MCPcopy Create free account
hub / github.com/HexHive/NASS / enumerate_cmd_ids

Method enumerate_cmd_ids

fuzz/preprocess.py:138–185  ·  view source on GitHub ↗
(self)

Source from the content-addressed store, hash-verified

136 return new_deserializer_found
137
138 def enumerate_cmd_ids(self):
139 # run fuzzer in cmd id enumeration mode
140 cmd_id_out = os.path.join(self.out_path, PREPOCESS_CMDID_DIR)
141 if not os.path.exists(cmd_id_out):
142 run_cmd(f'mkdir -p {cmd_id_out}')
143 self.log('starting the orchestrator fuzzing for cmd id enumeration')
144 fuzz_out_dir = nass_api.orchestrate_fuzz(
145 self.service_name,
146 self.device_id,
147 fuzz_code=True,
148 cov_rate=True
149 )
150 self.log('finished orchestrator fuzzing for cmd id enumeration')
151 # move resulting seeds to cmdids folder
152 gen_seed_dir = os.path.join(fuzz_out_dir, "data")
153 run_cmd(f'cp {gen_seed_dir}/* {cmd_id_out}/')
154 self.move_fuzz_out(fuzz_out_dir)
155 # print results
156 cmd_ids = set()
157 for f in os.listdir(cmd_id_out):
158 f_p = os.path.join(cmd_id_out, f)
159 if f.startswith("seed-"):
160 run_cmd(f'rm {f_p}')
161 continue
162 deser_p = fuzzparcel.deserialize_parcel(open(f_p, 'rb').read())
163 if deser_p is None:
164 logging.error(f'failed deserializing {f_p}, removing invalid seed')
165 run_cmd(f'rm {f_p}')
166 continue
167 cmd_ids.add(
168 deser_p.code
169 )
170 self.log(f'cmd ids discovered: {list(sorted(cmd_ids))}')
171 if len(cmd_ids) == 0:
172 self.log(f'no command ids discovered, exiting...')
173 exit(-1)
174 for cmd_id in cmd_ids:
175 self.interface[cmd_id] = []
176 for f in os.listdir(fuzz_out_dir):
177 p = os.path.join(fuzz_out_dir, f)
178 if f.startswith("crash-") and not os.path.isdir(p):
179 deser_p = fuzzparcel.deserialize_parcel(open(p, 'rb').read())
180 if deser_p is None:
181 continue
182 if deser_p.code not in self.crashing_cmd_ids:
183 self.crashing_cmd_ids.append(deser_p.code)
184 self.log(f'crashing command id discovered: {deser_p.code}, \
185 storing for future use')
186
187 def fuzz_and_refine(self, iteration):
188 self.log(

Callers 1

extractMethod · 0.95

Calls 6

logMethod · 0.95
move_fuzz_outMethod · 0.95
joinMethod · 0.80
run_cmdFunction · 0.70
readMethod · 0.45
addMethod · 0.45

Tested by

no test coverage detected