os.listdir(cmd_id_out): |
| 158 | f_p = os.path.join(cmd_id_out, f) |
| 159 | if f.startswith("seed-"): |
| 160 | run_cmd(f'rm {f_p}') |
| 161 | continue |
| 162 | deser_p = fuzzparcel.deserialize_parcel(open(f_p, 'rb').read()) |
| 163 | if deser_p is None: |
| 164 | logging.error(f'failed deserializing {f_p}, removing invalid seed') |
| 165 | run_cmd(f'rm {f_p}') |
| 166 | continue |
| 167 | cmd_ids.add( |
| 168 | deser_p.code |
| 169 | ) |
| 170 | self.log(f'cmd ids discovered: {list(sorted(cmd_ids))}') |
| 171 | if len(cmd_ids) == 0: |
| 172 | self.log(f'no command ids discovered, exiting...') |
| 173 | exit(-1) |
| 174 | for cmd_id in cmd_ids: |
| 175 | self.interface[cmd_id] = [] |
| 176 | for f in os.listdir(fuzz_out_dir): |
| 177 | p = os.path.join(fuzz_out_dir, f) |
| 178 | if f.startswith("crash-") and not os.path.isdir(p): |
| 179 | deser_p = fuzzparcel.deserialize_parcel(open(p, 'rb').read()) |
| 180 | if deser_p is None: |
| 181 | continue |
| 182 | if deser_p.code not in self.crashing_cmd_ids: |
| 183 | self.crashing_cmd_ids.append(deser_p.code) |
| 184 | self.log(f'crashing command id discovered: {deser_p.code}, \ |
| 185 | storing for future use') |
| 186 | |
| 187 | def fuzz_and_refine(self, iteration): |
| 188 | self.log( |