Pasted

/*
    S-Fuzz - Mutation Based Fuzzer
 
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
************************************************************************
 s4ndman
 mail all bugs to: <r[dot]coded[AT]gmail[dot]com>
 READFIRST: site link: http://mmaptonull.blogspot.com/2011/02/sfuzz-file-format-fuzzer.html
 
:::::::CHANGELOG:::::::::
 
v.1 ~ 05/12/09 
  -first _simple_ version out
  
v.3 ~ 07/12/09
  -additional options added
    +logging added
    
 
v.5 ~ 10/12/09
  -malloc implementation for [large file sizes]
    +auto malloc by calculating file sizes
  -improved logging
  -bugfixes
 
v.6 ~ 8/06/10
  -sleep timer adder to reduce computation load
  -memory corruption bugfixes [multiple _offbyone_ bugs]
 
v.7 ~ 10/02/11
  -implemented header offset
   +avoids header region if needed for strict header testing programs
  -added verbosity choice for logfile to reduce log file size
  
TODO: implement data addition mutation option 
***********************************************************************/
 
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
 
FILE *fpin, *fpout, *fplog;
 
main(int argc, char *argv[]){
    
    if (argc < 9){
        printf("[*]@@@@__S-Fuzz__@@@@\n");
        printf("[*]type: Mutation Fuzzer\n");
        printf("[*]by: Sandman, 05/05/2010\n");
        printf("[i]usage: ./sfuzz <i> <o> <nf> <fsz> <mbovr> <logf> <slp> <hdr> <vrb>\n");
        printf("[i]i     > infile\n");
        printf("[i]o     > outfile\n");
        printf("[i]nf    > number of files\n");
        printf("[i]fsz   > max file size (-1 to autocalculate)\n");
        printf("[i]mbovr > maximum bytes to overwrite\n");
        printf("[i]logf  > logfile name to log all actions.\n");
        printf("[i]slp   > sleep time between file writes [seconds]\n");
        printf("[i]hdr   > header offset [bytes from beginning, to avoid header corruption by fuzzing]\n");
        printf("[i]vrb   > logfile verbosity [0=off, 1=on]  [to avoid clutter in the logfile]\n");
        printf("[!]NOTE: ALL SWITCHES ARE REQUIRED.\n");
        exit(1);
        }
        
    int vrb, bLoc, rByte, fNumBytes, i, x, nFiles, maxNBytes, nBytes, fMemAllocd, sleepTime, hdrOffset;
    printf("%s\n",argv[4]);
    char *mainBuf;
    char *backupBuf;
    char outFile[1024];
    sleepTime = atoi(argv[7]);
    maxNBytes = atoi(argv[5]);
    nFiles = atoi(argv[3]);
    hdrOffset = atoi(argv[8]);
    vrb = atoi(argv[9]);
    
    fplog = fopen(argv[6], "w");
    
    fprintf(fplog, "[i]starting sfuzz on file %s\n", argv[1]);
    fprintf(fplog, "[i]starting with parameters:\n");
    fprintf(fplog, "[i]infile: %s\n", argv[1]);
    fprintf(fplog, "[i]outfile: %s\n", argv[2]);
    fprintf(fplog, "[i]number of fuzzed files: %s\n", argv[3]);
    fprintf(fplog, "[i]max file size (autocalculated if -1): %s\n bytes", argv[4]);
    fprintf(fplog, "[i]max bytes to overwrite: %s\n bytes", argv[5]);
    fprintf(fplog, "[i]log file: %s\n", argv[6]);
    fprintf(fplog, "[i]sleep time: %s\n", argv[7]);
    fprintf(fplog, "[i]header offset: %s\n bytes", argv[8]);
    fprintf(fplog, "[i]logfile verbosity: %s\n", argv[9]);
 
    
    if ((atoi(argv[4])) == -1){
        fpin = fopen(argv[1], "r");
        if (fpin == NULL){
            printf("[-]infile read error, does it exist??\n");
            fprintf(fplog, "[-]error file read error on %s\n", argv[1]);
            fclose(fplog);
            exit(-1);
        }
        fseek(fpin, 0, SEEK_END);
        fMemAllocd = ftell(fpin);
        fprintf(fplog, "[i]file size auto-calculate result: %d bytes\n", fMemAllocd);
        fprintf(fplog, "[i]allocating buffer size: %d bytes + 1000 bytes.\n", fMemAllocd);
        fclose(fpin);
        mainBuf = (char*)malloc(fMemAllocd+1000);
        backupBuf = (char*)malloc(fMemAllocd+1000);
        if (mainBuf == NULL || backupBuf == NULL){
            printf("[-]error: out of memory, malloc failed!\n");
            fprintf(fplog,"[-]error: out of memory, malloc failed!\n");
            fclose(fplog);
            exit(-1);
            }
    }
    else{
        mainBuf = (char*)malloc(atoi(argv[4]));
        backupBuf = (char*)malloc(atoi(argv[4]));
        if (mainBuf == NULL || backupBuf == NULL){
            printf("[-]error: out of memory, malloc failed!\n");
            fprintf(fplog,"[-]error: out of memory, malloc failed!\n");
            fclose(fplog);
            exit(-1);
            }
        fprintf(fplog, "[i]allocating buffer size: %s bytes\n", argv[4]);
        }
    
    fpin = fopen(argv[1],"r");
    if (fpin == NULL){
            printf("[-]infile read error, does it exist??\n");
            fprintf(fplog, "[-]error file read error on %s\n", argv[1]);
            free(mainBuf);
            free(backupBuf);
            fclose(fplog);
            exit(-1);
        }
    if ((atoi(argv[4])) == -1){
        fNumBytes = read(fileno(fpin), mainBuf, (fMemAllocd+1000));
        }
    else{
        fseek(fpin, 0, SEEK_END);
        fMemAllocd = ftell(fpin);
        fseek(fpin, 0, SEEK_SET);
        if (fMemAllocd > (atoi(argv[4]))){
            printf("[!]Warning: Allocated buffer [%d] is less than file size [%d], fuzzed files will be truncated.\n", (atoi(argv[4])), fMemAllocd);
            fprintf(fplog,"[!]Warning: Allocated buffer [%d] is less than file size [%d]; fuzzed files will be truncated.\n", (atoi(argv[4])), fMemAllocd);
            }
        fNumBytes = read(fileno(fpin), mainBuf, (atoi(argv[4])));
        }
        
    fclose(fpin);
    
    memcpy(backupBuf, mainBuf, fNumBytes);
    
    for(i=0; i<nFiles; i++){
        
        srand(time(NULL));
        nBytes = rand() % maxNBytes;
        nBytes++;
        
        printf("[+]Modifying %d byte(s) in copy %d\n", nBytes, i);
        fprintf(fplog, "[+]Modifying %d byte(s) in copy %d\n", nBytes, i);
        
        for (x=0; x<nBytes; x++){
            rByte = rand() % 257;
            bLoc = ((rand() % (fNumBytes-hdrOffset))+hdrOffset) -1;
            
            if (rByte == 256){
                rByte = -1;
                }
                
            mainBuf[bLoc] = rByte;
            if (vrb == 1){
                printf("[*]File buffer[%d] orig-byte = %d\n",bLoc, backupBuf[bLoc]); 
                printf("[*]File buffer[%d] new-byte = %d\n",bLoc, rByte);
                fprintf(fplog,"[*]File buffer[%d] orig-byte = %d\n",bLoc, backupBuf[bLoc]); 
                fprintf(fplog,"[*]File buffer[%d] new-byte = %d\n",bLoc, rByte);}
        }
            
            sprintf(outFile, "%d-%s",i,argv[2]);
            fpout = fopen(outFile, "w");
            write(fileno(fpout), mainBuf, fNumBytes);
            printf("[+]Writing file %s\n", outFile);
            fprintf(fplog,"[+]Writing file %s\n", outFile);
            fclose(fpout);
            printf("[-]sleeping %s seconds...\n", argv[7]);
            fprintf(fplog,"[-]sleeping %d seconds...", sleepTime);
            sleep(sleepTime);
            
            memcpy(mainBuf, backupBuf, fNumBytes);
    }
    
    printf("[+]completed creating %d fuzzed files.\n", nFiles);
    fprintf(fplog,"[+]completed creating %d fuzzed files.\n", nFiles);
    free(mainBuf);
    free(backupBuf);
    fclose(fplog);
}