Esempio n. 1
0
        protected override void OnInput(DataFrame frame)
        {
            DataNode[] nodes       = frame.SelectNodes(SelectionPath);
            DataFrame  oldFrame    = null;
            bool       doLog       = false;
            string     counterName = String.Format("{0}_count", Uuid);

            if (nodes.Length > 0)
            {
                if (Config.LogPackets)
                {
                    oldFrame = frame.CloneFrame();
                }
            }

            foreach (DataNode node in nodes)
            {
                if (Config.NoConversion)
                {
                    DataValue value = node as DataValue;

                    // If not a byte array then ignore
                    if ((value == null) || !(value.Value is byte[]))
                    {
                        LogVerbose(CANAPE.NodeLibrary.Properties.Resources.ByteFuzzer_IgnoringNode, node.Name);
                        continue;
                    }
                }

                byte[] data = node.ToArray();

                int fuzzLength = FuzzerUtils.GetFuzzLength(data.Length, Config.FuzzStart, Config.FuzzLength);


                if (fuzzLength > 0)
                {
                    long count = Graph.GlobalMeta.IncrementCounterLong(counterName, Config.MinValue, Config.Increment);

                    if (Config.Increment < 0)
                    {
                        if (count < Config.MaxValue)
                        {
                            LogInfo("No more values to fuzz");
                        }
                        else
                        {
                            doLog = true;
                        }
                    }
                    else if (Config.Increment > 0)
                    {
                        if (count > Config.MaxValue)
                        {
                            LogInfo("No more values to fuzz");
                        }
                        else
                        {
                            doLog = true;
                        }
                    }

                    if (doLog)
                    {
                        if (Config.LogFuzzText)
                        {
                            LogVerbose("Fuzzing with value {0}", count);
                        }

                        byte[] countData = BitConverter.GetBytes(count);

                        Array.Resize(ref countData, fuzzLength);

                        if (!Config.LittleEndian)
                        {
                            countData = countData.Reverse().ToArray();
                        }

                        Buffer.BlockCopy(countData, 0, data, Config.FuzzStart, fuzzLength);

                        node.ReplaceNode(data);
                    }
                }
            }

            if (doLog)
            {
                if (Config.LogPackets)
                {
                    Graph.DoLogPacket(String.Format("{0}: Pre-fuzz", Name), Config.Color, oldFrame, Config.ConvertToBytes);
                    Graph.DoLogPacket(String.Format("{0}: Post-fuzz", Name), Config.Color, frame, Config.ConvertToBytes);
                }
            }

            WriteOutput(frame);
        }
Esempio n. 2
0
        protected override void OnInput(DataFrames.DataFrame frame)
        {
            DataNode[] nodes        = frame.SelectNodes(SelectionPath);
            DataFrame  preFuzzFrame = null;
            int        nodeCount    = nodes.Length;
            bool       fuzzed       = false;

            if (nodeCount > 0)
            {
                if (Config.LogPackets)
                {
                    preFuzzFrame = frame.CloneFrame();
                }
            }

            foreach (DataNode node in nodes)
            {
                DataValue value = node as DataValue;
                string    fuzzString;

                if ((value != null) && (value.Value is string))
                {
                    fuzzString = value.Value;
                }
                else
                {
                    if (Config.NoConversion)
                    {
                        continue;
                    }

                    value      = null;
                    fuzzString = _encoding.GetString(node.ToArray());
                }

                int    fuzzLength = FuzzerUtils.GetFuzzLength(fuzzString.Length, Config.FuzzStart, Config.FuzzLength);
                string newString;

                if ((Config.FuzzStart == 0) && (fuzzLength == fuzzString.Length))
                {
                    newString = FuzzString(fuzzString);
                }
                else if ((Config.FuzzStart >= 0) && (fuzzLength > 0))
                {
                    string prefixString = fuzzString.Substring(0, Config.FuzzStart);
                    string suffixString = fuzzString.Substring(Config.FuzzStart + fuzzLength);

                    newString = String.Concat(prefixString, FuzzString(fuzzString.Substring(Config.FuzzStart, fuzzLength)), suffixString);
                }
                else
                {
                    continue;
                }

                if (newString != fuzzString)
                {
                    fuzzed = true;
                    if (Config.LogFuzzText)
                    {
                        LogInfo("Fuzzed string '{0}'", fuzzString);
                    }
                }

                if (value != null)
                {
                    value.Value = newString;
                }
                else
                {
                    node.ReplaceNode(_encoding.GetBytes(newString));
                }
            }

            if (nodeCount > 0)
            {
                if (Config.LogPackets)
                {
                    if (fuzzed)
                    {
                        Graph.DoLogPacket(String.Format("{0}: Pre-fuzz", Name), Config.Color, preFuzzFrame, Config.ConvertToBytes);
                        Graph.DoLogPacket(String.Format("{0}: Post-fuzz", Name), Config.Color, frame, Config.ConvertToBytes);
                    }
                }
            }

            WriteOutput(frame);
        }
Esempio n. 3
0
        protected override void OnInput(DataFrames.DataFrame frame)
        {
            DataNode[] nodes   = frame.SelectNodes(SelectionPath);
            DataFrame  preFuzz = null;
            bool       fuzzed  = false;

            if (nodes.Length > 0)
            {
                if (Config.LogPackets)
                {
                    preFuzz = frame.CloneFrame();
                }
            }

            foreach (DataNode node in nodes)
            {
                U[] data = NodeToArray(node);

                if (data == null)
                {
                    LogVerbose(CANAPE.NodeLibrary.Properties.Resources.BaseRandomArrayFuzzer_IgnoringData, node.Name);
                    continue;
                }

                int fuzzLength = FuzzerUtils.GetFuzzLength(data.Length, Config.FuzzStart, Config.FuzzLength);

                if (fuzzLength > 0)
                {
                    int points = GetPointCount(fuzzLength);

                    if (Config.LogFuzzText)
                    {
                        LogVerbose(CANAPE.NodeLibrary.Properties.Resources.BaseRandomArrayFuzzer_FuzzCount, points);
                    }

                    while (points > 0)
                    {
                        int pos = _random.Next(Config.FuzzStart, Config.FuzzStart + fuzzLength);
                        BaseRandomArrayFuzzerConfig.FuzzCombinationMode mode = Config.CombinationMode;

                        if (mode == BaseRandomArrayFuzzerConfig.FuzzCombinationMode.Random)
                        {
                            mode = (BaseRandomArrayFuzzerConfig.FuzzCombinationMode)_random.Next((int)BaseRandomArrayFuzzerConfig.FuzzCombinationMode.Max);
                        }

                        if ((pos >= 0) && (pos < data.Length))
                        {
                            U value = FuzzValue(mode, data[pos]);

                            if (!value.Equals(data[pos]))
                            {
                                fuzzed = true;
                                if (Config.LogFuzzText)
                                {
                                    LogInfo(CANAPE.NodeLibrary.Properties.Resources.BaseRandomArrayFuzzer_FuzzInfo,
                                            pos, data[pos], value);
                                }
                            }

                            data[pos] = value;
                        }

                        points--;
                    }

                    node.ReplaceNode(ArrayToNode(data, node));
                }
            }

            if (fuzzed)
            {
                if (Config.LogPackets)
                {
                    Graph.DoLogPacket(String.Format(CANAPE.NodeLibrary.Properties.Resources.BaseRandomArrayFuzzer_PreFuzzInfo, Name),
                                      Config.Color, preFuzz, Config.ConvertToBytes);
                    Graph.DoLogPacket(String.Format(CANAPE.NodeLibrary.Properties.Resources.BaseRandomArrayFuzzer_PostFuzzInfo, Name),
                                      Config.Color, frame, Config.ConvertToBytes);
                }
            }

            WriteOutput(frame);
        }