1
0

fuzzTIM.c 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160
  1. /*
  2. Fuzzes TIM Information element
  3. */
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6. #include <stdint.h>
  7. #include <string.h>
  8. #include "../frameDefinitions.h"
  9. //Indecates whether the timFuzzer is running
  10. int timRunningState = 0;
  11. //Number of fuzzing states
  12. const int timStates = 3;
  13. //Steps of fuzzers for each fuzzing state
  14. const int timSteps[] = {1, 8, 32};
  15. //Current state and step of the timFuzzer
  16. int fuzzState;
  17. int fuzzStep;
  18. void timPrintCurrentState()
  19. {
  20. switch (fuzzState)
  21. {
  22. case 0:
  23. {
  24. printf("\e[33mFuzzing TIM IE\e[39m\n");
  25. printf("Trying 255*0xFF data\n");
  26. break;
  27. }
  28. case 1:
  29. {
  30. printf("Fuzzing short lengths\n");
  31. break;
  32. }
  33. case 2:
  34. {
  35. printf("Fuzzing values\n");
  36. break;
  37. }
  38. case 3:
  39. {
  40. printf("\e[33mDone with fuzzing tim\e[39m\n");
  41. break;
  42. }
  43. }
  44. }
  45. //Updates timFuzzer
  46. //Status 0 indicates start
  47. //Status 1 indicates increaseStep
  48. //Status 2 indicates stop
  49. //Returns -1 if done with fuzzing
  50. int timFuzzUpdate(int status)
  51. {
  52. switch (status)
  53. {
  54. case 0: //start fuzzer
  55. {
  56. timRunningState = 1;
  57. fuzzState = 0;
  58. fuzzStep = 0;
  59. timPrintCurrentState();
  60. break;
  61. }
  62. case 1: //update fuzzer
  63. {
  64. if (timRunningState == 1) //sanity check
  65. {
  66. //increase steps until all steps are done
  67. if (fuzzStep < timSteps[fuzzState]-1)
  68. fuzzStep = fuzzStep + 1;
  69. //then increase state and notify
  70. else
  71. {
  72. fuzzStep = 0;
  73. fuzzState = fuzzState + 1;
  74. timPrintCurrentState();
  75. }
  76. //when all states are done, stop
  77. if (fuzzState == timStates)
  78. {
  79. timRunningState = 0;
  80. return -1;
  81. }
  82. }
  83. break;
  84. }
  85. case 2: //stop fuzzer
  86. {
  87. timRunningState = 0;
  88. break;
  89. }
  90. }
  91. return 0;
  92. }
  93. //Returns an tim information element
  94. infoElem timFuzz()
  95. {
  96. infoElem tim;
  97. //What to return when not fuzzed
  98. if (timRunningState == 0) //update this
  99. {
  100. tim.id = 0;
  101. tim.len = 1;
  102. tim.len_data = -1;
  103. tim.data = "\xab";
  104. }
  105. else
  106. {
  107. switch (fuzzState)
  108. {
  109. case 0: //255*0xff
  110. {
  111. tim.id = 5;
  112. tim.len = 255;
  113. tim.len_data = 255;
  114. //create data of 255 times 0xff
  115. u_char *data = malloc(255);
  116. memset(data, 0xff, 255);
  117. tim.data = data;
  118. break;
  119. }
  120. case 1: //tim short lengths
  121. {
  122. int dataSize = 0 + fuzzStep;
  123. tim.id = 5;
  124. tim.len = dataSize;
  125. tim.len_data = dataSize;
  126. //create data of datasize times 0xFF
  127. u_char *data = malloc(dataSize);
  128. memset(data, 0xFF, dataSize);
  129. tim.data = data;
  130. break;
  131. }
  132. case 2: //tim values
  133. {
  134. int dataSize = 255;
  135. tim.id = 5;
  136. tim.len = dataSize;
  137. tim.len_data = dataSize;
  138. //create data of datasize times 0xFF
  139. u_char *data = malloc(dataSize);
  140. if (fuzzStep < 16)
  141. memset(data, fuzzStep, dataSize);
  142. else
  143. memset(data, 255 + 16 - fuzzStep, dataSize);
  144. tim.data = data;
  145. break;
  146. }
  147. }
  148. }
  149. return tim;
  150. }