Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Support Functions for Fuzzing Attached Processes and Fix a False Hang issue in attached processes #61

Open
wants to merge 8 commits into
base: master
Choose a base branch
from
Open

Add Support Functions for Fuzzing Attached Processes and Fix a False Hang issue in attached processes #61

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
48f4449
Add files via upload
parikhakshat Aug 19, 2022
8417ab3
Add files via upload
parikhakshat Aug 19, 2022
1a406fe
Remove unused variable and implement windows specific checks
parikhakshat Aug 30, 2022
7489c6d
Revert "Remove unused variable and implement windows specific checks"
parikhakshat Aug 31, 2022
e7fc4aa
Fix debug loop, remove unused variable, and implement windows specifi…
parikhakshat Aug 31, 2022
2fce951
Remove some extraneous code and move it to the Jackalope repository
parikhakshat Sep 6, 2022
d2f1619
Update tinyinst repository by removing extraneous code
parikhakshat Sep 6, 2022
fade015
Remove unused script variable
parikhakshat Sep 6, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 13 additions & 9 deletions Windows/debugger.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1471,7 +1471,7 @@ DebuggerStatus Debugger::DebugLoop(uint32_t timeout, bool killing)
uint64_t time_elapsed = end_time - begin_time;
timeout = ((uint64_t)timeout >= time_elapsed) ? timeout - (uint32_t)time_elapsed : 0;

// printf("timeout: %u\n", timeout);
//printf("timeout: %u\n", timeout);
// printf("time: %lld\n", get_cur_time_us());

if (wait_ret) {
Expand All @@ -1491,7 +1491,7 @@ DebuggerStatus Debugger::DebugLoop(uint32_t timeout, bool killing)

thread_id = DebugEv->dwThreadId;

// printf("eventCode: %x\n", DebugEv->dwDebugEventCode);
//printf("eventCode: %x\n", DebugEv->dwDebugEventCode);

switch (DebugEv->dwDebugEventCode)
{
Expand Down Expand Up @@ -1742,8 +1742,6 @@ DebuggerStatus Debugger::Attach(unsigned int pid, uint32_t timeout) {

if (!DebugActiveProcess(pid)) {
DWORD error_code = GetLastError();


if(error_code == 5) {
HANDLE hToken = NULL;
LUID luid;
Expand Down Expand Up @@ -1810,19 +1808,25 @@ DebuggerStatus Debugger::Continue(uint32_t timeout) {
dbg_last_status = DEBUGGER_TARGET_START;
return dbg_last_status;
}
if (script != NULL) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is also something that should be implemented in Jackalope rather than TinyInst. IIUC "script" is used for fuzzing sample delivery, and should thus be implemented in Jackalope by subclassing the SampleDelivery class.

HANDLE thread_handle = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)system, script, 0, NULL);
CloseHandle(thread_handle);
}

dbg_last_status = DebugLoop(timeout);

if (dbg_last_status == DEBUGGER_PROCESS_EXIT) {
CloseHandle(child_handle);
CloseHandle(child_thread_handle);
child_handle = NULL;
child_thread_handle = NULL;
if (!attach_mode) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think these changes need to be reverted (IIUC they were related to the DEBUGGER_HANGED change). Basically I think all changes to debugger.cpp / debugger.h can be reverted at this point.

CloseHandle(child_handle);
CloseHandle(child_thread_handle);
child_handle = NULL;
child_thread_handle = NULL;
}
}

return dbg_last_status;
}

// initializes options from command line
void Debugger::Init(int argc, char **argv) {
have_thread_context = false;
Expand Down
2 changes: 2 additions & 0 deletions Windows/debugger.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,8 @@ class Debugger {
return last_exception;
}

char * script;
Copy link
Collaborator

@ifratric ifratric Sep 6, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This variable is now unused and can be removed, right?


protected:

enum MemoryProtection {
Expand Down
29 changes: 29 additions & 0 deletions common.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,14 @@ limitations under the License.
#include <chrono>

#include "common.h"
#if defined(WIN32) || defined(_WIN32) || defined(__WIN32)
#include <windows.h>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC windows.h is already included from common.h so it's not needed here.

#include <tlhelp32.h>
#endif
#include <iostream>
#include <string>
#include <codecvt>
#include <locale>

uint64_t GetCurTime(void) {
auto duration = std::chrono::system_clock::now().time_since_epoch();
Expand Down Expand Up @@ -96,6 +104,27 @@ int GetIntOption(const char *name, int argc, char** argv, int default_value) {
return (int)strtol(option, NULL, 0);
}

#if defined(WIN32) || defined(_WIN32) || defined(__WIN32)
DWORD FindProcessId(char * process_name)
{
PROCESSENTRY32 entry;
entry.dwSize = sizeof(PROCESSENTRY32);

HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);

if (Process32First(snapshot, &entry) == TRUE)
{
while (Process32Next(snapshot, &entry) == TRUE)
{
if (stricmp(entry.szExeFile, process_name) == 0)
{
CloseHandle(snapshot);
return entry.th32ProcessID;
}
}
}
}
#endif

//quoting on Windows is weird
size_t ArgvEscapeWindows(char *in, char *out) {
Expand Down
3 changes: 3 additions & 0 deletions common.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,9 @@ uint64_t GetCurTime(void);
char *GetOption(const char *name, int argc, char** argv);
void GetOptionAll(const char *name, int argc, char** argv, std::list<char *> *results);
bool GetBinaryOption(const char *name, int argc, char** argv, bool default_value);
#if defined(WIN32) || defined(_WIN32) || defined(__WIN32)
DWORD FindProcessId(char * process_name);
#endif
int GetIntOption(const char *name, int argc, char** argv, int default_value);

char *ArgvToCmd(int argc, char** argv);
Expand Down