EFuzzingReturn InternalJob() { ICrashDetector crash = null; try { TuringAgentArgs e = new TuringAgentArgs(); //Agent.OnLoad(Socket, e); // Create detector crash = Agent.GetCrashDetector(Socket, e); if (crash == null) { return(EFuzzingReturn.Fail); } // Run action Agent.OnRun(Socket, e); byte[] zipData; EExploitableResult res; if (crash.IsCrashed(Socket, out zipData, out res, new ITuringMachineAgent.delItsAlive(Agent.GetItsAlive), e)) { Result = new EndTaskMessage(EFuzzingReturn.Crash) { ZipData = zipData, ExplotationResult = res }; return(EFuzzingReturn.Crash); } } catch (Exception ex) { throw (ex); } finally { // Free and return if (crash != null && crash is IDisposable) { ((IDisposable)crash).Dispose(); } //Agent.OnFree(Socket, e); } return(EFuzzingReturn.Test); }
/// <summary> /// Set exception /// </summary> /// <param name="e">Exception</param> public void SetException(Exception e) { if (Result == null && e != null) { // Error result byte[] zip = null; if (ZipHelper.AppendOrCreateZip(ref zip, new ZipHelper.FileEntry[] { new ZipHelper.FileEntry("exception.txt", Encoding.UTF8.GetBytes(e.ToString())) }) > 0) { Result = new EndTaskMessage(EFuzzingReturn.Fail) { ZipData = zip, ExplotationResult = EExploitableResult.ERROR_CHECKING } } ; } }
/// <summary> /// Message logic /// </summary> /// <param name="sender">Socket</param> /// <param name="message">Message</param> void _Socket_OnMessage(TuringSocket sender, TuringMessage message) { if (_Paused) { // Send Paused signal //sender.SendMessage(new WaitMessage(TimeSpan.FromSeconds(1))); // Wait disable pause while (_Paused) { Thread.Sleep(500); } } TuringMessage response = new ExceptionMessage("Bad request"); try { switch (message.Type) { case ETuringMessageType.EndTask: { EndTaskMessage msg = (EndTaskMessage)message; List <FuzzerStat <IFuzzingInput> > sinput = null; List <FuzzerStat <IFuzzingConfig> > sconfig = null; // Log if are data FuzzerLog log = msg.SaveResult(sender, out sinput, out sconfig); if (log != null) { RaiseOnCrashLog(log); } // Send message of the end RaiseOnTestEnd(msg.Result, sinput == null ? null : sinput.ToArray(), sconfig == null ? null : sconfig.ToArray()); response = new BoolMessageResponse(true); break; } case ETuringMessageType.OpenStreamRequest: { Guid id = Guid.NewGuid(); OpenStreamMessageRequest msg = (OpenStreamMessageRequest)message; FuzzingStream stream = GetRandomStream(msg, sender, true, id); if (stream == null) { response = new ExceptionMessage("Not found stream"); break; } sender[id.ToString()] = stream; //if (msg.UseMemoryStream) // response = new OpenStreamMessageResponse(id) // { // CanRead = msg.CanRead, // CanSeek = msg.CanSeek, // CanTimeout = msg.CanTimeout, // CanWrite = msg.CanWrite // }; //else response = new OpenStreamMessageResponse(id) { CanRead = stream.CanRead, CanSeek = stream.CanSeek, CanTimeout = stream.CanTimeout, CanWrite = stream.CanWrite }; break; } case ETuringMessageType.GetStreamLengthRequest: { GetStreamLengthMessageRequest msg = (GetStreamLengthMessageRequest)message; FuzzingStream stream = (FuzzingStream)sender[msg.Id.ToString()]; if (stream == null) { response = new ExceptionMessage("No stream openned with id: " + msg.Id.ToString()); break; } response = new LongMessageResponse(stream.Length); break; } case ETuringMessageType.GetStreamPositionRequest: { GetStreamPositionMessageRequest msg = (GetStreamPositionMessageRequest)message; FuzzingStream stream = (FuzzingStream)sender[msg.Id.ToString()]; if (stream == null) { response = new ExceptionMessage("No stream openned with id: " + msg.Id.ToString()); break; } response = new LongMessageResponse(stream.Position); break; } case ETuringMessageType.SetStreamRequest: { SetStreamMessageRequest msg = (SetStreamMessageRequest)message; FuzzingStream stream = (FuzzingStream)sender[msg.Id.ToString()]; if (stream == null) { response = new ExceptionMessage("No stream openned with id: " + msg.Id.ToString()); break; } switch (msg.ValueType) { case SetStreamMessageRequest.EMode.Position: stream.Position = msg.Value; break; case SetStreamMessageRequest.EMode.Length: stream.SetLength(msg.Value); break; } response = new BoolMessageResponse(true); break; } case ETuringMessageType.FlushStreamRequest: { FlushStreamMessageRequest msg = (FlushStreamMessageRequest)message; FuzzingStream stream = (FuzzingStream)sender[msg.Id.ToString()]; if (stream == null) { response = new ExceptionMessage("No stream openned with id: " + msg.Id.ToString()); break; } stream.Flush(); response = new BoolMessageResponse(true); break; } case ETuringMessageType.CloseStreamRequest: { CloseStreamMessageRequest msg = (CloseStreamMessageRequest)message; FuzzingStream stream = (FuzzingStream)sender[msg.Id.ToString()]; if (stream == null) { response = new ExceptionMessage("No stream openned with id: " + msg.Id.ToString()); break; } // Save patch for dump sender[msg.Id.ToString()] = null; sender["Info=" + msg.Id.ToString()] = new FuzzingLogInfo(stream); try { stream.Close(); } catch { } try { stream.Dispose(); } catch { } response = new BoolMessageResponse(true); break; } case ETuringMessageType.ReadStreamRequest: { StreamReadMessageRequest msg = (StreamReadMessageRequest)message; FuzzingStream stream = (FuzzingStream)sender[msg.Id.ToString()]; if (stream == null) { response = new ExceptionMessage("No stream openned with id: " + msg.Id.ToString()); break; } if (msg.PreAppend != null) { stream.AppendToSource(msg.PreAppend, 0, msg.PreAppend.Length, msg.PreAppendReSeek); } byte[] data = new byte[msg.Length]; int r = stream.Read(data, 0, data.Length); if (r != data.Length) { Array.Resize(ref data, r); } response = new ByteArrayMessageResponse(data); break; } case ETuringMessageType.WriteStreamRequest: { StreamWriteMessageRequest msg = (StreamWriteMessageRequest)message; FuzzingStream stream = (FuzzingStream)sender[msg.Id.ToString()]; if (stream == null) { response = new ExceptionMessage("No stream openned with id: " + msg.Id.ToString()); break; } stream.Write(msg.Data, 0, msg.Data.Length); response = new BoolMessageResponse(true); break; } } } catch (Exception e) { response = new ExceptionMessage(e.ToString()); } sender.SendMessage(response); }