Skip to content

Instantly share code, notes, and snippets.

@ais2397 ais2397/freebsd_fuzzed.py Secret

Created Apr 14, 2020
Embed
What would you like to do?
import re
import os
import sys
freebsd_syscalls = {}
listed_syscalls = []
listed_syscalls_names = {}
unmatched_functions = []
possible_cases = {}
netbsd_syscalls={}
common_sys=[]
missing_sys=[]
missing_syscalls = ['syscall', 'compat_50_wait4', 'compat_43_ocreat', 'compat_50_mknod', 'break', 'compat_20_getfsstat', 'compat_43_olseek', 'compat_40_mount', 'unmount', 'access', 'kill', 'compat_43_stat43', 'compat_43_lstat43', 'profil', 'ktrace', 'compat_13_sigaction13', 'compat_13_sigprocmask13', '__getlogin', '__setlogin', 'acct', 'compat_13_sigpending13', 'compat_13_sigaltstack13', 'ioctl', 'compat_12_oreboot', 'revoke', 'umask', 'compat_43_fstat43', 'compat_43_ogetkerninfo', 'compat_43_ogetpagesize', 'compat_12_msync', 'compat_43_ommap', 'vadvise', 'compat_50_setitimer', 'compat_43_owait', 'compat_12_oswapon', 'compat_50_getitimer', 'compat_43_ogethostname', 'compat_43_osethostname', 'compat_43_ogetdtablesize', 'compat_50_select', 'setpriority', 'compat_30_socket', 'compat_43_oaccept', 'getpriority', 'compat_43_osend', 'compat_43_orecv', 'compat_13_sigreturn13', 'compat_43_osigvec', 'compat_43_osigblock', 'compat_43_osigsetmask', 'compat_13_sigsuspend13', 'compat_43_osigstack', 'compat_43_orecvmsg', 'compat_43_osendmsg', 'compat_50_gettimeofday', 'compat_50_getrusage', 'compat_50_settimeofday', 'compat_43_orecvfrom', 'compat_43_otruncate', 'compat_43_oftruncate', 'mkfifo', 'compat_50_utimes', 'compat_50_adjtime', 'compat_43_ogetpeername', 'compat_43_ogethostid', 'compat_43_osethostid', 'compat_43_ogetrlimit', 'compat_43_osetrlimit', 'compat_43_okillpg', 'setsid', 'compat_50_quotactl', 'compat_43_oquota', 'compat_43_ogetsockname', 'nfssvc', 'compat_43_ogetdirentries', 'compat_20_statfs', 'compat_20_fstatfs', 'compat_30_getfh', 'compat_09_ogetdomainname', 'compat_09_osetdomainname', 'compat_09_ouname', 'sysarch', 'compat_10_osemsys', 'compat_10_omsgsys', 'compat_10_oshmsys', 'compat_30_ntp_gettime', 'ntp_adjtime', 'lfs_bmapv', 'lfs_markv', 'lfs_segclean', 'compat_50_lfs_segwait', 'compat_12_stat12', 'compat_12_fstat12', 'compat_12_lstat12', 'pathconf', 'fpathconf', 'getsockopt2', 'compat_12_getdirentries', '__syscall', '__sysctl', 'undelete', 'compat_50_futimes', 'reboot', 'afssys', 'compat_14___semctl', 'semconfig', 'compat_14_msgctl', 'compat_14_shmctl', 'compat_50_clock_gettime', 'compat_50_clock_settime', 'compat_50_clock_getres', 'timer_create', 'timer_delete', 'compat_50_timer_settime', 'compat_50_timer_gettime', 'timer_getoverrun', 'compat_50_nanosleep', 'compat_50___sigtimedwait', 'sigqueueinfo', 'modctl', '_ksem_init', '_ksem_open', '_ksem_unlink', '_ksem_close', '_ksem_post', '_ksem_wait', '_ksem_trywait', '_ksem_getvalue', '_ksem_destroy', '_ksem_timedwait', 'mq_open', 'mq_close', 'mq_unlink', 'mq_getattr', 'mq_setattr', 'mq_notify', 'mq_send', 'mq_receive', 'compat_50_mq_timedsend', 'compat_50_mq_timedreceive', '__posix_rename', 'swapctl', 'compat_30_getdents', 'minherit', 'lchmod', 'compat_50_lutimes', '__msync13', 'compat_30___stat13', 'compat_30___fstat13', 'compat_30___lstat13', '__sigaltstack14', '__posix_chown', '__posix_fchown', '__posix_lchown', 'getsid', 'fktrace', 'compat_16___sigaction14', '__sigpending14', '__sigprocmask14', '__sigsuspend14', 'compat_16___sigreturn14', '__getcwd', 'compat_30_fhopen', 'compat_30_fhstat', 'compat_20_fhstatfs', 'compat_50_____semctl13', 'compat_50___msgctl13', 'compat_50___shmctl13', 'issetugid', 'utrace', 'getcontext', 'setcontext', 'compat_60_sa_register', 'compat_60_sa_stacks', 'compat_60_sa_enable', 'compat_60_sa_setconcurrency', 'compat_60_sa_yield', 'compat_60_sa_preempt', '__sigaction_sigtramp', 'rasctl', 'kqueue', 'compat_50_kevent', '_sched_setparam', '_sched_getparam', '_sched_setaffinity', '_sched_getaffinity', 'sched_yield', '_sched_protect', 'fsync_range', 'uuidgen', 'getvfsstat', 'statvfs1', 'fstatvfs1', 'compat_30_fhstatvfs1', 'extattrctl', 'extattr_set_file', 'extattr_get_file', 'extattr_delete_file', 'extattr_set_fd', 'extattr_get_fd', 'extattr_delete_fd', 'extattr_set_link', 'extattr_get_link', 'extattr_delete_link', 'extattr_list_fd', 'extattr_list_file', 'extattr_list_link', 'compat_50_pselect', 'compat_50_pollts', 'setxattr', 'lsetxattr', 'fsetxattr', 'getxattr', 'lgetxattr', 'fgetxattr', 'listxattr', 'llistxattr', 'flistxattr', 'removexattr', 'lremovexattr', 'fremovexattr', 'compat_50___stat30', 'compat_50___fstat30', 'compat_50___lstat30', '__getdents30', 'compat_30___fhstat30', 'compat_50___ntp_gettime30', '__socket30', '__getfh30', '__fhopen40', '__fhstatvfs140', 'compat_50___fhstat40', 'aio_cancel', 'aio_error', 'aio_fsync', 'aio_read', 'aio_return', 'compat_50_aio_suspend', 'aio_write', 'lio_listio', '__mount50', 'mremap', 'pset_create', 'pset_destroy', 'pset_assign', '_pset_bind', '__posix_fadvise50', '__select50', '__gettimeofday50', '__settimeofday50', '__utimes50', '__adjtime50', '__lfs_segwait50', '__futimes50', '__lutimes50', '__setitimer50', '__getitimer50', '__clock_gettime50', '__clock_settime50', '__clock_getres50', '__nanosleep50', '____sigtimedwait50', '__mq_timedsend50', '__mq_timedreceive50', '__kevent50', '__pselect50', '__pollts50', '__aio_suspend50', '__stat50', '__fstat50', '__lstat50', '____semctl50', '__shmctl50', '__msgctl50', '__getrusage50', '__timer_settime50', '__timer_gettime50', '__ntp_gettime50', '__wait450', '__mknod50', '__fhstat50', 'dup3', 'kqueue1', 'mkfifoat', 'fexecve', 'fstatat', 'futimens', '__quotactl', 'recvmmsg', 'sendmmsg']
def usage():
print "USAGE: python freebsd_fuzzed.py"
print "\t -c : print common sycalls"
print "\t -syz <path to sys/freebsd>: Syzkaller checker"
print "\t -get <path to sys/freebsd>: get syscalls to be ported from freebsd"
def freebsd_sys():
sys = re.compile("#define\s+SYS_(.*)\t(.*)")
content = open("freebsd_syscall.h").readlines()
for line in content:
if sys.match(line):
syscall_name = sys.match(line).groups()[1].strip()
freebsd_syscalls[syscall_name] = sys.match(line).groups()[0].strip()
def syzkaller_check(path):
for filename in os.listdir(path):
if filename.endswith(".txt"):
content = open(os.path.join(path, filename)).readlines()
syzkaller_file_parser(content)
def syzkaller_file_parser(content):
sys = re.compile("(.*?)\(.*\).*")
for line in content:
if sys.match(line):
flag = 0
for syscall, syscallno in freebsd_syscalls.items():
if cmp(line.split('(')[0].split('$')[0], syscall) == 0:
listed_syscalls.append(syscallno)
listed_syscalls_names[syscallno] = syscall
flag = 1
if flag == 0:
unmatched_functions.append(line)
def freebsd_sys():
sys = re.compile("#define\s+SYS_(.*)\t(.*)")
content = open("freebsd_syscall.h").readlines()
for line in content:
if sys.match(line):
syscall_name=sys.match(line).groups()[0].strip()
freebsd_syscalls[syscall_name]=sys.match(line).groups()[1].strip()
def netbsd_sys():
#sys = re.compile("\/\* syscall:\s+\"(.*)\"\s+ret:(.*)\*\/")
sys = re.compile("#define\s+SYS_(.*)\t(.*)")
content = open("syscall.h").readlines()
for line in content:
if sys.match(line):
syscall_name=sys.match(line).groups()[0].strip()
netbsd_syscalls[syscall_name]=sys.match(line).groups()[1].strip()
def find_match():
for i in netbsd_syscalls.keys():
if i in freebsd_syscalls.keys():
common_sys.append(i)
else:
missing_sys.append(i)
def add_support():
for i in common_sys:
if (i in listed_syscalls_names.values()) and (i in missing_syscalls):
possible_cases[netbsd_syscalls[i]] = i
def print_syscalls():
print "="*50
print "Existing syscalls"
print "="*50
for syscallno, syscall in listed_syscalls_names.items():
print "Syscall No " + str(syscallno) + " : " + syscall
def print_res():
print "="*50
print "Common syscalls"
print "="*50
for i in common_sys:
print "Syscall No ",
print netbsd_syscalls[i],
print " :\t",
print i
print "="*50
print "Unmatched syscalls"
print "="*50
for i in missing_sys:
print "Syscall No ",
print netbsd_syscalls[i],
print " :\t",
print i
def print_poss():
print "="*50
print "To be added"
print "="*50
for syscallno, syscall in possible_cases.items():
print "Syscall No " + str(syscallno) + " : " + syscall
def find_common():
freebsd_sys()
netbsd_sys()
find_match()
print_res()
def possible(path):
find_common()
syzkaller_check(path)
add_support()
print_poss()
def main():
if len(sys.argv) < 2:
usage()
exit()
if sys.argv[1] == "-c":
find_common()
if sys.argv[1] == "-syz":
if len(sys.argv) != 3:
usage()
exit()
path = sys.argv[2]
freebsd_sys()
syzkaller_check(path)
print_syscalls()
if sys.argv[1] == "-get":
if len(sys.argv) != 3:
usage()
exit()
path = sys.argv[2]
possible(path)
if __name__ == '__main__':
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.