1
0

fuzzRates.c 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221
  1. /*
  2. Fuzzes Supported rates Information element
  3. */
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6. #include <stdint.h>
  7. #include <string.h>
  8. #include "../frameDefinitions.h"
  9. //Indecates whether the ratesFuzzer is running
  10. int ratesRunningState = 0;
  11. //Number of fuzzing states
  12. const int ratesStates = 5;
  13. //Steps of fuzzers for each fuzzing state
  14. const int ratesSteps[] = {2, 4, 32, 32, 1};
  15. //Current state and step of the ratesFuzzer
  16. int fuzzState;
  17. int fuzzStep;
  18. void ratesPrintCurrentState()
  19. {
  20. switch (fuzzState)
  21. {
  22. case 0:
  23. {
  24. printf("\e[33mFuzzing rates IE\e[39m\n");
  25. printf("Trying rates with zero length or no element\n");
  26. break;
  27. }
  28. case 1:
  29. {
  30. printf("Fuzzing duplicate rates\n");
  31. break;
  32. }
  33. case 2:
  34. {
  35. printf("Fuzzing all possible rates\n");
  36. break;
  37. }
  38. case 3:
  39. {
  40. printf("Fuzzing more than 8 rates\n");
  41. break;
  42. }
  43. case 4:
  44. {
  45. printf("Trying 255*0xFF data\n");
  46. break;
  47. }
  48. case 5:
  49. {
  50. printf("\e[33mDone with fuzzing rates IE\e[39m\n");
  51. break;
  52. }
  53. }
  54. }
  55. //Updates ratesFuzzer
  56. //Status 0 indicates start
  57. //Status 1 indicates increaseStep
  58. //Status 2 indicates stop
  59. //Returns -1 if done with fuzzing
  60. int ratesFuzzUpdate(int status)
  61. {
  62. switch (status)
  63. {
  64. case 0: //start fuzzer
  65. {
  66. ratesRunningState = 1;
  67. fuzzState = 0;
  68. fuzzStep = 0;
  69. ratesPrintCurrentState();
  70. break;
  71. }
  72. case 1: //update fuzzer
  73. {
  74. if (ratesRunningState == 1) //sanity check
  75. {
  76. //increase steps until all steps are done
  77. if (fuzzStep < ratesSteps[fuzzState]-1)
  78. fuzzStep = fuzzStep + 1;
  79. //then increase state and notify
  80. else
  81. {
  82. fuzzStep = 0;
  83. fuzzState = fuzzState + 1;
  84. ratesPrintCurrentState();
  85. }
  86. //when all states are done, stop
  87. if (fuzzState == ratesStates)
  88. {
  89. ratesRunningState = 0;
  90. return -1;
  91. }
  92. }
  93. break;
  94. }
  95. case 2: //stop fuzzer
  96. {
  97. ratesRunningState = 0;
  98. break;
  99. }
  100. }
  101. return 0;
  102. }
  103. //Returns an rates information element
  104. infoElem ratesFuzz()
  105. {
  106. infoElem rates;
  107. //What to return when not fuzzed
  108. //Since this is a mandatory frame, we do want to return a normal information element here
  109. if (ratesRunningState == 0)
  110. {
  111. rates.id = 1;
  112. rates.len = 7;
  113. rates.len_data = 7;
  114. rates.data = "\x96\x18\x24\x30\x48\x60\x6c";
  115. }
  116. else
  117. {
  118. switch (fuzzState)
  119. {
  120. case 0: //no rates or no data
  121. {
  122. if (fuzzStep == 0)
  123. {
  124. rates.id = 1;
  125. rates.len = 0;
  126. rates.len_data = 0;
  127. rates.data = "";
  128. }
  129. else if (fuzzStep == 1)
  130. {
  131. rates.id = 1;
  132. rates.len = 0;
  133. rates.len_data = -1;
  134. rates.data = "";
  135. }
  136. break;
  137. }
  138. case 1: //duplicate rates
  139. {
  140. rates.id = 1;
  141. rates.len = 8;
  142. rates.len_data = 8;
  143. rates.data = "";
  144. switch (fuzzStep)
  145. {
  146. case 0: rates.data = "\x96\x96\x96\x30\x30\x30\x30\x96"; break;
  147. case 1: rates.data = "\x16\x16\x16\xB0\xB0\xB0\xB0\x16"; break;
  148. case 2: rates.data = "\x02\x82\x02\x30\xB0\x30\xB0\x82"; break;
  149. case 3: rates.data = "\x00\x00\x80\x80\xff\x7f\xff\x7f"; break;
  150. }
  151. break;
  152. }
  153. case 2: //all possible rates
  154. {
  155. rates.id = 1;
  156. rates.len = 8;
  157. rates.len_data = 8;
  158. u_char *data = malloc(8);
  159. data[0]= fuzzStep*8+0;
  160. data[1]= fuzzStep*8+1;
  161. data[2]= fuzzStep*8+2;
  162. data[3]= fuzzStep*8+3;
  163. data[4]= fuzzStep*8+4;
  164. data[5]= fuzzStep*8+5;
  165. data[6]= fuzzStep*8+6;
  166. data[7]= fuzzStep*8+7;
  167. rates.data = data;
  168. break;
  169. }
  170. case 3: //more than 8 rates
  171. {
  172. if (fuzzStep < 16)
  173. {
  174. int dataSize = 8 + fuzzStep;
  175. rates.id = 1;
  176. rates.len = dataSize;
  177. rates.len_data = dataSize;
  178. //create data of datasize times 0x96
  179. u_char *data = malloc(dataSize);
  180. memset(data, 0x96, dataSize);
  181. rates.data = data;
  182. }
  183. else
  184. {
  185. int dataSize = 255 - fuzzStep + 16;
  186. rates.id = 1;
  187. rates.len = dataSize;
  188. rates.len_data = dataSize;
  189. //create data of datasize times 0x96
  190. u_char *data = malloc(dataSize);
  191. memset(data, 0x96, dataSize);
  192. rates.data = data;
  193. }
  194. break;
  195. }
  196. case 4: //255*0xff
  197. {
  198. rates.id = 1;
  199. rates.len = 255;
  200. rates.len_data = 255;
  201. //create data of 255 times 0xff
  202. u_char *data = malloc(255);
  203. memset(data, 0xff, 255);
  204. rates.data = data;
  205. break;
  206. }
  207. }
  208. }
  209. return rates;
  210. }