(self)
| 275 | self.log(f'finished dumping vtable...') |
| 276 | |
| 277 | def extract(self): |
| 278 | self.log( |
| 279 | f'starting to setup extraction for {self.device_id}:{self.service_name}' |
| 280 | ) |
| 281 | # backup previous prepocessing data if it exists |
| 282 | if self.resume is None: |
| 283 | if os.path.exists(self.out_path): |
| 284 | backup_path = os.path.join(self.target_path, "preprocess_backup") |
| 285 | if not os.path.exists(backup_path): |
| 286 | run_cmd(f'mkdir -p {backup_path}') |
| 287 | backup_dir = os.path.join( |
| 288 | backup_path, |
| 289 | f'{datetime.now().strftime("%d.%m.%Y_%H%M%S")}_backup' |
| 290 | ) |
| 291 | run_cmd(f'mkdir -p {backup_dir}') |
| 292 | run_cmd(f'mv {self.out_path}/* {backup_dir}/') |
| 293 | else: |
| 294 | run_cmd(f'mkdir {self.out_path}') |
| 295 | else: |
| 296 | if not os.path.exists(self.resume): |
| 297 | self.log(f'WARNING resume path not specified') |
| 298 | exit(-1) |
| 299 | if self.resume is None: |
| 300 | # run cmd id extraction |
| 301 | self.enumerate_cmd_ids() |
| 302 | start_iteration = 0 |
| 303 | else: |
| 304 | start_iteration = int(os.path.basename(self.resume.strip("/")).split("ie_")[-1])+1 |
| 305 | self.log(f'resume start iteration {self.resume} -> {start_iteration}') |
| 306 | # iteratively refine seeds |
| 307 | final_iteration = 0 |
| 308 | i = start_iteration |
| 309 | while self.interface_updated(): |
| 310 | if not self.fuzz_and_refine(i): |
| 311 | self.log(f'iteration {i} failed miserably') |
| 312 | exit(-1) |
| 313 | i+= 1 |
| 314 | final_iteration += 1 |
| 315 | if i > MAX_ITERATIONS: |
| 316 | break |
| 317 | # copy final seeds |
| 318 | if i == 0: |
| 319 | final_data_dir = os.path.join( |
| 320 | self.out_path, |
| 321 | f'{PREPOCESS_CMDID_DIR}' |
| 322 | ) |
| 323 | else: |
| 324 | final_data_dir = os.path.join( |
| 325 | self.out_path, |
| 326 | f'{PREPOCESS_ITERATION_DIR_PREFIX}{i-1}' |
| 327 | ) |
| 328 | final_dir = os.path.join(self.out_path, PREPROCESS_FINAL_DIR) |
| 329 | if not os.path.exists(final_dir): |
| 330 | run_cmd(f'mkdir -p {final_dir}') |
| 331 | run_cmd(f'cp -r {final_data_dir}/* {final_dir}/') |
| 332 | # check if any of the final seeds directly crash the service |
| 333 | # if they do we remove them from the preprocessing seed corpus |
| 334 | # since otherwise it's very likely we'll just keep hitting these shallow |
no test coverage detected