diff --git a/.github/workflows/aarch64.yml b/.github/workflows/aarch64.yml index f2ffcb76..4817d35e 100644 --- a/.github/workflows/aarch64.yml +++ b/.github/workflows/aarch64.yml @@ -25,13 +25,7 @@ jobs: install: | export CARGO_TERM_COLOR=always export CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse - apt-get update && apt-get install -y gdb pip curl wget python3.10-dev clang llvm build-essential - wget https://download.visualstudio.microsoft.com/download/pr/092bec24-9cad-421d-9b43-458b3a7549aa/84280dbd1eef750f9ed1625339235c22/dotnet-sdk-8.0.101-linux-arm64.tar.gz - mkdir /dotnet && tar zxf dotnet-sdk-8.0.101-linux-arm64.tar.gz -C /dotnet && rm -rf dotnet-sdk-8.0.101-linux-arm64.tar.gz - export DOTNET_ROOT=/dotnet - export PATH=$PATH:/dotnet - export DOTNET_CLI_TELEMETRY_OPTOUT=1 - export DOTNET_UPGRADEASSISTANT_TELEMETRY_OPTOUT=1 + apt-get update && apt-get install -y gdb pip curl python3.10-dev clang llvm build-essential curl https://sh.rustup.rs -o rustup.sh && chmod +x rustup.sh && \ ./rustup.sh -y && rm rustup.sh run: | diff --git a/README.md b/README.md index a9b78106..46332206 100644 --- a/README.md +++ b/README.md @@ -35,7 +35,8 @@ java reports and get report from to analyze JavaScript reports and get report from [Jazzer.js](https://github.com/CodeIntelligenceTesting/jazzer.js) or [jsfuzz](https://github.com/fuzzitdev/jsfuzz). -Use `casr-csharp` to analyze C# reports. +Use `casr-csharp` to analyze C# reports and get report from +[Sharpfuzz](https://github.com/Metalnem/sharpfuzz). Crash report contains many useful information: severity (like [exploitable](https://github.com/jfoote/exploitable)) for x86, x86\_64, arm32, aarch64, rv32g, rv64g architectures, diff --git a/casr/src/bin/casr-afl.rs b/casr/src/bin/casr-afl.rs index d7bf9f13..36fd80f2 100644 --- a/casr/src/bin/casr-afl.rs +++ b/casr/src/bin/casr-afl.rs @@ -15,7 +15,7 @@ use std::path::{Path, PathBuf}; fn main() -> Result<()> { let matches = clap::Command::new("casr-afl") .version(clap::crate_version!()) - .about("Triage crashes found by AFL++ (Sharpfuzz)") + .about("Triage crashes found by AFL++/Sharpfuzz") .term_width(90) .arg( Arg::new("log-level") @@ -151,10 +151,10 @@ fn main() -> Result<()> { cmdline.split_whitespace().map(|s| s.to_string()).collect(); if cmd_args[0].ends_with("dotnet") || cmd_args[0].ends_with("mono") { tool = "casr-csharp"; - crash_info.casr_tool = util::get_path("casr-csharp")?.clone() + crash_info.casr_tool = util::get_path("casr-csharp")?; } else { tool = "casr-gdb"; - crash_info.casr_tool = util::get_path("casr-gdb")?.clone() + crash_info.casr_tool = util::get_path("casr-gdb")?; } crash_info.target_args = cmd_args; } else { @@ -209,6 +209,6 @@ fn main() -> Result<()> { args = Vec::new(); } - // Generate reports + // Generate reports. fuzzing_crash_triage_pipeline(&matches, &crashes, &args) } diff --git a/casr/src/bin/casr-csharp.rs b/casr/src/bin/casr-csharp.rs index 37f0fdbe..11250caf 100644 --- a/casr/src/bin/casr-csharp.rs +++ b/casr/src/bin/casr-csharp.rs @@ -83,10 +83,18 @@ fn main() -> Result<()> { bail!("Wrong arguments for starting program"); }; + // Check that args are valid. + let Some(pos) = argv + .iter() + .position(|x| x.ends_with(".dll") || x.ends_with(".exe") || x.ends_with(".csproj")) + else { + bail!("dotnet/mono target is not specified by .dll, .exe or .csproj executable."); + }; + // Get stdin for target program. let stdin_file = util::stdin_from_matches(&matches)?; - // Get timeout + // Get timeout. let timeout = *matches.get_one::("timeout").unwrap(); // Run program. @@ -103,16 +111,8 @@ fn main() -> Result<()> { // Create report. let mut report = CrashReport::new(); - // Set executable path (for C# .dll (dotnet) or .exe (mono) file) - if let Some(pos) = argv - .iter() - .position(|x| x.ends_with(".dll") || x.ends_with(".exe") || x.ends_with(".csproj")) - { - let Some(classes) = argv.get(pos) else { - bail!("dotnet target is not specified by .dll, .exe or .csproj executable."); - }; - report.executable_path = classes.to_string(); - } + // Set executable path (for C# .dll, .csproj (dotnet) or .exe (mono) file). + report.executable_path = argv.get(pos).unwrap().to_string(); report.proc_cmdline = argv.join(" "); let _ = report.add_os_info(); let _ = report.add_proc_environ(); @@ -139,6 +139,6 @@ fn main() -> Result<()> { } } - //Output report + //Output report. util::output_report(&report, &matches, &argv) } diff --git a/casr/tests/tests.rs b/casr/tests/tests.rs index fba780cc..af83f55b 100644 --- a/casr/tests/tests.rs +++ b/casr/tests/tests.rs @@ -5870,7 +5870,6 @@ fn test_casr_afl_csharp() { format!("{}:{}", bins.display(), std::env::var("PATH").unwrap()), ); - print!("{:?}", output); let output = output.output().expect("casr-afl crashed"); assert!( @@ -5928,14 +5927,8 @@ fn test_casr_afl_csharp() { } assert!(storage.values().all(|x| *x > 1)); - let _ = Command::new("rm") - .args(["-rf", &paths[4]]) - .output() - .expect("failed to remove dir"); - let _ = Command::new("rm") - .args(["-rf", &paths[5]]) - .output() - .expect("failed to remove dir"); + let _ = fs::remove_dir_all(&paths[4]); + let _ = fs::remove_dir_all(&paths[5]); } #[test] @@ -6054,12 +6047,6 @@ fn test_casr_afl_csharp_ignore_cmd() { } assert!(storage.values().all(|x| *x > 1)); - let _ = Command::new("rm") - .args(["-rf", &paths[4]]) - .output() - .expect("failed to remove dir"); - let _ = Command::new("rm") - .args(["-rf", &paths[5]]) - .output() - .expect("failed to remove dir"); + let _ = fs::remove_dir_all(&paths[4]); + let _ = fs::remove_dir_all(&paths[5]); } diff --git a/docs/usage.md b/docs/usage.md index ee08cbc3..3fece128 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -10,8 +10,10 @@ java reports and get report from to analyze JavaScript reports and get report from [Jazzer.js](https://github.com/CodeIntelligenceTesting/jazzer.js) or [jsfuzz](https://github.com/fuzzitdev/jsfuzz). -Use `casr-csharp` to analyze C# reports. `casr-afl` can triage crashes -found by [AFL++](https://github.com/AFLplusplus/AFLplusplus) (Sharpfuzz). +Use `casr-csharp` to analyze C# reports and get report from +[Sharpfuzz](https://github.com/Metalnem/sharpfuzz). `casr-afl` can triage +crashes found by [AFL++](https://github.com/AFLplusplus/AFLplusplus) and +AFL-based fuzzer [Sharpfuzz](https://github.com/Metalnem/sharpfuzz). `casr-libfuzzer` can triage crashes found by [libFuzzer](https://www.llvm.org/docs/LibFuzzer.html) (libFuzzer, go-fuzz, Atheris, Jazzer, Jazzer.js, jsfuzz). `casr-dojo` allows to upload new and @@ -473,8 +475,8 @@ fuzzer [Sharpfuzz](https://github.com/Metalnem/sharpfuzz). AFL++ Example (Ubuntu 20.04+): - $ cp -r casr/tests/casr_tests/bin/load_afl /tmp/load_afl - $ cp -r casr/tests/casr_tests/bin/load_sydr /tmp/load_sydr + $ cp casr/tests/casr_tests/bin/load_afl /tmp/load_afl + $ cp casr/tests/casr_tests/bin/load_sydr /tmp/load_sydr $ casr-afl -i casr/tests/casr_tests/casrep/afl-out-xlnt -o casr/tests/tmp_tests_casr/casr_afl_out $ tree tests/tmp_tests_casr/casr_afl_out