1
0

fuzzCF.c 4.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187
  1. /*
  2. Fuzzes CF Information element
  3. */
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6. #include <stdint.h>
  7. #include <string.h>
  8. #include "../frameDefinitions.h"
  9. //Indecates whether the cfFuzzer is running
  10. int cfRunningState = 0;
  11. //Number of fuzzing states
  12. const int cfStates = 3;
  13. //Steps of fuzzers for each fuzzing state
  14. const int cfSteps[] = {1, 32, 32};
  15. //Current state and step of the cfFuzzer
  16. int fuzzState;
  17. int fuzzStep;
  18. void cfPrintCurrentState()
  19. {
  20. switch (fuzzState)
  21. {
  22. case 0:
  23. {
  24. printf("\e[33mFuzzing CF IE\e[39m\n");
  25. printf("Trying 255*0xFF data\n");
  26. break;
  27. }
  28. case 1:
  29. {
  30. printf("Fuzzing lengths with 0xff data\n");
  31. break;
  32. }
  33. case 2:
  34. {
  35. printf("Fuzzing lengths with 0x00 data\n");
  36. break;
  37. }
  38. case 3:
  39. {
  40. printf("\e[33mDone with fuzzing cf\e[39m\n");
  41. break;
  42. }
  43. }
  44. }
  45. //Updates cfFuzzer
  46. //Status 0 indicates start
  47. //Status 1 indicates increaseStep
  48. //Status 2 indicates stop
  49. //Returns -1 if done with fuzzing
  50. int cfFuzzUpdate(int status)
  51. {
  52. switch (status)
  53. {
  54. case 0: //start fuzzer
  55. {
  56. cfRunningState = 1;
  57. fuzzState = 0;
  58. fuzzStep = 0;
  59. cfPrintCurrentState();
  60. break;
  61. }
  62. case 1: //update fuzzer
  63. {
  64. if (cfRunningState == 1) //sanity check
  65. {
  66. //increase steps until all steps are done
  67. if (fuzzStep < cfSteps[fuzzState]-1)
  68. fuzzStep = fuzzStep + 1;
  69. //then increase state and notify
  70. else
  71. {
  72. fuzzStep = 0;
  73. fuzzState = fuzzState + 1;
  74. cfPrintCurrentState();
  75. }
  76. //when all states are done, stop
  77. if (fuzzState == cfStates)
  78. {
  79. cfRunningState = 0;
  80. return -1;
  81. }
  82. }
  83. break;
  84. }
  85. case 2: //stop fuzzer
  86. {
  87. cfRunningState = 0;
  88. break;
  89. }
  90. }
  91. return 0;
  92. }
  93. //Returns an cf information element
  94. infoElem cfFuzz()
  95. {
  96. infoElem cf;
  97. //What to return when not fuzzed
  98. if (cfRunningState == 0)
  99. {
  100. cf.id = 4;
  101. cf.len = 1;
  102. cf.len_data = -1;
  103. cf.data = "\xab";
  104. }
  105. else
  106. {
  107. switch (fuzzState)
  108. {
  109. case 0: //255*0xff
  110. {
  111. cf.id = 4; //update this
  112. cf.len = 255;
  113. cf.len_data = 255;
  114. //create data of 255 times 0xff
  115. u_char *data = malloc(255);
  116. memset(data, 0xff, 255);
  117. cf.data = data;
  118. break;
  119. }
  120. case 1: //cf length with 0xff data
  121. {
  122. if (fuzzStep < 16)
  123. {
  124. int dataSize = fuzzStep;
  125. cf.id = 4;
  126. cf.len = dataSize;
  127. cf.len_data = dataSize;
  128. //create data of datasize times 0xff
  129. u_char *data = malloc(dataSize);
  130. memset(data, 0xff, dataSize);
  131. cf.data = data;
  132. }
  133. else
  134. {
  135. int dataSize = 255 - fuzzStep + 16;
  136. cf.id = 4;
  137. cf.len = dataSize;
  138. cf.len_data = dataSize;
  139. //create data of datasize times 0xff
  140. u_char *data = malloc(dataSize);
  141. memset(data, 0xff, dataSize);
  142. cf.data = data;
  143. }
  144. break;
  145. }
  146. case 2: //cf length with 0x00 data
  147. {
  148. if (fuzzStep < 16)
  149. {
  150. int dataSize = fuzzStep;
  151. cf.id = 4;
  152. cf.len = dataSize;
  153. cf.len_data = dataSize;
  154. //create data of datasize times 0x00
  155. u_char *data = malloc(dataSize);
  156. memset(data, 0x00, dataSize);
  157. cf.data = data;
  158. }
  159. else
  160. {
  161. int dataSize = 255 - fuzzStep + 16;
  162. cf.id = 4;
  163. cf.len = dataSize;
  164. cf.len_data = dataSize;
  165. //create data of datasize times 0x00
  166. u_char *data = malloc(dataSize);
  167. memset(data, 0x00, dataSize);
  168. cf.data = data;
  169. }
  170. break;
  171. }
  172. }
  173. }
  174. return cf;
  175. }