2016-12-02 23:02:01 +00:00
|
|
|
//===- FuzzerUtilWindows.cpp - Misc utils for Windows. --------------------===//
|
|
|
|
//
|
|
|
|
// The LLVM Compiler Infrastructure
|
|
|
|
//
|
|
|
|
// This file is distributed under the University of Illinois Open Source
|
|
|
|
// License. See LICENSE.TXT for details.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// Misc utils implementation for Windows.
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "FuzzerDefs.h"
|
|
|
|
#if LIBFUZZER_WINDOWS
|
|
|
|
#include "FuzzerIO.h"
|
|
|
|
#include "FuzzerInternal.h"
|
|
|
|
#include <cassert>
|
|
|
|
#include <chrono>
|
|
|
|
#include <cstring>
|
|
|
|
#include <errno.h>
|
|
|
|
#include <iomanip>
|
|
|
|
#include <signal.h>
|
|
|
|
#include <sstream>
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include <windows.h>
|
2016-12-13 17:45:20 +00:00
|
|
|
#include <Psapi.h>
|
2016-12-02 23:02:01 +00:00
|
|
|
|
|
|
|
namespace fuzzer {
|
|
|
|
|
2016-12-13 17:45:20 +00:00
|
|
|
static const FuzzingOptions* HandlerOpt = nullptr;
|
2016-12-02 23:02:01 +00:00
|
|
|
|
2017-02-02 19:07:53 +00:00
|
|
|
static LONG CALLBACK ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo) {
|
2016-12-02 23:02:01 +00:00
|
|
|
switch (ExceptionInfo->ExceptionRecord->ExceptionCode) {
|
2016-12-13 17:45:20 +00:00
|
|
|
case EXCEPTION_ACCESS_VIOLATION:
|
|
|
|
case EXCEPTION_ARRAY_BOUNDS_EXCEEDED:
|
|
|
|
case EXCEPTION_STACK_OVERFLOW:
|
|
|
|
if (HandlerOpt->HandleSegv)
|
|
|
|
Fuzzer::StaticCrashSignalCallback();
|
|
|
|
break;
|
|
|
|
case EXCEPTION_DATATYPE_MISALIGNMENT:
|
|
|
|
case EXCEPTION_IN_PAGE_ERROR:
|
|
|
|
if (HandlerOpt->HandleBus)
|
|
|
|
Fuzzer::StaticCrashSignalCallback();
|
|
|
|
break;
|
|
|
|
case EXCEPTION_ILLEGAL_INSTRUCTION:
|
|
|
|
case EXCEPTION_PRIV_INSTRUCTION:
|
|
|
|
if (HandlerOpt->HandleIll)
|
|
|
|
Fuzzer::StaticCrashSignalCallback();
|
|
|
|
break;
|
|
|
|
case EXCEPTION_FLT_DENORMAL_OPERAND:
|
|
|
|
case EXCEPTION_FLT_DIVIDE_BY_ZERO:
|
|
|
|
case EXCEPTION_FLT_INEXACT_RESULT:
|
|
|
|
case EXCEPTION_FLT_INVALID_OPERATION:
|
|
|
|
case EXCEPTION_FLT_OVERFLOW:
|
|
|
|
case EXCEPTION_FLT_STACK_CHECK:
|
|
|
|
case EXCEPTION_FLT_UNDERFLOW:
|
|
|
|
case EXCEPTION_INT_DIVIDE_BY_ZERO:
|
|
|
|
case EXCEPTION_INT_OVERFLOW:
|
|
|
|
if (HandlerOpt->HandleFpe)
|
|
|
|
Fuzzer::StaticCrashSignalCallback();
|
|
|
|
break;
|
2017-01-05 22:05:47 +00:00
|
|
|
// TODO: handle (Options.HandleXfsz)
|
2016-12-02 23:02:01 +00:00
|
|
|
}
|
|
|
|
return EXCEPTION_CONTINUE_SEARCH;
|
|
|
|
}
|
|
|
|
|
2016-12-13 17:45:20 +00:00
|
|
|
BOOL WINAPI CtrlHandler(DWORD dwCtrlType) {
|
2016-12-02 23:02:01 +00:00
|
|
|
switch (dwCtrlType) {
|
2016-12-13 17:45:20 +00:00
|
|
|
case CTRL_C_EVENT:
|
|
|
|
if (HandlerOpt->HandleInt)
|
|
|
|
Fuzzer::StaticInterruptCallback();
|
|
|
|
return TRUE;
|
|
|
|
case CTRL_BREAK_EVENT:
|
|
|
|
if (HandlerOpt->HandleTerm)
|
|
|
|
Fuzzer::StaticInterruptCallback();
|
|
|
|
return TRUE;
|
2016-12-02 23:02:01 +00:00
|
|
|
}
|
2016-12-13 17:45:20 +00:00
|
|
|
return FALSE;
|
2016-12-02 23:02:01 +00:00
|
|
|
}
|
|
|
|
|
2016-12-12 23:25:11 +00:00
|
|
|
void CALLBACK AlarmHandler(PVOID, BOOLEAN) {
|
|
|
|
Fuzzer::StaticAlarmCallback();
|
|
|
|
}
|
|
|
|
|
|
|
|
class TimerQ {
|
|
|
|
HANDLE TimerQueue;
|
|
|
|
public:
|
|
|
|
TimerQ() : TimerQueue(NULL) {};
|
|
|
|
~TimerQ() {
|
|
|
|
if (TimerQueue)
|
|
|
|
DeleteTimerQueueEx(TimerQueue, NULL);
|
|
|
|
};
|
|
|
|
void SetTimer(int Seconds) {
|
|
|
|
if (!TimerQueue) {
|
|
|
|
TimerQueue = CreateTimerQueue();
|
|
|
|
if (!TimerQueue) {
|
|
|
|
Printf("libFuzzer: CreateTimerQueue failed.\n");
|
|
|
|
exit(1);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
HANDLE Timer;
|
|
|
|
if (!CreateTimerQueueTimer(&Timer, TimerQueue, AlarmHandler, NULL,
|
|
|
|
Seconds*1000, Seconds*1000, 0)) {
|
|
|
|
Printf("libFuzzer: CreateTimerQueueTimer failed.\n");
|
|
|
|
exit(1);
|
|
|
|
}
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
static TimerQ Timer;
|
|
|
|
|
2016-12-02 23:02:01 +00:00
|
|
|
static void CrashHandler(int) { Fuzzer::StaticCrashSignalCallback(); }
|
|
|
|
|
2016-12-13 17:45:20 +00:00
|
|
|
void SetSignalHandler(const FuzzingOptions& Options) {
|
|
|
|
HandlerOpt = &Options;
|
2016-12-02 23:02:01 +00:00
|
|
|
|
2016-12-13 17:45:20 +00:00
|
|
|
if (Options.UnitTimeoutSec > 0)
|
|
|
|
Timer.SetTimer(Options.UnitTimeoutSec / 2 + 1);
|
2016-12-02 23:02:01 +00:00
|
|
|
|
2016-12-13 17:45:20 +00:00
|
|
|
if (Options.HandleInt || Options.HandleTerm)
|
|
|
|
if (!SetConsoleCtrlHandler(CtrlHandler, TRUE)) {
|
|
|
|
DWORD LastError = GetLastError();
|
|
|
|
Printf("libFuzzer: SetConsoleCtrlHandler failed (Error code: %lu).\n",
|
|
|
|
LastError);
|
|
|
|
exit(1);
|
|
|
|
}
|
2016-12-02 23:02:01 +00:00
|
|
|
|
2016-12-13 17:45:20 +00:00
|
|
|
if (Options.HandleSegv || Options.HandleBus || Options.HandleIll ||
|
|
|
|
Options.HandleFpe)
|
2017-02-02 19:07:53 +00:00
|
|
|
SetUnhandledExceptionFilter(ExceptionHandler);
|
2016-12-02 23:02:01 +00:00
|
|
|
|
2016-12-13 17:45:20 +00:00
|
|
|
if (Options.HandleAbrt)
|
|
|
|
if (SIG_ERR == signal(SIGABRT, CrashHandler)) {
|
|
|
|
Printf("libFuzzer: signal failed with %d\n", errno);
|
|
|
|
exit(1);
|
|
|
|
}
|
2016-12-02 23:02:01 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void SleepSeconds(int Seconds) { Sleep(Seconds * 1000); }
|
|
|
|
|
2016-12-13 17:45:44 +00:00
|
|
|
unsigned long GetPid() { return GetCurrentProcessId(); }
|
2016-12-02 23:02:01 +00:00
|
|
|
|
|
|
|
size_t GetPeakRSSMb() {
|
|
|
|
PROCESS_MEMORY_COUNTERS info;
|
|
|
|
if (!GetProcessMemoryInfo(GetCurrentProcess(), &info, sizeof(info)))
|
|
|
|
return 0;
|
|
|
|
return info.PeakWorkingSetSize >> 20;
|
|
|
|
}
|
|
|
|
|
|
|
|
FILE *OpenProcessPipe(const char *Command, const char *Mode) {
|
|
|
|
return _popen(Command, Mode);
|
|
|
|
}
|
|
|
|
|
|
|
|
int ExecuteCommand(const std::string &Command) {
|
|
|
|
return system(Command.c_str());
|
|
|
|
}
|
|
|
|
|
|
|
|
const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
|
|
|
|
size_t PattLen) {
|
|
|
|
// TODO: make this implementation more efficient.
|
|
|
|
const char *Cdata = (const char *)Data;
|
|
|
|
const char *Cpatt = (const char *)Patt;
|
|
|
|
|
|
|
|
if (!Data || !Patt || DataLen == 0 || PattLen == 0 || DataLen < PattLen)
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
if (PattLen == 1)
|
|
|
|
return memchr(Data, *Cpatt, DataLen);
|
|
|
|
|
2016-12-16 17:35:25 +00:00
|
|
|
const char *End = Cdata + DataLen - PattLen + 1;
|
2016-12-02 23:02:01 +00:00
|
|
|
|
|
|
|
for (const char *It = Cdata; It < End; ++It)
|
|
|
|
if (It[0] == Cpatt[0] && memcmp(It, Cpatt, PattLen) == 0)
|
|
|
|
return It;
|
|
|
|
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2017-01-22 01:58:26 +00:00
|
|
|
std::string DisassembleCmd(const std::string &FileName) {
|
2017-02-01 17:59:19 +00:00
|
|
|
if (ExecuteCommand("dumpbin /summary > nul") == 0)
|
2017-01-22 01:58:26 +00:00
|
|
|
return "dumpbin /disasm " + FileName;
|
2017-02-01 17:59:23 +00:00
|
|
|
Printf("libFuzzer: couldn't find tool to disassemble (dumpbin)\n");
|
2017-01-22 01:58:26 +00:00
|
|
|
exit(1);
|
|
|
|
}
|
|
|
|
|
|
|
|
std::string SearchRegexCmd(const std::string &Regex) {
|
|
|
|
return "findstr /r \"" + Regex + "\"";
|
|
|
|
}
|
|
|
|
|
2016-12-02 23:02:01 +00:00
|
|
|
} // namespace fuzzer
|
2016-12-13 17:46:11 +00:00
|
|
|
|
2016-12-02 23:02:01 +00:00
|
|
|
#endif // LIBFUZZER_WINDOWS
|