1
0

fuzzCOUNTRY.c 7.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237
  1. /*
  2. Fuzzes country Information element
  3. */
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6. #include <stdint.h>
  7. #include <string.h>
  8. #include "../frameDefinitions.h"
  9. //Indecates whether the countryFuzzer is running
  10. int countryRunningState = 0;
  11. //Number of fuzzing states
  12. const int countryStates = 6;
  13. //Steps of fuzzers for each fuzzing state
  14. const int countrySteps[] = {1, 6, 256, 1, 1, 1};
  15. //Current state and step of the countryFuzzer
  16. int fuzzState;
  17. int fuzzStep;
  18. void countryPrintCurrentState()
  19. {
  20. switch (fuzzState)
  21. {
  22. case 0:
  23. {
  24. printf("\e[33mFuzzing country IE\e[39m\n");
  25. printf("Trying 255*0xFF data\n");
  26. break;
  27. }
  28. case 1:
  29. {
  30. printf("Fuzzing lengths lower than 6\n");
  31. break;
  32. }
  33. case 2:
  34. {
  35. printf("Fuzzing country string\n");
  36. break;
  37. }
  38. case 3:
  39. {
  40. printf("Fuzzing first channel number, number of channels and transmit power\n");
  41. break;
  42. }
  43. case 4:
  44. {
  45. printf("Ignoring padding\n");
  46. break;
  47. }
  48. case 5:
  49. {
  50. printf("Trying duplicate triplets and long size without padding\n");
  51. break;
  52. }
  53. case 6:
  54. {
  55. printf("\e[33mDone with fuzzing country\e[39m\n");
  56. break;
  57. }
  58. }
  59. }
  60. //Updates countryFuzzer
  61. //Status 0 indicates start
  62. //Status 1 indicates increaseStep
  63. //Status 2 indicates stop
  64. //Returns -1 if done with fuzzing
  65. int countryFuzzUpdate(int status)
  66. {
  67. switch (status)
  68. {
  69. case 0: //start fuzzer
  70. {
  71. countryRunningState = 1;
  72. fuzzState = 0;
  73. fuzzStep = 0;
  74. countryPrintCurrentState();
  75. break;
  76. }
  77. case 1: //update fuzzer
  78. {
  79. if (countryRunningState == 1) //sanity check
  80. {
  81. //increase steps until all steps are done
  82. if (fuzzStep < countrySteps[fuzzState]-1)
  83. fuzzStep = fuzzStep + 1;
  84. //then increase state and notify
  85. else
  86. {
  87. fuzzStep = 0;
  88. fuzzState = fuzzState + 1;
  89. countryPrintCurrentState();
  90. }
  91. //when all states are done, stop
  92. if (fuzzState == countryStates)
  93. {
  94. countryRunningState = 0;
  95. return -1;
  96. }
  97. }
  98. break;
  99. }
  100. case 2: //stop fuzzer
  101. {
  102. countryRunningState = 0;
  103. break;
  104. }
  105. }
  106. return 0;
  107. }
  108. //Returns an country information element
  109. infoElem countryFuzz()
  110. {
  111. infoElem country;
  112. //What to return when not fuzzed
  113. if (countryRunningState == 0)
  114. {
  115. country.id = 0;
  116. country.len = 1;
  117. country.len_data = -1;
  118. country.data = "\xab";
  119. }
  120. else
  121. {
  122. switch (fuzzState) //update this
  123. {
  124. case 0: //255*0xff
  125. {
  126. country.id = 7;
  127. country.len = 255;
  128. country.len_data = 255;
  129. //create data of 255 times 0xff
  130. u_char *data = malloc(255);
  131. memset(data, 0xff, 255);
  132. country.data = data;
  133. break;
  134. }
  135. case 1: //lengths lower than 6
  136. {
  137. int dataSize = fuzzStep;
  138. country.id = 7;
  139. country.len = dataSize;
  140. country.len_data = dataSize;
  141. //create data of datasize times 0x41
  142. u_char *data = malloc(dataSize);
  143. memset(data, 0x41, dataSize);
  144. country.data = data;
  145. break;
  146. }
  147. case 2: //country string
  148. {
  149. country.id = 7;
  150. country.len = 6;
  151. country.len_data = 6;
  152. //create characters
  153. u_char *data = malloc(6);
  154. data[0] = fuzzStep;
  155. data[1] = fuzzStep;
  156. data[2] = fuzzStep;
  157. data[3] = 0x01;
  158. data[4] = 0x0d;
  159. data[5] = 0x14;
  160. country.data = data;
  161. break;
  162. }
  163. case 3: //first channel number and number of channels
  164. {
  165. country.id = 7;
  166. country.len = 28;
  167. country.len_data = 28;
  168. country.data = "\x45\x55\x20" //country string
  169. "\x00\x00\x00"
  170. "\xff\x00\x00"
  171. "\x00\xff\x00"
  172. "\xff\xff\x00"
  173. "\x00\x00\xff"
  174. "\xff\x00\xff"
  175. "\x00\xff\xff"
  176. "\xff\xff\xff"
  177. "\x00"; //padding
  178. break;
  179. }
  180. case 4: //first channel number and number of channels
  181. {
  182. country.id = 7;
  183. country.len = 27;
  184. country.len_data = 27;
  185. country.data = "\x45\x55\x20" //country string
  186. "\x00\x00\x00"
  187. "\xff\x00\x00"
  188. "\x00\xff\x00"
  189. "\xff\xff\x00"
  190. "\x00\x00\xff"
  191. "\xff\x00\xff"
  192. "\x00\xff\xff"
  193. "\xff\xff\xff";
  194. break;
  195. }
  196. case 5: //duplicate tiplets
  197. {
  198. country.id = 7;
  199. country.len = 255;
  200. country.len_data = 255;
  201. country.data = "\x45\x55\x20" //country string
  202. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  203. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  204. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  205. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  206. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  207. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  208. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  209. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  210. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  211. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  212. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  213. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  214. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  215. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  216. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  217. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  218. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  219. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  220. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  221. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14"
  222. "\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14\x01\x0d\x14";
  223. break;
  224. }
  225. }
  226. }
  227. return country;
  228. }